CommPulse

I am deploying a Next.js application using the App Router to an Ubuntu virtual machine on Google Cloud. The deployment is triggered through GitHub Actions whenever code is pushed to the main branch. The workflow successfully pulls the latest code, installs dependencies, creates a production build, and restarts the application with PM2. However, the website sometimes continues showing the previous version even though the GitHub Actions workflow finishes successfully. My deployment commands are similar to: cd /var/www/scallar git fetch origin git reset --hard origin/main npm ci npm run build pm2 restart scallar-app The PM2 application is started using: npm start I have also tried: pm2 delete scallar-app pm2 start npm --name "scallar-app" -- start The repository contains the updated files, and the .next directory has a recent timestamp. Restarting Nginx or manually deleting the .next directory and rebuilding usually fixes the problem. Expected behaviour: Every successful deployment should immediately serve the latest Next.js build. Actual behaviour: The previous build is sometimes served until I manually remove the build directory and restart PM2 or Nginx. What is the correct deployment process for a Next.js application running behind Nginx and PM2? Should the .next directory always be removed before building, and could PM2, Nginx caching, or multiple running Node.js processes be causing the old version to remain active?

Hello, I’m trying to understand whether I should classify myself as a trader under the EU Digital Services Act, and I would really appreciate input from developers who have dealt with this. I’ve received conflicting answers from AI tools, so I’m not confident relying on those alone. Apple requires developers to choose one of the following: “I’m a trader under the DSA” “I’m not a trader under the DSA or I don’t plan to distribute in the EU” I haven’t published any apps yet, but I’m preparing to release my first independently developed apps on the App Store and Google Play. App development is currently a hobby alongside my main job, and I’m not operating through a registered company. The apps will be free to download but include ads. One app will also offer a paid option to remove ads, and I may add in-app purchases in the future. I’ve noticed that some similar apps with ads and in-app purchases are published by developers who don’t appear to be marked as traders, though I understand that may not reflect their actual status. Given this, would you consider someone in my situation to be a trader under the DSA, or could it reasonably be treated as non-trader activity since it’s currently a hobby? I also have a few related questions: Does the same approach apply when selecting trader status on Google Play? What typically happens if you declare yourself a non-trader but the platform later disagrees? Are you usually allowed to update your status, or could your account be affected? Is it true that apps from non-trader accounts may be removed in the EU if the classification is later found to be incorrect? Is trader status set per app or per developer account on Apple and Google? I understand this isn’t legal advice. I’m mainly interested in how other independent developers have interpreted and handled this in practice. Thank you very much for your help. submitted by /u/Wsson_ [link] [comments]

I'm wondering what everyone's thoughts are on eol software that is perpetually licensed and whether the risk is minimal enough to run some programs that are eol? In this case I'm specifically referring to Bluebeam - we have a few users that use this program, and since we started using it they stopped offering perpetual licenses and switched to subscription only. We have licenses for a couple different versions as well as one user on the newest subscription option. Our oldest license is for Revu 17 which was eol in 2023. I suspect I'm going to be asked to shuffle it between workstations soon and trying to figure out whether its time for the conversation about purchasing a new license. I think their hesitation is that its used somewhat infrequently for specific tasks, so don't want to pay yearly for that. While not related to the situation that has me asking, I believe we also have a few older, spare machines which have older versions of Adobe. I may also end up running into this soon with Foxit perpetual licenses as we switched to them a couple years ago and they don't usually cover upgrade to the next major version. Any thoughts on how much risk older programs like these create, and how you deal with similar situations? submitted by /u/tr1ckd [link] [comments]

