• 0 Posts
  • 69 Comments
Joined 8 months ago
cake
Cake day: November 4th, 2023

help-circle
  • I see some comments recommending wordpress but wordpress is a security problem, especially if you’re using 3rd party plugins. It is such a bad problem that their are ‘wordpress security’ applications but even then wordpress sites get hacked all the time. If you are going to use it, it is best to let some other host handle it for you if you don’t know a whole lot about what you’re doing.

    There are many, many other content management systems out there. Some are lighter than wordpress and some heavier. They are all about posting and managing content. Most of them have some sort of user and authoring system. Once you’re webserver is set up, many are written in a mixture of php and python so setting them up is generally drag and drop with either minor configuration file edits or wizards. Many of them have sections that you can set up using a labeling/tagging system. Most of them allow you to have the ‘stories’ as private or draft where you have to actually click publish before people can view them. Some have user roles systems where you can limit viewing and even editing between different roles for sections.

    Generally, once their setup is done, they are point and click to do everything.

    Here’s a nice list of FOSS CMS’ (which includes Wordpress of course).






  • I accidentally overwrote /etc/passwd once and I allowed /boot to run out of space during a kernal update and I created a local user with the same user that was also on the realm/domain that I had joined and various bash script issues.
    Some stuff I’ve had to fix that someone else did:

    • named a file rm -rf
    • rm -rf /bin instead of ./bin – Also the fact that they had sudo was crazy and also I guess this was the second time
    • chmod -R 777 /
    • Various software bugs running swap out of space or hitting the inode limit by creating files over and over again with a timestamp in the filename and having to remove all of them because there was no backup to the OS
    • Someone disabled SELinux because something wasn’t working but didn’t tell anyone – ugh
    • Compiled java because they googled some issue and followed some old tutorial without understanding anything instead of using alternatives and symlinked the old java from /bin to /home/theiruser/java – had sudo because he was a Windows domain admin.
    • Cybersecurity guy didn’t know what some VMs did so he turned them off and figured he’d find out if/when someone complained. Caused a massive core services outage.
    • Same Cybersecurity guy deleted a bunch of data because he wanted to see how the sysadmins would respond and witness backup restorations. He did not inform anyone.
    • Cybersecurity guy above still has Domain Admin and sudo everywhere. I would have personally removed his privileged access regardless of what ‘CyberSecurity’ management thought but I was leaving for a new job by then anyway so I figured I’d just let them eventually lie in the bed they made.

    There’s more but I don’t want to keep going because it is Sunday and I don’t want to ruin it.











  • Depends on if there’s an IPv6NAT and how your ISP converts between IPv4 and IPv6 or actually supports IPv6 straight through. It also depends on your router.

    Currently, there’s still some debate since IPv6NAT (NAT66/NPT6/NATv6) isn’t really needed for WAN boundaries for the reasons NAT exists. However, without it you are right on that this will be a problem for the consumer because PCs, IoT devices, printers, circuts or whatever my wife has, etc. could all be exploitable and even worse, you may never know you’re contributing to the botnet.

    As an example, I have a global IPv6 on a few on my devices. They can connect to IPv6 if it originates from me but if it originates from them or is UDP it doesn’t route to my IPv6. My router doesn’t care. It’ll route it just fine either way. It would appear that my ISP has me behind one of the IPv6 NATs.

    I’d imagine that’s true for most people at home.


  • NAT provides some measure of security as pure coincidence to how it works. It is not designed or intended to provide security. It does not inspect packet payloads in order to filter them for security. It looks at the header and attempts to route it to an internal IP address (your devices on your LAN) and if it cannot, it will drop the packet because the header will only have the external IP address – the packet has no idea which device it is supposed to go to. Forwarding a port is telling the NAT to assume that when a packet hits a certain port, if it doesn’t know the destination internal IP, forward it to some internal IP anyway.

    The reason you can connect to websites, ssh outside, FTP, whatever, is because your connection comes from your internal IP first to some other IP and therefore, NAT knows which internal IP to route those packets to.

