Knocker, a knock based access control system for your homelab

Post by hrimfaxi » Wed, Oct 22, 2025, 10:39 PM UTC

akerl_ wrote: post #125

hrimfaxi wrote: post #122

Earlier quoted context omitted.

Don't compliance regimes like NIST 800-53 require logging access attempts, whether successful or not, and especially for privileged users?

> To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performan…

Post by Joel_Mckay » Wed, Oct 22, 2025, 10:46 PM UTC

immibis wrote: post #134

fencepost wrote: post #95

Earlier quoted context omitted.

"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"

These are what I call, corporate solutions. They're used to make CEOs feel good while deflecting blame, not to actually do the job. See also how nobody gets blamed if AWS goes down, but everyone who used a different host with higher uptime did get blamed when that went down. Open source tools are good at actually doing the job, as long as it's a programmer type of job. We've known how to do unbreakable encryption for…

Post by akerl_ » Wed, Oct 22, 2025, 10:49 PM UTC

hrimfaxi wrote: post #141

akerl_ wrote: post #125

Earlier quoted context omitted.

> To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performan…

I was thinking of: > The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. https:/…

Post by tptacek » Wed, Oct 22, 2025, 10:56 PM UTC

Joel_Mckay wrote: post #144

tptacek wrote: post #142

Earlier quoted context omitted.

I don't understand what you think CVE-2024-26950 has to do with this thread. Do you understand what that vulnerability actually is, or did you just go search "WireGuard CVE" to find ammunition?

Firewall administrative network port traffic priority is important for systems under abnormal stress.

Post by GuinansEyebrows » Wed, Oct 22, 2025, 11:31 PM UTC

Eisenstein wrote: post #32

nextlevelwizard wrote: post #28

Earlier quoted context omitted.

Github should have "LLM" as language for repos that self report to be vibe coded or at least this kind of disclosure should be at the top of the readme not after thought. Also the "If you're Anti-AI please don't use this." is pretty funny :D I guess I must be "Anti-AI" when I think this kind of code is wild to rely on.

I fully support the AI self-disclosure, but what I wonder what it is about AI generated code that makes this a separate problem from any other code where you don't know the programmer's competence? Is it because the AI can generate code that looks like it was made by a competent programmer, and is therefore deceiving you? But whatever the reason, I think that if we use it as a way to shame the people who do tell us t…