• 11 Posts
  • 2.68K Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle





  • I don’t know, this is just so… earnest, it’s bordering on fanatical. It reminds me of Christians I knew as a teenager who were “on fire for God!” It’s very tryhard.

    Instead of proselytizing, we should just focus on making our communities good places to hang out, share content and have a conversation. Instead of advertising to pull people in, be a place that people want to come to. The word will spread on its own.




  • DRAM is still susceptible to RowHammer because it’s a physics problem.

    There are many methods of fingerprinting a system connected to the internet, it’s very difficult to prevent it.

    Most processors that do speculative execution are vulnerable to Spectre-style exploitation, and this can’t be fully mitigated with firmware updates, only with hardware redesigns.

    If you pay any attention to cybersecurity news, you learn that basically everything is vulnerable in some way, and that a fair amount of the vulnerabilities are part of larger systems beyond your control that we’re stuck with for various legacy and dependency reasons. The vulnerabilities are never going away. Every new addition to computer network technology brings new vulnerabilities with it. This is inevitable. It is a consequence of developing open systems like IP, where any idiot can buy a box of some type with a network interface and plug it into the big’ol rat’s nest and get a connection. Open means exposed.

    I think it’s possible that no Turing machine can actually ever be completely secure, because by definition there is always a way to put the machine in any state, including the state where all the doors are unlocked.

    So, why bother with security?

    Because you want to close as many of those doors as often as possible. Because knowing that there is always an opening somewhere, your goal is to reduce the odds that it will be found and used by someone else.

    Risk assessment is how you move forward. Risk assessment is how you limit the scope, so that you put your best effort where it’s most effective. Know the field, know the threats, know what network(s) you’re connected to and how and where. Know where your important data is. Protect the pieces of your digital life that present the greatest risk. Diversify and segregate systems, data storage and connections based on risk.

    You know that a lock can be picked by someone with the right tools and skills. You probably still lock your front door when you leave.

    It’s not about 100% prevention, it’s about limiting your risk, and taking risks where they’re worthwhile and avoiding them where they’re not.






  • NaibofTabr@infosec.pubtoSelfhosted@lemmy.worldSelf host websites
    link
    fedilink
    English
    arrow-up
    14
    ·
    edit-2
    3 days ago

    I think the answer depends a lot on the use case of each business’s website and what the business owner/employees expect from it.

    Is the website a storefront? You’ll be spending a lot of time maintaining integration with payment networks and ensuring that the transaction process is secure and can’t be exploited to create fake invoices or spammed with fake orders. Also probably maintaining a database of customer orders with names, emails, physical addresses, credit card info, and payment and order fulfillment records… so now you have to worry about handling and storing PII, maybe PCI DSS compliance, and you’ll end up performing some accounting tasks as well due to controlling the payment processing. HIPAA compliance too if it’s something medical like a small doctor’s office, therapist, dialysis clinic, outpatient care - basically anything that might be billable to health insurance.

    Does the business have a private email server? You’ll be spending a lot of time maintaining spam filters and block lists and ensuring that their email server has a good reputation with the major email service providers.

    Do the employees need user logins so that they can add or edit content on the website or perform other business tasks? Now you’re not just a web host, you’re also a sysadmin for a small enterprise which means you’ll be handling common end-user support tasks like password resets. Have fun with that.

    Do they regularly upload new content? (e.g. product photos and descriptions, customer testimonies, demo videos) Now you’re a database admin too.

    Does the website allow the business’s customers to upload information? (comments/reviews/pictures/etc, e.g. is it Web 2.0 in some way) god help you.

    You’re going to expose this to the public internet. It will be crawled, and its content scraped by various bots. At some point, someone will try to install a cryptominer on it. Someone will try to use it as a C2 server. Someone will notice that you’re running multiple sites/services from one infrastructure stack and attempt to punch their way out of the webhost VM and into the main server just to poke around and see what else you’ve got there. Someone will install mirai and try to make it part of a DDOS service provider’s network.