ramielrowe
@ramielrowe@lemmy.world
- Comment on Keep Tier-One Applications Out of Virtual Environments 1 month ago:
In a centralized management scenario, the central controlling service needs the ability to control everything registered with it. So, if the central controlling service is compromised, it is very likely that everything it controlled is also compromised. There are ways to mitigate this at the application level, like role-based and group-based access controls. But, if the service itself is compromised rather than an individual’s credentials, then the application protections can likely all be bypassed. You can mitigate this a bit by giving each tenant their own deployment of the controlling service, with network isolation between tenants. But, even that is still not fool-proof.
Fundamentally, security is not solved by one golden thing. You need layers of protection. If one layer is compromised, others are hopefully still safe.
- Comment on Keep Tier-One Applications Out of Virtual Environments 1 month ago:
If we boil this article down to it’s most basic point, it actually has nothing to do with virtualization. The true issue here is actually centralized infra/application management. The article references two ESXi CVE’s that deal with compromised management interfaces. Imagine a scenario where we avoid virtualization by running Kubernetes on bare metal nodes, and each Pod gets exclusive assignment to a Node. If a threat actor has access to the Kubernetes management interface, and can exploit a vulnerability to access that management interface, it can immediately compromise everything within that Kubernetes cluster. We don’t even need to have a container management platform. Imagine a collection of bare-metal nodes managed by Ansible via Ansible Automation Platform (AAP). If a threat actor has access to AAP and exploit it, it then can compromise everything managed by that AAP instance. This author fundamentally attributes the issue to virtualization. The issue is centralized management and there are significant benefits to using higher-order centralized management solutions.
- Comment on [deleted] 3 months ago:
If I understand this correctly, you’re still forwarding it a port from one network to another. It’s just in this case, instead of a port on the internet, it’s a port on the TOR network. Which is still just as open, but also a massive calling card for anyone trolling around the TOR network to things to hack.
- Comment on tupd 0.6 - small bugfix 3 months ago:
This isn’t about social platforms or using the newest-hottest tech. It’s about following industry standard practices. You act like source control is such a pain in the ass and that it’s some huge burden. And that I just don’t understand. Getting started with git is so simple, and setting up an account with a repo host is a one time thing. I find it hard to believe that you don’t already have ssh keys set up too. What I find more controversial and concerning is your ho-hum opinion on automated testing, and your belief that “most software doesn’t do it”. You’re writing software that you expect people to not only run on their infra, but also expose to the public internet. Not only that, but it also needs to protect the traffic between the server on public infra and client on private infra. There is a much higher expectation of good practices being in place. And it is clear that you are willingly disregarding basic industry standard practices.
- Comment on tupd 0.6 - small bugfix 3 months ago:
Github and Gitlab are free, and both even allow private repos for free at this point. Git is practically one of the first tools I install on a dev machine. Likewise, git is the defacto means of package management in golang. It’s so built in that module names are repo URLs.
- Comment on tupd 0.6 - small bugfix 3 months ago:
Git was literally written by Linus to manage the source of the kernel. Sure patches are proposed via mailing list, but the actual source is hosted and managed via git. It is literally the gold standard, and source control is a foundational piece of software development. Same with not just unit tests, but functional testing too. You absolutely should not be putting off testing.
- Comment on tupd 0.6 - small bugfix 3 months ago:
Gotta be honest, downloading security related software from a random drive is sending off sketchy vibes. Fundamentally, it’s no different than a random untrusted git repo. But, I really would suggest using some source control rather than trying to roll your own with diff archives.
Likewise, I would also suggest adding in some unit and functional tests. Not only would it help maintain software quality, but also build confidence in other folks using the software you are releasing.
- Comment on Traefik conditional certificate for same URL 6 months ago:
Here’s a drawing of what I think might be happening to your private traffic: traffic diagram
- Comment on Traefik conditional certificate for same URL 6 months ago:
I somewhat wonder if CloudFlare is issuing two different certs. An “internal” cert your servers use to serve to CloudFlare, which uses a private CA only valid for CloudFlare’s internal services. CloudFlare’s tunnel service validates against that internal CA, and then serves traffic using an actual public CA signed cert to public internet traffic.
Honestly though, I kinda think you should just go with serving everything entirely externally. Either your trust CloudFlare’s tunnels, or you don’t. If you don’t trust CloudFlare to protect your services, you shouldn’t be using it at all.
- Comment on Traefik conditional certificate for same URL 6 months ago:
Just serve the CloudFlare certs. If the URL is the same, it won’t matter. Doesn’t matter if you’re talking to a local private address like 192.166.1.100 or a public IP. If you’re accessing it via a DNS name, that is what is validated, not the underlying IP.
- Comment on Apex Legends streamers surprised to find aimbot and other hacks added to their PCs in the middle of major competition via anti-cheat software 8 months ago:
I’m not saying they were purposefully cheating in this or any tournament, and I agree cheating under that context would be totally obvious. But, it is feasible that a pro worried about their stats might be willing to cheat in situations where the stakes are lower outside of tournaments.
What I also don’t understand is, if this hacker has lobby wide access, why was it only these two people who got compromised? Why wouldn’t the hacker just do the entire lobby? Clearly this hacker loves the clout. Forcing cheats on the entire lobby would certainly be more impressive.
- Comment on Apex Legends streamers surprised to find aimbot and other hacks added to their PCs in the middle of major competition via anti-cheat software 8 months ago:
This isn’t a statement from Apex or EAC. The original source for the RCE claim is the “Anti-Cheat Police Department” which appears to just be a twitter community. There is absolutely no way Apex would turn over network traffic logs to a twitter community, who knows what kind of sensitive information could be in that. At best, ACPD is taking the players at their word that the cheats magically showed up on their computers.
- Comment on Apex Legends streamers surprised to find aimbot and other hacks added to their PCs in the middle of major competition via anti-cheat software 8 months ago:
I do not buy this RCE in Apex/EAC rumor. This wouldn’t be the first time “pro” gamers got caught with cheats. And, I wouldn’t put it past the cheat developers to not only include trojan-like remote-control into their cheats, but use it to advertise their product during a streamed tournament. All press is good press. And honestly, they’d probably want people thinking it was a vulnerability in Apex/EAC rather than a trojan included with their cheat.
- Comment on Wisest Upgrade from Raspberry Pi 1 year ago:
Check out minisforum, for example this intel mini-pc. They have a ton of selection, not just that one example.
- Comment on US Space Force creates 1st unit dedicated to targeting adversary satellites 1 year ago:
From the article, “These systems range from ground-based lasers that can blind optical sensors on satellites to devices that can jam signals or conduct cyberattacks to hack into adversary satellite systems.”
- Comment on Satellites Are Rife With Basic Security Flaws 1 year ago:
At it’s most basic, a satellite will have two systems. A highly robust command and control system with a fairly omnidirectional antenna. And then the more complex system that handles the payload(s). So yea, if the payload system crashes, you can restart it via C&C.