• 1 Post
  • 125 Comments
Joined 2 years ago
cake
Cake day: August 15th, 2023

help-circle





  • Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.

    But hey! Change the world, amirite?



  • remotelove@lemmy.catoSelfhosted@lemmy.worldSecrets
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    9 months ago

    I would look into something like Doppler instead of Vault. (I don’t trust any company acquired by IBM. They have been aquiring and enshittifying companies before there was even a name for it.)

    Look into how any different solutions need their keys presented. Dumping the creds in ENV is generally fine since the keys will need to be stored and used somehow. You might need a dedicated user account to manage keys in its home folder.

    This is actually a host security problem, not generally a key storage problem per se. Regardless of how you have a vault setup, my approach here is to create a single host that acts as a gateway for the rest of the credentials. (This applies to if keys are stored in “the cloud” or in a local database somewhere.)

    Since you are going to using a Pi, you should focus on that being a restricted host: Only run your chosen vault solution on it. Period. Secure and patch it to the best of your ability and use very specific host firewall rules for minimum connectivity. Ie: Have one user for ssh in and limit another user account to managing vault, preferably without needing any kind of elevated access. This is actually a perfect use case for SELinux since you can put in some decent restrictions on the host for a single app (and it’s supporting apps…)

    If you are paranoid enough to run a HIDS, you can turn on all the events for any type of root account actions. In theory once the host is configured, you shouldn’t need root again until you start performing patches.




  • I installed it and tried it on occasion, but it never worked for finding any coupons. It was the only extension I had that I kept disabled because I always thought it’s interaction with the browser and web pages was sus as fuck.

    TBH, it was more of a curiosity I kept around to explore one day. I also dissect and detonate malware a few times a week, so I just treated Honey as such.

    (That folder named “malware” on my computer is actually real. I pitty the poor soul who steals it thinking its just a joke to store my private data.)

    Unrelated: I finally got my first .SVG downloader today, actually. Whoever the fuck thought it would be a good idea to add a script tag to SVG needs to be put down.






  • Maybe. People with more technical knowledge should understand that LLMs aren’t magic or sentient and have some severe limitations. Hell, I have been tinkering with ML and ANNs for a better part of 15 years or so and they can be extremely useful. (I am no expert and never indend to be.)

    It’s the marketing wank, scams, art theft and all the bullshit that pisses me off now. In that regard, I am squarely in the “Fuck AI” category. There is absolutely nothing phenomenal that has come of this recent bubble in the commercial space. AI generated images are mostly trash, articles are riddled with gross factual errors, phishing and other scams are more realistic (and maybe even more dynamic) now and public forums contain even more annoying bots. And the worst bit is that AI generated media, like music, is just a collection of averaged values with no originality.

    That bell curve represents something but it isn’t IQ.