6 ms·
In my (direct) experience most security researchers, have very poor practices in general. I come to this space from the side of anonymity and general paranoia -
by cik 6y ago
In my (direct) experience most security researchers, have very poor practices in general. I come to this space from the side of anonymity and general paranoia - because I find that interesting. That paranoia leads to horrible security experiences for me, but I feel much safer in my practices.
If you always assume your data is at risk, and that your data can become your person, you'll take care of it. In the modern era, we're almost post-goods. I couldn't care less if someone broke into my house and stole my TV/monitors/stuff - and it's happened. But the last thing I'd want stolen is data I hold near and dear.
- tarruda 6y agoIf you don't mind adding an additional layer to your paranoia, I suggest seeing this video on the 2012 solar storm: https://youtu.be/hESunUuFrzk https://youtu.be/hESunUuFrzk The video will show how your data can be suddenly destroyed if all you have are digital backups. Seeing this video led me to buy a laser printer so I can have paper backups: http://ollydbg.de/Paperbak/ http://ollydbg.de/Paperbak/
- avdlinde 6y agoNever seen this before, very interesting! But how much can one realistically print? 500KB per page isn't much for today's data hoarding standards. I guess you don't keep images?
- numpad0 6y ago500KB/page at $0.02/page = $20.97/GB. HDD is $0.01-0.03/GB, SSD is $0.10-0.25/GB, BD/DVD are $0.02-0.10/GB, respectively, at retail prices and before counting redundancy. $20/GB was as far back for HDD as Oct 1999, which by the way fell further to around $7.50 next year in Oct 2000[1]. Yeah interesting but 10-100 fold density improvement would be nice... 1: https://mkomo.com/cost-per-gigabyte https://mkomo.com/cost-per-gigabyte
- namibj 6y ago25G BD-R can be had for 8 ct. However, the patent license royalties are at about 10 ct (I forgot if USD or EUR). Also, you can't retroactively pay the royalties when importing. Patents are bad. They would have developed BluRay without patent protection.
- bouncycastle 6y agoGithub recently backed up a lot of open source projects on hardened microfilm and stored it in the Artic. See https://archiveprogram.github.com/ https://archiveprogram.github.com/
- danielheath 6y agoIf only there were some other technique to print a large image file onto a page /s
- avdlinde 6y agoSure, encryption over image data and printing works fine for retrieving it at a later date.
- danielheath 6y agoI was referring to printing the image pixels rather than a serialization of the binary data. A quality printer can do 600dpi in full color - an A4 page can hold a very large image.
- tarruda 6y agoI do have a many GBs of blobs backed up both in external HDs and cloud, but my most important data (which is what I plan to keep redudant copies on paper) is just notes and source code which I keep in small private git repos. BTW I still haven't backed up anything to paper yet, I bought a laser printer last year to follow that path, but ended up not doing it yet :/
- perl4ever 6y agoMany years ago, I used to contemplate how much data you could store on a piece of paper with a laser printer. Like a QR code but optimized as much as possible. I only got as far as figuring out how to address a page as a bitmap at full resolution, because I'm not good at algorithms. I was reading today Wikipedia about Turbo Codes, Viterbi encoding and similar things and it would be interesting to me to read how a very smart person would solve the problem of maximizing data stored on paper with reasonable error correction.
- imeron 6y agoThis is a good reason to backup to a cloud provider on the other side of the planet :).
- koheripbal 6y agoI remember seeing the 1989 solar storm [1] in upstate New York. I was a little kid and thought aliens had come to Earth. I had never seen such things in the sky before - it was really beautiful. When the power subsequently went out for two days, my parents got quite tired of me telling them it was an alien invasion. [1] https://en.wikipedia.org/wiki/March_1989_geomagnetic_storm https://en.wikipedia.org/wiki/March_1989_geomagnetic_storm
- csunbird 6y agoAre optical media vulnerable to radiation as well?
