Kid_Thunder

Depends on if there’s an IPv6NAT and how your ISP converts between IPv4 and IPv6 or actually supports IPv6 straight through. It also depends on your router.

Currently, there’s still some debate since IPv6NAT (NAT66/NPT6/NATv6) isn’t really needed for WAN boundaries for the reasons NAT exists. However, without it you are right on that this will be a problem for the consumer because PCs, IoT devices, printers, circuts or whatever my wife has, etc. could all be exploitable and even worse, you may never know you’re contributing to the botnet.

As an example, I have a global IPv6 on a few on my devices. They can connect to IPv6 if it originates from me but if it originates from them or is UDP it doesn’t route to my IPv6. My router doesn’t care. It’ll route it just fine either way. It would appear that my ISP has me behind one of the IPv6 NATs.

I’d imagine that’s true for most people at home.

NAT provides some measure of security as pure coincidence to how it works. It is not designed or intended to provide security. It does not inspect packet payloads in order to filter them for security. It looks at the header and attempts to route it to an internal IP address (your devices on your LAN) and if it cannot, it will drop the packet because the header will only have the external IP address – the packet has no idea which device it is supposed to go to. Forwarding a port is telling the NAT to assume that when a packet hits a certain port, if it doesn’t know the destination internal IP, forward it to some internal IP anyway.

The reason you can connect to websites, ssh outside, FTP, whatever, is because your connection comes from your internal IP first to some other IP and therefore, NAT knows which internal IP to route those packets to.

Take for example this scenario:

You download some software. It has malware that provides command and control (C2) to someone else outside of your network. A firewall and/or antivirus may be able to stop this and hopefully notify you. NAT will not help here. Furthermore, if you have uPNP enabled (usually it is by default on your router) the malware can forward any ports through your NAT to the compromised device opening it up to bot attacks and the like.

Another scenario:

You want to play a video game with you and your friends and you’re going to host it. So either you manually forward those ports or perhaps uPNP just does it for you. That game has an exploit known by attackers, or perhaps it can just be DDoS’d. Your NAT isn’t going to stop that. Hopefully a firewall will help you here. It definitely will if you set up explicit rules so that if they aren’t your friend’s IPs it will drop them. Though it is possible the game is exploitable and your friend’s are compromised.

Take for example malware has been known to spread via Minecraft.

As I understand it, NAT is a firewall

NAT is not a firewall. NAT does not inspect packet payloads, it doesn’t do anything except attempt to route packets to where they are supposed to go. If the connection originates from outside or it is a ‘connectionless’ protocol, the NAT has no idea which internal IP to route to, so it drops the packet.

NAT provides some security by sheer coincidence and not by design.

I disagree about ClamAV in-so-far as its vanilla virus signature database. You really should use some third party ones though you have to be careful since some like specifically malware patrol are way too general. For example, malware patrol will identify any document mentioning any drive.google.com URL a virus.

In regards to MP, I actually submitted the offending signature to MP support and the CSR told said and I quote “Unfortunately that is not a false positive, there is confirmed malware hosted at drive.google.com.” It caught my attention because a bunch of READMEs from some github projects and some HTML files ended up in the quarantine. I asked if future signatures would include this general URL since I’m going to blacklist this specific signature and was told basically ‘yes, probably’.

I do recommend third parties though and most are free for personal use. Some require a key and therefore some sort of sign up but it isn’t terrible except perhaps in regards to where I’m posting, some would consider it so.

Yeah you can use any executable but hh is just short and in everyone’s path.

In powershell:

for(){hh \}

Also the beeping will be annoying.

For Windows you can use KDE Connect (and also MacOS) or Microsoft Phone.

For Linux Mint there’s KDE Connect or GSConnect (GNOME Extension) though I don’t use GNOME often, I remember liking KDE Connect better still.

OK

Your immutable OS stays stable. For example, running a sudo pacman -Syu with a bunch of stuff from AUR in your Arch container for example will not bring down your OS or otherwise make it unstable. The immutable image you first install has been tested and it is the same image as the testers – same with the upgrades and updates, so long as you don’t overlap the image with rpm-ostree in this case.

Immutability keeps your OS stable and if something does happen to go wrong, you just roll it back.

If that isn’t something you need/want then that’s not something you need/want.

