Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)XY
Posts
69
Comments
290
Joined
2 yr. ago

  • What type of key do you have. Yubikey 5 supports multiple protocols including some you can use with SSH:

    • Multi-protocol: YubiKey 5 Series is the most versatile security key supporting multiple authentication protocols including FIDO2/WebAuthn (hardware bound passkey), FIDO U2F, Yubico OTP, OATH-TOTP, OATH-HOTP, Smart card (PIV) and OpenPGP.

    SSH would need to implement webauthn to support FIDO.

  • Secure can also mean more resilient. The infosec C-I-A triangle has three legs. Confidentiality, Integrity and Availability. Immutable distros are more resilient and thus offer better availability in the face of attacks or accidents.

  • Sometimes it helps to feel bad for someone instead of being angry at them. I think of Gandalf’s quote from LOTR:

    “Frodo: 'It's a pity Bilbo didn't kill Gollum when he had the chance.'
    \ Gandalf: 'Pity? It's pity that stayed Bilbo's hand. Many that live deserve death. Some that die deserve life. Can you give it to them, Frodo? Do not be too eager to deal out death in judgment.”

  • From an enterprise security perspective you want to operate with a least privilege model. For developers who need admin access this is typically granted through some just-in-time temporary elevation process, but many developers who are writing code and pushing builds through a devops CICD pipeline may not need admin to do their jobs.

  • While there is no system for monitoring the companies, experts can reverse engineer the apps and debug the devices. Thusfar, experts who have done this have found no evidence of these types of activities. All the evidence is anecdotal. I believe if this was a widespread practice, evidence would have been uncovered by now and we would have been reported on widely.

    The implication here is really scarier than if they were listening to our conversations. It means they do not need to listen to our conversations. The telemetry they already have is so good that in many cases they know what you will say with such high degrees of accuracy that people assumed that they had to be spying on their conversations.

    Either way, we need to demand an end to this unprecedented mass surveillance.

  • From the “Financial Advice Index Card”:

    1. Max your 401(k) or equivalent employee contribution.

    2. Buy inexpensive, well-diversified mutual funds such as Vanguard Target 20xx funds.

    3. Never buy or sell an individual security. The person on the other side of the table knows more than you do about this stuff.

    4. Save 20% of your money.

    5. Pay your credit card balance in full every month.

    6. Maximize tax-advantaged savings vehicles like Roth, SEP and 529 accounts.

    7. Pay attention to fees. Avoid actively managed funds.

    8. Make Financial Advisors commit to the fiduciary standard.

    9. Promote social insurance programs to help people when things go wrong.

  • Sometimes it helps to feel bad for the person rather than get angry. As Gandalf said in the LOTR:

    “Frodo: 'It's a pity Bilbo didn't kill Gollum when he had the chance.'
    \ Gandalf: 'Pity? It's pity that stayed Bilbo's hand. Many that live deserve death. Some that die deserve life. Can you give it to them, Frodo? Do not be too eager to deal out death in judgment.”

    Remember that plumber earns his livelihood on his professional reputation. If he cannot keep an appointment, he is failing at his career.

  • Why is no one talking about water?

    I got a generator and some fuel, some rice and beans. Should last a couple if weeks. I feel like it us unrealistic to plan for longer. If there is a society wide collapse, it really doesn’t matter how much gas you have in your generator.