• 0 Posts
  • 39 Comments
Joined 1 year ago
cake
Cake day: August 28th, 2023

help-circle
  • Peter F. Hamilton’s books may fit the bill: Futuristic, not hopeless/dystopic, and the main characters tend to make reasonable decisions. Be wrned though that he favours deus ex machina conclusions. Most will suggest Pandora’s Star as a starting point (with good reason, as the Commonwealth Saga is quite expansive), but it does not have to be. I personally read the Night’s Dawn trilogy first. The Salvation trilogy also stands on its own, and for a completely standalone book Great North Road was a good read.

    Adrian Tchaikovsky is another wonderful author! the Children of Time and Final Architecture series were quite enjoyable.

    Redemption Space (Alastair Reynolds) is another series one that I like to recommend. Closer to The Expanse. House of Suns also is a great read by the same author, as are several of his other stories.

    The White Space books by Elizabeth Bear should be on your reading list.

    Vorkosigan Saga (Lois McMaster Bujold) is a bit dated but similar to Vatta’s War in the earlier books. Later on the plot tends to be more along the lines of whodunnit mystery… in space.

    And let’s not forget another scifi favourite, Iain M. Banks! The Culture series are great of course, but I liked The Algebraist the best.















  • An open port is like a door on a building. It allows people from outside (the Internet) to go to the attached room on the inside (the service you’re exposing).

    Now is that’s the only room in the building (the computer is not used for anything else), and the building is alone in the middle of an island with no land access (the computer is separated from the network, like in a DMZ) then the second worst thing an attacker can do is squat in in and rifle through your papers (the configuration files). The worst thing they can do however is start using your address and the utilities you paid for to start some unsavoury business (make it part of a botnet).

    But if the server is not segregated from the rest of your network, they’ll start running into other rooms/buildings, getting their hands at anything they can. Your accounts, your identity, etc. You’ll be living in a really bad neighborhood, being shaken down for everything you have at every corner.

    Now for the type of door you’re putting on a building: if you just port forward it’ll be like a screen door. It keeps the bugs out, but any person can open it with ease or crash through it, and they can see what’s inside by just standing in front of it (server fingerprinting). If the services you run have a vulnerability it will be exploited. If you don’t have a firewall or intrusion detection it’ll be like putting a combination lock on the door and never checking if someone is trying all the numbers. The attackers WILL just keep trying until they succeed, and they’re really fast at it.

    So it’s not like you should never put a door on a building, but the door should be reasonably secure, with the appropriate strength, deadbolt, and depending on what you run a receptionist (reverse proxy) and security guard.



  • The CIS benchmarks for Linux are a good start. There are some off the shelf tools that let you run those, notably linux-bench. Another tool in a similar fashion is lynis. You can also use eBPF tools like callander to examine your workload behaviour and help tighten your seccomp policies.

    Once you’ve established a baseline for your system, you’ll next want to harden your environment. This means network scans, OWASP, etc. As far as off the shelf tools go, OpenVAS is quite popular even in Enterprise environments.

    Finally there’s the continuous security tasks. Continuous package updates, runtime security, log analysis, etc. There are some free tools that cover part of this like Security Onion, but if the price is right a SaaS tool can save you a lot of time.