21–30 of 132 posts
I don't. my family is all adult individuals so we all do whatever we want and are able. I do not go around imposing my beliefs upon them. They have their own problems to be bothered with mine too.
Everyone else: not my circus, not my monkey.
I have done zero or little past basic configuration and have had no issues or surprises.
There seems like a good OSS project - a bit of WMI a bit of bash - so I am interested if anyone has a idea.
All secure tasks like handling of IDs, banking, trading, etc. must be done through managed Linux workstations (Landscape with master image), or managed VDI. Keepass is used to store credentials. There is a network storage accessible only to those workstations containing important documents. A second storage area is avaliable for unmanaged and Windows devices.
Windows devices have Group Policy set for update settings, but generally users can do whatever they like. Mobile devices are expected to be patched but they have free reign. Haven't found a good management solution for Windows and mobile yet.
Wifi uses EAP-TLS, no exceptions and no guest devices permitted. As a result IOT and smart home devices are not allowed on the network since they don't support EAP-TLS. Certificates are issued per device and allow access to different services like VPN etc.
I currently don't have managed switches so mobile devices and personal workstations do share the same network as my servers and such, but all local services like network storage are encrypted and require authentication. Ideally I'd have VLAN segregation, but this will have to wait for the next network upgrade.
I preconfigure all windows machines in my family, and take away their local admin rights. No crapware installs, no disabling of updates or defender. No microsoft accounts. They get firefox browser with adblocker preinstalled. I manage their important passwords (eg fastmail) and trained them to rely on firefox sync for the recoverable accounts. I use MeshCentral for remote administration (amt)… its amazing for the pri…
Only apps that truly need admin rights (that install services, etc.) would be blocked. Everything else is wide open.
The admin rights restriction on app installs was almost just a convention that people followed. Now that the app incentives have changed (malicious apps don’t try to take over the machine anymore, they just try to steal your data), admin rights restrictions are becoming irrelevant.
+ Network is covered by pihole (and in exchange, plex/jellyfin/etc access works nicely)
+ Smart home stuff is managed by me. Everyone has admin rights but shared terminals (eg kitchen panel) are unpriviledged users.
+ Everyone has a home directory on the homelab they can back up to with as much space as they want (4tb+). I help them set it up if they ask.
+ Haven't done this yet but would like some kind of network level monitoring for threats (viruses, cryptominers, etc)
Things intentionally not done:
+ I don't install anything on folks devices.. at all, but never without their consent and without them having an off switch.
+ We have cams but everyone can turn them off and view recordings. Recordings are kept only for a short timeframe. Cams are all visible/known.
+ I intentionally collect no logs of dns or other stuff. When I do occasionally need to debug an issue, I let everyone know I am flipping on logs for a few minutes.
Empower users, don't control them.
Earlier quoted context omitted.
a physical jail cell and a faraday cage and you'll only need to tighten the chains a little more!
Two of the four homes already have a faraday cage :) It was built by a german chemicals company and the reinforced concrete blocks signals.
When I moved out I told the landlord that he should use it as a selling point, as some people in the area had just tried (and failed) to sue the library for not respecting their wifi allergy.
+ Family 1Password so everyone can securely manage passwords and share logins + Network is covered by pihole (and in exchange, plex/jellyfin/etc access works nicely) + Smart home stuff is managed by me. Everyone has admin rights but shared terminals (eg kitchen panel) are unpriviledged users. + Everyone has a home directory on the homelab they can back up to with as much space as they want (4tb+). I help them set it…
I install whatever I can to control/centralize the devices of my wife and parents. The less they know the better. Because your know, I am the 24/7/365 all-knowing support.
I do not do this with my teen kids. They can manage their stupid themselves. Until recently I had them tracked in Google maps but not anymore. They do see me though.
Jokes aside,
> making sure they have control of their passwords and accounts in a safe matter.
This looks like two requirements. Control your passwords and accounts and safeguard them. Because saving via Chrome, though unpopular, is quite safe but you give up control.
I've found this to be useful lately as I go through and take control of my login credentials:
https://mullvad.net/en/blog/2021/11/15/forget-your-passwords...
Earlier quoted context omitted.
> We have a WhatsApp group where they can ask whether something is dodgy. They don't use it for chitchat, so anything that comes through, I treat urgently. I really like that idea.
Until an older relative uses that same group for something completely unrelated.