• 0 Posts
  • 66 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle
















  • It sounds like your job might be needlessly hard.

    Coming up with a design for a new process that will fix all issues at once is very hard; you’re very likely to miss something important. Making such a process change in one go is also hard, even if you somehow happened to end up with a improbably good spec. Doing it by interviewing people sounds kinda doomed.

    An easier path might be to take whatever holistic understanding you have right now and start in some corner of the problem where there are clear issues. Bring engineers and people who use the system together. Have the people who use the system walk through their common workflow together with the engineers, noting what parts are usually hard or slow them down. Keep people focused on improving things rather than arguing about how you got here.

    Together come up with small achievable process or software fixes you can implement and evaluate quickly (like in a week or two). If it works out, you have now made a real improvement. If it didn’t work out, you understand the limitations a bit better and can try again, as it was pretty quick.

    Helping to deliver real improvements in a way that’s visible both to the involved engineers and the people using the system will buy you a lot of credibility for the next step.


  • Tailscale is very popular among people I know who have similar problems. Supposedly it’s pretty transparent and easy to use.

    If you want to do it yourself, setting up dyndns and a wireguard node on your network (with the wireguard udp port forwarded to it) is probably the easiest path. The official wireguard vpn app is pretty good at least for android and mac, and for a linux client you can just set up the wireguard thing directly. There are pretty good tutorials for this iirc.

    Some dns name pointing to your home IP might in theory be an indication to potential hackers that there’s something there, but just having an alive IP on the internet will already get you malicious scans. Wireguard doesn’t respond unless the incoming packet is properly signed so it doesn’t show up in a regular scan.

    Geo-restriction might just give a false sense of security. Fail2ban is probably overkill for a single udp port. Better to invest in having automatic security upgrades on and making your internal network more zero trust