• 0 Posts
  • 38 Comments
Joined 2 years ago
cake
Cake day: August 2nd, 2023

help-circle



  • A layered defense is always best. Nothing is 100%, but knowing your threat model will help define how far you have to go and how many layers you want in the way. Defending against State level actors looks different than swatting the constant low effort bot traffic. You’re right, if a bad actor gets root on your machine, all security is forfeit. The goal is to minimize that possibility by keeping applications and packages updated and only allowing necessary connections to the machine. You mentioned wireguard or tail scale. Set that up first. Then set up the host firewall to only allow outbound traffic onto the VPN to the required ports and endpoints on the LAN. If the VPS isn’t hosting any public facing services, disable all traffic except the VPN connection from and to the public Internet both on the cloud provider’s firewall and the host firewall. If it is hosting publicly accessible services then use tools like fail2ban and crowdsec to identify and block problem IPs.







  • Agreed.Also, Windows and OSX, unless you want to have to call your nephew who’s Good With Computers™ every couple of weeks. If you’re just using a browser for everything and never messing around like a good majority of people, Linux is just as good as either of those. Linux has gotten to the point where it’s Grandma proof if you stick to a distribution that prioritizes stability. If you choose a distro that prioritizes bleeding edge software versions, you may come across more bugs and breaking changes.Then you’ll need the troubleshooting skills mentioned here. Most of us are here to learn and mess around; the troubleshooting skills grow from that mindset.


  • I agree with your lack of affection for cloud services, but I think your view might be a little skewed here. Does a senior mechanic need to understand the physics of piston design to be a great mechanic, or just gather years of experience fixing problems with the whole system that makes up the car?

    I’m a Senior Systems engineer. I know very little about kernel programming or OS design, but i know how the packages and applications work together and where problems might arise in how they interact. Software Engineers might not know how or don’t want to spend time to set up the infrastructure to host their applications, so they rely on me to do it for them, or outsource my job to someone else’s computer.







  • While others are focusing on the legal aspect, which I guess is the question you actually asked, my first thought was bare minimum compliance while gathering evidence. Grab an old phone, wipe it completely, install the app with all new credentials not tied to you in any way, then just leave it running at work. They get their location data, just not anything usable, you get to submit a minimum number of receipts that doesn’t get you in trouble from purchases you would have made anyway, or not because why support scumbag companies. You get to gather more hard evidence of their assholery that way. Never install work apps on your personal phone. If they require something for your job, they should provide the hardware to run it on.