wr2623

@wr2623@midwest.social

• ⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  It certainly isn’t good to depend on it but security by obscurity is your first and probably most important line of defense. When these vulnerabilities come out they need to know your service exists to exploit it.

  The best way to do that is to setup a reverse proxy to reject invalid hostnames. A single port is all you need exposed for multiple web services, and the IP scans won’t find the script kiddies anything valuable. Be careful with lets encrypt, there is a public journal of all issued certs, so make sure to get yourself a wildcard cert so that you aren’t advertising your valid hostnames to the world.

  Use the reverse proxy to put basic auth in front of your services (if they can handle that). Basic auth is very simple, no web forms to attack, just a single header. If your php site is vulnerable they won’t ever be able to even attempt to reach it without a valid username/password.

  I’ve got a mix of containers and VMs behind that reverse proxy. The containers have network security groups around them limiting network access. The VMs are in a Harvester hypervisor with KubeOVN for software defined networking. That means each VM is in its own subnet with network security groups around the subnet preventing any unnecessary network access.

  For machines/containers that need Internet access I have a Squid proxy with an explicit whitelist of allowed URLs so that the machines can’t reach out to unauthorized sites to download their malware or contact command and control nodes.

  Unattended updates for the VMs, and FluxCD keeping helm charts up to date hourly for the containers. For my own containers, weekly scheduled container rebuilds.

  I do have one public website that I host for a friend (indexed by search engines so the sites name is known to the world). My friend had originally deployed that as a WordPress site, but WordPress/PHP don’t have the best security track record so I was concerned about that. The site was pretty simple so I recreated it as 100% static content, so now the attack surface is just a nginx container with a read-only filesystem.

• ⁨Comment⁩ on ⁨Has anyone managed to use their Steam Frame with an external monitor?⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Wireless display is too laggy? Steam Link is how half of the people using the frame are playing games in the first place. Not having the dongle doing the transmitting might add a couple of ms of delay due to the second hop, but there are many people who have been gaming with steam link for years.

• ⁨Comment⁩ on ⁨used hard drive retailers⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  I’ve bought about 16 drives from goharddrive (through eBay). Most of them 5+ years ago without any failures. So I can’t say how well they honor their warranty, but they have been around for some time so that is probably a good sign.

  If you are running your power supply near its limit I have seen that cause drive drops as well. If you continue to see drives drop that seem to be functional and cables/HBA don’t seem to be the cause, you might want to swap/upgrade power supplies if you can.

• ⁨Comment⁩ on ⁨Steam Controller delivery vent⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  Well they did try to schedule delivery and apparently UPS wouldn’t let them do that, but yeah certainly not anything to do with Valve.

  If this were pre-covid UPS likely wouldn’t have left a note and reattempted delivery the next day. But all of the shippers took the COVID no-contact rules to mean that they could just leave packages at the door, snap a pic, and be done with it. Saves them a huge amount on redelivery attempts, and they get to pass the blame on to their customers for not being there.

• ⁨Comment⁩ on ⁨Steam Controller delivery vent⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  UPS asking you to open a case with Valve is normal. You didn’t pay to ship it, Valve did. Even if it is a line item on your invoice it was a contract between Valve and UPS, so you can’t call up UPS demanding investigation/money because it is Valve that gets the money not you (who in turn refunds it to you).

  If Valve gives you the money back they are likely taking a loss on it to keep you happy. As far as UPS is concerned they delivered it (presumably with photographic evidence), so why would they pay up on insurance. Unless Valve pays for the higher level of insurance UPS won’t cover for porch pirates.

  It is unlikely that Valve paid to have that level of coverage, but that is because they know only a small number of packages will be stolen. It ends up being cheaper to just give a few refunds than it is to pay for the higher level coverage on thousands of packages.

  Hopefully that is the case on how Valve handles this and you get a replacement or at least your money back. Good luck!