foggy

I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.

The manual fix is relatively easy, just change a few configs.

Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.

It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.

My guess is releasing these CVEs the normal way could have catastrophic consequences. They’re giving stsadmins a heads up so there is less of a scramble when sysadmins read “hey fix your shit it’s totally vulnerable” before they have their coffee.

Like as a sysadmin, this is a great way for them to do this.

I will in 10 mins alert my team that the whole site has to come offline for a period today. I don’t need to take it offline in an emergency and tell my boss to send out a memo.

Literally a single nmap command will tell me where you “hid” your ssh port.

Like the poster you’re responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.

Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

I stood up grafana at work, and I make dashboards to keep my role secure.

Everyone uses my shitty little dashboards :)

Everything else is just those tools but you’re abstracted away from some level of control.

Or ELK.

I used to keep a charged spare on me. And this was back when a phones battery life was like 3-7 days.

Stop making phones thinner God dammit. I don’t want a thinner phone. I want longer battery life and a removable battery so I can fucking double the shitty longer battery life I get.

I was gonna say it looks like a keychron. I have like 5 in my house. Their mice are great too. Big fan. Waiting for the other shoe to drop.

I just need a few more billion and it’ll become profitable, I swear.

I’m gonna speak generally and it doesn’t quite generalize. Sue me.

Formal education in computer science is a waste, unless you want to be in academia. A formal education in computer science will either prepare you for higher education in Computer Sciences, or it will drill into you some best practices on how to be a good programmer. You can get the latter through brute force for free.

That said, I have a formal CS education. It has helped my career 0. I’m 10 years into my career and am the 1 man cybersecurity team (plus my boss and my coworker who does most of our networking stuff unless he’s too busy, then that’s me as well) for a fleet of ~4000 devices across ~1500 folks.

I have never once needed to explain to someone what von Neumann architecture is, and how it differs from Harvard. I have never once needed to explain two’s compliment or how to represent negative numbers in bunary. Knowing what an xor swap is and why it’s used has only helped me solve a leetcode problem exactly ONE TIME. I have explained to many people what P vs NP is (no your suno track will not be the next cultural phenomenon) but nobody cares.

The stuff that did serve me was like, making the card game of war in Java. Even the GUI. That’s a project I would have never done because who TF would. But it forces you to implement recursion (war within a war), it entails some good validation checking practices, etc. the truth is though, I did not need a college education for that project.

At the end of the day, technical projects teach technical skills. Not PowerPoints based on textbooks.

If you wanna learn how to harden your servers, I recommend freemium hands on learning platforms like tryhackme of hackthebox.

Hack the box has a module on server hardening. It’s my go to for hardening servers.

Do you have a moment to talk about our Lord and Savior, Jesus Christ?

The whole anti Google holier than thou is annoying at these levels.

Ok fine, don’t use Google. But telling your friends and loved ones to switch email providers over your crusade is worse than vegans telling you about their diet.

I’m all for kicking Google to the curb. I’m not for shoving my beliefs down other people’s throats.

Im not saying Zuck is good or a savior of choice, but now would be a good time for facebook investors to pressure him to eat that difference.

Not that he should, but hes all in on Open Source*

*Massive stipulations apply.

🖕 my home server disagrees 🏴‍☠️