NaibofTabr
@NaibofTabr@infosec.pub
- Comment on Hardware price surge drives student demand for refurbished laptops 5 days ago:
the best device
for schoolis a generic laptop that you can easily find guides and replacement parts for. That way you can fix thingsThis is the right idea. The qualifier is unnecessary. Repairability is always valuable. The more generic a device is, the more spare parts for it there will be on the market, and the longer those spare parts will be continue to be available on the market.
Buy common refurb/resale tech. Keep it for years, or decades.
- Comment on too real 5 days ago:
memory is impossible dream
- Comment on used hard drive retailers 1 week ago:
Well the “critical/irreplaceable” qualifier is kind of important - that’s why I specified it. It’s up to you to decide what that means for your data and risk tolerance.
For everything that I consider irreplaceable, I’m not comfortable with anything less than 100% duplication on the live system, and also an external offline backup. Even with enterprise-grade hardware, I don’t trust storage devices, they’re all destined to fail. Storage is the most important part of a data server, and should be treated like it is constantly trying to light itself on fire, like a library with wooden shelves lit with torches. All the other components are just as unreliable, but more expendable.
Admittedly, when you account for hot standby drives, the cost is that my storage availability is only 40%. A 16TB storage pool is in fact 5x 8TB drives: 2 mirrored pairs and 1 standby. On the plus side, thanks to ZFS and TrueNAS those drives can be whatever, no need to worry about RAID considerations for matched drives. SAS or SATA? who cares? They can even be different speeds, ZFS will compensate. Buy whatever is the right size for the pool, let the system deal with the other issues.
Can you put a price on stability? longevity? peace of mind?
The server hardware is all old repurposed stuff - a desktop build from 2013, secondhand data center surplus, refurbished/used drives, none of it’s worth much and almost all of it is well past end of life, any part of it could fail without warning at any moment. It doesn’t matter, it is highly reliable because the redundancies have redundancies, including the boot drives. Trying to squeeze every bit of value out of the hardware is a losing game because it’s basically worthless anyway, but the same would be true if it were all new top-of-the-line gear. The hardware is expendable, the data is not. Buy more cheap hardware, plan for it to explode, learn how to build stable, recoverable systems.
- Comment on used hard drive retailers 1 week ago:
Used data center drives are great for a home lab. They’re built like tanks for hundreds of thousands of hours of constant operation. Unless you’re running a business hosting a bunch of public-facing websites out of your garage, you don’t have that kind of workload (and if you are doing that you should just be buying new drives anyway and writing them off as a business expense).
Data center drives get replaced when they hit a ceiling of operating hours, with no actual faults, or if they experience any minor faults (it’s a business expense - drives are consumables - data centers have storage rooms of spares sitting around, they just replace them).
Any competent reseller should be able to give you a SMART report, and that should tell you if there are any major issues (generally they don’t get resold if there are, nobody will buy them). If the seller won’t give you a SMART report then obviously don’t buy, they’re either a scammer or incompetent.
If your array redundancy is set up properly then there’s no reason to be “scared” or trust in “good luck”. Assume luck will be bad. Mirror every storage device that has critical/irreplaceable data on it, and have at least one hot standby drive in every pool. Don’t bother with complicated striping schemes to try and scrape a little more storage space out of your drives, that’s dumb. One-to-one mirroring for every drive. Storage drives are consumables. They will fail, not if but when, even if you only buy new. Learn to read a SMART report. Enjoy quality hardware with no real problems at low prices.
- Comment on Stopping the smart TV from being used against you. 1 month ago:
Percussive maintenance:
- Comment on Elon Musk’s xAI used child porn to train Grok models, lawsuit says 1 month ago:
Yes… I believe I made that point in my comment.
- Comment on Elon Musk’s xAI used child porn to train Grok models, lawsuit says 1 month ago:
I just want to point out that there is a valid use case for such a model. The massive amount of images uploaded to the internet every hour has created an exponentially growing need for content moderation, and unfortunately that means some people have to spend time reviewing material flagged as CSAM. This leads to a lot of mental trauma: researchgate.net/…/373947227_The_psychological_im… (not surprisingly).
This is a fucking awful job, and there’s way too much for human moderators to handle. Most people who do this job burn out within a year or two. Supporting their work with automated recognition takes some of the strain off of them. In an ideal world we wouldn’t need humans to do this work at all, but that’s unlikely.
There is a real benefit to training some models to automatically identify CSAM, but such a model should be specialized and only used internally for its intended purpose. It should never be publicly accessible. I suspect that what happened with Grok is an example of gross negligence/incompetence, where a model intended for CSAM identification was included in the overall Grok system.
If that’s not the explanation, then this is way more disturbing because anything else would have been done with intent.
- Comment on We are regressing as a species. 1 month ago:
Well you can always bake your own. I actually do this occasionally for some LTS versions - DVDs are more shelf-stable than USB drives. In particular I like to keep a live gparted build around, it’s a great tool for its intended purpose and also a decent recovery environment.
- Comment on We are regressing as a species. 1 month ago:
Nonsense, you can run Linux on the PS5, and you don’t need the plastic donut anymore.
- Comment on Trump says Exxon and Chevron made ‘too much money’ off high oil prices during Iran conflict: ‘I don’t like it’ 2 months ago:
Of course he will… He’ll extort them for a bribe.
- Comment on France orders internet providers to block access to Polymarket prediction site 2 months ago:
Well, let me ask you a related question: do you think it is acceptable to ban books? Why or why not?
- Comment on France orders internet providers to block access to Polymarket prediction site 2 months ago:
I have no objection to sites like Polymarket being made illegal. That is not the argument.
