• 1 Post
  • 549 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle
  • NaibofTabr@infosec.pubtoSelfhosted@lemmy.worldSelf host websites
    link
    fedilink
    English
    arrow-up
    12
    ·
    edit-2
    9 hours ago

    I think the answer depends a lot on the use case of each business’s website and what the business owner/employees expect from it.

    Is the website a storefront? You’ll be spending a lot of time maintaining integration with payment networks and ensuring that the transaction process is secure and can’t be exploited to create fake invoices or spammed with fake orders. Also probably maintaining a database of customer orders with names, emails, physical addresses, credit card info, and payment and order fulfillment records… so now you have to worry about handling and storing PII, maybe PCI DSS compliance, and you’ll end up performing some accounting tasks as well due to controlling the payment processing. HIPAA compliance too if it’s something medical like a small doctor’s office, therapist, dialysis clinic, outpatient care - basically anything that might be billable to health insurance.

    Does the business have a private email server? You’ll be spending a lot of time maintaining spam filters and block lists and ensuring that their email server has a good reputation with the major email service providers.

    Do the employees need user logins so that they can add or edit content on the website or perform other business tasks? Now you’re not just a web host, you’re also a sysadmin for a small enterprise which means you’ll be handling common end-user support tasks like password resets. Have fun with that.

    Do they regularly upload new content? (e.g. product photos and descriptions, customer testimonies, demo videos) Now you’re a database admin too.

    Does the website allow the business’s customers to upload information? (comments/reviews/pictures/etc, e.g. is it Web 2.0 in some way) god help you.

    You’re going to expose this to the public internet. It will be crawled, and its content scraped by various bots. At some point, someone will try to install a cryptominer on it. Someone will try to use it as a C2 server. Someone will notice that you’re running multiple sites/services from one infrastructure stack and attempt to punch their way out of the webhost VM and into the main server just to poke around and see what else you’ve got there. Someone will install mirai and try to make it part of a DDOS service provider’s network.


  • While this article is not literally published by The Onion, it is in fact satire and not news, so I don’t think it really fits this community.

    I thought this bit about the therapist made it pretty obvious:

    “People are losing themselves,” said Dr. Aspen Riverstone, a local therapist who specializes in Post-Subaru Identity Crisis (PSIC).

    But if that wasn’t enough for you, the disclaimer at the end should be:

    This article is pure satire and should not be taken seriously (unless you, too, have questioned your entire existence after losing access to a forest green Subaru Outback—then we get it). No actual riots, therapy sessions, or underground Subaru trades took place (that we know of). And for those currently in crisis due to the lack of green Outbacks, stay strong. Your identity is more than your car. (Probably.)

    If you actually thought this was “typical Oregon stuff”… I’m afraid you’ve eaten the onion.









  • Ah, I see, I misinterpreted your original post.

    Well in any case, the email will probably be the recovery path for the accounts you set up (“I forgot my password”), so if you want to stay in control of them you should pick a service that encrypts the inbox.

    You might also find subaddressing useful. For example, if you have myaccount@email.com and you then use myaccount+pixelfed@email.com, and later that email subaddress gets exposed and you start getting spam specifically through it, then you know which account was exposed (the pixelfed one) and can attempt to address it individually. Basically the +alias lets you know the source(s) of incoming emails because you know where you’ve used that alias. Many services support this feature.



  • So when it comes to encryption for digital data there are really two concerns:

    1. encrypted at rest
    2. encrypted in transit

    Your options for encrypted email providers are limited:

    and Protonmail seems incorrect for this because it largely wouldn’t be encrypted mail.

    I’m curious why you think so?

    Proton’s inboxes are encrypted, so that’s (1) handled.

    For (2), Proton-to-Proton emails are automatically encrypted. Proton-to-WKD-enabled-services are also automatically encrypted:

    Proton also supports automatic external key discovery with Web Key Directory (WKD). This means that emails sent to other providers which use WKD will be automatically encrypted with OpenPGP as well, without the need to manually exchange public PGP keys with your contacts.

