6 ms·
My linode hasn't been updated for years, still runs nginx just fine. port knocking means little risks of intrusion, as ssh is on a non standard port too. My de
by 1996 8y ago
My linode hasn't been updated for years, still runs nginx just fine. port knocking means little risks of intrusion, as ssh is on a non standard port too.
My deployment is shell scripts launched by systemd timers
Instead of downvoting, can someone please explain why this setup that is stable is not up to whatever standards?
- boulos 8y agoMost likely your "hasn't been updated for years". Given all the security vulnerabilities that have been disclosed, including things like Heartbleed, I hope you meant your "setup hasn't been changed in years".
- 1996 8y agoNo, I run nothing like apt update. Why would I fix something not broken? And no, I do not run ssl. I like to limit the number of moving parts. Anyway, if someone can manage to access my servers with only nginx serving static files, they deserve to 0wn it :-)
- purerandomness 8y agoYou're exposing your users to MITM attacks by not deploying SSL. While your setup stays the same, major security flaws are found in different parts of the stacks. Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.
- 1996 8y agoIf you want to mitm my static site with no login and mostly PDFs, you are welcome to. Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense
- purerandomness 8y agoHow do you know your users are seeing "a static site with no login and mostly PDFs"? Security is a state of mind, indeed.
- 1996 8y agoI know because I make the site and use it too
- purerandomness 8y agoI know, but now anyone can: * Inject a cryptocurrency miner JavaScript into your page during the transmission of your static HTML page to your clients, without you or your users knowing it [1] * Injecting explicit, illegal image material that would get your clients immediately in legal trouble for possession of such material, without you knowing * Injecting a JS snippet that, instead of your site's contents, shows a fake antivirus page, telling the clients that your site is malicious and that a threat was eliminated by Fake Antivirus 10.0 and that they should immediately call Microsoft Support (Phone number in Bangladesh) for further "assistance". There they're told they need to get a full cleaning of the hard drive for only 99$ and are asked for their CC number The point is: If you don't have end-to-end-encryption, you can never be sure what your users see. They might see your site - or some slightly modified version of your site, with a login box, phishing passwords from your users, abusing their trust in your brand. A MITM has nothing to do with someone gaining access to your server. It's someone gaining access to infrastructure - a vulnerable public wifi, for instance. [1] https://www.hacking.reviews/2018/01/coffeeminer-collaborative-mitm.html?m=0 https://www.hacking.reviews/2018/01/coffeeminer-collaborativ...
- 1996 8y agoFair enough. I will enable https on cloudflare.
- aidanlister 8y agoYou have a single point of failure and a linux box (and CMS?) that needs to be constantly patched - how is that in any way comparable to the simplicity and scalability of dropping files onto an S3 bucket?
- 1996 8y agoNo cms. Nginx serving static files. Not patched or upgraded for years. Still running fine. Doing anything else than putting cloudflare in front of my nginx is needlessly overhead- because cloudflare scales quite well!