BonkTheAnnoyed

cross-posted from: https://lemmy.blahaj.zone/post/45069925

cross-posted from: https://piefed.blahaj.zone/c/asktransgender/p/856250/was-the-gcs-provider-wiki-from-reddit-preserved-or-moved-somewhere

Back in the day that Wiki was an amazing resource with descriptions, names, providers, and ratings, and I think stories for all kinds of gender confirmation surgery > > > > I deleted my account years ago before even moving to piefed or Lemmy or whatever it was back then. > > > > Is it still around? Is it accessible somewhere without id verification or any of the other bullshit that Reddit is doing now?

cross-posted from: https://lemmy.blahaj.zone/post/37920667

There are dozens of options across all platforms to seamlessly integrate PGP email signing and encryption.

I use Gnome's key manager with evolution and it's ridiculously simple...

It's been like 30 years -- what's holding us all back?

cross-posted from: https://lemmy.blahaj.zone/post/37920667

There are dozens of options across all platforms to seamlessly integrate PGP email signing and encryption.

I use Gnome's key manager with evolution and it's ridiculously simple...

It's been like 30 years -- what's holding us all back?

There are dozens of options across all platforms to seamlessly integrate PGP email signing and encryption.

I use Gnome's key manager with evolution and it's ridiculously simple...

It's been like 30 years -- what's holding us all back?

following up on my previous post:

it turns out that, like anything else weird in infrastructure, it was DNS

I registered mydomain.com as my primary router’s domain, re-ran the experiment with a fresh 128 char subdomain, and I received zero scans on the new domain.

Now my question is, who’s making that one query that leaks my domain name? Is it Apache on startup?

One solution is to resolve all my subdomains on /etc/hosts so it never has to leave the box, but I’m curious what a more experienced net admin would suggest.

I generated 16 character (upper/lower) subdomain and set up a virtual host for it in Apache, and within an hour was seeing vulnerability scans.

How are folks digging this up? What's the strategy to avoid this?

I am serving it all with a single wildcard SSL cert, if that's relevant.

Thanks

Edit:

• I am using a single wildcard cert, with no subdomains attached/embedded/however those work
• I don’t have any subdomains registered with DNS.
• I attempted dig axfr example.com @ns1.example.com returned zone transfer DENIED

Edit 2: I'm left wondering, is there an apache endpoint that returns all configured virtual hosts?

Edit 3: I'm going to go through this hardening guide and try against with a new random subdomain https://www.tecmint.com/apache-security-tips/

cross-posted from: https://lemmy.blahaj.zone/post/36713454

cross-posted from: https://lemmy.blahaj.zone/post/36713215

I don't even know what else to add to this headline. This is so fucked up and tragic scary and infuriating and it will in no way slow the resistance.

I don't even know what else to add to this headline. This is so fucked up and tragic scary and infuriating and it will in no way slow the resistance.

The instances that give the best results seem to also get throttled pretty often on the source search engines, to the point of near uselessness.

Thinking of hosting my own, but the maintenance seems pretty involved according to the docs.

What's your experience been like?

Edit: all right y'all, thanks for the feedback. I'm going to spin up an instance.

I run WireGuard on my router to hit my LAN services (SAMBA, home assistant, etc) from afar.

But when I enable the VPN client on my router, I can no longer access LAN services over Wireshark. "Allow LAN access is set to 'true'" on the UI (Merlin).

Has anyone else run into this? Any ideas?

cross-posted from: https://lemmy.blahaj.zone/post/34623175

How realistic is this architecture? It's been a while since I've set something like this up for work.

The thought behind this layout is that having only one machine hanging out there with just Apache and ssh (from lan only, non-standard port), and forwarding via Mod_Proxy any services I might want to share with non-LAN friends/family (photos, docs), is a smaller exposure than hosting all my VMs in a DMZ and hoping that the one server doesn't get nuked.

Something like: DNS -> public-zone{ www-serv } <-> firewall-1 <-> lan{ vm-host <-> firewall-2 <-> (printers, laptops, etc) }

firewall-1 is actually a router running Tomato, with custom iptables rules. That way if www-serv is compromised the attacker can't just drop some rules.

firewall-2 is just iptables rules on vm-host

all LAN computers' iptables are a little more permissive, with holes for SAMBA, CUPS, and ssh on non-standard port.

What do you think? Is this sufficient? What would you do differently?

How realistic is this architecture? It's been a while since I've set something like this up for work.

The thought behind this layout is that having only one machine hanging out there with just Apache and ssh (from lan only, non-standard port), and forwarding via Mod_Proxy any services I might want to share with non-LAN friends/family (photos, docs), is a smaller exposure than hosting all my VMs in a DMZ and hoping that the one server doesn't get nuked.

Something like: DNS -> public-zone{ www-serv } <-> firewall-1 <-> lan{ vm-host <-> firewall-2 <-> (printers, laptops, etc) }

firewall-1 is actually a router running Tomato, with custom iptables rules. That way if www-serv is compromised the attacker can't just drop some rules.

firewall-2 is just iptables rules on vm-host

all LAN computers' iptables are a little more permissive, with holes for SAMBA, CUPS, and ssh on non-standard port.

What do you think? Is this sufficient? What would you do differently?