• 0 Posts
  • 28 Comments
Joined 4 months ago
Cake day: June 23rd, 2024
  • Laser@feddit.orgtoProgrammer Humor@programming.dev•Sometimes, it's backwards
    4·
    1 month ago

    I worked in software certification under Common Criteria, and while I do know that it creates a lot of work, there were cases where security has been improved measurably - in the hardware department, it even happened that a developer / manufacturer had a breach that affected almost the whole company really badly (design files etc stolen by a probably state sponsored attacker), but not the CC certified part because the attackers used a vector of attack that was caught there and rectified.

    It seemingly was not fixed everywhere for whatever reason… but it’s not that CC certification is just some academic exercise that gives you nothing but a lot of work.

    Is it the right approach for every product? Probably not because of the huge overhead power certified version. But for important pillars of a security model, it makes sense in my opinion.

    Though it needs to be said that the scheme under which I certified is very thorough and strict, so YMMV.

  • Laser@feddit.orgtoSelfhosted@lemmy.world•Paid SSL vs LetsencryptEnglish
    1·
    2 months ago

    I was also with a provider that didn’t offer API access for the longest time. When they then increased prices, I switched, now paying a third of their asking price per year at a very good provider.

    I guess migrating is difficult if the provider doesn’t offer a mechanism to either dump the DNS to a file or perform a zone transfer (the later being part of the standard).

    Can only recommend INWX for domains, though my personal requirements aren’t the highest.

  • Laser@feddit.orgtoSelfhosted@lemmy.world•Paid SSL vs LetsencryptEnglish
    11·
    2 months ago

    Also wildcard certificates are more difficult to do automated with let’s encrypt.

    They are trivial with a non-garbage domain provider.

    If you want EV certificates (where the cert company actually calls you up and verifies you’re the company you claim to be) you also need to go the paid route

    The process however isn’t as secure as one might think: https://cyberscoop.com/easy-fake-extended-validation-certificates-research-shows/

    In my experience trustworthyness of certs is not an issue with LE. I sometimes check websites certs and of I see they’re LE I’m more like “Good for them”

    Basically, am LE cert says “we were able to verify that the operator of this service you’re attempting to use controls (parts of) the domain it claims to be part of”. Nothing more or less. Which in most cases is enough so that you can secure the connection. It’s possibly even a stronger guarantee than some sketchy cert providers provided in the past which was like “we were able to verify that someone sent us money”.

  • Laser@feddit.orgtolinuxmemes@lemmy.world•Have you tried NixOS?
    4·
    3 months ago

    Well, a lot of it is just trying stuff out, but let’s say you want to setup Navidrome because you read about it somewhere. My first step is always to go to https://search.nixos.org/options? and search for it, it’ll show you the options available. If you want to know how it’s implemented under the hood, press the “Declared in” link where it shows you the source code of the module, this can sometimes be helpful.

    Other than that, read the wiki for examples, and remember that nix is a full language and not just a configuration, so you can keep it flexible.

  • Laser@feddit.orgtolinuxmemes@lemmy.world•Have you tried NixOS?
    1·
    3 months ago

    Thanks for the answer; I do have at least one module in my config, but usually, I don’t enable or disable services like that, it was more of an example of how the configuration is split up and what the advantage of that is. In the end, if the only option is to enable the module, you’re not gaining that much if you need to import and enable it instead of just importing the configuration straight is my opinion.

  • Laser@feddit.orgtolinuxmemes@lemmy.world•Have you tried NixOS?
    131·
    3 months ago

    Even when using in a basic way, I think it has one very tangible advantage: the fact that you can “compartmentalize” different aspects of your configuration.

    Let’s say I set up a specific web service that I want to put behind a reverse proxy, and it uses a specific folder that doesn’t exist yet, like Navidrome which is a web-based audio player. It requires a set of adjustments of different system parts. My nix file for it looks like this:

    { config, ... }:

let
  domain = "music." + toString config.networking.domain;
in
  {
    services.navidrome = {
      enable = true;
      settings = {
        Address = "127.0.0.1";
        Port = 4533;
        MusicFolder = "/srv/music";
        BaseUrl = "https://" + domain;
        EnableSharing = true;
        Prometheus.Enabled = true;
        LogLevel = "debug";
        ReverseProxyWhitelist = "127.0.0.1/32";
      };
    };

    services.nginx = {
      upstreams = {
        navidrome = {
          servers = {
            "127.0.0.1:${toString config.services.navidrome.settings.Port}" = {};
          };
        };
      };
    };

    services.nginx.virtualHosts."${domain}" = {
      onlySSL = true;
      useACMEHost = config.networking.domain;
      extraConfig = ''
        include ${./authelia/server.conf};
      '';
      locations."/" = {
        proxyPass = "http://navidrome";
        recommendedProxySettings = false;
        extraConfig = ''
          include ${./authelia/proxy.conf};
          include ${./authelia/location.conf};
        '';
      };
    };

    systemd.tmpfiles.settings."navidrome-music-dir"."${toString config.services.navidrome.settings.MusicFolder}" = {
      d = {
        user = "laser";
        mode = "0755";
      };
    };
    systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = ["/run/systemd/resolve/stub-resolv.conf"];
      
    security.acme.certs."${config.networking.domain}".extraDomainNames = [ "${domain}" ];
  }

    All settings related to the service are contained in a single file. Don’t want it anymore? Comment it out from my main configuration (or whereever it’s imported from) and most traces of it are gone, the exception being the folder that was created using systemd.tmpfiles. No manually deleting the link from sites-available or editing the list of domains for my certificate. The next generation will look like the service never existed.

    And in my configuration, at least the port could be changed and everything would still work – I guess there is room for improvement, but this does what I want pretty well.

  • Laser@feddit.orgtolinuxmemes@lemmy.world•Have you tried NixOS?
    151·
    3 months ago

    Just to clarify, I wouldn’t recommend putting everything in a single file, but rather modularize the configuration.

    I also came from Arch, but have since abandoned it, and I don’t think I want to use distributions for myself that use the the classic imperative concept. One you get a better understanding of it, it makes so much more sense.