sylver_dragon

the thing is in the video tutorial he’s using password only(no tpm) and it still requires you to create a recovery key

Never watched the video, so I’m just answering for the general case. Even with just a password, the recovery key serves a similar function. It’s a fail-safe if the primary protector is lost. It’s entirely possible that the password being setup will be given to a user and IT will still need a way in, if that password gets lost/changed.

on Linux with luks, it never asked for me to save a recovery key.

Ok, and? Yup, LUKS uses different defaults. Don’t get too caught up on “Linux does it this way”. Both ways have valid reasons and the Microsoft developers and LUKS developers picked different defaults. If you want, you can create a recovery.key file on LUKS. If you are using TPM as your primary protector, I’d actually recommend you follow Microsoft’s lead on this. If that TPM chip (or the motherboard it’s attached to) dies, you’re kinda fucked. If you are using a password, this is less of an issue. assuming you have that password stored safely somewhere not on that system.

It’s a design decision and one which is probably about right for many situations. TPM chips are not perfect, and there are a lot of situations which can cause them to fail or the hardware around them can fail (e.g. the motherboard). With the end result being that the data would be rendered unreadable. So a recovery key is a trade-off between confidentiality and accessibility.

The design of the recovery key itself is also fairly good as a backup protector goes. The key is long and complex enough that brute forcing it is hard enough and would require long enough that it is functionally impossible. If your concern is that the recovery key could leak, the easy answer is “don’t write it down”. You could simply choose not to store it and while it would be a theoretical attack on the confidentiality of your data, practically it’s a non-issue. But, for those folks who feel that having an unlock code written down somewhere is an acceptable risk while mitigating the risk of the TPM breaking and rendering the disk unreadable, it’s a good solution. And I can personally attest to the usefulness in a corporate environment. People do dumb things with laptops all the time. And no matter how much we might tell people to use the network/cloud storage which is off the system and backed up regularly, there is always a parade of people whose system just died and contains the only copy of important project data.

It’s important to remember that security is a long series of compromises between confidentiality, integrity and accessibility. All three are important. And you have to find the spot in the nexus of those factors which works for your situation.

surely you can’t profile criminals based on a film franchise with significant mass appeal. Talk about painting with a large brush.

If everyone is guilty of something, it makes yanking them off the street easier to justify to a news media asleep at the switch.

Buy a bit of paracord, make a simple net, toss as appropriate.
Paintball markers are also cheap, reasonably accurate and don’t involve yeeting a bullet on a ballistic arc.

I’ve been on several sides of this. As a sysadmin supporting a Windows dominated environment integrating Linux, as a user who wants to use Linux in a Windows dominated environment and in security trying to secure an environment with both Windows and Linux. In short, it depends on the use case, environment and the users’ tolerance for problems.

The first question which will come up is, “why?”. If you don’t have a good business use case, you should expect to be basically told to go get fucked. I realize that this seems like IT sticking their head in the sand, and it kinda is. But, also realize that you are asking them to take on extra work for nothing more than your own self edification. I have yet to meet an IT department which is so overflowing with time and resources that they want to take on new work which isn’t required. Even with the most basic use cases for Linux, IT is going to need to have resources dedicated to support, maintenance and oversight. Things like asset management, patching and license management don’t go away on Linux systems. Sure, the OS may not have a license to worry about (unless it’s RHEL or Ubuntu Pro), but there may be other software installed which is licenses and that license may be a different SKU on Linux. Then there are issues with ensuring IdM works on that flavor of Linux and supporting it when it breaks.

Along side that “why” question, be ready to answer the “why not” questions. Why not a Windows based alternative? Why not Cygwin/WSL? Why not a Linux based server that you SSH into from your main Windows desktop? Especially with a lot of workloads moving to the cloud, I’ve seen the mainframe model start to return, just with Linux instead of Unix/AIX this time. This sort of thing centralizes a lot of the IT headaches into a single host (or handful) which can much more easily be centrally managed. And that’s a theme to keep in mind, IT departments love centralized management. This is one of those places where Linux kinda lags Windows. Centralized management does work on Linux. It’s one of the reasons RHEL is all over the place, Satellite is like crack for IT departments dealing with Linux. But, a lot of centralized management looks like a folder full of Ansible scripts. With proper code management, it can work quite well. Keep in mind that many folks in IT are not coders and for a handful of Linux systems, dedicated resources which can handle that may not be in the budget (in the end, everything is about money).

