NaibofTabr
@NaibofTabr@infosec.pub
- Comment on Researchers turn mushrooms into living memory chips for sustainable computing 1 week ago:
- Comment on What else should I do for my home server security? 2 weeks ago:
I’m not sure you know what SNMP is
Oops, I was definitely confusing that with ICMP. Good point.
oneuptime.com/blog/post/…/view
Also Iot devices aren’t really much of a threat.
I consider it a threat if a device maps my local network, identifies the other devices I have connected, and/or monitors my network traffic and then sends a report on that back to its control server.
Also don’t put things on the internet. That is generally a really bad idea and will bite you in the butt eventually.
Ain’t that the truth. We really should just not.
- Comment on What else should I do for my home server security? 2 weeks ago:
I’m looking for advice to maximize security.
The most important answers to this all live outside your server. What is your home network like? Do you control the gateway? Do you have a dedicated firewall? Do you have devices segregated into VLANs so they can’t observe each other (especially IoT devices)? Do you have SNMP disabled?
- Containers are not a security barrier. They cannot be, they never will be.
- If you are defending against intrusion at your local file server, it is already too late. The call is coming from inside the house.
If you want security, you block all inbound and outbound traffic by default at your network firewall (not the server OS firewall), and then you open only the ports that you actually need, one by one. You set all the closed external ports to do not respond (“stealth” mode), so that anybody trying to reach your network from outside just gets nothing back except on the ports you specifically need to use. You segregate your internal network into logical areas, and you put things that need to talk to each other on their own VLAN, which may or may not have access to the upstream WLAN port depending on what they’re doing. You don’t allow crosstalk between VLANs except in very specific cases. You set static IPs and document them, so that you never have to ping or traceroute internally to find something, so you don’t need SNMP. Anybody trying to use SNMP is conducting surveillance on your network and should stick out from other traffic (some “smart”/IoT devices do this automatically - they are bad and should be treated as malicious and should not be allowed to phone home). And then you monitor your traffic at the firewall, and you deal with anything unexpected as it comes up (like once a week review the logs until you have a sense of what normal looks like on different days at various times, then maybe set a few automatic alerts for things that exceed normal-ish boundaries, then go to reviewing like once a month or so - you don’t need to be checking your logs hourly unless you have some reason to be actively paranoid).
If you handle everything correctly at the router/firewall level, you’re way way beyond the security of most residential and small business networks. You’re not, you know, impenetrable, but you’re at the point where somebody with experience and resources will have to be trying to break into your network specifically on purpose. If you’re that kind of target then nothing short of an actual SOC is going to help you, and running self-managed servers on your home network is a bad idea.
- Comment on Hardware price surge drives student demand for refurbished laptops 3 weeks ago:
the best device
for schoolis a generic laptop that you can easily find guides and replacement parts for. That way you can fix thingsThis is the right idea. The qualifier is unnecessary. Repairability is always valuable. The more generic a device is, the more spare parts for it there will be on the market, and the longer those spare parts will be continue to be available on the market.
Buy common refurb/resale tech. Keep it for years, or decades.
- Comment on too real 3 weeks ago:
memory is impossible dream
- Comment on used hard drive retailers 4 weeks ago:
Well the “critical/irreplaceable” qualifier is kind of important - that’s why I specified it. It’s up to you to decide what that means for your data and risk tolerance.
For everything that I consider irreplaceable, I’m not comfortable with anything less than 100% duplication on the live system, and also an external offline backup. Even with enterprise-grade hardware, I don’t trust storage devices, they’re all destined to fail. Storage is the most important part of a data server, and should be treated like it is constantly trying to light itself on fire, like a library with wooden shelves lit with torches. All the other components are just as unreliable, but more expendable.
Admittedly, when you account for hot standby drives, the cost is that my storage availability is only 40%. A 16TB storage pool is in fact 5x 8TB drives: 2 mirrored pairs and 1 standby. On the plus side, thanks to ZFS and TrueNAS those drives can be whatever, no need to worry about RAID considerations for matched drives. SAS or SATA? who cares? They can even be different speeds, ZFS will compensate. Buy whatever is the right size for the pool, let the system deal with the other issues.