    And finally, emails to non-secure services can be encrypted, but you must provide the decryption password to the receiver through some other method. These emails can also be configured to automatically delete after a set expiration time.

    This is the most feature-complete encrypted email service that I’m aware of, it basically covers all cases that it is possible for Proton to cover on their own service, anything more would require cooperation from the other service(s). No email service could possibly force an inbound email to be encrypted in transit, the sending service has to do that, and that’s really the only part that Proton doesn’t have a feature for (because it’s impossible). If encryption is your concern, I don’t think there are any better options right now.








  • I use gui more for file management. I dont like using the terminal for that since I have to remember everything constantly.

    Well of course. The only time terminal is really useful for file management is when you want to do mass operations (e.g. find all filenames that match a pattern and rename them with another pattern) or when you’re managing a remote/headless system.

    Why isnt the /home separate from /root by default? Frankly I dont see any benefits from it being in there.

    It complicates the setup process to make multiple partitions. Generally speaking I wouldn’t want an automated process to mess with partitioning a drive for me, I would either be satisfied with the basic single-partition setup or else set up the partitions manually.

    If you do set up your partitions manually, make sure you create a swap partition of at minimum 2GB, though if you plan to use hibernation you’ll need enough swap to store your entire RAM contents, plus additional space for the swap itself.

    Your OS partition doesn’t need to be all that big, Linux tends to be pretty efficient. 30GB is probably enough to provide room for growth.

    Also, what is your opinion on kubuntu vs fedora regarding this?

    I used Kubuntu for many years, but I don’t really like the recent changes in Ubuntu, especially the move away from standard repository package management in favor of snaps.

    Fedora is a solid choice, and may be particularly useful if you plan to do anything career-wise with Linux. There’s a lot of RedHat/Fedora/CentOS in industrial and enterprise computing.

    Personally I’ve recently started using EndeavourOS, and I’m pretty happy with it so far. It’s an Arch variant, but designed to be useful out-of-the-box. The only thing I miss occasionally is Synaptic, there really isn’t anything comparably competent for any of the non-Debian distros unfortunately.


  • The problem i’m having is that i want the good things from windows desktop. for example; tray icons, being able to control filesystem easily with gui, shortcuts on desktop.

    KDE uses a system tray for various status indicators, so that’s probably what you’re looking for. You should know that on Linux the OS and the desktop environment are modular components. You can have multiple DEs and choose which one you want to log into. You can try different DEs, in parallel, without reinstalling your entire OS. It will still be the same OS/file system underneath. All you have to do is find and install the corresponding desktop environment packages in your package manager.

    KDE is probably the most feature-rich DE, though depending on the specific distro it may not have the entire range of KDE applications installed by default. Your distro should have KDE group packages like “kdebase”, “kdegames”, “kdeutils”, etc, which provided groups of applications based on functional areas. I recommend these over installing every application individually, and you can always trim down later if there are things you don’t need.

    There are other DEs, like XFCE and LXQt, but most of them are geared around minimalism or creating a specific look/feel and don’t have the feature depth of KDE.

    GUI file manager should be no problem in any DE/distro, though you will be limited in what you can edit from your user account (please don’t run as root for normal use).

    As far as desktop icons, most DEs favor an organized application launcher over icons. Do you use desktop icons more for launching applications or for opening files?

    As for retaining your settings, my recommendation would be to create /home as a separate partition from / (root) when you do your OS install. All of your user configuration and your files will be in /home, which gives you the freedom to reformat and reinstall the OS in / without affecting your user files (when you run the OS installer, you’ll need to manually configure the partitions, then tell it to use the existing /home but not format it). This also adds some safety for your personal files in case you are making changes to the OS and you end up breaking it - you can just replace it without losing your stuff.

    Also if you’re considering running multiple distros (Fedora, Debian, Arch, w/e), you can give each of them a separate root partition and have them all use the same /home partition, so your files will be available in all of them. In this case I recommend also making a separate /boot partition, which would be shared across all distros.