Ok, so you have your “why” and are ready for “why not”. Let’s talk about the security stack. No, just because it’s Linux doesn’t mean you can ignore security. I’ve personally worked cases where Linux boxes got popped. And from the user side, things like ClickFix attacks are starting to crop up targeting Linux desktops. So, does your company’s software stack support Linux? This has, thankfully, started to be more common. Go back a decade and the answer was almost certainly, “no”. Partly because Linux wasn’t that common and partly because idiots believed Linux was fully secure by design. Anyone who believes that today shouldn’t be allowed to work on anything more advanced than an Etch-a-Sketch. With the dominance of Linux in the cloud, attackers are targeting Linux and your system will need to be ready for it. If your company’s security stack doesn’t support Linux, and/or your security department doesn’t have the expertise to monitor and respond to issues on Linux systems, you might find them resistant. Thankfully, that whole “Linux dominating the cloud” thing has started pushing security teams towards supporting Linux. And more advanced security teams often utilize Linux themselves in some capacity. So, that could ease your path a bit.

The final bit might be your tolerance for pain. If you’re out there on the bleeding edge, trying to be the first Linux system in an all Windows environment, expect things to break. No matter how well planned the rollout, the fact that the IT department hasn’t done this before means that they are going to miss stuff. It happens. If your system becomes a common source of trouble tickets, IT leadership may try to pull the plug. If you turn out to be a high maintenance user, you might find IT slow to respond and unwilling or unable to help with things aren’t working quite right. Some level of self-help and patience with a help desk which doesn’t have Linux expertise are going to be necessary. You really don’t want to become the phone number which pops up on the Help Desk queue and all the analysts scramble to avoid taking the call.

To conclude this long ramble. Linux systems in a Windows dominated environment is getting easier. That “the cloud” basically runs on Linux has gone a long way into getting Linux integrated into Windows environments. Microsoft has been forced to make their tools actually work with Linux, rather than the abomination which was setting up POSIX uids in a Windows 2000/2003 Active Directory domain. But, a lot of IT departments will still want to treat Linux as a server OS and not a desktop OS. MS Office, Teams and the rest of their communications and collaboration software still treats Linux as a pariah. Integrating and supporting Linux alternatives means budget and resources which aren’t dedicated to the core business. And that’s really what IT is going to care about.

Along side what you mention, I work for a company with a lot of engineers from multiple disciplines. Linux is everywhere in our environment and has been growing. Most of our engineers either have a Linux laptop, use Linux virtual machines or submit jobs through Linux backed software stacks. Our products have tools built on Linux to the point that we used to maintain our own Linux distribution to make having all those tools on a system easy, though we’ve just moved to having scripts to install and setup everything. Almost all of those engineers also have a Windows laptop as their daily driver. The few who don’t have Macs.

I don’t doubt that organizations can move to all non-Windows, but the Windows Ecosystem of Exchange, Office and Active Directory/Entra is very hard to replace. Yes, you can absolutely cobble together alternatives. But, you then have a special snowflake of an IT infrastructure. Maintenance may be eased by the use of tools like Ansible, but even that will likely result in organization specific playbooks and scripts. But centralized management of a Linux environment isn’t quite as standardized yet and so requires more planning and effort. And then there is the challenge of security.

Folks like to tout the inherent better security of Linux. As someone who works in Cybersecurity daily, I fully agree with that assessment. However, “better” isn’t “perfect”. You still need vulnerability management, monitoring and response tools. And this is an area where Linux lags behind Windows, mostly because of the effort put into it. Something as basic as Endpoint Detection and Response (EDR) on Linux is still a foreign concept to a lot of folks. And yes, it’s absolutely necessary. I’ve personally worked cases involving compromise of Linux systems and Linux specific malware. And more than just XMRig clone #5374. It may be harder to move from user to root on Linux than moving to local admin on Windows (unless some jack-off decided that Linux doesn’t need updates and DirtyCow still worked); but, there is still a lot of damage which can be done without root.

Overall, I’d say that the Linux ecosystem is evolving. It’s already embedded in a lot of environments of all sizes, but it’s usually a smaller part of a much larger Windows network. Hopefully, if enough large organizations start pushing away from Windows and towards Linux, there will be more investment and standardization. And, we’ve already seen some of that. Red Hat is a common distro of choice for large organizations because of that higher level of centralized control and standardization. Of course, a lot of the tools engineers want to use aren’t on Red Hat, specifically because of that centralization (read: everything AI). So, it will be interesting to see where we land.