    Take for example this scenario:

    You download some software. It has malware that provides command and control (C2) to someone else outside of your network. A firewall and/or antivirus may be able to stop this and hopefully notify you. NAT will not help here. Furthermore, if you have uPNP enabled (usually it is by default on your router) the malware can forward any ports through your NAT to the compromised device opening it up to bot attacks and the like.

    Another scenario:

    You want to play a video game with you and your friends and you’re going to host it. So either you manually forward those ports or perhaps uPNP just does it for you. That game has an exploit known by attackers, or perhaps it can just be DDoS’d. Your NAT isn’t going to stop that. Hopefully a firewall will help you here. It definitely will if you set up explicit rules so that if they aren’t your friend’s IPs it will drop them. Though it is possible the game is exploitable and your friend’s are compromised.

    Take for example malware has been known to spread via Minecraft.



  • It doesn’t sound so terrible. Just tracks upsells for a bonus, right? Think about what happens every single time with technology like this. It will definitely be used to create metrics on virtually everything an employee does and continue to press upward.

    If this goes unchallenged expect things like cameras watching everything you do. White collars have cameras aimed at their faces and keyboards, blue collars have them on their job sites. You’ll need to meet hard metrics to be considered at the bare minimum and also compete with others for raises/bonuses based on the data. The top competitors push the mean metrics up and up.

    It wasn’t that long ago when employers were demanding not only their employees’ social media username and passwords but also applicants. Some states passed laws specifically banning that, which was helpful and thankfully some of those states were key states where many corporations are incorporated for the immense tax breaks and also thankfully people just made it ineffective by creating obvious dummy accounts.

    Workers rights in the US much like consumer rights aren’t that great compared to other nations. Unions are trying hard to make a big come back but are being hard fought. There are big companies that continue to illegally union bust that aren’t held accountable at all.

    Companies do not need this to remain competitive and survive. They need this to maximize profits. Please consider these types of issues when you vote and write your representatives about these things going forward.


  • In I’d say the first 10 years in my adult career, I definitely hated that. At about the 10 year mark I changed my entire perspective on things. I just changed to the mindset that employment is a two way business decision. I knew that I could leave at any time and I know they can make me leave at any time. So, I became much more independent. I make my own meetings with others when I feel I need to. I only attend meetings I feel like matter, which cuts a lot of them out. I do great work and I specifically build relationships with everyone I interact with. In all of my positions at all of the companies and projects I’ve worked on, I basically cut my manager out of everything. I set my own boundaries and make my own decisions. I will not do something that I don’t want to do. I will not work hours that I don’t see as reasonable for whatever I’m doing and I will have a good work-life balance.

    My job has been threatened from time to time but I just shrug and say “that’s your decision but it doesn’t change mine” but I usually have a great reputation everywhere for being the guy that can ‘do anything’ and ‘get it done’. I’ve had directors and once a VP force a rewrite of my manager’s performance of me because I basically tell them I’ll just leave if my performance rating isn’t what I expect it should be from what I produce. It takes about 6 months, sometimes a little longer at a new place to get that sort of political capital for me.

    Basically, taking control of my own work-life has made me a lot more money, given me a much better work-life balance (I rarely work over 40 hours a week) and has made my actual time at work much more productive and enjoyable. I’ve empowered myself and it is fucking great.

    Most of your direct managers aren’t really going to let you go (except perhaps mandatory lay-offs) if you’re very productive because you’re effectively making them look good and advancing their career. If they do, then fuck’em, you shouldn’t be there anyway because you’ll always be held back and treated poorly for your efforts. You don’t have to actively search for jobs always but shooting your resume out to places from time to time, especially as you build your professional network can be very beneficial. If you have a good offer, demand they match it somehow – either in money or benefits of some type. If they don’t then just take the offer.

    When management knows that you can and will leave and you’re productive, it changes the whole dynamic for you at work.

    I know some people take the opposite path and do the bare minimum they have to in order to keep the job but I think having control over what you are doing, when you are doing it and having actual leverage in negotiating your pay whenever is much better for you. When they know you don’t need them, they’ll pay you better and just let you do your thing. The 80/20 || 90/10 (depending on how mismanaged your org actually is) rule is real. Be one of the 10 || 20 and show them you know it.