Though I would add that looking back to when I was an IC, my Computer Science degree hadn't given me much if any formal training in Software Engineering (especially in a large team and code base) and I mostly learnt by doing that also.
If someone is performing a denial of service attack from one I.P. address then this will help.
To tptacek's point, you've got to ask yourself is a denial of service attack in your threat model?
The reality is most folk set up fail2ban after seeing auth failures in their logs, not service degradation.
If you're considering a denial of service attack in your threat model, then I'd probably also consider a DDoS attack and there are likely more effective solutions here (a firewall or CDN).
And don't forget you're using some of those precious CPU cycles to parse the auth logs, with python no less :-)
fail2ban is a real pet peeve of mine because anyone security conscious enough to deploy this will have likely already mitigated any actual security risks this could help with either by using a strong password or public key authentication.
That leaves noise in the logs - which sure, it's nice to reduce, but using an alternative port can help here.
I may sound like a spoilsport - but the fact that there have been a number of security vulnerabilities (https://www.cvedetails.com/vulnerability-list/vendor_id-5567...) in this project, make it worse than security theatre, it actually increases risk whilst not at all reducing it.
Don't disagree - but if I have a limited amount of resources to harden my Drupal server, it might be best to start looking at hardening around the most commonly exploited Drupal vulnerabilities.
Implementing what you describe sounds to me way more "clever" and less robust than the canary page approach described above.
Specifically - I wouldn't fancy writing the "consistently anticipates their adversaries sneaking behind a wall" heuristic you describe but the earlier post describes the API that already exposes the "has read canary page" functionality.
These services help some issues but don't solve all of them, just a few off the top of my head:
Legal differences can be significant - for example, in France it may be difficult legally to ask an employee to put in more than their contracted hours compared to another country where this could be very normal.
A recent example in the news is the Twitter layoffs - in the EU they may have enacted layoffs that aren't legal there but are perfectly legal in the US.
Taxes in different countries can mean there's a significant difference in the difference between the amount an employer pays and the employee receives per country. Sometimes it's negligible enough for the employer to foot the bill, sometimes it's large enough they may need to pass on the difference. This can get even more complicated when share options come in to play.
If you are responsible for this it all really starts to add up, ultimately the more countries you employ in, the more cognitive overhead which can impact an organisation's agility (or require them to take more risks).
> but they don't want to use Docker, at least not immediately, because it requires to learn a few Docker commands
That's not what the blog post says. They don't want to use docker because it does a lot of things. They use rkt because it does fewer things. It's not about learning commands, it's about complexity of software. They selected rkt because it does less stuff, not because it's easier to learn.
Whilst it may be a better user experience for those with Saudi numbers in Saudi Arabia (calls would be blocked anyway) it is a much worse user experience for those with Saudi numbers not in Saudi Arabia (calls would work fine, but are blocked by WhatsaApp).
Maybe it's just a use case they missed - but quite a significant one!
If your tag line is "The World's first $9 computer" I don't think it's totally unreasonable for people to point out that you have to pay more than $9 to get the thing.
I appreciate this is tongue in cheeck but given that it should be possible for me to constantly scan his server and get each port change is there anything I can do with that? i.e. derive his 2FA private key
I suppose, but the thing with doing something like this on a botnet is you need to put that bit of spotify listening software on all those infected computers. Once spotify got their hands on the software they could come up with ways to defeat it.