I'm the sole systems engineer for a small US manufacturer (~70 employees, automotive tier-1). I run everything across network, servers, identity, development, etc. I'd like (a) a sanity check, and (b) real talk about the future. What happened : About three weeks ago on a normal workday around noon, some people suddenly noticed that they weren't able to send or receive email. Shrug. Probably Outlook just being Outlook. But wasn't able to figure anything out, so took to the admin portal... But I couldn't even get in to the admin portal: AADSTS5000224: "the tenant you are trying to access has been deauthenticated and is no longer available." Man, I hope none of you ever have to feel the panic I felt when I read this message. I immediately went to try our breakglass unlicensed admin account, but received the same error. The very last email I received (which arrived after attempting these log-ins) was a notification that all of our subscriptions had been cancelled. Obviously, that was not an action I took. On further research it seems to be some sort of backend authorization state set by Microsoft (perhaps algorithmic automatic action in response to a detected security incident? - just blind speculation really). There is nothing client side to try at all. There is literally no admin path into our own tenant. Current status : 20 days down. The case has been passed between at least five different support people. It finally got "escalated to the product team to verify the tenant status," and for a week now the only updates I get are rolling "please allow an additional 48 hours." Meanwhile sign-in logs are on a retention clock, so the forensic record of who cancelled our subs (if anyone? maybe this cancellation is just an artifact of this deauth?) is about to age out while we're locked out of the only portal that could export it and Microsoft won't commit to preserving it server-side. That first day, I cut MX over to a temporary Fastmail tenant to keep email flowing. I was able to restore people's inboxes to these new accounts. Office apps are running in their month grace periods. All our real data is on-prem. Feeling very grateful that we deliberately never integrated more intensely with Microsoft's cloud services... To that end, the business is stable. But there are nevertheless many secondary effects as I'm sure you can all imagine. Okay, now that you know basically the story, it's time for some preemption so we just get it out of the way before I get to my actual questions: "You should have had MFA." We do, on every account. FIDO2- (yubikey) only for most accounts (I was literally mid rollout...) "You should have had CA." We do. Business Premium, Entra P1, CA policies in place, custom auth strength enforcing phishing-resistant (FIDO2) sign-in for admins. Plus all the standard: SMS auth killed off, SSPR locked down, legacy protocols (SMTP AUTH/POP/IMAP/ActiveSync) all disabled, external auto-forwarding blocked, Safe Links + Safe Attachments on, SPF/DKIM/DMARC all passing. "You should have a breakglass account." We do. Doesn't save you from this. "Hire an MSP" Okay, I mean, maybe fair? They'd just be in the same position though, so. If anything this is its own can of worms and there's a reason we don't have one. Alright. Now my questions: Has anyone actually lived through one of these AADSTS5000224 tenant deauthentications? How long did recovery really take, and what finally moved it? A specific support path, an escalation channel, a TAM, a Microsoft account rep, LinkedIn-ing a PM, a partner ticket? Anything? Were you able to discover what triggered the lockout in your case? How do you preserve/obtain audit/sign-in logs? I'm not sure what's going to happen in terms of retention when the tenant is in this state. Is our log data going to get nuked in a week? Trust. After this, how does anyone justify betting a company's ability to function on a platform where a backend flag can vaporize all access overnight, your breakglass account included, and the SLA to undo it is measured in weeks (and counting!) with no communication? I'm not naive enough to think "just leave M365" is free. But it's challenging to design around "Microsoft can turn us off and there's nothing you can do and no one will tell you why." How are you all handling that? Are you even? To be honest, I didn't know this was a thing that could even happen, really. So maybe you all didn't either. Thankfully we weren't super integrated. We basically use M365 for email, product licensing, and Teams, and that's about it. But it literally makes me shudder to think about what could have happened if it were otherwise. submitted by /u/SecaleOccidentale [link] [comments]

We currently have Veeam in a Hyper-v environment. I backup to a local host, as well as do cloud copy jobs. In the vain of 3-2-1 backup philosophy, I would like to setup an additional redundant backup solution and our old Veeam host hardware. The server is just setting there. What additional redundant backup solution would everyone recommend to run adjacent to Veeam? submitted by /u/Ok_SysAdmin [link] [comments]

Going from VMware to hyper V at the moment. But once I finalize this I want to implement hot patching for servers. Is there any way to do so without azure VMs? submitted by /u/h9xq [link] [comments]

Not affiliated or selling. https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat submitted by /u/possibilities69 [link] [comments]

We use them sparingly for foriegn contractors rather than shipping them a corporate laptop -- so that's the only nice part. But in the few months we've been using them I've noticed the following: Slower than hell to provision, like really slow even with Microsoft's stock images... Doesn't play well with Intune even though it is an Intune native solution. Configs/Apps/Compliance are hit or miss compared to actual local hardware like a laptop. Some stuff just doesn't even load, or you have to reboot the machine constantly They suffer horribly from performance issues, if you don't reboot these things daily (which there's no option in the OS to do a restart) you have to do it from the Windows App or Intune which is dumb as hell. Resizing, I've pushed the resize in Intune, added a bigger license, removed the old smaller license and it's been almost an HOUR and its still just sitting in "pending". Other little things suck with these as well, yet Microsoft has pushed these things at Ignite the past 2-3 years like they are IT God's gift to customers. These things are absolute ASS. submitted by /u/Dtrain-14 [link] [comments]

Hi all, I'm looking for the following, what is there an the market. Requirements : 1 : 1 or 2 NVME at 1TB or 2TB 2 : 20 or 40 TB SSD HDD or HDD 3 : Ram 16 or 32 GB 4 : root SSH access 5 : Unlimited 1 or 10 Gbps 6 : No setup fee Budget: around ~ €150

