Got a real laugh from the meme at the end of FOSS Weekly #26.34.
We are kinda dangerous (mostly in a good way).
8 Likes
I have seen people say that it’s possible to clean out W 11 to get rid of the ads and the crazy AI surveillance, but I haven’t used Windows in more than a decade other than to take a look, so I wouldn’t bother. W 10 is either unsupported or will be soon and with AI vulnerability discovery, it won’t be at all safe to use pretty soon.
1 Like
How safe is Linux in that scenario?
2 Likes
How safe is Linux in that scenario?
Slightly safer because it gets updates sooner. But things like the bash bug that was present for ten years mean that it’s far from invulnerable. Every time things update, the attack surface changes.
2 Likes
I think you have to assume linux is vulnerable, and keep it behind NAT and a firewall , wherever possible.
Changing your distro frequently probably helps confuse intruders too. … also rolling release will keep you more up to date.
I dont know about immutable distros … have not looked into that yet.
Obfuscation is not a form of security. The best it does is keep the simpletons out.
The best security you can have is:
- Only have that available which you need.
- Run everything service in its own virtual machine, in a root-jail.
- Keep things updated (this one is important).
- Get rid of anything you don’t need or use.
- Don’t give console access to every service (only ssh should have it), the rest has /bin/true as a console.
- A limited set of commands can be run as root, the rest doesn’t need root.
- NO windowing system.
- Full disk encryption.
- Headless mode – no mouse, keyboard, or screen configured.
- Logging of every command entered.
- Sanitize your input – so no code injection in those places vulnerable to it.
- A firewall which only allows those services out which need to be public. Admin access is only accessible through the ssh connection, which in turn is only accessible – and activated – through port knocking.
- And, of course, memory address randomization and ACL.
- Only access via USB (in case of emergency) and SSH.
Good luck hacking into a system configured like this. Now, this is not my system, but I do know what I would do if I were to manage a server (promptly lose the SSH key 
).
1 Like
Most of those good hints are for servers.
For a home computer the most important thing is to hide … behind NAT.
I think rarity rather than obfuscation. Linux has few issues because it is not popular… that may change.
A very unusual linux, or perhaps BSD, would be overlooked by most malware.
Unfortunately, I have some experience in this. You can disable them on Windows 11, but it’s a pain. Worst part, when there’s an update, a lot of the telemetry, as well as ads, I have previously disabled gets re-enabled, and even new ones added. Great times!
2 Likes
How can one tell if they are behind a NAT?
1 Like
You forgot to mention not using systemd.
Systemd presents an enormous attack surface.
Choose a small init system , runit or dinit.
1 Like
I used to have a NAT rule on my VDSL router to allow SSH in on a non-standard port - and - running fail2ban… That worked for a while - then stopped… When I logged a ticket with my ISP they advised the solution was a fixed IP address - which they allocated me with no additional charge…
I cutover to full fibre early last month - part of that was the ISP does “CG-NAT” - I’m not quite sure what that is or means - but - net result is the IP address my router gets, is not what gets reported e.g. “curl http://ipv4.icanhazip.com” output - or - my NoIP configured on my router…
I’m not even going to ask my ISP about why this no longer works - I can’t imagine there’d be a way to get a dedicated IP address on my router that a legit IPV4 external address…
Some UPnP stuff continues to work - regardless - like my IP cameras, and Resilio Sync…
So - I’ve replaced that (ssh via NAT to a Pi4) with using TailScale VPN - got it running on my JellyFin server - and now my Pi4 that I used to SSH to from the intertubes…
I don’t need to worry about fail2ban or using a different port for SSHD…
I’ve tested it - fire up the TailScale VPN on my phone, and I can use TermUX to telnet to my Pi4 on it’s VPN IP address…
How do you figure that? I’d suspect that because SystemD is so complex (yeah it seems unnecessarily so sometimes - I know) it would be easier to hack something simpler…
I know it would be way easier to “hack” SystemV init on a compromised system - get privileges - plonk a shell script in /etc/init.d/ then link to it from /etc/rc3.d/ or /etc/rc5.d/ - or just insert some code into an existing init script…
1 Like
Not so. In general small well crafted code presents few hack opportunities. You can understand it easier, but what hacking needs is slipups in the logic.
Forget sysVinit… it is hopeless old code. The path forward is dinit or maybe S6.
Keep intruders out. Once they gain entry the battle is lost.
1 Like
100%
I get sick of trying to tell “alleged” cyber security experts (no hands on practical experience - just a few letters after their qualifications, attended a few seminars, did a post-grad diploma et cetera) that a certain attack vector, or vulnerabilty - isn’t a huge risk because the “thing” is hosted internally and there’s no external access to it! But I gave up… Patch patch patch patch…
99/100 - a vulnerability is only that if your internal networks are already compromised - once that’s achieved - it’s open slather on anything they can port scan or whatever - and a CVE reported on an internal server is probably the least of your worries - but you can’t explain that to some of these people…
I remember having an argument with a Cyber Security “Officer” - they claimed I was breaching security by using telnet to connect to a TCP port (e.g. common test for Apache / NGinX : “telnet localhost 80”) - this “expert” was so ill informed they conflated “telnet” with telnetd!
Anyway - the chances of someone “accidentally” stumbling on my TailScale VPN are extremely low - i.e. as I’m now on CG-NAT - they can’t even port scan me!
3 Likes
The biggest problems with making coding hackerproof come with large , almost unmanageable projects … like browsers or systemd or the kernel.
Since we have to have these things, they need to be isolated as well as we can. So network setup is the key, as you say.
2 Likes
If someone has write access almost anywhere in /etc, the game is already over. The simpler the system, the smaller the combinatorial space to explore/defend.
2 Likes
If you want great control over running services on Windows 11, I’ve recently discovered Shutup10. It’s been very useful for me, and I suggest you check it out,
Ernie
2 Likes
If your device has an IP address starting with any of the following (192.168.x..x; 10.x.x.x, or 172.16.x.x), you’re behind a NAT. The next step that I’d recommend would be to visit Shield’s Up! to run GRC’s security checks, carefully reading everything there, so you can better understand Local Area Network (LAN) security. I hope this helps,
Ernie
1 Like
That second part is me! I use Garuda KDE-Lite Linux! 
Ernie
2 Likes