[-] kristoff@infosec.pub 1 points 3 hours ago

Hi,

Just to put things into perspective.

Well, this example dates from some years ago, before LLMs and ChatGPT. But I agree that the principle is the same. (an that was exactly my point).

If you analyse this. The error the person made was that he assumed an arduino to be like a PC, .. while it is not. An arduino is a microcontroller. The difference is that a microcontroller has resources that are limited: pins, hardware interrups, timers, .. An addition, pins can be reconfigured for different functions (GPIO, UART, SPI, I2C, PWM, ...) Also, a microcontroller of the arduino-class does not run a RTOS, so is coded in "baremetal". And as there is no operating-system that does resource-management for you, you have to do it the application.

And that was the problem: Although resource-management is responsability of the application-programmer, the arduino environment has largly pushed that off the libraries. The libraries configure the ports in the correct mode, set up timers and interrupts, configure I/O devices, ...And in the end, this is where things went wrong. So, in essence, what happened is the programmer made assumption based on the illusion created by the libraries: writing application on arduino is just like using a library on a unix-box. (which is not correct)

That is why I have become carefull to promote tools that make things to easy, that are to good at hiding the complexity of things. Unless they are really dummy-proof after years and decades of use, you have to be very carefull not to create assumptions that are simply not true.

I am not saying LLMs are by definition bad. I am just careful about the assumptions they can create.

[-] kristoff@infosec.pub 4 points 3 days ago

As a sidenote. This reminds me of a discussion I haver every so often on "tools that make things to easy".

There is something I call "the arduino effect:. People who write code for things, based on example-code they find left and right, and all kind of libraries they mix together. It all works .. for as long as it works. The problem is what happens if things do not work.

I once helped out somebody who had an issue with a simple project: he: "I don't understand it. I have this sensor, and this library.. and it works. Then I have this 433 MHz radio-module with that library and that also works. But when I use them together. It doesn't work"| me: what have you tried? he: well, looked at the libraries. They all are all. Reinstalled all the software. It's that neither me: could it be that these two boards use the same hardware interrupt or the same timer he: the what ???

I see simular issues with other platforms. GNU Radio is a another nice example. People mix blocks without knowing what exactly they do.

As said, this is all very nice, as long as it works

I wonder if programming-code generated by LLMs will not result in the same kind of problems. people who do not have the background knowledge needed to troubleshoot issues once problems become more complex.

(Just a thought / question .. not an assumpion)

[-] kristoff@infosec.pub 3 points 3 days ago

To be honest, I have no personal experience with LLM (kind of boring, if you ask me). I know do have two collegues at work who tried them. One -who has very basic coding skills (dixit himself) - is very happy. The other -who has much more coding experience- says that his test show they are only good at very basic problems. Once things become more complex, they fail very quickly.

I just fear that, the result could be that -if LLMs can be used to provide same code of any project- open-source project will spend even less time writing documentation ("the boring work")

[-] kristoff@infosec.pub 8 points 3 days ago

Hmmm .. 🤔 The best way not to make friends with somebody with over 30 years of coding experience: suggest him to use ChatGPT to write a computerprogram 🤣🤣

[-] kristoff@infosec.pub 7 points 3 days ago

Wauw! So many answers in such a short time. Thanks all! 👍 (I will not spam the channel by sending a thank you to all but this is really greatly apriciated)

Concerning ncurses. I did hear of it but never looked at it myself. What is not completely clear for me. I know you can use it for 'low-level' things, but does it also include 'high-level' concepts like windows, input fields and so?

The blog mentioned in one of the other posts only shows low-level things.

57
submitted 3 days ago by kristoff@infosec.pub to c/linux@lemmy.ml

Hi all,

Perhaps a stupid question. Some time ago, I received a rpi zeroW as a gift, but as I did not have any use for ii I passed it to somebody else in our electronics-group. Now, that person has had a +30 year carreer as self-taught programmer -starting out with BASIC on DOS machines- so he showed of some of his old BASIC applications in dosbox on the pi.