Can you put a price on stability? longevity? peace of mind?
The server hardware is all old repurposed stuff - a desktop build from 2013, secondhand data center surplus, refurbished/used drives, none of it’s worth much and almost all of it is well past end of life, any part of it could fail without warning at any moment. It doesn’t matter, it is highly reliable because the redundancies have redundancies, including the boot drives. Trying to squeeze every bit of value out of the hardware is a losing game because it’s basically worthless anyway, but the same would be true if it were all new top-of-the-line gear. The hardware is expendable, the data is not. Buy more cheap hardware, plan for it to explode, learn how to build stable, recoverable systems.
- Comment on used hard drive retailers 4 weeks ago:
Used data center drives are great for a home lab. They’re built like tanks for hundreds of thousands of hours of constant operation. Unless you’re running a business hosting a bunch of public-facing websites out of your garage, you don’t have that kind of workload (and if you are doing that you should just be buying new drives anyway and writing them off as a business expense).
Data center drives get replaced when they hit a ceiling of operating hours, with no actual faults, or if they experience any minor faults (it’s a business expense - drives are consumables - data centers have storage rooms of spares sitting around, they just replace them).
Any competent reseller should be able to give you a SMART report, and that should tell you if there are any major issues (generally they don’t get resold if there are, nobody will buy them). If the seller won’t give you a SMART report then obviously don’t buy, they’re either a scammer or incompetent.
If your array redundancy is set up properly then there’s no reason to be “scared” or trust in “good luck”. Assume luck will be bad. Mirror every storage device that has critical/irreplaceable data on it, and have at least one hot standby drive in every pool. Don’t bother with complicated striping schemes to try and scrape a little more storage space out of your drives, that’s dumb. One-to-one mirroring for every drive. Storage drives are consumables. They will fail, not if but when, even if you only buy new. Learn to read a SMART report. Enjoy quality hardware with no real problems at low prices.
- Comment on Stopping the smart TV from being used against you. 2 months ago:
Percussive maintenance:
- Comment on Elon Musk’s xAI used child porn to train Grok models, lawsuit says 2 months ago:
Yes… I believe I made that point in my comment.
- Comment on Elon Musk’s xAI used child porn to train Grok models, lawsuit says 2 months ago:
I just want to point out that there is a valid use case for such a model. The massive amount of images uploaded to the internet every hour has created an exponentially growing need for content moderation, and unfortunately that means some people have to spend time reviewing material flagged as CSAM. This leads to a lot of mental trauma: researchgate.net/…/373947227_The_psychological_im… (not surprisingly).
This is a fucking awful job, and there’s way too much for human moderators to handle. Most people who do this job burn out within a year or two. Supporting their work with automated recognition takes some of the strain off of them. In an ideal world we wouldn’t need humans to do this work at all, but that’s unlikely.
There is a real benefit to training some models to automatically identify CSAM, but such a model should be specialized and only used internally for its intended purpose. It should never be publicly accessible. I suspect that what happened with Grok is an example of gross negligence/incompetence, where a model intended for CSAM identification was included in the overall Grok system.
If that’s not the explanation, then this is way more disturbing because anything else would have been done with intent.
- Comment on We are regressing as a species. 2 months ago:
Well you can always bake your own. I actually do this occasionally for some LTS versions - DVDs are more shelf-stable than USB drives. In particular I like to keep a live gparted build around, it’s a great tool for its intended purpose and also a decent recovery environment.
- Comment on We are regressing as a species. 2 months ago:
Nonsense, you can run Linux on the PS5, and you don’t need the plastic donut anymore.
- Comment on Trump says Exxon and Chevron made ‘too much money’ off high oil prices during Iran conflict: ‘I don’t like it’ 2 months ago:
Of course he will… He’ll extort them for a bribe.
- Comment on France orders internet providers to block access to Polymarket prediction site 3 months ago:
Well, let me ask you a related question: do you think it is acceptable to ban books? Why or why not?
- Comment on France orders internet providers to block access to Polymarket prediction site 3 months ago:
I have no objection to sites like Polymarket being made illegal. That is not the argument.
I don’t approve of people using Polymarket, but I would fight for their right to access the website without censorship.
