lazyweb

le mois dernierdiscuss

It is a bad idea. There's RCE CVEs on an almost weekly basis.

il y a 5 moisdiscuss

T-Pot does something similar: https://github.com/telekom-security/tpotce

il y a 8 moisdiscuss

Oh snap, that's crazy. In a bad way.

> Going forward, customers must order the full server system to obtain the motherboard.

lazyweb

il y a 8 moisdiscuss

Veritasium - Why It Was Almost Impossible to Make the Blue LED

https://www.youtube.com/watch?v=AF8d72mA41M

lazyweb

il y a 11 moisdiscuss

I generally agree. But then again, we had Master/Slave IDE connectors, floppy drives, _extremely_ shitty CPU sockets (broke plenty of Sockel A / 370 cooler latches), nothing (including keyboards and mice!) was hot-pluggable ...

Regarding your last point: that's just market segmentation. Plenty of lanes on server CPUs. Remember Linus' rant about Intels refusal to offer ECC for consumer CPUs?

lazyweb

il y a 12 moisdiscuss

I did the exact opposite. And by that I mean physically moved my homelab into their colo earlier this year. Runs like a charm, costs about 500€ per month total.

Sounds like a lot, but I was almost paying the same before - 220€ for power at home, 110€ for a dedicated Hetzner server, 95€ for a secondary internet connection (as not to interfere with the main uplink used for home office by my partner and me).

Not having to deal with the extra heat, noise and used up space at home anymore has been worth it as well.

lazyweb

l’année dernièrediscuss

I'm hosting my own internal CA using Hashicorp Vault and some ansible + CI. The root CA is valid for 20 years, intermediate CA 10 years, client certs three months.

Initial setup is a handful of commands interacting with Vault's CLI, from there, with CI in place, client certs are renewed automatically. Services are restarted / reloaded as well. Works flawlessly.

I should maybe write a (small) blog explaining how it works.

lazyweb

l’année dernièrediscuss

As predicted by Mass Effect 1: Introducing Omni-gel.

lazyweb

il y a 2 ansdiscuss

Mort Way

lazyweb

il y a 2 ansdiscuss

I set up something like this [1] a few years ago at a previous job, mostly just because the security team wanted an interactive dashboard.

[1] https://github.com/debricked/dmarc-visualizer

lazyweb

il y a 2 ansdiscuss

I am running my own private CA as well, powered by Hashicorp Vault, Ansible and Jenkins.

The Vault initialization and configuration is more or less manual (just a bunch of commands, I have them in my notes). From there I am using an ansible role based on the hasi_vault module [1] which is run by a Jenkins job every night, logging into each target system, renewing certs if needed and reloading services.

Has been working very well for about a year now. Of course, there's a little more technical context needed - my CA needs to be present on all systems interacting with it, and my CI needs to be able to log into each target system (SSH keypair + sudo user). This ties into the rest of my infrastructure, which is managed by Terraform and Ansible.

I might write up a small blog post about this if I find the time.

[1] https://docs.ansible.com/ansible/latest/collections/communit...

lazyweb

il y a 2 ansdiscuss

Straight out of https://www.imdb.com/title/tt21942866/

Which is a fun watch btw

lazyweb

il y a 2 ansdiscuss

Has anyone tried mirroring their apt repo yet? Using apt-mirror on Debian stable, I'm seeing errors:

  Processing indexes: [PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPapt-mirror: can't open index packages.mozilla.org/apt//dists/mozilla/main/binary-amd64/Packages in process_index at /usr/bin/apt-mirror line 891.

Config section in /etc/apt/mirror.list:

  deb https://packages.mozilla.org/apt mozilla main
  clean https://packages.mozilla.org

Edit - probably apt-mirror showing its age and adding a second forward slash. I'll look into it soon-ish.

lazyweb

il y a 3 ansdiscuss

Mildly relevant - the Telmate Terraform provider for Proxmox [1], which now stopped working with latest Proxmox version due to seemingly being abandoned, was initially mostly developed by an engineer employed by a company of the same name. They've since rebranded [2].

I've used that provider for a while, and only recently started looking into the specifics. The repo is effectively owned by a company profiting off of incarcerated persons in the US. Pretty wild.

Mostly writing this since I've spent the last few days migrating my Terraform setup to a different, supported provider [3].

[1] https://github.com/Telmate/terraform-provider-proxmox

[2] https://www.gettingout.com/

[3] https://github.com/bpg/terraform-provider-proxmox

lazyweb

il y a 3 ansdiscuss

Agreed. I've introduced an internal, selfs-signed CA using Vault, ansible and Jenkins for my personal infrastructure. Issues certs via pipeline job and restarts / reloads affected target services if needed.

I might do a writeup soon on this, it's not even that complicated.

lazyweb

il y a 3 ansdiscuss

"I still ate some and feel fine" vs. "I've been sitting on the toilet for the last 25 minutes".

lazyweb

il y a 3 ansdiscuss

I'm using Graphene, but with the default Google captive portal settings. While yes, I am technically leaking my current public IP to Google servers, what does it actually tell them apart from the IP?

It's a generic user agent I believe and there's billions of (simple) HTTP requests hitting that endpoint. If you're using a stock Android (or even worse, like Samsung) it's the Play services and unkillable vendor background apps you should be worried about.

I'd argue it's a lot more conspicuous to network operators if you're using non-standard captive URLs.

lazyweb

il y a 3 ansdiscuss

Wow, incredible video.

That's what I imagine could be the last few seconds of semi conscious hallucination by some poor Warhammer40K space traveller during a gellar field failure.

lazyweb

il y a 3 ansdiscuss

Exactly. Depending on the location and "crookedness" of each tooth, the oral surgeon might grind down the inside of the jaw bone for a clean extraction.

Source: I've had three of my four wisdom teeth removed like that just a few weeks ago (mid thirties, local anesthetic). Chewing harder things like bread still hurts a little, otherwise it's fine.

lazyweb

il y a 3 ansdiscuss

My way of doing private SSL (not necessarily the easiest):

* own CA, to be distributed to all systems via Ansible playbook or Dockerfile directives

* Hashicorp Vault with enabled PKI engine

* Ansible Hashivault module [1]

* Ansible role & playbook to tie it all together

* CI enviroment for automated deployment of SSL certs to target systems

Works flawlessly once set up, including restart/reload of affected services. Might do a writeup on my personal blog at some point.

[1] https://github.com/ansible-collections/community.hashi_vault

Submissions

Running a private mail server for six years, easy peasy

Ask HN: Best way to migrate from Wordpress to something simpler/more elegant?

Running a private mail server for six years, easy peasy

comments