So far so good, but he had an interesting question: Years ago, I wrote a library in BASIC for screen / window applications in DOS. (you know, pop-up text-windows and so on). How do I do that on linux (in C)?

As I myself only do 'backend' coding (so no UI), I have to admit I did not have any answer to that.

So, question, For somebody who has mostly coded in BASIC (first DOS and later Visual Basic) and now switched to C and python, what is the best / most easy tool to write a basic UI application with window-function on linux/unix. I know there exist things like QT and ncurses, but I never used these, so I have no idea.

Any advice?

Kr.

[-] kristoff@infosec.pub 28 points 3 weeks ago

This is a typical mail a phishing campaign would send out, and we have already said to people "never believe this kind of messages. They are all fake.

Now, if a genuine company sends out mails with a genuine gift-cards (what the article on techcrunch seems to indicate) .. this is NOT helpfull at all!!!

And that comming from a cybersecurity company (rolling-eyes)

13
replacing memories (infosec.pub)
submitted 1 month ago by kristoff@infosec.pub to c/cyberpunk@lemmy.zip

An open question, related to cyberpunk culture.

Considering the possibilities of current social-engineering as used by social media and desinformation, to what degree ido you think it is now possible to 'implant' fake memories into somebody's consciousness, without that person noticing it.

22

Hi all,

Well, my question is in the title of of post. :-)

Does somebody know if there exists an easy sollution to share files to users (e.g. members of an organisation), based on the fact that the user is known in a SSO (authentik) ?

I know nextcloud would be an option, but that would create a nextcloud account for all the users, .. which is quite overkill for what is needed here.

I know we can probably build something based on apache, PHP or so, .. but if there would be a ready-to-use service for this, that would be nice. (and probably a lot more secure then what I would build myself :-) ).

Kr.

[-] kristoff@infosec.pub 5 points 7 months ago

Yes. Fair point.

On the other hand, most of the disaster senarios you mention are solved by geographic redundancy: set up your backup // DRS storage in a datacenter far away from the primary service. A scenario where all services,in all datacenters managed by a could-provider are impacted is probably new.

It is something that, considering the current geopolical situation we are now it, -and that I assume will only become worse- that we should better keep in the back of our mind.

[-] kristoff@infosec.pub 5 points 7 months ago

Well, the issue here is that your backup may be physically in a different location (which you can ask to host your S3 backup storage in a different datacenter then the VMs), if the servers themselfs on which the service (VMs or S3) is hosted is managed by the same technical entity, then a ransomware attack on that company can affect both services.

So, get S3 storage for your backups from a completely different company?

I just wonder to what degree this will impact the bandwidth-usage of your VM if -say- you do a complete backup of your every day to a host that will be comsidered as "of-premises"

91

Hi all,

As self-hosting is not just "home-hosting" I guess this post should also be on-topic here.

Beginning of the year, bleeping-computers published an interesting post on the biggest cybersecurity stories of 2023.

Item 13 is an interesing one. (see URL of this post). Summary in short A Danish cloud-provider gets hit by a ransomware attack, encrypting not only the clients data, but also the backups.

For a user, this means that a senario where, not only your VM becomes unusable (virtual disk-storage is encrypted), but also the daily backups you made to the cloud-provider S3-storage is useless, might be not as far-fetches then what your think.

So .. conclussion ??? If you have VMs at a cloud-provider and do daily backups, it might be usefull to actually get your storage for these backups from a different provider then the one where your house your VMs.

Anybody any ideas or remarks on this?

(*) https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2023/

25
submitted 7 months ago* (last edited 7 months ago) by kristoff@infosec.pub to c/selfhosted@lemmy.world

Hi all,

Short question. Does somebody here run authentik as single sign-on provider? (dockerised?)

I'm looking for information on how to best backup a authentik server? Just do a backup of the postgres database and the docker-compose file? Something else? How crucial is the dump.rdb file of the redis container?

Kr.

16

H all, Somebody here selfhosting jitsi meet?

I am working on a jitsi-meet setup for an organisation, now looking at the options for redundancy.