- AnIdiotOnTheNet 6y agoI have to ask because my imagination is failing me: what kind of private personal data do you have that is so important that you're worried about it surviving this sort of thing?
- tarruda 6y agoNotes and personal source code (private projects, automation scripts, dotfiles...). Not important to anyone but myself :)
- AnIdiotOnTheNet 6y agoImportant enough to go through the effort and expense of printing them out and (I'm presuming) scanning them back in? I mean I guess it just comes down to priorities. I can't think of anything I want to keep so badly I'd bother with that.
- tarruda 6y agoI still haven't done it yet, but I plan to do so. All this important data (the directory I keep my git repos) is less than 90mb in size. With 500kb/page I could store everything in about 180 pages (90 if I print on both sides) which is not that much. Since I store backup of these git repos in a ZFS dataset, I can do incremental backups (with zfs send -I) every 6 months or so. By my estimates, I would be adding at most 1-2 pages per year. Also, it is not like I expect to ever need to read that back in. I also keep redundant backups of everything in multiple cloud providers and in external HDs. Using these papers would be a last resort if everything else fails.
- AnIdiotOnTheNet 6y agoYeah, I guess what I'm saying is: think of the state the world would have to be in for you to lose all your redundant backups except the paper ones. In that world, would you really want this data back so badly that you're going to scan it all in from a giant pile of paper? Again, I'm not saying that your data isn't actually that important to you, I'm just personally having a hard time imagining any data is or ever will be that important to me.
- marcosdumay 6y agoA solar flare won't destroy anything that isn't plugged into a power outlet. We will also be aware of it days before it hits, time enough to unplug anything and not even need to touch backups. The disastrous consequences are all in the area of losing the power grid itself.
- shadowprofile77 6y agoWait, what? You mean there's no way to store data in an external HD that's secure from solar storms under concrete or metal shielding? Or simply keep simultaneous cloud backups on more than one part of the world's surface? You could probably just find a cloud service that offers both shielding and multi-locational backups. For many people, even ordinary people, printing out even their personal data, never mind photos, would be absurdly difficult.
- Randor 6y agoWell, Windows Defender actively interferes with security software development. I've noticed that lots of developers either disable Windows Defender or try to whitelist the development folders. Whitelisting doesn't always work... Windows Defender will block certain behaviors such as token stealing and in-memory attacks. Also... software developers often have 'test-signing' enabled and all kinds of other security risks that are unique to software development.
- zinekeller 6y agoTrue, it is often hard to secure these things when the ultimate goal is to produce a new binary, however there are obvious low-hanging fruit that I've always encountered regardless of the host OS used. The encouragement of using a read-write directory (I'm looking at Eclipse and Android Studio of all things, but the majority of development tools are guilty of these) are fully writable (especially executables) without administrative/superuser permissions. Seriously, you want Android SDK on a user-writable place by default? That's questionable at best and contrary to any sysadmins who are the ones to lock these executables to well-known places.
- londons_explore 6y agoThe days of multiple users logging into the same machine and each having a writable home directory are pretty much over. 2020 mostly consists of single human machines with a user account and a root account. All the private data is stored in the user account. There is nothing extra of value in the root account. The 1980's security paradigm's no longer really work.
- zinekeller 6y agoI do sometimes laugh at the naïvety of some here. Sorry, what? There is no value of actually securing systems here? It is frustrating to know that in real life, some developers are not really concerned about the security of their dev machines. Try to install Android Studio (make sure to initialise it!) or Eclipse on your system and tell me where it put its executables. Go and indulge in the horror that your local adb binary can be replaced silently without your knowledge. When most mobile operating systems are designed to isolate components together, we collectively are hindering effective security by allowing these low-hanging fruit on our systems. Sorry but often I just see countless developers that are not that concerned about security and then ask themselves why are users irresponsible about security.
- userbinator 6y agomost security researchers, have very poor practices in general That's likely because, not unlike the rest of the software industry, a huge number of them are just in it for the money, and have the minimal knowledge required to do the job (i.e. find exploits, get paid).