4 ms·

Looking at the author's response to this through the lens of my own occasional anxiety I wonder if they're having a bit of a small-to-moderate breakdown over th

Looking at the author's response to this through the lens of my own occasional anxiety I wonder if they're having a bit of a small-to-moderate breakdown over the situation. I find it easy to get tangled up in the pedantry of correctness sometimes, and see things like security as effectively binary (99.99999% might as well be as good as 0%). Simplifying things down that way makes for a very mentally straightforward (black and white) way of looking at things but simply does not gel with human imperfection in practice. I accidentally left Xvnc running "for a quick thing" on my VPS once to find it mining Monero when I returned later and wondered why it was a bit slow. That taught me a few good lessons - like the security ramifications of the "once you've started you're on a roll" mental intertia thing, which can intuitively turn something I anticipate to maybe take 30min into something longer once I'm over the hurdle of starting it; but it also taught me that I'm a bit OCD about intrusions, and (despite the fact that whoever found the VPS was likely more interested in XMR than the boring files on it) I still completely nuked it and reinstalled from scratch... because of course I had NOPASSWD in sudoers :/. So I empathize with total local device compromise, which would hurt. But by the same token, it may be singularly effective to grab a favorite/preferred device, reinstall just that, turn everything else off (and maybe even notifications as well) for a week or two, and just decompress. I've never actually heard of this project before (anything involving video with my hardware/internet connection = not going to work lol) but I can easily see that it's up near the top in terms of competence and execution at what it does and the niche it fills. The resiliency that comes with that will probably take more than a week or two to put a dent in, FWIW.

exikyut 4y ago
Was writing the above while a tiny bit distracted, and nicely managed to forget the half of the sentence that actually made my point lol. I'd specifically left Xvnc running with `-securitytypes=none` (no password :D), an option I always use locally (WPA2-PSK et al) whenever I spin up Xvnc instances (which I do frequently). So I copied that (comfortable, friction-reducing default) behavior to the pUbLiC InTeRnEt because "quick thing that I'll be tearing down in 5 minutes". And then of course the thing stayed up for a while because I mis-estimated. Yeah. Lesson learned. And this article has actually got me wondering about the wisdom of just segregating everything, BeyondCorp style, even in home LAN situations. The challenge there would be to achieve a comfort zone that makes it hard for lazy-me to make mistakes and which doesn't introduce friction that makes me want to throw up my hands and just mush everything onto the same network switch. I suspect that would probably wind up being an emergent, site-specific DevOps problem and a case of modeling the humans, not the computers (which in a home/lab setting are just prototyping tools).
- castillar76 4y ago
  It's for this reason I've been moving a great deal of my stuff over to a private ZeroTier network (Tailscale is also getting good reviews and on my list to look at). The stuff I trust is part of the ZT network and can access things on it from anywhere; I then don't have to expose stuff to the Internet at all. I still have to do some figuring about how to expose services I want to expose; I may create a second ZT network as a "DMZ" and then use an intermediary host as a choke point to filter and screen traffic.
- aaaaaaaaata 4y ago
  Still kinda goofy to bring up due to the automated attacks that don't take "getting lost in time" to happen — they happen as soon as you're open to the public..

exikyut 4y ago

Was writing the above while a tiny bit distracted, and nicely managed to forget the half of the sentence that actually made my point lol. I'd specifically left Xvnc running with `-securitytypes=none` (no password :D), an option I always use locally (WPA2-PSK et al) whenever I spin up Xvnc instances (which I do frequently). So I copied that (comfortable, friction-reducing default) behavior to the pUbLiC InTeRnEt because "quick thing that I'll be tearing down in 5 minutes". And then of course the thing stayed up for a while because I mis-estimated. Yeah. Lesson learned. And this article has actually got me wondering about the wisdom of just segregating everything, BeyondCorp style, even in home LAN situations. The challenge there would be to achieve a comfort zone that makes it hard for lazy-me to make mistakes and which doesn't introduce friction that makes me want to throw up my hands and just mush everything onto the same network switch. I suspect that would probably wind up being an emergent, site-specific DevOps problem and a case of modeling the humans, not the computers (which in a home/lab setting are just prototyping tools).

castillar76 4y ago
It's for this reason I've been moving a great deal of my stuff over to a private ZeroTier network (Tailscale is also getting good reviews and on my list to look at). The stuff I trust is part of the ZT network and can access things on it from anywhere; I then don't have to expose stuff to the Internet at all. I still have to do some figuring about how to expose services I want to expose; I may create a second ZT network as a "DMZ" and then use an intermediary host as a choke point to filter and screen traffic.
aaaaaaaaata 4y ago
Still kinda goofy to bring up due to the automated attacks that don't take "getting lost in time" to happen — they happen as soon as you're open to the public..