gepeto42

8 ms·

31.
by gepeto42 2y ago
Yeah. To be honest, I kind of setup this blog as a joke when the dot zip gTLD came up, as an inside joke with a few fellow security people who (rightfully) are against the ever expanding list of TLDs we have to deal with.
32.
Magic/tragic email links: don't make them the only option(recyclebin.zip)
706 points by gepeto42 2y ago|504 comments
33.
by gepeto42 2y ago
I mean, I’d be fine with streaming the webcam from my phone to my work Mac via USB if I knew my work Mac couldn’t also back up the phone. But I agree it might be a lot of effort, feature by feature.
34.
Apple: Let Us Be Polymacous(recyclebin.zip)
3 points by gepeto42 2y ago|2 comments
35.
by gepeto42 3y ago
Nice! Good luck with your product. As someone who regularly worked with tools like R Studio or Jupyter notebooks, it boggles my mind to still see monthly and quarterly presentations that are the same, except for some (badly) copy-pasta&#x27
36.
by gepeto42 3y ago
I work in security and a use case I've had in the past and hacked together using a combination of Power BI and powerpoint (hey, license was already paid for!) was exporting tons of data from logs, load into Power BI to generate charts
37.
Opening Pandora's Box – Supply Chain Insider Threats in Open Source Projects(boostsecurity.io)
5 points by gepeto42 3y ago|3 comments
38.
by gepeto42 3y ago
One of the authors here. Someone just told me we were on the HackerNews front page, made me happy we just went with a static website on GitHub pages. I will go through the comments later, but for now, if you are Canadian, please get in touc
39.
by gepeto42 3y ago
I completely agree with the threat model of "an attacker on your machine can get to the keys" but I'd like to add two security use cases that makes encrypting indexes valuable: 1. Off-the-shelf malware exfiltrates data, as se
40.
by gepeto42 3y ago
For me it was conferences, and after landing one remote US job then through contacts it became the new normal over a decade or so.
41.
by gepeto42 3y ago
I really dislike when people say SBoM could help with the Solarwinds scenario, because it would not. Once the CI/CD environment is compromised, how would the SBoM be trustworthy anyway?
42.
by gepeto42 3y ago
Reminded me of tmbg37 going to the market…
43.
by gepeto42 4y ago
And secure the email addresses used for your registrar account with 2FA, and disable weak recovery methods.
44.
by gepeto42 4y ago
Very niche product but I was happy to find a real use case for 3D printing!
45.
Keep track of your Yubikeys with this open source 3D model and AirTag(fleetdm.com)
10 points by gepeto42 4y ago|5 comments
46.
by gepeto42 4y ago
Mermaid is great for keeping simple diagrams in Markdown documents, and GitHub very recently started supporting it. Beats taking screenshots and uploading PNGs to the repo for sure! For those using VS Code, this GitHub Markdown extension al
47.
by gepeto42 5y ago
I am a big fan of using the CDM to understand and explain things clearly. I especially liked the graphic in this post that shows the awareness levels and the boom within the CDM.
48.
The key role ‘visibility’ plays in healthcare’s cybersecurity resilience(cloud.google.com)
2 points by gepeto42 5y ago|2 comments
49.
by gepeto42 5y ago
I have used mostly Synology in the past, so I have no hands-on experience with QNAP, but I am also pretty sure they are very similar types of Linux based with tons of features boxes. QNAS does have a guide: https://www.qnap.com&#
50.
by gepeto42 5y ago
Our specific macOS configuration is available on https://fleetdm.com/handbook/security#how-we-protect-end-use... - but I wanted to take advantage of working at an open-source company to write more about how we ended up
51.
Tales from Fleet security: securing laptops in a startup(blog.fleetdm.com)
8 points by gepeto42 5y ago|2 comments
52.
by gepeto42 5y ago
I would only enable Google Drive local sync on laptops that we know are company owned. The guide didn't cover "Context-aware access". Depending on how you work, it is surprising to see that most people don't even mind th
53.
by gepeto42 5y ago
That is exactly what it is for! We will be adding more about how we secure Fleet to our handbook, check it again in a few weeks and it should have even more stuff that a startup CTO can use!
54.
by gepeto42 5y ago
That is true especially if your sessions are made very short, which requires the more expensive Google Workspace edition. But if sessions are long, the risk is users lose access to their 2FA and don't notice until it becomes a bigger p
55.
by gepeto42 5y ago
There is, though it is not ultra granular. They introduced it last year and we mention it in the guide. https://workspaceupdates.googleblog.com/2019/03/more-control... Essentially you can enforce 2FA or not, then,
56.
by gepeto42 5y ago
Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...
57.
by gepeto42 5y ago
We did mention DMARC DKIM etc but I did not put a link to this very useful tool. Feel free to submit a PR and we'll merge it - https://github.com/fleetdm/fleet/edit/main/handbook/security... -
58.
by gepeto42 5y ago
The API Access section covers OAuth apps. Essentially you: 1. Mark Google services you consider critical as "restricted" (ex: Drive, gmail) 2. On Gmail and Drive, you can then allow apps that use lower levels of permissions, but n
59.
by gepeto42 5y ago
Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot. Would be nice if Google allowed enforcing it
60.
by gepeto42 5y ago
You are 100% right that the domain is the keys to the kingdom. Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs&#x2F

More ›