• 0 Posts
  • 71 Comments
Joined 2 years ago
cake
Cake day: August 15th, 2023

help-circle


  • Effort vs Reward vs Ability vs Inital investment

    In most cases, think of this kind of thing like a legitimate business. Same concepts. I’ll grade a few scenarios based on what I have seen over the last 20 or so years. (The ratings are arbitrary and just trying to explain my point.)

    Do you have the means to rent a botnet and phish a few million people for lots of credit card numbers? Can you manage that kind of data, test all those numbers and maybe end up just selling that data? Low Risk/Moderate Reward (“Selling shovels” analogy is probably a better scheme than actually renting the botnet, IMHO)

    Could you setup a “call center” in India and run a scam ring like an 8-5 business? Are there enough people you can hire to do this work? That requires training, infrastructure and time. You also may need to “work with” law enforcement to ensure your scam isn’t busted by legitimate cops. Moderate Risk/Moderate Reward.

    Are you part of a small group with an insane amount of skill that has the time to pull off an extortion scheme against a Fortune 500 company for a few million bucks? High risk/High reward

    Those are all normal scenarios above and it’s based on profitability and initial investment. Risk/Reward is always a balance.

    (Sorry. I pulled a “wHellll aKshUallY” when you said it’s not worth the time for the small targets.)


  • If it’s more formal, you don’t say anything. In almost all cases where someone would be tempted to lie, I should already know what the correct information is before I even asked a question.

    In less formal situations, I would just keep asking follow-up questions. Lies are generally very shallow.

    Edit: My point is that there are methods to call someone out without actually making direct accusations. Accusations are “hostile” and not generally worth derailing a meeting for something that can be dealt with later.




  • Alumina (aluminum oxide) is what you are extracting from aluminum ore and tough as fuck, which is why it’s easier to dissolve the rest of the stuff around it first.

    Oxygen is mainly that other “junk” you have to separate with electricity. While the smelters only run at 4.5 volts (per cell), they have to push about 300kA to get the stuff up to ~950°C which breaks its chemical bond.

    You probably have never even touched pure aluminum before. Aluminum and oxygen react so quick, all we typically ever see and touch is a alumina shell.













  • remotelove@lemmy.catoSelfhosted@lemmy.worldSecrets
    link
    fedilink
    English
    arrow-up
    5
    ·
    edit-2
    3 months ago

    I would look into something like Doppler instead of Vault. (I don’t trust any company acquired by IBM. They have been aquiring and enshittifying companies before there was even a name for it.)

    Look into how any different solutions need their keys presented. Dumping the creds in ENV is generally fine since the keys will need to be stored and used somehow. You might need a dedicated user account to manage keys in its home folder.

    This is actually a host security problem, not generally a key storage problem per se. Regardless of how you have a vault setup, my approach here is to create a single host that acts as a gateway for the rest of the credentials. (This applies to if keys are stored in “the cloud” or in a local database somewhere.)

    Since you are going to using a Pi, you should focus on that being a restricted host: Only run your chosen vault solution on it. Period. Secure and patch it to the best of your ability and use very specific host firewall rules for minimum connectivity. Ie: Have one user for ssh in and limit another user account to managing vault, preferably without needing any kind of elevated access. This is actually a perfect use case for SELinux since you can put in some decent restrictions on the host for a single app (and it’s supporting apps…)

    If you are paranoid enough to run a HIDS, you can turn on all the events for any type of root account actions. In theory once the host is configured, you shouldn’t need root again until you start performing patches.