• 0 Posts
  • 19 Comments
Joined 1 year ago
cake
Cake day: June 2nd, 2023

help-circle











  • While Microsoft should absolutely be held accountable for flaws in its code and its failures to disclose actively-exploited attacks in the wild against said flaws, most organizations have policies (or the lack thereof) resulting in security flaws you can drive a truck through.

    Specifically, a lack of M365 and Teams “app” review and approval processes, a lack of CASB tooling, and grossly inadequate asset inventories and security agent coverage. You can’t protect what you can’t see, and most Microsoft customers are barely doing the minimum.

    Is that Microsoft’s fault, when they explicitly tell your admins you’ve got a “Secure Score” of 19%, and they don’t do shit about it?


  • You are trying to solve two different, but related problems, and there are discrete solutions for both.

    One is a personal cloud. You need a secure place to store your shit from multiple users and devices, from multiple networks. You’ll need a mostly static IP and dyndns or your own domain, and certificates signed by a public CA/letsencrypt.

    Then, you are looking for a backup application that supports rsync or sftp/scp over ssh or vpn, that is also cross compatible (Android and PC/Linux). Point this to the service above, and you are good to go.


  • This.

    At some point, you need to be able to quantify the risk to your business before you can do this.

    For instance, if your business earns $10 per transaction, and you perform 100 transactions per second, the difference between five and six nines (313 seconds vs 31 seconds) is $282,000; nowhere near enough to justify the added investment.

    Edit: Important to note that for the first example, these are already enormously huge numbers. Such a business, assuming no holidays or weekends, would be grossing $31.5 billion per year, in the same ballpark as Oracle and Coca Cola.

    So when we say the company is losing 282,000, this is a tiny, tiny fraction of revenue. Even 99.5%, which is almost two days of downtime, would “only” be a loss of 0.5% of all revenue for the year. Sure, this is $157M, but even that would probably not cover the cost of a six nines infrastructure (that said, they could save up to $120M per year by achieving 99.9%, which would be worth exploring).




  • Honestly, seems like Lemmy could be a pretty good implementation of asymmetric PKI as well, the instance could easily host your public key as part of your profile, and only the user would have the private key.

    There’d be some vulnerability around key issuance and recovery, but with a good official app, most users would just store the private key in the Keychain or Android Keystore, and would never bother with exporting the keys.