• 1 Post
  • 284 Comments
Joined 2 years ago
cake
Cake day: June 7th, 2023

help-circle



  • If the device is encrypted and single-user there is no good reason to require further login after the first.

    The reason is non-repudation. Ignoring the fact that the drive’s encryption should have been handled by TPM and not be bothering the user, the drive encryption password does not establish who is using the laptop, only that they know the unlock password. Unfortunately, those unlock password are usually centrally assigned and managed, which means that they are not something that only the user knows. Also, it doesn’t have a good second factor. If the laptop is stolen, there is nothing keeping an attacker out, if they know the password. Their account, on the other hand, should have a password only the user knows. Yes, central IT can reset the password, but this creates logs which show the reset and can be used to prove that the password was reset, and who reset it. And the user’s password can be backed up with a second factor. So, a stolen laptop isn’t an easy on-ramp to the organization’s network.

    As for logins after that, it gets harder to justify. OS, email and most web portal logins should be handled via SSO. For most users, this should mean that their drive gets decrypted via TPM, they type their password into the OS login prompt, deal with 2FA and that’s it. For users with admin access to stuff, there will be a separate login step when they need to elevate permissions, but that should largely be limited to IT staff and developers. For the original poster, it sounds like their organization’s IT is being run on a shoestring by someone who either doesn’t know or isn’t allowed to do it well.








  • I work remote and my work has a pretty loose policy on webcams for meetings. If you don’t want it on, don’t turn it on. That said, when I am presenting or speaking, I like to have my webcam on. I personally find that the level of engagement is higher for speakers with their camera on, and so I try to extend that back to the people I am speaking to. I also find that the inclusion of visual cues helps with communications.

    As for political spaces, my local congress person holds a regular townhall via telephone (not sure if she’ll keep this up if she wins the governorship this year) and I have never really felt the need to stare at her as she talks. I actually like the format as I can listen with my earbuds while doing something else. So, different situations can merit a different response.

    Honestly, I think some folks make far more out of using or not using a webcam than it really merits. For those of us who are more introverted, having a camera on us can make us feel self-conscious. Though, I think using the word “trauma” to describe this is being overly bombastic. At the same time, I think there are some folks for whom the visual connection with a speaker or listener is also important and the lack visual of feedback from the other participants in the conversation makes the conversation more difficult. It’s just another of those areas where we are each going to need to make a decision based on the particular conversation and context. Interacting with other people is messy and is going to involve some level of discomfort from time to time.


  • Most of the folks I talk to hear agree with me that things are going wrong

    That’s not surprising, though be careful on what the definition of “going wrong” is. For example, Emerson College recently put out the results of some polling part of which found that 67% of voters think the US is on the wrong track. It’s highly likely that 67% includes voters from all over the political map. But, while both a hardcore Trump/MAGA voter and a Bernie Bro voter might each say that the US is on the “wrong track”, we’d probably have trouble getting those two voters to reconcile on the color of the sky, let alone what the “right track” would be. Also, be wary of coworkers who actually just want to be left alone and will “go along to get along”. They will tacitly nod and agree with just about anything, so long as you go away and let them get back to work.

    or that x,y, or z is a problem, but not enough to do anything about it.

    Ok, but what is the ask? What are you expecting them to do? And why do you believe that they should be the ones doing it? Again, going back to my previous comment:
    Maybe they do care about your thing, but they have their own “most important thing” and if your thing and their thing are in contention, they are going to pick their thing.

    You may view things as so bad that everyone should be out in the streets protesting 24x7. They may not see it that way. They may put “protecting themselves” at a higher priority than protesting whatever it is you are upset about. This might be especially true if they have families to care for and that can drastically change how people prioritize things.

    Once again, I’d go back to understanding their beliefs and priorities. Why won’t they do the thing you want them to do? It probably comes down to those beliefs and priorities being more important to them than whatever it is you are promoting. And again, I would note your complete dismissal of their point of view. They have given you some insight as to why they aren’t taking action:
    " I want to do something, but I have to protect myself."

    It’s clear they prioritize their personal well-being over the perceived value of whatever you are asking them to do. Why is that? What is it that you are asking them to do that they see it as risky? If your goal is to organize something, can you work to provide them the perceived safety that would get them over that hump? Do they have other issues and their answer is just a proxy to avoid an argument? I’m afraid I’m just repeating myself here; but, you need to really understand them if you want them to change their minds.


