• 4 Posts
  • 12 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle


  • Non-developer searches seem to work Ok. I honestly havent tried that much. It seems like most the time I do engage with Phind its usually code related. Its become a pretty good utility for debugging.

    Strip out any sensitive bits, paste it over asking the questions and or presenting the error while running usually results in figuring out my mistakes (or at least gets me closer).



  • I’ve patched on to Phind(phind.com) a bit more lately and for the first time in a while thought that i would absolutely pay for it if the service can remain the same.

    I’m all for paying for services that make sense for the better of my own data. I’ve been running a SearXNG instance for a bit though. I’ll likely check out Kagi, as SearXNG hasn’t been too quick to return results.


  • Current have two Yubikeys for personal use. One is a backup and remains in a fireproof safe, while the other is on my most / all of the time via my keyring. Agree the individual side is a bit more complex.

    For me I took the approach of not relying that much on cloud services and rolling a lot of it myself. My data then gets backed up to a backup repository via borgbase in the EU. Usually try to follow the 3,2,1 rule for backups. Three copies of your data on two different medias with one copy offsite (ok the two different medias thing i cheat a bit and have a couple extra disks).

    The enterprise side we’ve talked about implementing Yubikeys in the org, but havent gotten all the buy in on that yet.


  • What’s funny working in the cybersecurity space is we’ve actually adopted Bitwarden I’m out org. Now, with that said to your point not all our eggs are in one basket.

    Most of our auth (if not all) relies on another mechanism for authentication. Typically some other 2FA mechanism that isn’t stored in our org Bitwarden vault. We enforce that separation with the assumption that if our vault is compromised the core aspects of the business easily accessible isn’t necessary breached.

    The break glass accounts / etc that are not protected by 2FA are 99% of the time locked down to only be able to use that use from very specific subnets and or source systems. The ones that are accessible outside (say a AWS account) is always locked down with a hardware key. This isn’t fool proof either as technically in a very targeted attack you could focus on the admin/IT user and work your way through their system. To your point…it’s Electron based, but we also found not offering it and making it easy for the typical user often led to even worse practices being adhered to.

    We’ve embraced Bitwarden at this point pretty heavily, but at some point we will be rolling our own instance and migrating that way. This will allow a bit more separation and control for more of our break glass based accounts.





  • MicroOS user here. Honestly I love the workflow of using distrobox for about everything I need.

    Essentially I have distrobox images setup for specific development workflows. I just hop into the one that is suited for the task I’m doing. It automatically sets up icons in the Gnome menu if you don’t want to use the cli commands.

    Between flatpaks and containers I couldn’t be happier with my setup. Combine that with the fact I can potentially trust the underlying OS to not crap the bed via updates (and when it does I can roll back my filesystem snapshots) is a win/win.