Father, Hacker (Information Security Professional), Open Source Software Developer, Inventor, and 3D printing enthusiast

  • 2 Posts
  • 57 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle





  • As someone who’s caught a leaker in the past (well, someone that was exfiltrating company secrets to a competitor) catching leakers is actually pretty easy if you have any modicum of control over the tools they use and the places they work. Barring that, no. Just no. It’s not going to happen.

    If a leaker is gullible and stupid some trickery is possible but I wouldn’t get my hopes up, Warner Music. Seems like a job that’s doomed to fail from the start. I wouldn’t even bother unless they know it’s just a job on paper and are actually just looking to give someone’s kid a legit-sounding job to pad their resume 🤷

    Not only that but if I were in charge of hiring I’d be extremely skeptical of any and all applicants. Anyone smart enough to do the job will know it’s impossible and will just become a master of stalling and picking low hanging fruit (aka useless) and everyone else is just a fraud.





  • This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.









  • Riskable@programming.devtoSelfhosted@lemmy.worldWhat's the deal with Docker?
    link
    fedilink
    English
    arrow-up
    81
    arrow-down
    1
    ·
    8 months ago

    Docker containers aren’t running in a virtual machine. They’re running what amounts to a fancy chroot jail… It’s just an isolated environment that takes advantage of several kernel security features to make software running inside the environment think everything is normal despite being locked down.

    This is a very important distinction because it means that docker containers are very light weight compared to a VM. They use but a fraction of the resources a VM would and can be brought up and down in milliseconds since there’s no hardware to emulate.


  • I work for a huge bank that’s investing a non-trivial amount of money (billions) in single family homes. They don’t plan to rent them out. They just want to own them.

    Now why would a huge, rich bank invest in something like that? Because they’re pretty sure they’re going beat inflation when they resell those properties later. It’s a very safe (if spread across the entire US and Canada) place to park money.

    It’s not a big deal if one or two banks do this or even a handful of private equity firms. However, when all of them do it at once (like they are now) it can have a major impact on the prices of single family homes. It also creates something called a, “systemic risk” but that’s a very large topic that I’m not going to cover here.

    The point is that yes: The big banks and big private equity firms (and 401ks!) all own way too much non-commercial real estate in general right now and their expansion into single family homes is a great big societal problem.

    …but why now‽ Why haven’t they been investing in huge swaths of single family homes since forever? I mean, they’ve been appreciating faster than inflation since forever with only a few minor hiccups (e.g. 2008). The answer is: It used to be much more expensive to maintain homes that don’t have anyone living in them.

    Back in the day most homes were unique. In any given neighborhood some homes might have gas heat while others had electric and some others used oil or coal! There were also more fire and flood hazards with more flammable furnishings/building materials and things like washing machine hoses would often just break after a certain amount of time (the seals were only good for like ten years).

    These days you have endless amounts of cookie cutter homes in enormous neighborhoods all over the damned place. They’re also built to vastly superior building standards and come with appliances and AC that are orders of magnitude more efficient than in decades past.

    This means a big bank or private equity firm can buy hundreds of houses in a region and (cheaply) hire a 3rd party to look after them. They just don’t need as much maintenance as they used to. They’re so much cheaper to maintain en mass.

    So how do we fix this problem? There’s all sorts of things you can do but some quick and perhaps unexpected things are:

    • Raise minimum wage and crack down on businesses hiring illegal workers doing house maintenance work (let them do construction 👍).
    • Raise property taxes in general. You could try to raise them for homes without people living in them but then you just end up creating other unintended consequences/problems (which I won’t get into to stay brief)
    • Force upgrades on unoccupied homes. Air conditioning system is 10 years old? You have to get a new one with improved efficiency. House has gas stoves? You have to replace those.
    • Force inspections of unoccupied homes and come down hard in regards to code enforcement (every unoccupied home poses a nonzero fire risk to every neighborhood).

    Basically, you have to turn unoccupied homes into expenses again. When that happens the banks and private equity will get the hell out.

    There’s lots of private equity that will just convert to being slumlords but the big banks do not want to be renting out anything. It’s a huge risk for them and looks real bad on their balance sheets from a banking perspective. Also, if a bank is big enough they’re straight up forbidden (by law) from renting out properties (though there’s various loopholes which I won’t get into).