Onno (VK6FLAB)

Anything and everything Amateur Radio and beyond. Heavily into Open Source and SDR, working on a multi band monitor and transmitter.

#geek #nerd #hamradio VK6FLAB #podcaster #australia #ITProfessional #voiceover #opentowork

  • 2 Posts
  • 20 Comments
Joined 4M ago
cake
Cake day: Mar 04, 2024

help-circle
rss
How much should an organisation reveal about a data breach?
There is a growing trend where organisations are strictly limiting the amount of information that they disclose in relation to a data breach. Linked is an ongoing example of such a drip feed of PR friendly motherhood statements. As an ICT professional with 40 years experience, I'm aware that there's a massive gap between disclosing how something was compromised, versus what data was exfiltrated. For example, the fact that the linked organisation disclosed that their VoIP phone system was affected points to a significant breach, but there is no disclosure in relation to what personal information was affected. For example, that particular organisation also has the global headquarters of a different organisation in their building, and has, at least in the past, had common office bearers. Was any data in that organisation affected? My question is this: # What should be disclosed and what might come as a post mortem after systems have been secured restored?
fedilink

It’s an interesting question.

Perhaps I’m not devious enough, but the only impact I can see is insurance companies increasing your fees or denying cover.


I’ve been using Linux for near enough a quarter of a century as my main desktop and I haven’t regretted it yet.

Linux today is plenty easy to use today for a non-technical audience, runs with less resources, has global communities, comes in your language and it’s free.


The only reason that LinkedIn is doing this is money. Not yours, theirs.

By jumping through the hoops, you prove that you are you and suddenly your data is more valuable to people marketing on the platform.

Remember, LinkedIn is owned by Microsoft.


Here in Australia, they were attempting to force us to provide Government Photo ID on Airbnb several years ago, we stopped using them instead.

There’s a Know Your Customer (KYC) legislation that keeps being interpreted by numpties as requiring that they store these documents, rather than identify the user, create an account and dispose of the documents, which is making these companies rich hunting ground for infiltration by groups wanting to monetize personal data and provide identity theft services.


It’s right up there with random requirements to upload government photo id to suppliers in a different legal system. Hard Pass.

(I’m looking at you, PayPal, Airbnb and Stripe)


OMG!

That’s sensational! Thank you so very much!


I created some buttons with Tasker that log my desired entries into a seperate calendar which I download from time to time to analyse.


Given that this is in a thread about Microsoft Server, I’d recommend using Debian as the distribution to replace Microsoft Server.

If you want a desktop, I’d start with a LiveCD version and familiarise yourself with the various available distributions on offer.

The intent of a LiveCD is essentially to boot into Linux without modifying your hard-disk and keeping your existing OS unchanged.

I’ll note that many of these images are available for DVD or USB. Some will offer a mechanism to store data on your existing drive without wiping anything.

With USB drives being fast and cheap, you can also often use a LiveCD to install onto an external drive.

Finally, you can install a virtual machine on your computer and use it to run your Linux tests.


How do you trust a U2F key?
U2F keys can be purchased online for the price of a cup of coffee. They're being touted as the next best thing in online security authentication. How do you know that the key that arrives at your doorstep is unique and doesn't produce predictable or known output? There's plenty of opportunities for this to occur with online repositories with source code and build instructions. Price of manufacturing is so low that anyone can make a key for a couple of dollars. Sending out the same key to everyone seems like a viable attack vector for anyone who wants to spend some effort into getting access to places protected by a U2F key. Why, or how, do you trust such a key? The recent XZ experience shows us that the long game is clearly not an issue for some of this activity.
fedilink

I haven’t looked into it, I was just attempting to point out that disembowling a locked up piece of hardware is harder[1] than starting with a clean slate.


  1. But plenty of fun if that’s what you’re interested in. ↩︎



It’s unsurprising that the information is version dependent, since the manufacturer will be doing everything in their power to prevent their hardware being used for purposes other than envisioned by their marketing team.

The basic process is to determine if the version you have has been modified by the community and then if it is, collect the information specific to your version.

It’s non trivial because not everyone takes copious notes or uses the same methods or processes as anyone else.

You’ll likely find contradictory information and search engine search results have likely been affected by DMCA takedown notices.

In other words, YMMV.

The alternative is to buy something that is already open source and intended to be modified, like a raspberry pi for example.


I’m not sure what information you are working from, but these links appear to say something different:


I’m unsure why you think that Linux mitigations should apply to OpenBSD.

A different approach is to use a version of an OS that is read-only (immutable).

I noticed that you didn’t mention ChromeOS.

Edit: Added immutable, couldn’t think of the word.


I have no idea, never used those.

I like Focus as my main browser because it essentially is Firefox without all the bells and whistles.



I went with a Nokia X20. It has standard android, no extra cruft and comes with a guaranteed three years of updates, as opposed to the Google device that was considered obsolete after six months.

It’s not waterproof, but that was the only feature I gave up. Cost half of my previous “flagship” phone.

No doubt there is a newer version of this device available today.


I love the notion. The marketing “better than DDG” is a little janky. Perhaps consider a positive statement, like “finally find what you’re looking for”.

This is a crowded landscape. I’ve been here since Gopher and seen plenty of services come and go. With that in mind, here are some questions you might want to consider:

How does it compare with products like SearXNG, specifically their ecosystem of plug-in search types?

How do you plan to pay for it?

How do you expect to protect the index against spam?

How will you scale it to a global audience?

How will you handle language?

Good luck!


I would ask their support team that question.


I do not believe that is true, but I’m happy to be wrong.


While the post you link to is new to me, thank you for sharing, the underlying issues associated with running your own instance are what has stopped me from running my own at this stage.

If the only person on your own instance is you, then none of this really matters, since you are the master of your own destiny. As I understand it, the GDPR doesn’t apply.

The moment you let anyone else create an account however, there’s a liability. You become exposed to whatever they say in their account on your instance and other laws start applying.

What I mean by that is as I understand it, any illegal or undesirable activity conducted by an account holder on something you control becomes a legal minefield for you. And you’ll be stuck in the middle between the account holder and the world. Things like the GDPR may apply, but that likely depends on their location.

So, if your instance is just you, no need to delete it. If it’s more, then I’d be thinking long and hard about who else is there with you.

Finally, consider the implications of taking money from account holders to finance your instance, now there’s a financial contract between you and them.