• 0 Posts
  • 26 Comments
Joined 1 year ago
cake
Cake day: July 30th, 2023

help-circle






  • This is true of a even some public universities in the US. I can’t remember if it was a rule where I was, but definitely most freshman did just live in dorms.

    Lot of folks brought their own desktops to set up, and we were allowed Ethernet switches to hook up multiple devices - had to be wired. Wireless had two options, WPA# 802.1X or unencrypted captive portal guest. If your device didn’t support that, it had to be wired by policy.

    And they weren’t wrong, I did a radio scan and they had the full sized enterprise access points about as good as they could (with a few low signal exceptions, and the air waves were still overloaded with too many people. The building uplink was perfectly fine, it was just overcrowded wireless.



  • I’m an American android user and I’m confused too. At least in my area, contactless is pretty ubiquitous now. (I accept adoption is slower, but it’s getting there)

    Sure Apple Pay seemed to come to a lot of terminals first, but NFC Google wallet or whatever it is the phone does automatically I’ve only seen fail at certain terminals. In that rare case, usually someone behind me with Apple Pay often also fails, so I’d be more likely to attribute it to a system glitch rather than lack of support.




  • The first few screens look like a combination reverse job board and Coinbase. But your description says “post stuff and create tokens”, which doesn’t quite seem to line up

    Why?

    I don’t think Web3 contracts have tested case law yet, so who knows if it’s enforceable in court, at most it may only be as strong as a gentleman’s agreement. And the token part looks like an easy way to create rug pull coins, just on the ETH database instead of an independent database.


  • I’d like to politely disagree

    Finding alternatives to large software packages is great, don’t think I’m not saying that - but any time you have competitor X and competitor Y, be they both commercial, both F/OSS, or some combination thereof, the competitors must be cognizant of each other when setting up features.

    Burying your head in the sand and ignoring Microsoft, Apple, and Google is a very solidly Microsoft-Apple-Google-style play. It’s the play of someone who believes the other side offers no competition. That’s how you get unwieldy features these tech giants implement because they know they can make a 70% effort and people won’t be annoyed enough to leave.

    Every tool they make has a reason someone made it. Many tools are very important - for one example, the Microsoft Office document format is considered to be almost a universal format in presentations, spreadsheets, and plain documents for message passing between businesses.

    But as we as a society design alternatives to those various monopolies (as we should), we need users to want to use the new thing. We have to take what people like and keeps them on their old platform, and best preserve the intent of what they want on the new platform. Doing so requires discussing the features those big tech companies

    And as users, when we select the platforms we use, we need to weigh the cost of going with an alternative vs going with a giant. No solution is a perfect solution for everyone, and the chooser needs to weigh the maintenance cost (in hours or money) they will incur, how their users will like/dislike it, and maybe even look at a piece of software and decide “nah the vibes are off”.

    I’d love a world where those three tech giants had proper competition in all fields, and I think their business practices are scummy and need improvement. But the real alternatives to each need some polish before they’re ready to be used by [arbitrary tech illiterate grandmother].



  • Far-UVC has a lot of potential once it’s scaled up. Right now, we’re still learning about best practices.

    Institutions should be adopting this tech at scale.

    If we’re still learning about best practices why are we talking about deploying this at scale? Self contradictory article…

    It should be the other way around. Figure out if it works academically, then test small scale, then scale up with proven and reproducible results. That’s how science works. Best practices can be formulated and adjusted at each stage as more knowledge is gained. That’s how we don’t make a massive health mistake and give an entire convention center indoor sunburns. Especially for people who might be more sensitive to sunburns.





  • Virtual servers (as opposed to hardware workstations or servers) will usually have their “KVM” (Keyboard Video Mouse) built in to the hypervisor control plane. ESXi, Proxmox (KVM - Kernel Virtual Machine), XCP-ng/Citrix XenServer (Xen), Nutanix (KVM-like), and many others all provide access to this. It all comes down to what’s configured on the hypervisor OS.

    VMs are easy because the video and control feeds are software constructs so you can just hook into what’s already there. Hardware (especially workstations) are harder because you don’t always have a chip on the motherboard that can tap that data. Servers usually have a dedicated co-computer soldered onto the motherboard to do this, but if there’s nothing nailed down to do it, your remote access is limited to what you can plug in. PiKVM is one such plug-in option.