Hi everyone, I did some deeper network forensics on DataPasa Limited before deciding whether to use their services, and I wanted to share some documented architectural findings with the community. While they advertise themselves as a clean UK Limited operating on budget infrastructure in Germany, a look into their actual BGP routing reveals a complex, single homed network setup that replicates classic bulletproof and state linked routing obfuscation patterns: 1. The ASN & Paraguayan Registration DataPasa is exclusively announced via AS199566 (DATAPASA-AS) . According to BGP.tools for AS199566 and the official RIPE NCC WHOIS Database , this Autonome System is not registered to the UK company, but to a private individual named Artem Lomakin , with a registered legal address in Encarnación, Paraguay . Crucially, the official RIPE registry lists NETSHIELD LTD as the explicit "sponsoring-org" for this ASN. This proves that DataPasa did not just randomly buy transit from them, but relies entirely on Netshield as their upstream LIR to maintain their cryptographic network resources in the RIPE region. 2. The Single Homed Upstream (Netshield Ltd) DataPasa's AS199566 is completely single homed behind NETSHIELD LTD (AS49418) . Netshield is officially a UK shell entity registered at UK Companies House (Company Nr. 14769288) using corporate mailbox addresses (128 City Road / 71-75 Shelton Street). However, looking at their official network records (as indexed via public WHOIS scraping mirrors like ipinfo.io for AS49418 ), their primary administrative contact number is a Russian mobile phone starting with the country code +7 ( +79029519859 ). 3. The Sanctioned Infrastructure & "Doppelgänger" Connection Looking at who provides transit to Netshield (AS49418), the rabbit hole leads directly into officially flagged and sanctioned Russian cyber infrastructure: Aeza Group & Aurologic GmbH: Following Western compliance pressure and data center expulsions, the US sanctioned Russian bulletproof provider Aeza Group LLC offloaded massive amounts of its malicious traffic to Aurologic GmbH (AS30823) and Netshield Ltd , which effectively acted as their Western European proxy network. This transition and the systemic handling of malicious infrastructure have been extensively documented by the Recorded Future Insikt Group Report . DDoS-Guard.ru (AS49612): Netshield's peering with DDoS-Guard has been forensically linked by independent investigative groups to the technical infrastructure used to tunnel and shield the Kremlin-backed "Doppelgänger" disinformation campaign from Western legal takedowns, as detailed in the Qurium Media Foundation Investigation . BiMajLink d.o.o. (AS62255): A company legally registered as a shell in Ljubljana, Slovenia, but officially managed and directed by Russian national Yury Gavrilov , serving as a primary BGP transit bridge to funnel traffic from Russian networks into Western Europe, visible via public routing tables on BGP.tools for AS62255 . Live Network Verification (Traceroute from Frankfurt) To verify how DataPasa handles their infrastructure, I ran a traceroute directly from a server located at a major Frankfurt routing zone straight to DataPasa's IP ( 144.31.38.254 ). To maintain operational security, the source infrastructure hops have been anonymized, but the edge routing is fully transparent: 1 * * * ([REDACTED] Local German Datacenter Edge) 2 * * * ([REDACTED] Frankfurt Exchange Routing) 3 100.65.91.1 (Internal Carrier Routing) 4 gnm-ix-eu.7280qr-1.eqx8.fra.as49418.net (178.18.236.208) 1.021 ms 5 109.206.242.89 (109.206.242.89) 1.026 ms 6 109.206.242.43 (109.206.242.43) 1.895 ms 7 45.89.62.23 (45.89.62.23) 1.601 ms 8 10.101.17.3 (10.101.17.3) 7.556 ms 9 144.31.38.254 (144.31.38.254) 7.424 ms Technical Breakdown of the Traceroute: The Netshield Handover (Hop 4): At a sub-millisecond level ( 1.021 ms ), the traffic is instantly handed over to NETSHIELD LTD (AS49418) at the Frankfurt exchange point. DataPasa does not use native Hetzner routing at the edge. The Internal Pipeline (Hop 5-7): The packets route through Netshield's internal Frankfurt infrastructure ( 45.89.62.23 ). The Private Tunnel (Hop 8): At Hop 8, we see a private IP address ( 10.101.17.3 ) accompanied by a sudden latency jump of ~6ms. This proves a private GRE/WireGuard backbone tunnel . Netshield is backhauling the traffic from Frankfurt directly to the physical server backend. The Target (Hop 9): The total round-trip time of 7.4 ms perfectly aligns with physical hardware sitting in a regional German datacenter (like Hetzner Falkenstein). Compliance & Transparency Considerations Since DataPasa is single homed behind Netshield, 100% of the traffic to and from their servers relies entirely on this specific routing chain. Just putting these routing facts out there for anyone doing their due diligence on new providers. Would love to hear the community’s thoughts on this specific setup, or perhaps a statement from @datapasa regarding their choice of upstream providers and network asset registration.

