Just your normal everyday casual software dev. Nothing to see here.

  • 0 Posts
  • 12 Comments
Joined 11 months ago
cake
Cake day: August 15th, 2023

help-circle
  • Seconding this, I took the plunge a month or two back myself using proxmox for my home lab. Fair warning if you have never operated anything virtualized outside of using virtualbox or Docker like I was you are in for an ice Plunge so if you do go this route prepare for a shock, it is so nice once everything is up and running properly though and it’s real nice being able to delegate what resource uses what and how much, but getting used to the entire system is a very big jump, and it’s definitely going to be a backup existing Drive migrate data over to a new Drive style migration, it is not a fun project to try to do without having a spare drive to be able to use as a transfer Drive


  • TPM is a good way, Mine is setup to have encryption of / via TPM with luks so it can boot no issues, then actual sensitive data like the /home/my user is encrypted using my password and the backup system + fileserver is standard luks with password.

    This setup allows for unassisted boot up of main systems (such as SSH) which let’s you sign in to manually unlock more sensative drives.



  • I fully agree, a project should have as little ties to illegal content as it can, and yes the current system goes off of current legal law or at least how the judge/Jury interpret it. And that’s where a lot of this issue comes to play.

    It’s quite clear in existing law that you are legally allowed to reverse engineer a piece of equipment that you have physically purchased, there is no argument on that. The issue occurs when you are reverse engineering something that has DRM because at that point you were breaking a security standard. This is also why most emulators are legal however ROMs are not, because while it’s completely legal to reverse engineer a switch for example, the ability to bypass the DRM on the game itself in order to play the game is breaking a security standard which is not referenced in existing laws or backup laws.

    This, in my opinion is the biggest issue with current laws, it makes no sense for me to be allowed to make a digital Archive of something that I have, but not be allowed to circumvent the security on the item itself in order to actually use the archive. Due to this it also means that ripping 4K and Blu-ray discs also are breaking a DRM which means you are legally not allowed to make a digital copy of movies that you own. Which directly contradicts the intent of these laws.

    Of course I’m talking about in the US, other countries have a more lapse ideology for a data retention and archival purposes. Maybe someday as the younger Generations get older they will reapproach current dmca and copyright law and give exemption for personal use to allow breaking DRM, but until that happens expect every emulator is going to have this same exact claim every time


  • I don’t see how that is the Yuzo teams problem though, it’s the same argument people use with firearms, just because the emulator can be used to emulate contribute piracy doesn’t mean that it was made with the intent to. How would you recommend the Yuzo team actively block non-released games/restrict it down to only legal use? They used the telemetry data that they recieved to better improve their own platform, honestly it doesn’t really matter what that data is. The issue is fully at the user who used the tool illegally, not the developers of the tool.

    God I hate current copyright law, in my opinion they need to do seething similar to the legal systems “when acting as an official” law and just have them exempt from copyright/privacy suits. This happens with every emulator and it’s generally used as a scare tactic to make the devs close shop.


  • I just expanded the existing fail2ban config on the commonly used default ports such as 22, 21 Etc, any requests on those ports get sent into purgatory, so the ip gets blacklisted any connections from it hangs until it times out. It’s a super basic setup iptables logs whenever a request is not in the current firewall (last rule in the chain) and then fail2ban reads the log and handles the block. I don’t count it as part of the normal setup because they’re isolated Because the actual ports the service is on still have the normal rule set but the default port numbers are just an instant if there’s activity on it you’re gone


  • My security is fairly simplistic but I’m happy with it

    • software protection

      • fail2ban with low warning hold
      • cert based login for ssh (no password Auth)
      • Honeypot on all common port numbers, which if pinged leads to a permanent IP ban
      • drop all firewall
      • PSAD for intrusion/scanning protection (so many Russian scanners… lol)
      • wireguard for VPN to access local virtual machines and resources
      • external VPN with nordVPN for secure containers (yes I know nord is questionable I plan to swap when my sub runs out)
    • physical protection

      • luksCrypt on the sensitive Data/program Drive ( I know there’s some security concerns with luksCrypt bite me)
      • grub and bios locked with password
      • UPS set to auto notify on power outage
      • router with keep alive warning system that pings my phone if the lab goes offline and provides fallback dns
    • things I’ve thought about:

      • a mock recovery partition entry that will nuke the Luks headers on entry (to prevent potential exploit getting through grub)
      • removing super user access completely outside of local user access