Recent content on Ramblings of a Unix Geek
In December I documented TLS settings for Debian 13 . These settings gave us TLS1.3, the ability to use ECDSA, backwards compatibility with some older software, and an A+ rating in SSL Labs . Last week I re-ran the tests and noticed an additional flag had been added; “This server supports PQC (Post-Quantum Cryptography) key exchange.” So I thought I’d summarize all the previous…
I got asked a question… this gives me a chance to write an opinion. I have lots of them! What Linux distribution should I use? Oh boy, this is a biggie and could almost be a religious one! In the past we had the Unix wars and then the Linux distro wars. But with Microsoft making Windows worse and people trying out (and liking!) Linux is becoming a viable desktop operating system. Heck, even…
Over on Reddit someone commented that self-hosting solutions (eg email, calendars, file sync) was too much like hard work. Needing to update TLS certificates, keeping code up to date, acting like IT support (especially if what you’re doing is used by friends and family) was becoming too much like a job. And you know what, they could be right. Other people starting out on their homelab and…
These days it seems that AI is everywhere. It’s being pushed in your face, every application has an AI component. Even your OS is going to be agentic In many cases I’m not a fan. But I can see some benefits under some circumstances. Because of how many areas AI is getting into, this has become something of a long post (I’ve been putting it off for a while ‘cos I expected…
Back in 2016 and then in 2020 I described how to get an A+ score with your TLS config. That was 5 years ago. Since then OpenSSL and Apache have both advanced and there’s even more options than before. Nicely OpenSSL can now also use the official TLS names for ciphers, so we don’t need to keep switching between entries reported by Qualys SSL Labs and the OpenSSL internal names.…
The recent AWS outage led to a slew of It was DNS jokes. It reminded me of a time maybe 12 or 13 years back. I was part of the architecture/engineering team for the company’s Unix authentication product. Basically every login, su, privilege escalation call went through our code. So when things went wrong we got the blame. One day a call got escalated to me. It went something like: Caller…
One of the things you might see a lot on sites like LinkedIn is the recommendation to not ask interview questions for stuff that is easy and trivial to look up. For example, asking about command line options to a program. To an extent I agree with this. I always need to look up the “key field” options to the sort command (especially since they changed from when I learned the command!).…
This is a long long post because I’m providing a lot of configuration files and explanation. I could have split this into multiple posts, but I felt it made sense to put it all in one entry In my homelab I use virsh to manage QEMU/KVM virtual machines. I might want to spin up a test VM (oh, say Debian 12) to do some playing around and then destroy it again. And, naturally, I don’t want…
In the past I’ve pushed for automation of server builds, of application configuration. Indeed, for my home setup, I’ve been using ansible for over a decade; I still see a config file for CentOS 6 postfix dated 2015. I’ve started a migration from CentOS/Rocky Linux (i.e. RedHat) to Debian for my personal servers. And I’ve realised this automation is causing me more problems…
I have a routine that runs every 15 minutes on my home machine and polls other of my servers and collates the results. Once or twice a day one of my machines, at linode, was refusing to talk. It wasn’t causing a problem since the data is replicated and the system catches up, but it was annoying. Digging around, the machine looked like it was working normally. But I found, in one log, that…
This post contains a lot of code, presented as close as possible to the code ChatGPT gave me. I’m including it here so people can see how good or bad they think it is. Where necessary I modified the code to make it work, but it’s as close as possible. All this code makes the post look longer than it is. If you’re not interested in the code then you can just skip over it and just…
When I was using a Mac as my media center player I liked that you could “remote desktop” into it; basically VNC and got the existing desktop. This meant I could use my local keyboard and monitor to control the machine that was 20ft away across the room from me, in the odd case where the command line wasn’t sufficient. As MacOS went on these occurrences got more frequent……
Back in 2018 I was asked about whether someone should become a Unix specialist. In a similar vein, I saw a question on LinkedIn that asked whether someone should become a generalist or a front-end specialist or a back-end specialist. Of course I had opinions :-) This is an extended take on my quick reply to the LinkedIn question. Let’s scope this a bit better I think, first, we need to think…
Leaving twitter And my social media footprint shrinks; I’ve closed my twitter account, mostly ‘cos there’s very little left there to read. Yesterday there were only 5 or 6 new posts on the “Following” feed (I never used the algorithmic feed); 90% of the likes my posts got were bots. It really was the text equivalent of a post-apocalyptic wasteland with howling winds.…
So 5 years ago today was the day I told my boss I wasn’t going to come into the office for a while, and would work from home. Because I didn’t feel comfortable. The company had made a plan; they were going to split the office into two groups who would come in alternate weeks. The idea was to reduce occupancy. However I’d been seeing more and more in the news how bad COVID could…
Secure messaging A common question I get asked is “what secure messaging app do you use?” and the answer of “none” gets some surprised looks; how can I be in cyber security if I don’t use secure messaging? The answer is “convenience”, with a side of “risk analysis”. Back when Signal (on Android) did both secure messaging and SMS in the same app…