Yes, though keep in mind containers aren’t like VMs so the hardware isn’t virtualized or anything. The root system and everything in it is still immutable as well. In usage, it doesn’t matter for the container but it isn’t changing the root since what is writable to the container is outside of the root.

Using containers this way is the way Silverblue was intended to be used for by the user and pretty much any other immutable distro of note.

Are you saying you can’t use toolbox or distrobox for that?

You should be installing software with stuff like flatpak, toolbox or distrobox. If you treat the immutable image as a mutable one there really isn’t an improvement except for less of a chance of instability of updating/changing software that’s running in memory already.

YouTube, Facebook, forums and pretty much any echo chamber. Pretty much anything that has replaced AM radio and shitty newsletters. In the ~2020’s also parroting politicians – I’m sure I don’t need to go over the last 4 years of examples, so how about the Bowling Green massacre that never happened?

In short, his argument in court is that the lack of evidence is evidence of criminal intent.

In a memo sent to employees Mozilla says it wants to bring “trustworthy AI into Firefox”. To help it do this sooner it’s merging its Pocket, content, and AI/Ml teams.

That’s pretty concerning. It could go either way but I assume they are going to try to shove more sponsored content in an effort to further monetize Firefox in spite of getting hundreds of millions of dollars a year in donations. Maybe I’m just cynical about Mozilla though.

The SSH keys don’t help me if I get locked out of a Domain Controller unless you’re using OpenSSH (which is now a native feature you can turn on). In that case you can actually still log into the DC via command line because it authenticates based on authorized_keys and not the LDAP of the DC. I actually do this on the enterprise, not because I may get locked out but because it is just convenient. Granted you’ll have to execute powershell on the command line once in to use the AD cmdlets.

On the other hand when you create a DC now-a-days (Server 2019…I don’t remember if this is asked in the wizard when in Server 2016) you can create a “Directory Services Restore Mode” password which is basically a local admin account on the DC that you can log into only when the DC is booted into safe mode. You’ll be asked to create it when you promote your DC.

Personally I use FreeIPA for my LDAP. I like that I can create sudoers rules from one centralized place and manage ssh keys across all clients. Granted I could just use Ansible I suppose, which is how I update multiple distributions in my network and online but I like that I can just change SSH keys and sudoers from one place easily instead of changing tasks/roles. I also usually run cockpit even on my non-Red Hat distros with SSH keys just so I don’t have to log into everything though it is somewhat limited outside of the Red Hat sphere.

If you don’t want to use ProxMox or some other specialized HyperVisor ecosystem, you can also use Cockpit to manager your VMs along with your Pods. I wish there’d be more attention to it for features because it feels like it could do a lot more.

I also don’t really worry about locking myself out for two reasons:

1. I use SSH keys.

2. I also have a break-glass local account on every system…with SSH keys. If its on your local network, you can use VNC/VM console/Remote Desktop with a local account while only allowing SSH with keys if you’d like. Just make sure if you’re going to allow remote access outside of your network that you never forward the VNC/RDP ports. For SSH when I do this I always pick some random port – never default and never common ones like 2222 to at least keep my logs less noisy from the botnet auto attacks.

For my online VPS’ I use a firewall with geoIP from Maxmind and drop all ports but 443 from the world, except for whatever country I’m in. I drop all packets from certain countries that seem to auto-attack more often than others. I try to drop packets from all known (to me) Shodan scanners. If I’m not traveling I just restrict all other ports to my public IP’s subnet though my IP hasn’t changed for years. For status checking services like StatusCake, I use the “push” method instead using a simple cron job with curl instead of relying on servers around the world checking my ports. In this case, the services just check that my server has successfully hit them within X minutes to be “up”.

As much as he may have a case so long as he didn’t act against store policy and actually attempted to he probably has a case, even in an at-will state.

The problem is that it will likely be difficult to get an attorney to represent him without an actual retainer because these cases usually draw out for a long, long time and are difficult to fight. Unless there’s a legitimate case for a class action, then the chances are slim that anyone can afford to fight the case, even if they ultimately could win because no attorney is going to devote years to this for a ‘maybe’.

The only route there may be a hope of winning here is for him to apply for unemployment and if he doesn’t get it, to appeal himself. He may get that as small of a win as that is.

I was just replying tongue-in-cheek to this, though I really do have the cups.

Aw. I just have the older McDonald’s Garfield cups with all the lead paint instead of the plutonium I guess.