  • Getting production servers back online with a low level fix is pretty straightforward if you have your backup system taking regular snapshots of pet VMs. Just roll back a few hours. Properly managed cattle, just redeploy the OS and reconnect to data. Physical servers of either type you can either restore a backup (potentially with the IPMI integration so it happens automatically), but you might end up taking hours to restore all data, limited by the bandwidth of your giant spinning rust NAS that is cost cut to only sustain a few parallel recoveries. Or you could spend a few hours with your server techs IPMI booting into safe mode, or write a script that sends reboot commands to the IPMI until the host OS pings back.

    All that stuff can be added to your DR plan, and many companies now are probably planning for such an event. It’s like how the US CDC posted a plan about preparing for the zombie apocalypse to help people think about it, this was a fire drill for a widespread ransomware attack. And we as a world weren’t ready. There’s options, but they often require humans to be helping it along when it’s so widespread.

    The stinger of this event is how many workstations were affected in parallel. First, there do not exist good tools to be able to cover a remote access solution at the firmware level capable of executing power controls over the internet. You have options in an office building for workstations onsite, there are a handful of systems that can do this over existing networks, but more are highly hardware vendor dependent.

    But do you really want to leave PXE enabled on a workstation that will be brought home and rebooted outside of your physical/electronic perimeter? The last few years have showed us that WFH isn’t going away, and those endpoints that exist to roam the world need to be configured in a way that does not leave them easily vulnerable to a low level OS replacement the other 99.99% of the time you aren’t getting crypto’d or receive a bad kernel update.

    Even if you place trust in your users and don’t use a firmware password, do you want an untrained user to be walked blindly over the phone to open the firmware settings, plug into their router’s Ethernet port, and add https://winfix.companyname.com as a custom network boot option without accidentally deleting the windows bootloader? Plus, any system that does that type of check automatically at startup makes itself potentially vulnerable to a network-based attack by a threat actor on a low security network (such as the network of an untrusted employee or a device that falls into the wrong hands). I’m not saying such a system is impossible - but it’s a super huge target for a threat actor to go after and it needs to be ironclad.

    Given all of that, a lot of companies may instead opt that their workstations are cattle, and would simply be re-imaged if they were crypto’d. If all of your data is on the SMB server/OneDrive/Google/Nextcloud/Dropbox/SaaS whatever, and your users are following the rules, you can fix the problem by swapping a user’s laptop - just like the data problem from paragraph one. You just have a team scale issue that your IT team doesn’t have enough members to handle every user having issues at once.

    The reality is there are still going to be applications and use cases that may be critical that don’t support that methodology (as we collectively as IT slowly try to deprecate their use), and that is going to throw a Windows-sized monkey wrench into your DR plan. Do you force your uses to use a VDI solution? Those are pretty dang powerful, but as a Parsec user that has operated their computer from several hundred miles away, you can feel when a responsive application isn’t responding quite fast enough. That VDI system could be recovered via paragraph 1 and just use Chromebooks (or equivalent) that can self-reimage if needed as the thin clients. But would you rather have annoyed users with a slightly less performant system 99.99% of the time or plan for a widespread issue affecting all system the other 0.01%? You’re probably already spending your energy upgrading from legacy apps to make your workstations more like cattle.

    All in trying to get at here with this long winded counterpoint - this isn’t an easy problem to solve. I’d love to see the day that IT shops are valued enough to get the budget they need informed by the local experts, and I won’t deny that “C-suite went to x and came back with a bad idea” exists. In the meantime, I think we’re all going to instead be working on ensuring our update policies have better controls on them.

    As a closing thought - if you audited a vendor that has a product that could get a system back online into low level recovery after this, would you make a budget request for that product? Or does that create the next CrowdStruckOut event? Do you dual-OS your laptops? How far do you go down the rabbit hole of preparing for the low probability? This is what you have to think about - you have to solve enough problems to get your job done, and not everyone is in an industry regulated to have every problem required to be solved. So you solve what you can by order of probability.