_wldu

As an aside, those same low-level remote management tools are used by cyber actors (criminals and governments) to compromise entire organizations with ransomware and other malware. That's the real reason ransomware is such an issue today.

If corporate systems were stand-alone/isolated, we probably would not have this problem to the extent that we do.

The most secure way to do this would be to run Qubes OS [1] and use a qube dedicated solely to your software development. You can do your random web browsing and other risky Internet based things (such as email) in other qubes (not your dev qube). IMPO, isolation is really the best defense we have against modern attacks (supply chain, water hole attacks, whale phishing, etc.)

Hope this helps.

[1] - https://www.qubes-os.org/

$HOME/bin is useful as well. I like that I can have my own software (that I wrote and compiled) in my home folder and don't need to ask a sys admin to install it for me.

Assuming you are a US citizen, you likely have no need to worry about FVEY [1] targeting you unless a judge has been convinced you are a very bad person and issues a warrant.

You do have to protect against cyber-criminals and potentially other nation state actors like Russia, China, Iran and North Korea. These groups do not control infrastructure (like FVEY) and have a harder time targeting you. BTW, this is why FVEY are so determined to keep China out of 5G networks (they don't want to share).

To gain access to your things, these attackers typically rely on phishing emails and social engineering attacks. They try to convince your bank or cellular provider, etc. that they are you and then do bad things with, or to, your accounts.

The best protection against this is 2FA (Yubikeys and TOTP) and process isolation. Run a reasonably secure operating system (such as Qubes) to isolate your digital life. Be sure to do your online banking in a qube of its own separate from your email qube and your random web browsing qube. And avoid phone or email based 2FA when you can.

That's about it. If you do that, you'll probably be fine.

[1] - https://en.wikipedia.org/wiki/Five_Eyes

SSH certificates are useful in large environments when scaling, automatic onboarding and offboarding are important, but IMO, small teams can (and should) continue using authorized key files as they have for years. They don't really need these features.

I wonder if the OpenBSD team would be open to Go or Rust implementations?

Yes, putting every device in Windows AD and installing remote management tools that run at the system level is a recipe for total compromise.

Software diversity is good. Remotely controlled mono-cultures are bad. IT management and security compliance people need to understand this.

I liken the mindset of (only we will use the remote control software to do good things) to Encryption back doors (only law enforcement will use them to catch criminals). Computer scientists call these 'Exceptional Access Systems' and it has been shown (many times) that it is impossible to ensure they will not be abused and used against you.

Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications:

https://dspace.mit.edu/handle/1721.1/97690

A lot. Pen tests, red teams, simulations, etc.

The point is, if they want someone poking around these systems, they'll contract with them to do that. You should not tamper with them just out of curiosity. Convicted felons have a hard time finding jobs.

Gas stations are probably considered 'Critical Infrastructure' by the US government as they are part of 'Transportation Systems' infrastructure. Tampering with their computer systems (even just out of curiosity) is probably a bad idea.

https://en.wikipedia.org/wiki/Critical_infrastructure

You could end up with a felony conviction.

Relevant blog post 'Now They Have 2FA Problems':

https://www.go350.com/posts/now-they-have-2fa-problems/

I believe man -k just runs apropos.

apropos first then man second.

Some people seem to be unaware of apropos too (old text based cli tool).

    $ apropos network
    interfaces (5)       - network interface configuration for ifup and ifdown
    aseqnet (1)          - ALSA sequencer connectors over network
    byteorder (3)        - convert values between host and network byte order
    ctstat (8)           - unified linux network statistics

Go has maps already. A set is just a map where the key and value are the same thing.

End user convenience.

Having been a CISO, I would also add that this really depends on the company.

Some companies want to be technically secure (Google, Facebook, etc.), others want to be compliant to regulations (do the basics, check the box and move on) and a few just want to have a figure head for IT security to fire when things go wrong. So finding the right company that fits you and understanding their culture is important.

If you are hardcore CS/ECE and very technical, you'll want to work for the first type of company. If you did business/management/audit then perhaps the second type of company. I would not encourage anyone to work for the third type.

Just my personal opinion. Hope it helps someone.

bcrypt, scrypt, argon2 or any other reasonably strong password hash will not be cracked in a few days (unless the passwords are simple dictionary words).

I find it hard to believe that Huawei does not use version control. No company is perfect, but surely software developers (at a multinational company) with advanced degrees in CS and ECE are using version control.