The government can declare a business like Polymarket to be illegal, that’s fine. Take action against Polymarket directly. The government dictating which sites a citizen can or cannot access is not fine.
- Comment on France orders internet providers to block access to Polymarket prediction site 3 months ago:
Control is never relinquished voluntarily, it only expands. If the government has the power to block access to one site they will do it with more, for increasingly less justifiable reasons, until they eventually don’t bother justifying it at all.
Government censorship is not permissible in a free society, period.
- Comment on France orders internet providers to block access to Polymarket prediction site 3 months ago:
This isn’t blocking information or anything worthwhile
The government should neither know nor care what its citizens access on the internet, any more than they should have control over what books its citizens read.
Censorship is censorship regardless of what is being censored.
- Comment on France orders internet providers to block access to Polymarket prediction site 3 months ago:
This is the wrong way to do things. The government should not be dictating what its citizens are allowed to access on the Internet. It seems like so many countries go after ISPs and DNS providers to solve their problems for them, and I think it’s mostly just laziness.
What France should be doing is making it illegal for Polymarket to operate in their country, and fining them for violations.
- Comment on Roblox announce plans to let people AI generate basic games using text prompts stuck into a mobile app, but claim that won't fill their homepage with AI slop 3 months ago:
Ooh… so Roblox uses Luau internally for user-developed game logic, which means that you could probably get the AI to write you a complete application and execute it within the Roblox environment. This seems ripe for exploitation.
- Comment on All Cars Sold in the EU Now Require a Camera Aimed at Your Face. It’s Still Not Clear Where That Data Goes 3 months ago:
- Comment on Microsoft rolls back some of its Copilot AI bloat on Windows 7 months ago:
But what will I do without Copilot in Notepad
- Comment on OpenAI launches ChatGPT Health, encouraging users to connect their medical records 9 months ago:
give us your data give us your data give us your data
- Comment on Report: Microsoft quietly kills official way to activate Windows 11/10 without internet 9 months ago:
Anyone know if massgrave still works?
- Comment on US | NY Governor Hochul signs bill requiring warning labels on ‘addictive’ social media 10 months ago:
Oh, I don’t know, putting labels on things can be very effective for general public awareness. Plenty of people using Instagram never think about these kinds of things, it’s just not part of their normal concerns. The notifications might be an annoyance, but they will also start a lot of conversations between people that would not have happened otherwise, conversations that will turn into “wait, why do we let this company do this kind of thing at all?”
- Comment on Boing 10 months ago:
That’s boinking.
- Comment on Where Winds Meet: Why China's Wuxia RPG is Winning Over Global Gamers 10 months ago:
This is an ad.
- Comment on Amazon’s dynamic pricing is causing chaos for school budgets 10 months ago:
…move fast and break things?
- Comment on Looks Like We Can Finally Kiss the Metaverse Goodbye 10 months ago:
To be fair, they’ve been doing mobile surveillance for a long time.
- Comment on ‘There isn’t really another choice:’ Signal chief explains why the encrypted messenger relies on AWS 11 months ago:
Right, OK, but Signal sustains itself on charity.
- Comment on China releases 'UBIOS' standard to replace UEFI — Huawei-backed BIOS firmware replacement charges China's domestic computing goals 1 year ago:
UBIOS’s unique features over UEFI include increased support for chiplets and other heterogeneous computing use-cases, such as multi-CPU motherboards with mismatching CPUs, something UEFI struggles with or does not support. It will also better support non-x86 CPU architectures such as ARM, RISC-V, and LoongArch, the first major Chinese operating system.
Hmm, I haven’t read the full spec, but typically when you’re making mismatched components work together like this it means you can only support security features that are common for all of them - that is, any security can only be the lowest common standard. Does anybody know where to find more specific information on security features in UBIOS? Wider compatibility generally means more vulnerability.
One of the major design goals of UEFI was to add security to BIOS, which never had any real security in its design. If UBIOS is less secure than UEFI then it’s really not a good idea to use it for anything beyond personal devices.
Does UBIOS have feature parity with UEFI or is it just targeting a different use case altogether? UEFI’s security features are still not complete protection, but it would be a terrible idea to run a network server without them in the present cybersecurity environment.