I recently saw a posting on LinkedIn that said something like “with zero trust we can consider all access as privileged access”. While this could be considered true, I also made the same argument 15+ years ago before zero trust was a thing people cared about; my argument was “if I can login to a server then I can run commands, impact applications (eg chew up CPU), fork bomb, etc;…
This post may seem odd for this blog; after all, why would anyone be interested in my screwdrivers? After all, someone like Project Farm did a scientific(ish) comparison of various things and gives you a lot more data than I ever could. But we’re all human, and sometimes a subjective opinion is valuable. And as people know, I have opinions :-) This may seem long but if you just want my…
There’s a theme going around that you should create secure products, not buy security products. And, as far as it goes, this is… Well, actually it’s not good. My initial response was “Why not both?” We need to secure the products we develop. There’s no doubt about that. And we need to mitigate mistakes. How do we do this? Spoiler… security products :-)…
One thing I’ve noticed, over the years, is the habit of people blaming technology for the problems rather than taking a look at the processes behind the problem. A personal example A big example, for me, was when I was part of the Unix enterprise authentication team. The technology worked, and it worked well . It was resilient, reliable, fast. We literally turned off the infrastructure in…
Google has been threatening this for a while, but now they’re finally getting around to it ; they’re starting to remove Manifest v2 (MV2) from Chromium (and thus Chrome, and likely many browsers based on chromium, which is the majority of the browser space, these days!). What does this mean? Chrome extensions use a set of APIs to talk to the browser engine. The main version…
For some reason this year a lot more 9/​11 denialism has come across my social media feeds. I wonder if it’s because of the upcoming election. And I just can’t… I’d had enough a decade ago and wrote something then; I’m repurposing it here. I was working on Wall Street the day it happened, just half a mile away. I’d only moved to the US 2 months…
I’d previously written about the Yubikey 5 and how we could use it to solve various use cases and when to trust it. Personally, I think it’s a great device for corporate authentication solutions. But… This week, Yubico released an advisory that stated that ECDSA private keys could be stolen from a Yubikey 5 that’s running firmware older than 5.7.0 (or 2.4.0 for the…
I was asked about today’s Crowdstrike issues on Windows. Naturally I have some thoughts… What went wrong? What I know. Crowdstrike is an EDR (Endpoint Detection and Response) tool. (Well, they claim “XDR”, but that’s marketing). It has an agent component and a set of rule sets (called “channel file”). The agent has both user space and kernel space…
WARNING: technical content ahead! There’s also a tonne of config files, which make this page look longer than it really is, but hopefully they’ll help other people who want to do similar work. Back in 2017 I described how to build a home router based on CentOS 7. C7 is now out of date, so I figured it was time to rebuild it, this time using Rocky Linux 9. That should give me another 8…
This isn’t my normal tech-ish posting; this is a more personal view at how Corporate America and tech startups and the like are abusing their workforce. I don’t mean the sort of abuse seen in the service industry (below minimum wages needing to be supplemented with tips; excessive overtime; all that stuff). I’m talking about white collar tech jobs. The sort of jobs I did; likely…
When it comes to talking about API Security there are many facets and paths the conversation can take. We might want to talk about from an AppDev security perspective; after all, an API is just code, so your SAST/DAST type processes apply. We might want to talk about it in terms of authentication; after all, you need credentials to access an API and there’s many different ways this can be…
We all know what imposter syndrome is. We may all have suffered from it at some point. I know I did. We may even know, rationally, that this isn’t a sensible thing. One good representation of this was from David Whittaker Yet despite this whenever I started a new job I was always worried that I wasn’t the right person for it; that I’d fail to deliver. I feared messing up and…
Recently I wrote about how I got here without knowing what it was I wanted to do. That was a prelude to the other half of the equation; I may not know what I want, but I do know what I don’t want. At this moment in my life, I don’t to work. At all. I want to have the luxury to be able to lie in, to read a book, to stay up late hacking on some code or whatever… I find myself…
So I don’t do much “streaming”. I’m old school; if I like a show then I’ll buy it (or get it as a present) on physical media… BluRay or 4K these days. This meant I hadn’t seen much of New Trek. A few years back I got Picard Season 1 on BluRay, then season 2. But this year I’ve received/bought a lot of the new stuff, and I thought I might write down…
One of the most annoying interview questions is “where do you see yourself in five years time?“. I hate it. I have no vision of the future like this. Hell, I barely know what I want to do tomorrow. I’m good at foreseeing the future, honest! So my first job, straight out of uni, was with a small Greek shipping company. I learned a lot there ‘cos I had to do it all. But I…
A number of years ago I wrote a Hue Bridge Emulator that would let you emulate light bulbs in shell script in such a way that these devices could be controlled by Alexa (and so used in routines and the like). It worked well. But recently Amazon appear to be changing how hue bridges are detected. The big challenge appears to be it wants the server to listen on port 80. This is annoying for a number…
Else-net there was a discussion on how “security” is generally seen as a blocker; they’re seen as gate keepers and people who just say “no”, or who may be focused on regulatory compliance and not actual security. Who needs Mordac, the Preventer Of Information Services when you have a security team?! The thing is, “security” isn’t a monolith, and…