  • The first thing I would ask is, have you made any attempts to really understand what motivates them and why they believe as they do? Given your flippant dismissal of their belief systems, I suspect you have just mentally bucketed them and, instead of really trying to understand them, you fall back on your per-conceived notions of what you think they believe. Without that understanding, you will never be able to “make people care”, because you are not treating them as fully formed people with their own beliefs and priorities. You expect that, if you just yell at them loudly enough, they will come around. They won’t and, if anything, they will just dig their heels in further. To them, you’re this guy:

    Not everyone has the same priorities you do. What you see as “the most important thing in the world” may fall much further down the list for someone else. They may not even see it in the same framing you do. Maybe they do care about your thing, but they have their own “most important thing” and if your thing and their thing are in contention, they are going to pick their thing. This is part of the reason we have politics in the first place, once you start dealing with other people and trying to decide what and how things should be prioritized and run, you are going to run into differing beliefs and priorities. It’s why most government polices generally suck and don’t get everything done. Because those policies are the result of compromise between people with different and often competing priorities. And yes, it may be that some of those other priorities come from bad information, though more often they will come from radically different base beliefs. And not understanding what those beliefs actually are means that you will not have any sort of basis for convincing them of anything.

    Changing peoples’ minds is hard. But, it starts from a place of understanding people and not dismissing their beliefs. Step back from your outrage for a moment and try to really get in their heads. You may not agree with their position, but you need to understand how they got there before you have any chance of getting them out of it. And, maybe you can’t. It may just be that they have some foundational beliefs which are completely at odds with what you want to convince them of. But, if you know and understand that, it becomes much easier to walk away from the situation and not waste time and energy on a hopeless fight. And while it feels good to yell at people, that basically never works and only serves to push them further away.



  • This is not speculation. Donald Trump was successfully impeached for inciting insurrection.

    Did you stop reading your link at the title? Literally the third sentence:

    On February 13, 2021, the Senate voted to acquit Trump on the article of impeachment.

    If you want to dig into the arguments about what is and isn’t legally insurrection and if the 14th Amendment is self executing or not, that is an interesting discussion. But, don’t lead with a “pants on head” stupid argument that the House passed Articles of Impeachment, for which the Senate acquitted him, as evidence that the 14th Amendment applies. Just fucking no.


  • My list of items I look for:

    • A docker image is available. Not some sort of make or build script which make gods know what changes to my system, even if the end result is a docker image. Just have a docker image out on Dockerhub or a Dockerfile as part of the project. A docker-compose.yaml file is a nice bonus.
    • Two factor auth. I understand this is hard, but if you are actually building something you want people to seriously use, it needs to be seriously secured. Bonus points for working with my YubiKey.
    • Good authentication logging. I may be an outlier on this one, but I actually look at the audit logs for my services. Having a log of authentication activity (successes and failures) is important to me. I use both fail2ban to block off IPs which get up to any fuckery and I manually blackhole entire ASNs when it seems they are sourcing a lot of attacks. Give me timestamps (in ISO8601 format, all other formats are wrong), IP address, username, success or failure (as a independent field, not buried in a message or other string) and any client information you can (e.g. User-Agent strings).
    • Good error logging. Look, I kinda suck, I’m gonna break stuff. When I do, it’s nice to have solid logging giving me an idea of what I broke and to provide a standardized error code to search on. It also means that, when I give up and post it as an issue to your github page, I can provide you with some useful context.

    As for that hackernews response, I’d categorically disagree with most of it.

    An app, self-contained, (essentially) a single file with minimal dependencies.

    Ya…no. Complex stuff is complex. And a lot of good stuff is complex. My main, self-hosted app is NextCloud. Trying to run that as some monolithic app would be brain-dead stupid. Just for the sake of maintainability, it is going to need to be a fairly sprawling list of files and folders. And it’s going to be dependent on some sort of web server software. And that is a very good place to NOT roll your own. Good web server software is hard, secure web server software is damn near impossible. Let the large projects (Apache/Nginx) handle that bit for you.

    Not something so complex that it requires docker.

    “Requires docker” may be a bit much. But, there is a reason people like to containerize stuff, it avoids a lot of problems. And supporting whatever random setup people have just sucks. I can understand just putting a project out as a container and telling people to fuck off with their magical snowflake setup. There is a reason flatpak is gaining popularity.
    Honestly, I see docker as a way to reduce complexity in my setup. I don’t have to worry about dependencies or having the right version of some library on my OS. I don’t worry about different apps needing different versions of the same library. I don’t need to maintain different virtual python environments for different apps. The containers “just work”. Hell, I regularly dockerize dedicated game servers just for my wife and I to play on.

    Not something that requires you to install a separate database.

    Oh goodie, let’s all create our own database formats and re-learn the lessons of the '90s about how hard databases actually are! No really, fuck off with that noise. If your app needs a small database backend, maybe try SQLite. But, some things just need a real database. And as with web servers, rolling your own is usually a bad plan.

    Not something that depends on redis and other external services.

