• 1 Post
  • 75 Comments
Joined 2 years ago
cake
Cake day: August 15th, 2023

help-circle




  • Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.

    But hey! Change the world, amirite?


  • I don’t want to go so far as to tell you how to think, but as long as we are talking about how to visualize IP addresses, you may want to check out subnets and subnet masking.

    The notation of IP addresses starts to make sense when you think about the early days of TCP/IP when all IP addresses were public and NAT’ing wasn’t really required yet. Basically, there needed to be ways for networks to filter traffic by IP blocks that were applicable. (It was [in part] a precursor to collision avoidance, but absolutely not the full story.) We still use addressing and masking today, but it’s more obvious when it’s local. (Like in data centers, where it’s super practical to mask off a block of addresses for a row or rack of servers.)

    To your point, yeah. IP addresses are probably more comparable to the Dewey Decimal System rather than actual numbers and thinking of them as strings is probably easier.










  • remotelove@lemmy.catoSelfhosted@lemmy.worldSecrets
    link
    fedilink
    English
    arrow-up
    5
    ·
    8 months ago

    I would look into something like Doppler instead of Vault. (I don’t trust any company acquired by IBM. They have been aquiring and enshittifying companies before there was even a name for it.)

    Look into how any different solutions need their keys presented. Dumping the creds in ENV is generally fine since the keys will need to be stored and used somehow. You might need a dedicated user account to manage keys in its home folder.

    This is actually a host security problem, not generally a key storage problem per se. Regardless of how you have a vault setup, my approach here is to create a single host that acts as a gateway for the rest of the credentials. (This applies to if keys are stored in “the cloud” or in a local database somewhere.)

    Since you are going to using a Pi, you should focus on that being a restricted host: Only run your chosen vault solution on it. Period. Secure and patch it to the best of your ability and use very specific host firewall rules for minimum connectivity. Ie: Have one user for ssh in and limit another user account to managing vault, preferably without needing any kind of elevated access. This is actually a perfect use case for SELinux since you can put in some decent restrictions on the host for a single app (and it’s supporting apps…)

    If you are paranoid enough to run a HIDS, you can turn on all the events for any type of root account actions. In theory once the host is configured, you shouldn’t need root again until you start performing patches.



  • Instances don’t have to be federated and instances federate and defederate from each other often enough. The goals of instances may not align, and to keep conflict low(er) it’s better if some instances cut ties.

    TBH, this sounds like a technical issue between ml and nl or just a typo in the way you are posting.

    While I thought it was basically an on/off switch for defederation, I suppose there could be a way to block updates from instances without fully defederating.

    I am not going to get into the drama, but ml is defederated at a little higher frequency, but it’s not as high as some others. It’s because reasons, and is not relevant to this particular thread.