[-] digdilem@lemmy.ml 3 points 3 days ago
[-] digdilem@lemmy.ml 4 points 5 days ago

Microsoft was forced by regulators overseas to allow ring 0 third party software as part of antitrust proceedings.

Interesting - I wasn't aware of that. Gave me a few minutes of interesting googling, thanks.

Looks like some people don't agree that is an excuse.

Also worth remembering is that Crowdstrike stopped RHEL 9 machines booting in a vaguely similar update to their falcon service a few months earlier, so it's not something that is exclusive to Windows. That also needed manual intervention to get vms booting. (I dealt with that one too - but it's easier to roll back to the previous kernel with Linux and we had fewer machines that were running falcon) Not surprisingly, there was a very similar blame game played them.

[-] digdilem@lemmy.ml 7 points 5 days ago

If my work were to remote wipe, I have assumed that would only affect the (second) user profile which has those apps, and not the main user account.

My understanding is that these tools offer a factory reset, so they would wipe everything. After all - if the phone is stolen, you wouldn't want to just wipe one profile and leave data within another.

[-] digdilem@lemmy.ml 7 points 6 days ago

You should get a second phone for work related things

Slight correction: OP's employer should get him a second device if they require him to access work email away from his office during work hours.

[-] digdilem@lemmy.ml 28 points 6 days ago

Don't.

Two reasons:

Many employers require you to install phone-management software as part of the data loss mitigation/data exfiltration requirements - and those requirements might be set by their insurers.

This gives them the ability to remotely lock or wipe your phone at any time - useful to them because they remove company data if you lose your phone, or you leave the company, or are suspended for any reason. Obviously that'll also lose any personal data on the phone, but that's your problem, not theirs. They can also monitor its location and similar things.

That's obviously a reason why you should never, ever, use a work-issued device for personal use - besides it being against their acceptable use policy. If your employer requires you to check email then they are required to issue you the means to do so. They cannot insist that you use any personal devices for that.

It's bad for your mental health.

Keep work to work hours. Keep work devices for work. Keep personal hours and devices for your personal use.

This physical separation requires a little discipline but, having been on all sides of this barrier (employer, employee, suffering with poor mental health, and currently, in good mental health) - I know this to be the only way to achieve a health balance.

[-] digdilem@lemmy.ml 1 points 6 days ago* (last edited 6 days ago)

Cylance was comparable several years ago. But, as you say, Blackberry bought it. Development effectively stopped at that moment. Reported bugs were going un-triaged and the software stopped moving forwards and AV software that isn't constantly adapting becomes a security risk in itself. The two are not comparable now - CS has a lot of extra features, especially in attack monitoring and analysis.

We were Cylance customers, and we changed to Crowdstrike when our contract expired. It was the right choice at the time, as was our decision to choose Cylance before them. Turns out we have pretty crappy luck.

[-] digdilem@lemmy.ml 20 points 6 days ago

They have a shitload of big contracts with a great many companies across the world. Money keeps coming in.

Legal actions take time. Years. Sometimes decades.

The software, when it isn't bricking computers, is actually pretty good.

This could equally have been caused by any other software running at ring 0. That's most antivirus software and most drivers. Drivers caused BSODs all the time - the difference here is only one of scale and timing. And, as it turns out, some pretty terrible quality control, test processes and release scheduling - and that is likely to be the focus of many of the legal actions.

Your reference to a hacker is spurious - deliberate vs accidental is a major distinction. As is cause and effect - Microsoft can be seen as equally to blame for allowing software to run at ring 0 and allowing this to happen.

[-] digdilem@lemmy.ml -3 points 6 days ago

Nice ditty.

What reason do you suggest why “his or her” would be preferable to “their” in this context?

Regional dialect, fluidity of language, variety - even habit.

“It’s grammatically incorrect” argument doesn’t hold much water

Oh, I do respectfully disagree with that, especially when you cite medieval English but reference an American language dictionary as your source.

I could just as viably give "his or hers" as equally valid as "theirs", because it is. We're not newspaper headline writers, nobody penalises us if we use a few more characters for any reason. And you could switch back and forth between them both for variety.

[-] digdilem@lemmy.ml 110 points 1 month ago

Over the past year Musk has removed all masks and clearly believes he can operate beyond the law. His motives are clearly to watch the world burn. He is an extremely dangerous, unpredictable and powerful man, threatening democracy across the globe.

Our governments need to protect us from him. Brazil's being brave here, I hope they're just the first.

[-] digdilem@lemmy.ml 121 points 2 months ago

No shit. The amount of far-right propaganda, hate and disinformation it's pushing is so much that it's pretty much over the line as an extremist site now, and I expect it to start getting flagged as that with a lot more organisations.

Musk wants to set the world on fire and X is his box of matches.

