101–110 of 239 posts
Earlier quoted context omitted.
Yeah and I don’t trust that a vpn would really care for my $5 a month or whatever when faced with state actions that if it came to that.
At least one VPN provider did just that https://torrentfreak.com/private-internet-access-no-logging-...
I’m thinking after the fact, if the government asked them to log future events.
Earlier quoted context omitted.
What's the better set-it-and-forget-it alternative? The Dream Machine Pro has been truly wonderful for me. I'm not interested in the equivalent of "a totally customizable Linux box running pfSense".
Mikrotik?
Then no thanks. I have a finite number of hours on this planet and I have no interest in spending more of them trying to configure network equipment with commands like
``` /ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related \ comment="fast-track for established,related"; add chain=forward action=accept connection-state=established,related \ comment="accept established,related"; add chain=forward action=drop connection-state=invalid add chain=forward action=drop connection-state=new connection-nat-state=!dstnat \ in-interface=ether1 comment="drop access to clients behind NAT form WAN" ```
Ubiquiti does a great job of having good defaults out of the box, a straightforward UI, and remote management. I could walk my mother through setting up Unifi equipment over the phone and even get so far as to grant remote access to me without ever leaving it in an insecure state. I wouldn't get past setting an IP address in the Mikrotik section before losing that.
> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to…
Proper opsec is you blackhole all traffic when the vpn isn’t active.
I can't believe someone can literally destroy its life for BTC. Imagine his family and close friends. His parents probably thought he was a tech wizard genius. And now he destroyed his reputation, his employer's, and he'll be behind bars for quite a few years. I hope he doesn't have kids.
And picture: he could have been the guy who did a great job "fixing" employer's lack of security. Have that on his resume, tell lessons learned on real world practice.
Why the hell would he even think about the FBI route in the first place?
Earlier quoted context omitted.
With wireguard since there is no "connection" to be maintained, you could argue this is a non-issue.
But Wireguard itself relies on an active internet connection, which needs to still be set up to not fall back on in case the wg connection deactivates.
Earlier quoted context omitted.
not necessarily. tons of ways to still be identified
Care to elaborate?
Makes me wonder if (at least some of) the posts dunking at the company leadership and the engineering in various comments around the internet had also been him.
I think there's a fair chance that whatever someone's mental/emotional state, if a workplace could motivate someone to act as extremely as he did, there are others similarly disenfranchised.
Earlier quoted context omitted.
Accounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards you'd expect of next level monitoring from companies such as CrowdStrike. It took Ubiquiti weeks to notice these issues and he used the AWS root account, this account should be actively secured and alerted for abuse using AWS GuardDuty or similar. I've made m…
But who configures AWS GuardDuty and who does it report to? Presumably the root account owner? In that case, wouldn't that be the cloud lead?
Earlier quoted context omitted.
if a security tool lets the user shoot themselves on the foot it's a problem of the security tool not of the user.
I’d be willing to bet that for most of the VPNs that are getting advertised by YouTubers (NordVPN, SurfShark, ExpressVPN, PIA, et al) it’s 100% marketing and they don’t actually care whether their “kill switch” works 100% of the time. After all, they are not as trivial to implement as it sounds.
For me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs. * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for wh…
While I agree this is demonstrative of overall less than adequate security practices, I’m unsurprised that a company that started with making hardware and only later added cloud functionality beyond a website/store was not initially setup as you described. What you described is the sort of setup I’ve been involved in the transition from what Ubiquiti has and what you just described, and it can be quite a lot of work…