Trump’s order serves as guidance, not a mandate, since shots required for school attendance are set at the state level, rather than by the federal government.

Like a lot of his crap, this is purely performative and will only impact States dumb enough to follow his suggestion That sucks for the millions of children who won’t be vaccinated, but it also means it won’t effect most children. Federalism can be a huge PITA when trying to pass good and useful legislation, but it’s also a pretty good bulwark for when stupid gets a turn at the wheel.

Even when a company is doing things pretty well with a VPN, all it takes is one mistake and the cat is out of the bag. At one of my previous employers, we had a fairly good setup with VPNs using single sign on via our IdM provider. IdM enforced SSO and the VPN had a number of policies setup which kept good control over what users could login. And then someone had the brilliant idea to take an old VPN appliance, reset it to factory defaults and configure it just enough to work on our network and then hung it out on the internet for some sort of test (our configuration management left a lot to be desired). Of course, that led to it being left there for a couple months and an attacker finally found it. They also had a valid username/password combination which got them in the door.

Security is hard and often expensive. But still, compared to “we put out OT devices on the internet” a basic VPN is a huge step up.

Sadly yes, this is exactly what happens. And it ends up being IT holding the bag at the end, with the managers having long since cashed out their stock options and left.

The hacks target internet-facing programmable logic controllers (PLCs)

Why the fuck
is your PLC
facing the fucking internet!

Jesus Zombie Christ an a pogo stick. Has no one been paying attention for the last two decades? Seriously, we learned this sort of lesson in Two Thousand and fucking Three. Your critical assets do not get public IP addresses.

The AI is a tool argument is getting tired. I haven’t seen it do anything useful at all that helps my day to day life.

I’ve also never had a use for a rib spreader. That doesn’t mean it’s not useful in the right setting. I talked through it in a different reply (feel free to use AI to find it), but LLMs and image classifiers do have use cases in particular settings. Just because some folks abuse them and use them for entirely the wrong use cases, doesn’t mean they aren’t useful in the right ones.

I might need to ask chatgpt to reply to this comment. In fact if i ever see your username around i will put it into chatgpt and ask it to generate a reply for me, because i can’t think for myself.

Go for it, it might be kinda funny. A bit of irony in it too, as it would offloading the critical thinking required to engage with an argument you disagree with.

i don’t believe i’ve ever asked calculator to answer biology question for me.

Nor should you, you would be using the wrong tool for the job. I’d also not use a calculator to drive screws, that doesn’t invalidate the point. Tools are useful when we use them the right ways. And ya, AI is a terrible tool to offload critical thinking onto. There are use cases where AI makes sense though. Things like image classification and fuzzy searches on large data sets are good use cases for various AI models. One of the problems with AI, at the moment, is that it has been sold as some sort of cure-all that will replace humans and critical thinking. And it’s absolutely not that. It’s in much the same place as cocaine in the first part of the 20th century. Hucksters are putting “AI” on the label and claiming it will solve everything. The reality is much more nuanced. It has it’s uses but they are far more limited than the hucksters are claiming.

Large language models really can be useful for fuzzy searches in large data sets. To give an example from my own work, Copilot is really good at searching Microsoft documentation for me. Could I find the answers with a regular search? Probably, it would also take me longer. Instead, I send Copilot chasing after the answer to that question and go do something else while it finds the answer. They can also help in re-writing for different audiences. I write a lot of technical reports and those need to be summarized for managerial audiences. Yes, I could do that manually, I’ve done it for years. I also hate doing it. Clippy is good enough at doing it that it can give me a first draft and I can finish it up in far less time and effort.

The biggest issue I have seen with LLMs is exactly what you point out, that people trust them too much and don’t think critically about their answers. Again with my work, we use a product that uses an LLM to summarize cybersecurity issues and provides suggestions for response and investigation. It’s a pretty well trained model and it’s suggestions are pretty good most of the time. But, it falls down spectacularly bad from time to time and the analyst needs to be able to recognize that and respond to the alerts appropriately. Some analysts are better at this than others and this is now part of our training for new analysts. We teach them to use the LLM, but to also always think about the basics and question the LLM when it doesn’t seem right.

