• 0 Posts
  • 41 Comments
Joined 3 years ago
cake
Cake day: July 1st, 2023

help-circle



  • Most corporate owned devices are managed with some kind of tool (for restricting what users can do, pushing out software and updates, etc). These tools are called Mobile Device Management (MDM).

    The developer is detecting the presence of MDM tools and using that to present a splash page to the user about the licensing requirements etc.

    Some educational institutes use MDM to manage students, even so far as to require it be installed on personal owned devices. The developer has been working with edu users to except them.





  • Stallman would disagree with you, I believe. The Free Software Moment has never been about not making money, it’s about liberty with the software you use. Free as in freedom, not free as in beer; free as in libre, not free as in gratis.

    Quote from FSF:

    Many people believe that the spirit of the GNU Project is that you should not charge money for distributing copies of software, or that you should charge as little as possible—just enough to cover the cost. This is a misunderstanding.

    Actually, we encourage people who redistribute free software to charge as much as they wish or can.





  • Have you had anyone with experience with security look at this thing? There’s a lot of really questionable practices in your schedule shell scripts. I especially find how you’re handling VPN secrets kinda worrying. And the backup_challenge_clients.sh script isn’t robust at all. Your nginx config has a few bad choices like lack of try_files, the regex \.php$. It’s definitely not hardened so I hope people don’t put this Internet facing.

    I’ve spent like 5min in the GitHub to get a feel for the project maturity. Personally, I don’t think this is suitable for actual use yet.

    If you’ve not done any security assessments on your project yet, you might not want to (a) call it “Safe”box and (b) might not want to start charging money for it until you do.

    I worry you’re setting yourself up for a hard-to-shake-off embarrassment should a nasty vuln be found. Maybe a name like “selfbox” etc that drops the connotation of security would be safer.

    Edit: Kudos on the project website though! Looks fricking gorgeous.