codelitt

You still can't login to the system. Root login is disabled as well as password authentication. The root password is just in case you lose your sudo password but it doesn't provide you a way to login if you don't have your key, passphrase to your key, access to the static IP/VPN and device with 2FA.

Get a PW manager instead. No passwords should be stored in your head (because every one should be different) and they should be stored behind encryption -- definitely not plain text nor sticky notes.

http://keepass.info/download.html

I mention Ansible and other tools in the article. The idea, as others have mentioned, is to teach a man to fish. You're much better off with having an automated way to perform this, but you shouldn't ever run anything automated that you don't understand.

We'll release an Ansible Playbook over the next week or so that follows these steps.

Someone on /r/netsec rightly pointed out that you shouldn't ever add a user directly to sudoers anyways. You should add them to the sudo or wheel group. I've since updated the article.

What I've described is a more of a base, but according the Principle of Least Privilege you could go even one step further and do what you're suggesting. You'd probably want to have a couple of users though. An admin user, a deploy user, and a maintain user all with different privileges.

Great! Thanks for the answer.

Ooo. Fair point. I'll add that now and link to your comment.

So it looks like from the `passwd` man page that `-l` locks it, but doesn't actually remove it completely? I wonder if there are any disadvantages to this.

It depends on your VPS, but many give a root password by default.

I do make sure later in the article that `/etc/ssh/sshd_config` does not allow root login:

    PermitRootLogin no

But you make a good point that a simple solution is just having no root password at all. If your VPS does have a root login by default, then I believe you can get rid of it with:

    sudo usermod -p '!' root

The best part about sharing things like this is getting all sorts of great info and input on things.

Thank you for the notes. I'm on the go right now so sorry for the short reply, but I agree with what you've said. This was more of a primer with some hope to quickly explain the basic steps and what they were doing to younger engineers who don't have a ton of experience with it.

RE ssh note: That's the second time someone has linked it to me. It looks really good. I haven't had a chance to read it yet though. Will do.

Also good reading is: https://en.wikipedia.org/wiki/Principle_of_least_privilege

Out of curiosity, how does it compare to fail2ban?

Yes. You should still keep your eye out on patches. If a big vulnerability gets patched requiring a reboot, you'll want to attend to the upgrades yourself.

Yes. We originally just put this together just as a primer for younger engineers to understand the basic steps. The guide you posted looks really good though. It looks like it covers some of the application side of things as well.

Hahaha great quote.

I haven't seen this article before. It looks quite good. Thanks for posting it.

Codelitt Incubator | Miami | Full-time | ONSITE / REMOTE (US or LATAM)

Position: Full Stack Engineer (Ruby, Javascript, bit of Go, and quite a few other technologies that you can work on if you're interested in branching out - we like to keep people working on stuff that excites them). Not having a lot of professional experience is okay, but you should have some open source contributions. We're looking for smart people who solve problems regardless of background/education.

Projects you'll work on: A crypto trading platform, several new POCs, and new R&D projects.

Contact: cody@codelitt.com and vincent@codelitt.com

Job description and about us: https://angel.co/l/MB9LZ

Joel Test: Score an average of an 11/12. Working to get that 12th.

We build a ton of products and use a ton of technology across the web, mobile, machine learning, robotics, and AI. We have a great team, a profitable company, a great culture, and we'd love to hear from you.

I said this in a reddit thread[1], but I really just have a philosophical aversion to this. The industry has moved forward because of open source code. If I come up with a great algorithm, it is in my best interest to share it with others, have it improved upon, and contribute to the community. What if something like quick sort were only available if I paid someone for the snippet/service?

I might pay to use a service that allowed an implementation not in my projects language (and it's faster, I can't be bothered to write it, etc), but close sourcing or licensing of algorithms seems to go against the entire ethos of the community.

Especially in the wake of Oracle v Google and the implications that it could have on APIs, I really think to purposefully close off algorithms is just another step in a really bad direction.

[1]: https://www.reddit.com/r/ruby/comments/4k4fpr/algorithmia_no...

Here's an article including first hand account and quotes from Moxie: http://news.softpedia.com/news/wire-drops-lawsuit-alleging-e...

IMHO, no credence should be given to lawsuits and accusations made without proof and right before OWS integrates with two huge partners. The accuser even filed a voluntary notice of dismissal with prejudice. Accusations without proof are just mudslinging.

