Comment on [deleted]

JoeKrogan@lemmy.world ⁨9⁩ ⁨months⁩ ago

• constantokra@lemmy.one ⁨9⁩ ⁨months⁩ ago

  Can you explain why you use onion repos? I’ve never heard of that, and I’ve heard of kind of a lot of things.

  source

  • JoeKrogan@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Onion repositories are package repositories hosted on tor hidden services. The connection goes through six hops and is end to end encrypted. In addition to further legitimizing the tor network with normal everyday usage it has the benefit of hiding what packages have been installed on a system.

    Whonix has some notes about it here if you want to read more.

    www.whonix.org/wiki/Onionizing_Repositories

    source

    • constantokra@lemmy.one ⁨9⁩ ⁨months⁩ ago

      That’s pretty neat. I might start doing that, just for kicks.

      source
    • MigratingtoLemmy@lemmy.world ⁨9⁩ ⁨months⁩ ago

      That is very interesting, thanks!

      source
  • BautAufWasEuchAufbaut@lemmy.blahaj.zone ⁨9⁩ ⁨months⁩ ago

    With Debian it’s just the apt-tor package, and the project maintains an official list at… onion.Debian.org iirc?
    I don’t know if serving onion traffic is more expensive for Debian/mirror maintainers so idk if this is something everybody should use

    source
• MigratingtoLemmy@lemmy.world ⁨9⁩ ⁨months⁩ ago

  System updates over tor connecting to onion repos.

  How does this help, assuming your DNS isn’t being spoofed?

  source

  • JoeKrogan@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Please see my reply below with links.

    source

    • MigratingtoLemmy@lemmy.world ⁨9⁩ ⁨months⁩ ago

      Thanks, never thought of that before. I’ll certainly try it, great way to help the network!

      source
• peter@feddit.uk ⁨9⁩ ⁨months⁩ ago

  Linux only on the main network.

  Is that a security benefit?

  source

  • semperverus@lemmy.world ⁨9⁩ ⁨months⁩ ago

    If big corporations hoovering your data should be on everyone’s threat list, then yea, i’d say its a huge benefit.

    source
  • JoeKrogan@lemmy.world ⁨9⁩ ⁨months⁩ ago

    Well I dont trust closed source software and so what I can to avoid it when I can. At least foss can be audited. Also all the linux devices on the main network are devices I admin.

    source
  • NOPper@lemmy.world ⁨9⁩ ⁨months⁩ ago

    I guess it cuts the attack surface profile down a bit?

    source
• rekabis@lemmy.ca ⁨9⁩ ⁨months⁩ ago

  Fail2ban bans after 1 attempt for a year.

  Fail2ban yes; one year, however, is IMO a bit excessive.

  Most ISP IP assignments do tend to linger - even with DHCP the same IP will be re-assigned to the same gateway router for quite a number of sequential times - but most IPs do eventually change within a few months. I personally use 3 months as a happy medium for any blacklist I run. Most dynamic IPs don’t last this long, almost all attackers will rotate through IPs pretty quickly anyhow, and if you run a public service (website, etc.), blocking for an entire year may inadvertently catch legitimate visitors.

  Plus, you also have to consider the load such a large blocklist will have on your system, if most entries no longer represent legitimate threat actors, you’ll only bog down your system by keeping them in there.

  Fail2ban can be configured to allow initial issues to cycle back out quicker, while blocking known repeat offenders for a much longer time period. This is useful in keeping block lists shorter and less resource-intensive to parse.

  source

  • JoeKrogan@lemmy.world ⁨9⁩ ⁨months⁩ ago

    My block list is very small actually due to the non standard ssh port. Everything else goes through wireguard.

    If it was open to the public then yes I’d have to reconsider the ban length.

    source

    • rekabis@lemmy.ca ⁨9⁩ ⁨months⁩ ago

      That makes a lot more sense for your setup, then.

      source