4 ms·

"and wonder how I can avoid hacks" (I'll leave it to others more knowledgeable to answer this but keep what I say next in mind.) My question to you is, how bi

by larrys 14y ago

"and wonder how I can avoid hacks" (I'll leave it to others more knowledgeable to answer this but keep what I say next in mind.) My question to you is, how big of a target are you? I mean the security you would use if you are Madonna is not the same as a "B" list actor or the person working in the local coffee shop. You can put untold hours into this but unfortunately security is a full time job and can also detract from other things you need to be concerned with that might be more important for your particular situation. "I may be forgetting something" Sure but the same concern is in play when taking a trip or with anything. What are you forgetting? Where are you going? How easy will it be to solve the problem and how much impact will forgetting dental floss have? Are you going to an uninhabited island or Manhattan where you can buy almost anything 24/7?

laumars 14y ago
What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on. While the former member might not be a high profile target for the moment (and let's assume that he isn't for the sake of devils advocate), who's to say that next week a story hits the news about his wife or children or even a company he's affiliated with and then reporters decide to start poking about on forums and social media for cheap information to write sensationalist reports on? Or that hackers use that news as an excuse to target the poor guy? Or even who's to say that next month he annoys someone on HN who decides to play some pranks? While you are right that that security is a full time job, you should never advocate the numbers game because as remote as the odds might be, people do win the lottery.
- rmrfrmrf 14y ago
  I think both of you and your parent post's points are well-taken. IMO you should do all that you can to secure your site within practical reasoning. The LivingSocial password hashing debacle is an example of a security failure that pretty much every website in the known universe could improve on by changing a single line of code -- that's what's so frustrating about it in the first place. There are cases, though, where certain security measures are probably not needed. For example, I would probably not recommend that my mom use a keyfob security token to log into her blog admin page (although I'd probably offer to make one for her with an Arduino as a weekend project lol), or hire armed guards to guard her database servers. Enterprises certainly need these measures along with many others.
  - laumars 14y ago
    What you're discussing is how valuable is the data. eg if your mum lost her blog (and kudos to her being tech-savvy enough to run one - my mum certainly isn't!), it would be frustrating, but not really a big problem. She'd just just restore from a back up, change the passwords then back to business as usual. But then you're comparing it against examples where there's confidential information (eg user passwords) which, if stolen, is a massive problem. I'm assuming from the OPs tone, that his box sits somewhere between the two extremes. However the very fact that he's got an SSH account on it makes the box a much more favorable target than the millions of free blogs on shared hosting services - so even if his box doesn't contain 3rd party passwords and/or credit card information, and even if he can easily restore the box from a back up, he still has the problem that a break in could see his box used to send spam and what not. Many hosting providers will just kill your subscription if that happens. So while you're right that there's a balance between security and usability, security most definitely comes first if you're administrating your own VPS / dedicated hardware.
- larrys 14y ago
  "What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on." I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school?
  - laumars 14y ago
    > I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". But that's exactly what security through obscurity is! > Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school? If you must use that crude analogy then please remember than In the UK we've had terrorists blow up random buses and trains (7/11) and attack town centres on otherwise uneventful days (IRA). In America there has been frequent shootings at schools without the need for high profile dignitaries visiting. So your own example proves my point that being a seemingly low profile target doesn't mean that you're safe from attack.

by larrys 14y ago

laumars 14y ago

What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on. While the former member might not be a high profile target for the moment (and let's assume that he isn't for the sake of devils advocate), who's to say that next week a story hits the news about his wife or children or even a company he's affiliated with and then reporters decide to start poking about on forums and social media for cheap information to write sensationalist reports on? Or that hackers use that news as an excuse to target the poor guy? Or even who's to say that next month he annoys someone on HN who decides to play some pranks? While you are right that that security is a full time job, you should never advocate the numbers game because as remote as the odds might be, people do win the lottery.

rmrfrmrf 14y ago
I think both of you and your parent post's points are well-taken. IMO you should do all that you can to secure your site within practical reasoning. The LivingSocial password hashing debacle is an example of a security failure that pretty much every website in the known universe could improve on by changing a single line of code -- that's what's so frustrating about it in the first place. There are cases, though, where certain security measures are probably not needed. For example, I would probably not recommend that my mom use a keyfob security token to log into her blog admin page (although I'd probably offer to make one for her with an Arduino as a weekend project lol), or hire armed guards to guard her database servers. Enterprises certainly need these measures along with many others.
- laumars 14y ago
  What you're discussing is how valuable is the data. eg if your mum lost her blog (and kudos to her being tech-savvy enough to run one - my mum certainly isn't!), it would be frustrating, but not really a big problem. She'd just just restore from a back up, change the passwords then back to business as usual. But then you're comparing it against examples where there's confidential information (eg user passwords) which, if stolen, is a massive problem. I'm assuming from the OPs tone, that his box sits somewhere between the two extremes. However the very fact that he's got an SSH account on it makes the box a much more favorable target than the millions of free blogs on shared hosting services - so even if his box doesn't contain 3rd party passwords and/or credit card information, and even if he can easily restore the box from a back up, he still has the problem that a break in could see his box used to send spam and what not. Many hosting providers will just kill your subscription if that happens. So while you're right that there's a balance between security and usability, security most definitely comes first if you're administrating your own VPS / dedicated hardware.
larrys 14y ago
"What you're advocating is bordering dangerously into the realm of "security through obscurity" - a very bad principle to base any kind of security on." I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school?
- laumars 14y ago
  > I don't believe that is what I am saying. I'm saying you are less of a target if you are "nobody" than "somebody". But that's exactly what security through obscurity is! > Would you agree that it is proper to have more security in place at an event like the Boston Marathon or a major league baseball game or when the prime minister visits then the dance recital at the local school? If you must use that crude analogy then please remember than In the UK we've had terrorists blow up random buses and trains (7/11) and attack town centres on otherwise uneventful days (IRA). In America there has been frequent shootings at schools without the need for high profile dignitaries visiting. So your own example proves my point that being a seemingly low profile target doesn't mean that you're safe from attack.