[-] digdilem@lemmy.ml 66 points 2 months ago

I lost a day's holiday, and our team spent 8 man days on this entirely preventable mistake.

$10? Try extending our licence by another year for free, that might start going towards it.

195
submitted 5 months ago* (last edited 5 months ago) by digdilem@lemmy.ml to c/linux@lemmy.ml

I host a few small low-traffic websites for local interests. I do this for free - and some of them are for a friend who died last year but didn't want all his work to vanish. They don't get so many views, so I was surprised when I happened to glance at munin and saw my bandwidth usage had gone up a lot.

I spent a couple of hours working to solve this and did everything wrong. But it was a useful learning experience and I thought it might be worth sharing in case anyone else encounters similar.

My setup is:

Cloudflare DNS -> Cloudflare Tunnel (Because my residential isp uses CGNAT) -> Haproxy (I like Haproxy and amongst other things, alerts me when a site is down) -> Separate Docker containers for each website. On a Debian server living in my garage.

From Haproxy's stats page, I was able to see which website was gathering attention. It's one running PhpBB for a little forum. Tailing apache's logs in that container quickly identified the pattern and made it easy to see what was happening.

It was seeing a lot of 404 errors for URLs all coming from the same user-agent "claudebot". I know what you're thinking - it's an exploit scanning bot, but a closer look showed it was trying to fetch normal forum posts, some which had been deleted months previously, and also robots.txt. That site doesn't have a robots.txt so that was failing. What was weird is that the it was requesting at a rate of up to 20 urls a second, from multiple AWS IPs - and every other request was for robots.txt. You'd think it would take the hint after a million times of asking.

Googling that UA turns up that other PhpBB users have encountered this quite recently - it seems to be fascinated by web forums and absolutely hammers them with the same behaviour I found.

So - clearly a broken and stupid bot, right? Rather than being specifically malicious. I think so, but I host these sites on a rural consumer line and it was affecting both system load and bandwidth.

What I did wrong:

  1. In docker, I tried quite a few things to block the user agent, the country (US based AWS, and this is a UK regional site), various IPs. It took me far too long to realise why my changes to .htaccess were failing - the phpbb docker image I use mounts the root directory to the website internally, ignoring my mounted vol. (My own fault, it was too long since I set it up to remember only certain sub-dirs were mounted in)

  2. Figuring that out, I shelled into the container and edited that .htaccess, but wouldn't have survived restarting/rebuilding the container so wasn't a real solution.

Whilst I was in there, I created a robots.txt file. Not surprisingly, claudebot doesn't actually honour whats in there, and still continues to request it ten times a second.

  1. Thinking there must be another way, I switched to Haproxy. This was much easier - the documentation is very good. And it actually worked - blocking by Useragent (and yep, I'm lucky this wasn't changing) worked perfectly.

I then had to leave for a while and the graphs show it's working. (Yellow above the line is requests coming into haproxy, below the line are responses).

Great - except I'm still seeing half of the traffic, and that's affecting my latency. (Some of you might doubt this, and I can tell you that you're spoiled by an excess of bandwidth...)

  1. That's when the penny dropped and the obvious occured. I use cloudflare, so use their firewall, right? No excuses - I should have gone there first. In fact, I did, but I got distracted by the many options and focused on their bot fighting tools, which didn't work for me. (This bot is somehow getting through the captcha challenge even when bot fight mode is enabled)

But, their firewall has an option for user agent. The actual fix was simply to add this in WAF for that domain.

And voila - no more traffic through the tunnel for this very rude and stupid bot.

After 24 hours, Cloudflare has blocked almost a quarter of a million requests by claudebot to my little phpbb forum which barely gets a single post every three months.

Moral for myself: Stand back and think for a minute before rushing in and trying to fix something in the wrong way. I've also taken this as an opportunity to improve haproxy's rate limiting internally. Like most website hosts, most of my traffic is outbound, and slowing things down when it gets busy really does help.

This obviously isn't a perfect solution - all claudebot has to do is change its UA, and by coming from AWS it's pretty hard to block otherwise. One hopes it isn't truly malicious. It would be quite a lot more work to integrate Fail2ban for more bots, but it might yet come to that.

Also, if you write any kind of web bot, please consider that not everyone who hosts a website has a lot of bandwidth, and at least have enough pride to write software good enough to not keep doing the same thing every second. And, y'know, keep an eye on what your stuff is doing out on the internet - not least for your own benefit. Hopefully AWS really shaft claudebot's owners with some big bandwidth charges...

EDIT: It came back the next day with a new UA, and an email address linking it to anthropic.com - the Claude3 AI bot, so it looks like a particularly badly written scraper for AI learning.

view more: next ›

digdilem

joined 1 year ago