Image classifiers are another area where I think AI has some good use cases. Consider the job of reviewing images and videos for sites like FaceBook, TikTok or YouTube. The folks who do this work are exposed to a lot of very violent and disturbing media. I used to work with a guy who did computer forensics in a law enforcement setting and he finally left that work because he could deal with having to review CSAM images any more. This seems like the perfect place to slot in an AI image classifier, to make a first pass at it. If it can correctly classify the vast majority of that sort of content, that greatly lessens the workload on the analysts who will need to deal with the borderline stuff and reports of false positives and negatives.

The new normal is people just follow what billionaire said, and you think it’s okay.

Not at all, but I also think the reactionary “fuck all AI” isn’t okay either. It’s a tool and it’s going to change things. We need to navigate that with a clear head and careful consideration.

Do you disregard people IRL who you know use a calculator for everything?

If that sounds like a ridiculous question, it’s because the use of that tool has become so ingrained in our society that we don’t question its use anymore. AI is a new tool and one which can offload a lot of mental work. Such tools have always been controversial. If Plato is to be believed (and that isn’t necessarily a given), Socrates complained that writing made men lazy and their minds weak, because they didn’t have to exercise their memories and were not taught things, just read facts.

AI is a tool, and it’s going to be worked into the fabric of our society, for good or ill. It’s also facing a lot of push-back, as have many tools, but that is unlikely to stop it. Will AI make us lazier? Absolutely. That’s kinda the point. If necessity is the mother of invention, laziness is the father. So much of human invention is all about ways to not work as hard. Sometimes, this is because we need to improve how we do something, sometimes its because we’d rather be down at the pub sipping a brew while a machine does the hard stuff. Often, it’s both.

That said, there is likely to be a lot of pain in the short term as we adjust to the new reality. And it will likely cause another shift in how work happens. Businesses used to have hundreds of people doing nothing but tabulating accounts. Rooms would be full of people just doing math. Now, we have Excel and most of that tedious work is now done by one person at the click of a button. The main problem with the rollout of AI may be one of speed. The same speed which empowers Excel is making the disruption of AI happen at a much faster speed than many of our institutions may be equipped to handle. Or not, there’s been some reporting lately that the promises of AI have been severely over-hyped (shocker, AI companies over sold the capabilities of AI, whodathunkit?). We won’t really know until we’re well past the point of disruption.

So, does it annoy me that people use (and believe) AI to answer relatively simple questions? No not really. Sure, they could take the time to look it up with google, but that is slower and harder. Or they could look it up in a book, which is even slower and harder. Or they could just memorize it and avoid that new fangled writing thing, which is making kids lazy. But, that sort of thing is a dead end. Ai is here, it’s a tool people will use. We just need to find a way to educate people about its strengths and limitations. And that is a hard problem, but maybe AI will help us solve it.

While I’m glad these guys are going to jail, this does go to show that one should not use Windows if they care about OPSEC.

Don’t worry so much about sports, as finding something you enjoy which gets you moving. The important thing is to try stuff and find something that works for you. Really, the best exercise you can do, is one you will actually do. It sounds like you have issues with team sports, so maybe try some stuff which doesn’t involve other people. Also, accept that you will likely suck as whatever you do, if you keep practicing, you might find you suck less over time.

I’m not a “sports person”. In fact, I suck as most sports I have tried. But, I discovered that I enjoy indoor sport climbing. I sucked amazingly bad at it when I first started. I mostly climb top rope and was struggling to finish a 5.9 climb. But, I kept at it and now I can finish most 5.10a climbs on my first attempt. I’m not some super climber by any means, but I have become kinda competent. I enjoy the challenge and have met some great people along the way. I also get excited when I walk into the gym and see a new set of routes. It’s like being handed a new set of puzzles to solve.

Sounds like a self-correcting problem.

Another investment area to consider is other Tax Advantaged savings accounts (e.g. IRA).

I do not really want a credit card, but I need to start using one because my credit score dropped to 550 after not making a payment for a while.

While they are a Faustian deal, you do want one. Much of our society is built around credit scores and the credit reporting companies. It sucks, but you have to deal with it. Find a credit card which doesn’t charge an annual fee, and which provides some sort of kick back you can make use of. Use this for everything, and pay it off completely every month. Use the points/miles/etc when possible.

