I got a Boox Go Color 7 as a less locked in alternative to my Kindle a while back, and overall I've really enjoyed it.
It's apparently rootable, although I haven't done that personally. It's Google Play certified so anything from the Play store works, and side loading Android apps works too. I use it with the open source KOReader app and in tandem with Calibre Web Automated. I did a writeup[0] with some details if you're interested.
~2019 I led a team of highly qualified security R&D folks inside Cisco (we were part of an acquisition), these folks were effectively highly specialized SWEs. But because the title was something like "security researcher" it was compared against the closet Radform ladder which was closer to to compliance officer.
This meant the specialists were on a ladder with often lower pay than a standard SWE, and I couldn't shift the bureaucracy enough to change that. People left for all sorts of reasons but a big part was being able to get 2x-4x the total compensation at other companies.
I use a single node microk8s instance mainly so I can stay familiar with syntax and things for work rather than an actual high availability system.
But I use Portainer and store my files on Github so Portainer can auto-update a deployment if I submit a code change, so kind of rudimentary CI/CD which could be fleshed out more with some GitHub Actions probably.
I use iSCSI mounted storage from my NAS on the host and k8s volumes storing configs there. Actual app data is on the NAS accessed via NFS from the relevant apps.
So a new deployment is usually test locally on my laptop, once it's good commit the code to github and either let the deployment auto update or go to Portainer and do it manually if it's a new deployment. Ingress traffic is done via Cloudflare Tunnels deployed in k8s.
I keep most apps in a single namespace called prod unless they need more than 1-2 pods. If I was doing this again I'd use a namespace per app, I do use a dedicated namespace for anything with a Helm deployment or needs a lot of pods (e.g. Immich)
The biggest difference I'm aware of is TLS 1.3 encrypts the initial handshake[0] in a way to prevent eavesdropping the hostname of the destination. Prior to that, you could get the hostname via network monitoring if you wanted. Encrypting the TLS handshake didn't maker sense to prioritize though as DNS requests were sent in the clear.
However with DNS increasingly being encrypted with DoH and DoT, the TLS handshake was one of the only places you could eavesdrop on the destination hostname, until it was removed in 1.3.
Of course network monitoring will still give you the destination IP, but those are increasingly overwhelmingly destined for a major cloud or CDN provider which doesn't provide much context about the actual destination.
If you'll forgive the shameless self-promo, I covered a decent amount of this in my Blackhat talk about encrypted DNS a few years back: https://www.youtube.com/watch?v=XCnE2o2pfxs
I asked a cloudflare engineer this and the answer was a bit vague but amounted to the failure rate being something like 0.5% which was too high for the amount of TLS sessions being initiated all the time.
Although I always thought it would be a nice feature for security conscious folks to be able to ennable. Or go ahead and use it on more sensitive sites only, e.g. banks.
I have a Synology for data accessible via NFS, SMB, and a couple iSCSI mounts.
## Compute:
I have an off the shelf Thinkserve running Ubuntu + Cockpit for VM management via the Web. I
I have 3 VMs running on the Thinkserve.
1) A single node microk8s instance. (This is mostly so I can stay familiar with k8s. Most of it could also be in a docker-compose file). This runs most stuff: portainer, Immich (photos), Jellyfin, Plex, Kavita (ebooks), Nextcloud, owntracks (location tracking), paperless-ngx, NodeRED, and Fasten (health tracking).
Most apps are deployed in portainer from a GitHub file, so a git commit is all it takes to update an app.
2) A VM for downloading things from YouTube and other places, categorizing/renaming them, and putting them on the NAS.
3) A VM dedicated to Home Assistant, with a pass-through USB to their SkyConnect device to control ZigBee/Thread home IoT stuff.
Each VM runs a cronjob to regularly put my Github pubkeys in my authorized_keys file for break glass SSH access. I detail my normal access below.
## Network/Security:
I use a Unifi Dream Router (UDR) with VLANs for most devices, one for IoT that's locked down, and one for my personal laptop with certain SMB traffic allowed for backups.
I don't allow incoming traffic (well one exception for Plex). I leverage Cloudflare pretty heavily for DNS, ingress, and access control.
I have 4 cloudflare tunnel pods on the k8s node. And a tunnel agent on each of the VMs, the Synology, the hypervisor, and the UDR. I use Cloudflare's ephemeral certs for SSH in tandem with cloudflared on my clients so I can SSH in a normal terminal (as opposed to the web SSH client).
Ingress traffic comes in via the tunnels which takes care of dynamic DNS. HTTP traffic runs through Cloudflare Access connected to my Google account which requires FIDO2 to log in. Non HTTP traffic (or non-browser traffic) are authorized via Cloudflare WARP + Gateway (mostly applicable to native Android apps).
## Internal DNS:
I have the cloudflared agent running in the UDR to allow incoming traffic for management, but it also creates a local DNS proxy that sends encrypted DNS requests to my Cloudflare Gateway allowing me to collect metrics and do filtering for any DNS on my home network.
## Backups:
I use rclone to backup an encrypted blob to Hetnzner storage.
It's a challenge but seems to be becoming moire prevalent for folks focused on supply chain attacks. Chainguard in particular has a bunch of standard containers (e.g. nginx) that reduce the container footprint as much as possible.
I'm an information security consultant. I have a broad skill set, but I specialize in younger organizations and/or SMBs who are looking to make sure they have good modern security baselines across their entire organization. I can tackle specific projects or can review systems and procedures and make recommendations.
I have extensive experience in deploying, automating, and securing corporate IT systems. For example: automating employee onboarding/offboarding, deploying Single Sign On, implementing account security best practices, and Zero Trust principles (e.g. microsegmentation, scoped access, device attestation, hardware backed authentication).
I have and I like it. It was in the apt repositories for Ubuntu so I use that to manage my hypervisor (which is just an Ubuntu LTS box). In browser VNC to manage/install VMs is pretty great for when SSH isn't set up yet or I'm having issues with it.
It has a libvirt extension you can use to manage the VMs which is nice. Kind of remind me of webmin tbh.
Kong | InfoSec Tech Lead (and lots of others) | Remote (US timezones) | Full-time
Kong(https://konghq.com) creates software and managed services that connect APIs and microservices natively across and within clouds, Kubernetes, data centers and more using intelligent automation. We have had an on-prem OSS and enterprise product known Kong Gateway that is an API gateway. We recently launched our first SaaS offering in Kong Konnect. I am looking to build out our Information Security program and need a right-hand person to assist. As an early team member, your skills and opinions will play a significant role in shaping our Infosec strategy.
If you're interested in the role please apply via the careers page. If you'd like to learn more please reach DM me on Twitter. https://twitter.com/magiceldridge
While I share your general suspicion I don't think they need to see the messages to get a lot of privacy-violating use out of WhatsApp.
When the NSA was talking about metadata collection, they said it was more useful than actual data. Likely because it's already computer consumable, and less dense.
If FB gets your contact lists, and sees who you message, how much, and when, that's probably a hugely valuable commodity to them.