Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you trust that your personal machine is not compromised?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 469 posts

Re: Ask HN: How do you trust that your personal machine is not compromised?

#11

Post by jl6 »

I don’t have ultimate trust in any software or hardware, but I get to “good enough” by deciding which providers I trust:

* Software: Canonical, Google, Microsoft, Valve, Oracle, Dropbox. I install software from their official repos and keep it up to date. Anything 3rd-party/unofficial/experimental/GitHub goes in a VM.

* Hardware: I built my main PC from mainstream commodity components. I have no way of knowing if there are secret backdoors but I consider it unlikely.

I use a password manager, I enable 2FA, I turn off things I don't use, and generally have a low-risk hygienic approach to computing.

I’m also privileged enough to not be a “person of interest” so don’t feel the need to take any extraordinary precautions.

Yes, I’m aware of VM escapes. Yes, I’ve read Reflections on Trusting Trust. I choose to trust regardless because life’s too short for paranoia. As Frank Drebin said:

“You take a chance getting up in the morning, crossing the street, or sticking your face in a fan.”

Re: Ask HN: How do you trust that your personal machine is not compromised?

#13

Post by adriancr »

Just some generic things that should help avoid or clean up after a compromise.

- clean reinstall every month, just pick a new flavor of Linux to try out. (also helps ensure I have proper backups and scripts for setting up environment)

- Dev work I usually do in docker containers, easy to set up/nuke environments.

- Open source router with open source bios (apu2), firewall on it, usually reinstall once in a while.

- Spin up VMs via scripts for anything else. (games - windows VM with passthrough GPU for example)

- automatic updates everywhere.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#14

Post by mimimi31 »

tluyben2 wrote: post #10
codetrotter wrote: post #5

Noone has drained my crypto from my wallets yet. So either my personal machine is not compromised, or they think the amount of crypto in the wallets is too low. Jokes on them though, cause I am moving my crypto to a hardware wallet eventually

Quite an interesting honeypot really.

More like a canary I think.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#16

Post by NikolaNovak »

Great question. I don't anymore. Decades ago when I had a 286 and knew what each file did and what all the software was, and threats were limited and crude, I had good confidence of controlling my machine. Today, when my laptop has millions of files and each website - even hacker news - could inject something malicious and my surface is so broad (browsers applications extensions libraries everything) and virtually anything I do involves network connections... I just don't have the confidence.

FWIW, I try to segregate my machines for different categories of behaviour - this laptop is for work, this one is for photos and personal documents, this one is for porn, this one is if I want to try something. But even still my trust in e. G. software vlan on my router and access controls on my NAS etc are limited in this day and age.

I feel today it's not about striving for zero risk (for 99.99 of people) , but picking the ratio of overhead and risk you're ok with. And backups. (bonus question - how to make backups safe in age of encrypting ransom ware).

Re: Ask HN: How do you trust that your personal machine is not compromised?

#17

Post by 867-5309 »

adriancr wrote: post #13

Just some generic things that should help avoid or clean up after a compromise. - clean reinstall every month, just pick a new flavor of Linux to try out. (also helps ensure I have proper backups and scripts for setting up environment) - Dev work I usually do in docker containers, easy to set up/nuke environments. - Open source router with open source bios (apu2), firewall on it, usually reinstall once in a while. -…

>Spin up VMs via scripts for .. games

this is not sustainable. you do this once and then pray nothing breaks!

Re: Ask HN: How do you trust that your personal machine is not compromised?

#18

Post by adriancr »

867-5309 wrote: post #17
adriancr wrote: post #13

Just some generic things that should help avoid or clean up after a compromise. - clean reinstall every month, just pick a new flavor of Linux to try out. (also helps ensure I have proper backups and scripts for setting up environment) - Dev work I usually do in docker containers, easy to set up/nuke environments. - Open source router with open source bios (apu2), firewall on it, usually reinstall once in a while. -…

>Spin up VMs via scripts for .. games this is not sustainable. you do this once and then pray nothing breaks!

I just have a clone of a clean windows VM.

If something breaks or I get bored, nuke the active one and start clone, update it and make another backup, then reinstall games again.

On the other hand, gpu pass-through breaks once in a while and is annoying to fix.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#19

Post by rhn_mk1 »

jl6 wrote: post #11

I don’t have ultimate trust in any software or hardware, but I get to “good enough” by deciding which providers I trust: * Software: Canonical, Google, Microsoft, Valve, Oracle, Dropbox. I install software from their official repos and keep it up to date. Anything 3rd-party/unofficial/experimental/GitHub goes in a VM. * Hardware: I built my main PC from mainstream commodity components. I have no way of knowing if the…

What about publicly known backdoors in your hardware?

https://www.techrepublic.com/article/is-the-intel-management...

There is hardware that doesn't contain those at least, but it doesn't break power records.

Re: Ask HN: How do you trust that your personal machine is not compromised?

#20

Post by amelius »

gnfargbl wrote: post #9

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-... . It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock s…

Do you lock your computer every time you leave your desk?

And do you always check for keylogger thumbdrives and such?

Post reply on HN