Hello, I'm looking for a dedicated or virtual dedicated server in London with the following reqs: -IP with a foreign geolocation, so the server is physically in London, but it's IP shown in the databases (MaxMind, IP2Location, ipinfo, etc) as some other RIPE IP (Ireland/France/Swedish, etc). There are some exceptions, DM me for info if you have or can do such setup. -Good peering inside London, peering through the London Internet Exchange (LINX). I am optimizing around latency to AWS London. CPU 2-8 cores. RAM 8-16 gb . Ubuntu 1x IPv4 Purpose: latency sensitive trading Willing to pay more than the market price!

submitted by /u/N4Naman [link] [comments]

Somehow, it's hard to comprehend the networking costs in AWS. People see instances and databases as 'real resources' but totally miss out on networking costs. The following account is spending $500 per month while not using AWS. All instances stopped, DB paused, but networking remains. Just flushing this all out to save 70%. https://preview.redd.it/mt0zuouv3dhh1.png?width=782&format=png&auto=webp&s=f6eb4b84219fa37124fe78ed35439753c4204c07 submitted by /u/skpratik [link] [comments]

Hello Maximum Budget : ** $25/Month** The location should be in EU

Hi, I am looking for Disk 80G SSD / NVME Cores = 4 - 6 RAM = 8 GB Uplink = 1G / 10G = Bandwidth minimum 5 - 10Tera bytes uplink only. Locations = Madrid, Johannesburg, Mumbai, Singapore. If those Cores are dedicated (Like not too much shared), My budget for per vm is 20 USD per month. Please share discounted price.

Been doing security audits for a while (I’m a secops engineer) and the same patterns keep showing up. Regardless of the vendor, so these are the same whether it’s Akamai, Cloudflare, AWS WAF. **1.** Origin is directly reachable! Traffic bypasses the CDN/WAF (check cert transparency logs for leaked origin hostnames) **2.** They've got bypass rules that were meant to be temporary but never got removed **3.** Cache key too broad (cache poisoning risk) or too narrow (kills hit ratio, looks like a DDoS) **4.** WAF rule sets are treated as “once and done”. Rules deployed once and never tuned, so there are a lot of silent false positives on real traffic. **5.** TLS/cert management with no clear owner, resulting in expired certs, weak ciphers left on etc. Wrote up a longer breakdown with a checklist if anyone wants to run through their own setup, happy to share. submitted by /u/witchlike-monkey [link] [comments]

I spent way too long trying to fix something recently before realizing nothing was actually wrong. It turned out to be a configuration mistake that I had made myself. It got me wondering how much time people in ML and software spend debugging their own setups rather than actual code. What's the dumbest "bug" you've ever chased? submitted by /u/Crypton228 [link] [comments]

shipped an LLM feature, felt fine at launch, moved on to other work. a while later the bill showed up noticeably higher than expected and that was the first real signal anything had changed. no alert, no dashboard flag, just a number at the end of the month that made me go "wait, what happened." went back and actually set up proper tracing and token/cost monitoring per request instead of just trusting it'd be fine, and found a specific workflow was making way more calls than i thought due to a retry loop that wasn't being logged anywhere visible. it had been quietly running up cost for weeks with zero visibility until the invoice. also added latency budgets and caching for repeated queries after this, which cut cost noticeably on top of the retry fix. feels like a pretty basic devops instinct (you monitor what you ship, you don't wait for the bill) that somehow gets skipped constantly once "AI feature" is involved, like people ship LLM stuff with less observability discipline than they'd ever accept for a normal service. anyone else's team caught something similar the hard way before actually building proper monitoring in from the start submitted by /u/camerongreen95 [link] [comments]

Anyone using Azure files for file shares for remote employees? I have seen horror stories in the past but saw some positive reviews on it recently. I am an Entra ID, cloud only shop and the new updates to the service look promising. submitted by /u/DickBalczak [link] [comments]

So I'm wondering how people are registering Yubikeys for Microsoft tenant GA accounts that are cloud only. We don't login to a computer with those accounts and when I open up a browser to set up the key it wants to tie it to the device and the account in currently logged into the computer with. Is there a workaround? submitted by /u/The_Ent1 [link] [comments]