    Again, sometimes you just need to have certain functionality and there is no point re-inventing the wheel every time. Breaking those discrete things out into other microservices can make sense. Sure, this means you are now beholden to everything that other service does; but, your app will never be an island. You are always going to be using libraries that other people wrote. Just try to avoid too much sprawl. Every dependency you spin up means your users are now maintaining an extra application. And you should probably build a bit of checking into your app to ensure that those dependencies are in sync. It really sucks to upgrade a service and have it fail, only to discover that one of it’s dependencies needed to be upgraded manually first, and now the whole thing is corrupt and needs to be restored from backup. Yes, users should read the release notes, they never do.
    The corollary here is to be careful about setting your users up for a supply chain attack. Every dependency or external library you add is one more place for your application to be attacked. And just because the actual vulnerability is in SomeCoolLib.js, it’s still your app getting hacked. You chose that library, you’re now beholden to everything it gets wrong.

    At the end of it all, I’d say the best app to write is the one you are interested in writing. The internet is littered with lots of good intentions and interesting starts. There is a lot less software which is actually feature complete and useful. If you lose interest, because you are so busy trying to please a whole bunch of idiots on the other side of the internet, you will never actually release anything. You do you, and fuck all the haters. If what you put out is interesting and useful, us users will show up and figure out how to use it. We’ll also bitch and moan, no matter how great your app is. It’s what users do. Do listen, feedback is useful. But, also remember that opinions are like assholes: everyone has one, and most of them stink.


  • It’s not nice as something to target, but it makes sense. Employment is about more than just straight money. When evaluating an employer, I consider everything from the top line salary, to benefits, work culture, work life balance and work environment. The non-tangible factors can mean that I would be willing to take a lower salary. That is why companies will do things like decked out rec rooms or the like. And ya, I might consider a lower salary to be part of something I love or believe in. E.g. If NASA were looking for remote cybersecurity workers, I might consider a lower salary that I would get elsewhere, just to get to be part of NASA.

    Employment is a negotiation between you and your employer. And while I do think technical folks could really use a trade union (something like the IBEW for electricians), for now you have to represent yourself and make sure you get what you are worth. And this might mean not working on the thing you are really passionate about. Especially if the people in charge of it are a bag of dicks.



  • I was lucky that, despite being somewhat religious, my parents were fine with me being an atheist. We would even debate the merits of religion and they did not have any issues with my questioning of their beliefs. Both were Lutheran and they had raised me in that tradition. I went to Sunday school, attended the Lutheran Catechism and reached the point of Confirmation. And that was right about the time I realized that the whole thing seemed to be based on a bunch of old stories with no more evidence than elves or faeries. And that was always the crux of my issue with their religion, and one they could never argue past.

    When it came to my kids, they have been raised with my complete lack of belief and my wife being agnostic. We spend our Sunday mornings sleeping in and not going to any sort of church/temple/forest altar. Though, that last might happen, if it’s ruins at the end of a nice hike. My parents never expressed any disapproval and the lack of religion was never an issue. Technically, my mother is still kicking about and could suddenly go off the deep end, though I strongly doubt that’s in the cards.

    At the same time, my wife and I had discussed religion before we had kids and what we might do in the event it became an issue. The simple answer was, “fuck 'em”. I love my parents, but my kids come first. If my parents had decided to get stupid over us not indoctrinating our kids in their fairy tales, then I would have just removed them from my life a few years before death did it anyway. Sure, it would have meant the kids never knowing their grandparents. But, there are lots of assholes in this world, I don’t see the need to personally inflict them all upon my children.

    The best thing you can do is talk to your partner and have a plan. I would say that, if you expect it to be a point of contention with your parents, you might want to talk with them about your views on religion before it gets to that point. It doesn’t need to be anything confrontational, just be up front and say, “I don’t believe what you do”. You don’t need to go on a Dawkins style, “your religion sucks and you are morons for believing it.” Just make it clear that you don’t believe. It’s still entirely possible to have a warm, loving relationship with folks who don’t believe as you do. It just requires that each side treats the other with basic human decency and respect.


  • I generally use the OS which fits what I am trying to do. For my desktop PC, I run Arch Linux as it lets me game, run VMs and have a high level of control over what the system is doing. The VMs are mostly Windows for testing stuff and one running Ubuntu as a host for PolarProxy. My server runs Ubuntu, though really just as a platform to host docker containers. That was a decision I made years ago when I knew a lot less about Linux and was looking for something which was more turnkey. My work laptop is Windows, because my work is mostly a Microsoft shop. But, I have WSL running both Ubuntu (for the SANS Sift framework) and Kali.

    An Operating System is a tool. Don’t get wedded to any one OS.