There are two primary reasons for this. First off, it gets that credit score up. You want a high credit score as it’s often used for things like background checks. It’s annoying, but you’re not going to win the fight against it. Second, using a credit card comes with some protection for you money. If your card number gets compromised (and it will eventually, if you’re using it) credit card companies have some legal requirements to refund you for the fraud. When paying for things with debit cards and ACH transactions, those protections aren’t as strong and you may end up out some money.

The one thing I can’t emphasize enough is, pay the damned thing off every month! It’s easy for these to get out of hand. And with your current credit score, the interest rate is going to be in the range “fuck your wallet”. Letting any charges roll over is just pissing away money.

Lastly, once you have your credit accounts created freeze your credit. Don’t let them trick you into “monitoring” or other bullshit half-measure, do the freeze.

I wouldn’t expect it to replace people. It will make workers more productive. However, because it is already pretty well spread through most companies, those productivity gains will only lead to competitive advantages for companies with highly skilled workers.

Think of it like a chainsaw for lumberjacks. A lumberjack with a chainsaw is going to be far more productive than one with just a hand axe. But since every company equips their lumberjacks with chainsaws, they aren’t really at an advantage, chainsaws are now just a cost of entry for a company. Also, lumberjacks are required to know how to use a chainsaw. But they are ok.

For knowledge workers, AI is our new chainsaw. We’re going to learn to use it. And it’s going to be part of our jobs going forward. From my own experience, it has it’s uses and is pretty good at certain tasks. It can also be endlessly frustrating at tasks where it’s not well suited or the training isn’t up to snuff. We just have to learn and adjust to a world where the tool exists and is used everywhere. The genie isn’t going back in the bottle.

Not surprising. Web search from the Start Menu was always a bad idea.

Hell, I’ve had to deal with users getting their systems compromised because of this idiocy. User typed ‘ms teams’ in the start menu, clicked on the first link and ended up at an attacker’s page which mimicked the official Teams download page. User clicked “Download”, received the trojaned .msi file and ran it.

Sure, there’s some blame to go around in that case (and we finally got some default configuration changes out of it), but the fact that Microslop’s greed led to a malvertising link showing up in a user’s Start Menu is indicative of everything wrong with Windows 11.

All of the above.

Is it that ISPs are being paid by tech-bros to assign them these IPs?

Bullet Proof Hosting is a thing. Some ISPs basically advertise to criminals about their ability to evade take down orders and unwillingness to work with law enforcement. So, some infrastructure ends up on these devices. However, the IP ranges from these services often get discovered and are added to public reputation and block lists.

Along side this, cloud providers are pretty bad about policing their networks. On my own home server, I have blocked much of the Digital Ocean IP space, as it’s home to a lot of scanners, bots and other malicious traffic.

Is it that residential devices have been hacked /contain malware that does this?

This happens, a lot. The Mirai Botnet thrived on compromised home routers. People are pretty bad at updating their devices and many SOHO routers ship with some pretty bad vulnerabilities. It’s only a matter of time until someone finds an unpatched or misconfigured router and adds it to a botnet. People also get phished or install trojans all the time, adding to botnets. Darknet Diaries just had a fantastic episode on the Bayrob malware, part of which was turning infected machines into a custom botnet.

Is it trivial for companies to assign themselves residential IPs?

Some ISPs just look the other way when they get reports of malicious activity on their network. Also, attackers can force a DHCP refresh and just get a new IP when the old one seems blocked. Getting one in the first place is often as simple as signing up for service and/or compromising someone’s home PC and using it as a relay.

Paid volunteers are doing this for AI companies?

This probably happens. Afterall, we’ve already seen a company selling an AI product which was just workers in India.

Obviously this is a problem because one can rotate / cycle through residential IPs and if I aggressively block each offender in my logs permanently, then the next person assigned this IP who may be a legitimate user will be unable to access my site.

Look into Fail2Ban. This program monitors your logs and will ban IPs automatically based on criteria you set. This can include specific HTTP requests in your web logs. The ban can be permanent or can be time limited. For example, I have a container running in a cloud provider which I use to proxy requests through my ISP’s CGNAT setup. There is an NGinx reverse proxy running there and I have fail2ban watching the access log. If certain request strings are seen, the sending IP gets dumped in a permanent jail. I also have it scanning the sshd logs and banning IPs which fail to login 3 times within a short period.

It’s far from a silver bullet, but it’s something which should be running on any web facing system. Attackers will always be rattling the door knobs. There is no reason to let them keep rattling away.