I don’t approve of people using Polymarket, but I would fight for their right to access the website without censorship.
The government can declare a business like Polymarket to be illegal, that’s fine. Take action against Polymarket directly. The government dictating which sites a citizen can or cannot access is not fine.
- Comment on France orders internet providers to block access to Polymarket prediction site 2 months ago:
Control is never relinquished voluntarily, it only expands. If the government has the power to block access to one site they will do it with more, for increasingly less justifiable reasons, until they eventually don’t bother justifying it at all.
Government censorship is not permissible in a free society, period.
- Comment on France orders internet providers to block access to Polymarket prediction site 2 months ago:
This isn’t blocking information or anything worthwhile
The government should neither know nor care what its citizens access on the internet, any more than they should have control over what books its citizens read.
Censorship is censorship regardless of what is being censored.
- Comment on France orders internet providers to block access to Polymarket prediction site 2 months ago:
This is the wrong way to do things. The government should not be dictating what its citizens are allowed to access on the Internet. It seems like so many countries go after ISPs and DNS providers to solve their problems for them, and I think it’s mostly just laziness.
What France should be doing is making it illegal for Polymarket to operate in their country, and fining them for violations.
- Comment on Roblox announce plans to let people AI generate basic games using text prompts stuck into a mobile app, but claim that won't fill their homepage with AI slop 2 months ago:
Ooh… so Roblox uses Luau internally for user-developed game logic, which means that you could probably get the AI to write you a complete application and execute it within the Roblox environment. This seems ripe for exploitation.
- Comment on All Cars Sold in the EU Now Require a Camera Aimed at Your Face. It’s Still Not Clear Where That Data Goes 2 months ago:
- Comment on Microsoft rolls back some of its Copilot AI bloat on Windows 6 months ago:
But what will I do without Copilot in Notepad
- Comment on OpenAI launches ChatGPT Health, encouraging users to connect their medical records 8 months ago:
give us your data give us your data give us your data
- Comment on Report: Microsoft quietly kills official way to activate Windows 11/10 without internet 9 months ago:
Anyone know if massgrave still works?
- Comment on US | NY Governor Hochul signs bill requiring warning labels on ‘addictive’ social media 9 months ago:
Oh, I don’t know, putting labels on things can be very effective for general public awareness. Plenty of people using Instagram never think about these kinds of things, it’s just not part of their normal concerns. The notifications might be an annoyance, but they will also start a lot of conversations between people that would not have happened otherwise, conversations that will turn into “wait, why do we let this company do this kind of thing at all?”
- Comment on Boing 9 months ago:
That’s boinking.
- Comment on Where Winds Meet: Why China's Wuxia RPG is Winning Over Global Gamers 9 months ago:
This is an ad.
- Comment on Amazon’s dynamic pricing is causing chaos for school budgets 10 months ago:
…move fast and break things?
- Comment on Looks Like We Can Finally Kiss the Metaverse Goodbye 10 months ago:
To be fair, they’ve been doing mobile surveillance for a long time.
- Comment on ‘There isn’t really another choice:’ Signal chief explains why the encrypted messenger relies on AWS 11 months ago:
Right, OK, but Signal sustains itself on charity.
- Comment on China releases 'UBIOS' standard to replace UEFI — Huawei-backed BIOS firmware replacement charges China's domestic computing goals 11 months ago:
UBIOS’s unique features over UEFI include increased support for chiplets and other heterogeneous computing use-cases, such as multi-CPU motherboards with mismatching CPUs, something UEFI struggles with or does not support. It will also better support non-x86 CPU architectures such as ARM, RISC-V, and LoongArch, the first major Chinese operating system.
Hmm, I haven’t read the full spec, but typically when you’re making mismatched components work together like this it means you can only support security features that are common for all of them - that is, any security can only be the lowest common standard. Does anybody know where to find more specific information on security features in UBIOS? Wider compatibility generally means more vulnerability.
One of the major design goals of UEFI was to add security to BIOS, which never had any real security in its design. If UBIOS is less secure than UEFI then it’s really not a good idea to use it for anything beyond personal devices.
Does UBIOS have feature parity with UEFI or is it just targeting a different use case altogether? UEFI’s security features are still not complete protection, but it would be a terrible idea to run a network server without them in the present cybersecurity environment.
- Comment on Microsoft starts rolling out Gaming Copilot on Windows 11 PCs 1 year ago:
You will use Copilot and you will
like ithave no recourse. - Comment on Microsoft says U.S. law takes precedence over Canadian data sovereignty 1 year ago:
Certainly, but it doesn’t exist yet, and Microsoft has been developing their system for more than two decades. There is a lot of catching up to do to get to feature parity.
- Comment on Microsoft says U.S. law takes precedence over Canadian data sovereignty 1 year ago:
Maybe… almost universally, open source software requires more initial configuration work and more long-term oversight to keep operational, so if you’re making a statement like this you have account for additional labor costs. Proprietary software is usually sold as an out-of-the-box solution (it usually isn’t, but it’s usually a lot closer than open source equivalents).
The entry cost for an open source solution might be lower (no licensing fees) but the long-term cost might actually be higher, especially when you start trying to make various pieces of software work together. One of the areas where Microsoft does really well is system administration tools. Active Directory is a full suite of tools that all work together through a unified interface. To replicate AD you would have to patch many different open source projects together, some of which would overlap in functionality and some of which wouldn’t quite meet in the middle. As your environment increases in complexity and your sysadmin needs expand, these interoperation problems grow exponentially, which means more labor time and more expertise requirements, less stability and more security holes between the patched-together solutions.
Don’t get me wrong, I love open source software, but so far there are no good open source sysadmin solutions that scale well for organizations with thousands of users.