Previously I had modified a digital safe to be controlled via an ESP8266; basically a WiFi safe. I was asked if I could create a firmware for it that made it act like a timer safe; something along the lines of a Kitchen Safe . I decided to take the opportunity to build (yet another) safe, using the combined esp/relay board. Without any soldering, I’m sure I can make a cleaner more reliable…
Yes, this is a blog about a very old TV show. I went down a rabbit hole. A very stupid rabbit hole. A meaningless rabbit hole. There was a 1983 Gerry Anderson puppet show “Terrahawks”. It wasn’t as good as his older stuff (e.g. the original Thunderbirds). Maybe I was also that little bit older when I first watched it (I would have been around 15 when it started). Earth was under…
The problem I use the Ookla Speedtest CLI in a cron job to get an idea of the speed of my internet connection (Verizon FIOS), and spot if there are problems. Why? Because why not :-) It let’s me draw graphs like this. However, recently I was starting to get error messages that the command wasn’t able to reach speedtest.net to get the configuration. It wasn’t happening every time;…
This is one of my infrequent “philosophical” type posts. An earlier version of this appeared on LinkedIn. There was a LinkedIn post along the lines of “are we treating ChatGPT today like we used to treat calculators in the past”. In my mind the question is “what skill do we believe is valuable that ChatGPT will replace”. The parallels between how we treated…
I don’t normally write about specific products, but I was asked to take a look at the YubiKey series (primarily 4 and 5) and write up a summary of when and how it can be used. This is timely, because CISA is pushing for access management enhancements and recently published a chart for phishing resistance . I thought this interesting; typically I’ve looked at this from a user…
Recently I was invited to be part of a panel on Microservice Security . The fools! Normally on these panels they want you to talk for 5-ish minutes; unfortunately I came up with about 15 minutes worth of material! That’s perfect for a blog :-) Older designs Before I talk about microservices I want to take a look at older designs Monoliths. A “monolith” is pretty much an…
I got asked another question. I’m going to paraphrase the question for this blog entry. Given the Russian invasion of Ukraine and the response of other nations (sanctions, asset confiscation, withdrawal of services, isolation of the Russian banking system…) there is a chance of enhanced cyber attacks against Western banking infrastructure in retaliation. How can we be 100% sure our…
I got asked a question… this gives me a chance to write an opinion. I have lots of them! If I redirect my port 80 traffic to another site, do I need to get a TLS cert? The question here is related to if a bank (or other service) has changed their name, then do they still need to maintain a TLS site for the old name? Can’t they just have http://mybank.com send a redirect to…
I got asked a question… this gives me a chance to write an opinion. I have lots of them! Is it reasonable to just stick with a single cloud provider, or is it better to go multi-cloud? It think it seems reasonable. I expect very few places are true multi-cloud, as in a given app runs in two clouds. That becomes challenging if trying to use cloud native services ‘cos how you access RDS…
A while back I wrote about some basic usage of SSH certificates as an authentication system. I only described the core, but the comments went into some further detail. I thought it time to write a follow up post describing some of the more advanced features. Quick recap To handle cert based authentication you need a CA certificate. This is created with the ssh-keygen command. e.g. $ mkdir ssh-ca $…
What is IP Allow-Listing Typically when you want to access a remote resource (e.g. login to a server) you need to provide credentials. It might be a simple username/password, it could be via SSH keys, it could use Mutual TLS with client-side certificates… doesn’t really matter. One concern is “what happens if the credential is stolen”. IP allow-listing is a way of…
When people ask me something technical, I frequently find it useful to tell the basics as a story or an analogy. Obviously all these stories have limitations to how accurate they can get, but it’s surprising how well it gets people to understand what you mean. So this post is part of a series of “explaining technology as a story” TLS Certificates One of the challenges, on the…
When people ask me something technical, I frequently find it useful to tell the basics as a story or an analogy. Obviously all these stories have limitations to how accurate they can get, but it’s surprising how well it gets people to understand what you mean. So this post is part of a series of “explaining technology as a story” DHCP For a machine to be able to talk over IP it,…
When people ask me something technical, I frequently find it useful to tell the basics as a story or an analogy. Obviously all these stories have limitations to how accurate they can get, but it’s surprising how well it gets people to understand what you mean. So this post is part of a series of “explaining technology as a story” DNS The internet basically runs on numbers (either…
When people ask me something technical, I frequently find it useful to tell the basics as a story or an analogy. Obviously all these stories have limitations to how accurate they can get, but it’s surprising how well it gets people to understand what you mean. So this post is part of a series of “explaining technology as a story” Routing Far too frequently there are internet…
I was asked to describe the stuff I use for my not-so-smart home and how it fits together. This was originally an email, but I figure other people might find it interesting This is as complete as I can think! The goal, where possible, is to have everything under local control and not dependent on the cloud. Setup may require cloud… Lights Philips hue bulbs where possible (including the…