I have noticed you can configure multiple XMPP servers on the jitsiivideobridge. What is the exact goal of this?

Can you connect a jvb to multiple jitsj servers (domains)? or is this only for making the jitsii backend redundant?

Kr.

[-] kristoff@infosec.pub 7 points 11 months ago* (last edited 11 months ago)

Hi,

What is the reason you do not want a domain? it is not that DNS-domains are that expensive these days. The cheapest option I found is .ovh (which is one of the major cloud-providers in France), which is 3 euro / year (+VAT). You can then put as much hosts or subdomains under it, and it supports dynamic IP.

Agreed, .ovh is not the most "professional" looking domain, but it depends on what you want to do. If your goal is simply to have something for yourself / family / friends, then this is good enough.

BTW. Having your own domain for a nextcloud instance has additional advances: you can get a real https/tls certificate from letsencrypt, and -if you put a reverse proxy in front of your NC- it shields you from people who just scan the complete IP-space of the internet but who do not know your domain.

45
submitted 11 months ago by kristoff@infosec.pub to c/selfhosted@lemmy.world

With jitsi meet now requireing registration (something I do understand, .. but I just happen not to have a google, MS or meta account), I am looking at selfhosting a jitsi meet for personal use.

Has somebody already done this? What are your experience? What are the hardware requirements? Docker or native? Linux or other OS? (FreeBSD)?

[-] kristoff@infosec.pub 5 points 11 months ago

or a one-way trip from a window on the 10th storey of a building all the way down to the ground.

10

Hi all,

Small question. Does anybody know if there already exists a lemmy community on disinformation (in the infosec area or more broadly)?

Thanks! :-)

Kr.

2

Hi all,

Had a small chat on #AI with somebody yesterday, when this video came up: "10 Things They're NOT Telling You About The New AI" (*)

What strikes me the most on this video is not the message, but the way it is brought. It has all the prints of #disinformation over it, .. especially as it is coming from a youtube-channel that does not even post a name or a person.

Does anybody know this organisation and who is behind it?

Is this "you are all going to lose your job of AI and that's all due to " message new? What is the goal behind this?

(Sorry to post this message here. I have been looking for a lenny/kbin forum on disinformation, but did not find it, so I guess it is most relevant here)

(*) https://www.youtube.com/watch?v=qxbpTyeDZp0

6

I do not think this has already been mentioned. As I guess most of you are also an mastodon (or another fediverse-enabled playform)

More info also here: https://github.com/revengeday/blackhand-mastodon-bot

[-] kristoff@infosec.pub 8 points 1 year ago

just out of interest .. somebody here on satellite? I am interested to know the prices for sat services out there?

[-] kristoff@infosec.pub 6 points 1 year ago* (last edited 1 year ago)

I dan't know if this is still valid but I used to be told to have different partitions for your system, logs and data (home directories) .. and have the swap-partition located in between them. This was to limit the distance the head has to move when reading from your system starts swapping.

But if you use a SSD drive, that is not valid anymore of course :-)

Kr.

21

Hi,

I don't know if this has already been posted here.

Some time ago, I found this 3-part documentary on the cyberpunk genre:

Part 1: https://www.youtube.com/watch?v=sttm8Q9rOdQ (also in the title of this post)

Part 2: https://www.youtube.com/watch?v=0VoX3vr6CCM

Part 3: https://www.youtube.com/watch?v=KczJNtexinY

Enjoy! :-)

8
submitted 1 year ago* (last edited 1 year ago) by kristoff@infosec.pub to c/cybersecurity@infosec.pub

HI all,

For people who live in the neighbourhood of Hanover, Gernany. In almost 3 weeks from now, I will give a workshop "Hacking Radio-signals" in the summer edition of hackover 2023. The exact timeslot still has to be decided, but hackover is the weekend of 14, 15 and 16 July.

In the workshop, we will capture, analyse and decode the signal of a 433 MHz remote-control. You do are required to bring your laptop and have some software installed beforehand.

If you are interested, either drop a message in this thread or contact me at the email-address in the announcement

view more: next ›

kristoff

joined 1 year ago