It's a tunnel into your internal network.

If nation states and/or cyber criminals do control most of tor, then you are opening your internal network to those groups.

That's sort of like having backdoor access to your internal network (similar to teredo). Others may use it to gain access to that network. If it's your home, that may be OK to you, but if it is an employer, you may want to obtain approval to do that and be sure all of your hidden services use keys or strong passwords for access.

Relevant blog post: https://www.go350.com/posts/now-they-have-2fa-problems/

Yes, and I believe they initially made this change in June 2017 (almost 5 years ago now). IT audit/compliance is typically 5 to 10 years behind best security practices and some standards are even slower to catch up.

Organizations may use ADK (additional decryption key) when they want to access what users are emailing to each other (for compliance/security reasons). It can be done with vendor provided software or manually. Here is a short description of how it works:

https://www.go350.com/posts/age-file-encryption/#additional-...

Find a system or a piece of software, use it a lot (look at source code if you have it) and then ask yourself how you can break it. That's the key to becoming a great hacker.

If you don't understand a piece of software (and I mean really understand it) you probably can't break it in a meaningful way. You may accidentally break it, but your lack of understanding how it actually works will prevent you from further exploiting it.

Just my 2 cents. Hope it helps.

I agree and anything above the OS layer can be written in Go or Java or C#. Lots of those devs out there to hire.

Yes. Mutual TLS. But that involves certificates, potentially CAs, dealing with certificate expirations and other PKI formalities. Any user can generate an Ed25519 key pair, base64 encode the public part of the key and register that with websites. It's more informal than TLS certificates and totally user controlled.

I do use TLS client certificates (with several APIs) but I don't consider them as password replacements (which is the goal of ed25519-login).

I'm currently experimenting with Ed25519 signatures in place of passwords for website authentication:

Git repo: https://github.com/62726164/ed25519-login

Test website: https://gen.go350.com/

I plan to write an Android and iOS app (someday) that has the same functionality as ed25519-login. We need to go password less, but the complexity of webauthn is too much IMO.

I'm looking for feedback and appreciate any suggestions.

Every time I call a plumber it's a least 600 USD. I have learned to do many things myself such as rebuild the innards of toilets, repair broken drain pipes, install sinks and new drain lines, but some things are too much for me (don't have the time, tools or knowledge).

I just had an old 2 inch steel drain pipe descaled ($600) because it was causing the washing machine to backup and overflow. I had had it power cleaned/jetted before (several times) but that did not work. The rust corrosion had constricted the pipe to about 1.25 inches. Descaling seems to have really opened it up.

I used to hate drywall. It would get wet and need replacing after plumbing problems, but I recently came to realize that as messy and time consuming as drywall is to replace, it's a good thing because it allows you to spot water leaks early and absorbs a lot of water. A more water resistant surface would hide the problem and only allow it to grow much bigger before someone noticed it. If you have enough space, drop ceilings are the best thing since sliced bread.

Also, when you are not using your washing machine, turn the water off at the wall. That will prevent a washer water line bursting (while everyone is at work) and ruining an entire room/floor of the house. And when you buy replacement water hoses for your sinks and washing machine, buy the best you can afford and replace them every 3 to 5 years. You'll save yourself a lot of money and trouble by doing this.

If you ever own a house, you'll learn to fear and respect water (and chipmunks) more than anything else.

George was the first graduate of the program.

Georgia Tech is consistently ranked a Top 10 CS program (worldwide) and their OMSCS program now accounts for 10% of all MSCS degrees issued. It costs about 6,000 to 7,000 USD total:

"OMSCS started in January 2014 with 380 students. Enrollment increased each semester (excluding summer terms). In 2019 I believed that we were very close to the peak, since we are graduating more and more students. But then, the pandemic hit and we have kept growing every semester. This spring term we just passed a new mile stone – we have over 12,000 students, 12,016 to be precise. We might be at the peak or very close to it. Apparently, OMSCS is the biggest degree program, online or not in any subject in the US and probably the world. More importantly, the degree is of the same quality of the on campus program. We have 56 courses (we started with 5); several courses now have over 1,000 students. We graduated 1,970 in 2021 for a total of 6,470 so far. We are graduating in a year well over 10% of the number of those that graduate with MS in CS in the US." - Zvi Galil

Online, Cheap and Elite: https://www.insidehighered.com/digital-learning/article/2018...