Moxie has a great track record; the burden of proof is on the accuser, not the defendant.

Codelitt Incubator | Miami | Full-time | ONSITE / REMOTE (US or LATAM)

Position: Full Stack Engineer (Ruby, Javascript, bit of Go, and quite a few other technologies that you can work on if you're interested in branching out - we like to keep people working on stuff that excites them). Not having a lot of professional experience is okay, but you should have some open source contributions. We're looking for smart people who solve problems regardless of background/education.

Projects you'll work on: An existing SaaS product, several new POCs, and new R&D projects.

Contact: cody@codelitt.com and vincent@codelitt.com

Job description and about us: https://angel.co/l/MB9LZ

Joel Test: Score an average of an 11.5/12

We build a ton of products and use a ton of technology across the web, mobile, machine learning, robotics, and AI. We have a great team, a profitable company, a great culture, and we'd love to hear from you.

A few others to test out:

- https://www.houndify.com/

- http://api.ai/

- https://wit.ai/

Thank you so much for your reply. I'll have a look at the plugin_weather and see how that one works.

Regarding the neural net, I think that's an important feature because the most difficult part about guessing triggers is, well, guessing. Our language is awfully diverse and I think you'll get better results in the long run.

I've applied for membership to the mailing list. I'll keep my questions there.

This is really interesting hellcow. You've done an impressive amount of work on this.

I just wanted to ask about the intelligence built into the bot. I dug through the code a bit (great documentation btw) and it seems that this is using a state machine you've written and custom plugins for different scenarios. How would one account for situations were a case keyword in a plugin is used in a different context? Say for example, I ask "What street number did you say?" to the bot with this plugin^1. It seems that these are items that would trip it up?

Also these bots would not "learn" or get better over time without direct human input correct?

I hope these don't sound like critiques. They're not. Just generally curious about how all of this is put together - particularly the state machine and then also how the plugins can be built (and improved).

[1]: https://github.com/itsabot/plugin_restaurants/blob/master/re...

Thank you for the link. That's good to know, however, as you alluded to sometimes it's not possible to alert users.

In that vein, end-to-end would protect those users even if you can not alert them. Your hands are tied with something like PGP because you couldn't access it even if you wanted to. Someone mentioned your end-to-end extension. Will you be releasing end-to-end to the Web Store soon? Or some other killer end-to-end solution?

We disagree in opinion. I'm advocating for what I feel to be important in security and privacy and you are advocating for ease of use and features. It's not stupid, just we have different priorities.

Not completely useless. Just doesn't go far enough.

And you'll notice it's conveniently not in the Chrome Web Store (where the average user can easily install it). It's better than nothing, but it is a bit transparent to have this tool yet not release it into their Web Store (or even better standard in Chrome).

I do remember reading about that with Twitter, however, I have not read about it with Google.

For most people you're right. But that seems like just the type of challenge a billion dollar company could tackle. :)

You're right. Governments of any country could target any user. My point was, they make a point of saying "attackers" which is not synonymous with the data they release due to government requests (which is likely a more worrisome concern).

They're alerting you of "attacks" to obtain your data, but not necessarily government requests for your data.

This seems like much ado about nothing.

I certainly appreciate the effort is better than nothing, however, how often are those notices served to US/European citizens? It's one thing to stand up to government overreach in foreign countries, but how about the country where you (and a large percentage of your users) reside? They specify attackers, but I'm assuming this notice to the end user does not apply to the US/EU governments requesting your data and them complying?

Another gripe I have is that TLS has probably been broken by the NSA^1. It's better than nothing to alert us about the other party not using it, but really provides limited protection. PGP/GPG is really the only assurance you have and the plugins for different desktop apps are nearly always buggy. I end up just manually encrypting/decrypting with GPG because a buggy encryption integration is not a comforting thought. If they really cared about keeping your privacy safe, they'd have an end-to-end encryption tool/integration.

[1]: http://blog.cryptographyengineering.com/2013/12/how-does-nsa...

I don't believe we are that close to running out though, are we?

Using the number scheme, this person calculated^1 that (assuming Amex starts issuing 16 digit cards) there would be 3*10^14 + 10^11 or 4.001e+14 possible combinations.

[1]: https://www.reddit.com/r/theydidthemath/comments/3wj8eb/requ...