Kid_Thunder

I see some comments recommending wordpress but wordpress is a security problem, especially if you’re using 3rd party plugins. It is such a bad problem that their are ‘wordpress security’ applications but even then wordpress sites get hacked all the time. If you are going to use it, it is best to let some other host handle it for you if you don’t know a whole lot about what you’re doing.

There are many, many other content management systems out there. Some are lighter than wordpress and some heavier. They are all about posting and managing content. Most of them have some sort of user and authoring system. Once you’re webserver is set up, many are written in a mixture of php and python so setting them up is generally drag and drop with either minor configuration file edits or wizards. Many of them have sections that you can set up using a labeling/tagging system. Most of them allow you to have the ‘stories’ as private or draft where you have to actually click publish before people can view them. Some have user roles systems where you can limit viewing and even editing between different roles for sections.

Generally, once their setup is done, they are point and click to do everything.

Here’s a nice list of FOSS CMS’ (which includes Wordpress of course).

Just to be clear, if you’re in the US, you 100% have copyright protection as soon as you put pen to paper.

The conservative strategy has been to polarize politics in America in order to have a very aligned power. This means that if you aren’t 100% behind them, then you are an enemy to them.

It is only through this that the GOP can both say that they are protecting individual freedoms but limiting or taking them away (of course opponents to this will be quick to point out the one and only counter point which is fighting against restrictions of the 2nd Amendment and only that), say that they are for smaller government but yet want private companies to be regulated that attempt to censor hate and misinformation (which has nothing to do with the 1st Amendment when it comes to non-government entities) yet still say that they are for businesses to operate as unrestricted as possible. They are anti-union because they are corrupt and take away accountability yet strongly support the worst of the worst of unions – the police unions. The GOP constantly cries that there’s a nanny government, yet they push laws to restrict people’s choices, censor libraries and try to tear down citizen protections. The GOP cries that this country’s deficit is out of control but when they are in power, they over spend. They complain that public schools indoctrinate but at the local and state levels attempt to indoctrinate in public schools. They talk about needing to stay in power to turn America around, yet when empowered in all three federal branches fails to pass meaningful legislation and run the government that they are overseeing and yet blame the government because they will eat each other alive for their own individual gains.

There so much more but the GOP is a party of hypocrites. Without polarization mixed with some fear mongering their party would likely cease to exist with any real power because they do not stand for the ideals that their own voting base supports.

The GOP constantly tries to create an environment of being constantly under attack and spews hate. Their voter base is simply a product of that.

A 30% cut for steam games sold on steam and a 0% cut for steam keys sold by the publisher wherever they want with the caveat that they must give steam users the same sales at around the same time. They get their games hosted on Steam’s industry best CDN, a page with support for images and videos, an API with features users like, workshop API for mod hosting and delivery, and other SteamWorks API stuff for stuff like multiplayer, patch management without charging a fee for it, forum hosting to hit the highlights. Pretty much all of that drives engagement and is mostly turn-key though you do have to programmatically interact with their API when it makes sense.

Steam provides a lot of benefit for a 30% cut of what is sold on their store front and a lot more benefit for getting all of the above for a 0% cut if they sell steam keys outside of steam.

Sounds like you have nothing listening on port 80 that resolves for your domain for Let’sEncrypt to verify that you own the domain. You need a webserver listening on port 80 and that Certbot can access if you’re using the http method.

Basically you’re forwarding traffic to port 80 but there’s nothing on port 80.

Depends on if there’s an IPv6NAT and how your ISP converts between IPv4 and IPv6 or actually supports IPv6 straight through. It also depends on your router.

Currently, there’s still some debate since IPv6NAT (NAT66/NPT6/NATv6) isn’t really needed for WAN boundaries for the reasons NAT exists. However, without it you are right on that this will be a problem for the consumer because PCs, IoT devices, printers, circuts or whatever my wife has, etc. could all be exploitable and even worse, you may never know you’re contributing to the botnet.

As an example, I have a global IPv6 on a few on my devices. They can connect to IPv6 if it originates from me but if it originates from them or is UDP it doesn’t route to my IPv6. My router doesn’t care. It’ll route it just fine either way. It would appear that my ISP has me behind one of the IPv6 NATs.

I’d imagine that’s true for most people at home.

NAT provides some measure of security as pure coincidence to how it works. It is not designed or intended to provide security. It does not inspect packet payloads in order to filter them for security. It looks at the header and attempts to route it to an internal IP address (your devices on your LAN) and if it cannot, it will drop the packet because the header will only have the external IP address – the packet has no idea which device it is supposed to go to. Forwarding a port is telling the NAT to assume that when a packet hits a certain port, if it doesn’t know the destination internal IP, forward it to some internal IP anyway.

The reason you can connect to websites, ssh outside, FTP, whatever, is because your connection comes from your internal IP first to some other IP and therefore, NAT knows which internal IP to route those packets to.

Take for example this scenario:

You download some software. It has malware that provides command and control (C2) to someone else outside of your network. A firewall and/or antivirus may be able to stop this and hopefully notify you. NAT will not help here. Furthermore, if you have uPNP enabled (usually it is by default on your router) the malware can forward any ports through your NAT to the compromised device opening it up to bot attacks and the like.

Another scenario:

You want to play a video game with you and your friends and you’re going to host it. So either you manually forward those ports or perhaps uPNP just does it for you. That game has an exploit known by attackers, or perhaps it can just be DDoS’d. Your NAT isn’t going to stop that. Hopefully a firewall will help you here. It definitely will if you set up explicit rules so that if they aren’t your friend’s IPs it will drop them. Though it is possible the game is exploitable and your friend’s are compromised.

Take for example malware has been known to spread via Minecraft.

As I understand it, NAT is a firewall

NAT is not a firewall. NAT does not inspect packet payloads, it doesn’t do anything except attempt to route packets to where they are supposed to go. If the connection originates from outside or it is a ‘connectionless’ protocol, the NAT has no idea which internal IP to route to, so it drops the packet.

NAT provides some security by sheer coincidence and not by design.

YouTube, Facebook, forums and pretty much any echo chamber. Pretty much anything that has replaced AM radio and shitty newsletters. In the ~2020’s also parroting politicians – I’m sure I don’t need to go over the last 4 years of examples, so how about the Bowling Green massacre that never happened?

In short, his argument in court is that the lack of evidence is evidence of criminal intent.

The SSH keys don’t help me if I get locked out of a Domain Controller unless you’re using OpenSSH (which is now a native feature you can turn on). In that case you can actually still log into the DC via command line because it authenticates based on authorized_keys and not the LDAP of the DC. I actually do this on the enterprise, not because I may get locked out but because it is just convenient. Granted you’ll have to execute powershell on the command line once in to use the AD cmdlets.

On the other hand when you create a DC now-a-days (Server 2019…I don’t remember if this is asked in the wizard when in Server 2016) you can create a “Directory Services Restore Mode” password which is basically a local admin account on the DC that you can log into only when the DC is booted into safe mode. You’ll be asked to create it when you promote your DC.

Personally I use FreeIPA for my LDAP. I like that I can create sudoers rules from one centralized place and manage ssh keys across all clients. Granted I could just use Ansible I suppose, which is how I update multiple distributions in my network and online but I like that I can just change SSH keys and sudoers from one place easily instead of changing tasks/roles. I also usually run cockpit even on my non-Red Hat distros with SSH keys just so I don’t have to log into everything though it is somewhat limited outside of the Red Hat sphere.

If you don’t want to use ProxMox or some other specialized HyperVisor ecosystem, you can also use Cockpit to manager your VMs along with your Pods. I wish there’d be more attention to it for features because it feels like it could do a lot more.

I also don’t really worry about locking myself out for two reasons:

1. I use SSH keys.

2. I also have a break-glass local account on every system…with SSH keys. If its on your local network, you can use VNC/VM console/Remote Desktop with a local account while only allowing SSH with keys if you’d like. Just make sure if you’re going to allow remote access outside of your network that you never forward the VNC/RDP ports. For SSH when I do this I always pick some random port – never default and never common ones like 2222 to at least keep my logs less noisy from the botnet auto attacks.

For my online VPS’ I use a firewall with geoIP from Maxmind and drop all ports but 443 from the world, except for whatever country I’m in. I drop all packets from certain countries that seem to auto-attack more often than others. I try to drop packets from all known (to me) Shodan scanners. If I’m not traveling I just restrict all other ports to my public IP’s subnet though my IP hasn’t changed for years. For status checking services like StatusCake, I use the “push” method instead using a simple cron job with curl instead of relying on servers around the world checking my ports. In this case, the services just check that my server has successfully hit them within X minutes to be “up”.

Can’t wait for a story from a developer or sysadmin that knows how all the duct tape is held together, gets laid off and refuses to come back to fix everything. Then the former employer doubles doubt and threatens to sue them for loss of revenue. It would be absurd but I expect the absurd now.

Well except in Linux’s case when you use zram anyway. It compresses a pool of RAM. I usually compress almost all of my RAM and generally hover around and 2:1 ratio with lz4.

Windows 10+ also compresses a pool of RAM but it is a terrible ratio and seems to hover around 1:1.1. Nothing to write home about.

I like how HP says a big reason to not use 3rd party ink is because they can introduce malware, which is another reason they need to work to make sure you only use HP ink.

However, the security issue is because of the chips they use in order to make sure you only use HP ink.

It seems like to me that HP, HPE and HP Printing have had the most constant and slowest death in the industry and if this article proves anything, it isn’t going to change.

deleted by creator

The free solution I was referring to was my comment about using ControlD, which certainly offers a free service…which is the comment that the other person was responding to.

I run pihole and my wireguard VPN server locks all queries through it, which in turn uses unbound and queries via different providers like Cisco’s OpenDNS, Cloudflare and Quad9. However, I wanted to present a similar offering that also has a free-tier without a query cap for people interested.

NextDNS caps your queries per month on the free account. ControlD doesn’t and you can pick a various mix of their public DNS resolvers. You don’t necessarily get the granular control with doing it this way for free that you can get with NextDNS though.

If you do check out these, make sure you click the Secure Resolvers if you’d prefer for DLS/DOQ/DNS over HTTPS instead of Legacy.

I wash my hands all the time. I’m not voluntarily gross. The tests will find trace amounts but if you don’t wash your hands after going to the bathroom, you are a gross person passing on loads of bacteria that is exponentially more than the testing will find.

I appreciate the distinction though. There are definitely people that live like that. There used to be a guy at a place I used to work who used to dig in those big trail mix jars people put out sometimes instead of dumping them into something or even dumping them into their hands. Once I was in the bathroom (washing my hands) and saw him leave the stall and just walk straight out. Now I can’t see those without thinking about that. I’ll never touch those things again.