eldridgea

https://blog.eldrid.ge

Thank you!

I got a Boox Go Color 7 as a less locked in alternative to my Kindle a while back, and overall I've really enjoyed it.

It's apparently rootable, although I haven't done that personally. It's Google Play certified so anything from the Play store works, and side loading Android apps works too. I use it with the open source KOReader app and in tandem with Calibre Web Automated. I did a writeup[0] with some details if you're interested.

[0] https://blog.eldrid.ge/2025/03/12/self-hosted-ebook-manageme...

I believe it strips everything after a "+" so you can use youraddress+servicename@gmail.com.

It ignores periods so you could also use your.address@gmail.com or y.ouraddress@gmail.com or whatever.

Some sides block plus addressing but that's what I use a lot of the time.

~2019 I led a team of highly qualified security R&D folks inside Cisco (we were part of an acquisition), these folks were effectively highly specialized SWEs. But because the title was something like "security researcher" it was compared against the closet Radform ladder which was closer to to compliance officer.

This meant the specialists were on a ladder with often lower pay than a standard SWE, and I couldn't shift the bureaucracy enough to change that. People left for all sorts of reasons but a big part was being able to get 2x-4x the total compensation at other companies.

I use a single node microk8s instance mainly so I can stay familiar with syntax and things for work rather than an actual high availability system.

But I use Portainer and store my files on Github so Portainer can auto-update a deployment if I submit a code change, so kind of rudimentary CI/CD which could be fleshed out more with some GitHub Actions probably.

I use iSCSI mounted storage from my NAS on the host and k8s volumes storing configs there. Actual app data is on the NAS accessed via NFS from the relevant apps.

So a new deployment is usually test locally on my laptop, once it's good commit the code to github and either let the deployment auto update or go to Portainer and do it manually if it's a new deployment. Ingress traffic is done via Cloudflare Tunnels deployed in k8s.

I keep most apps in a single namespace called prod unless they need more than 1-2 pods. If I was doing this again I'd use a namespace per app, I do use a dedicated namespace for anything with a Helm deployment or needs a lot of pods (e.g. Immich)

The biggest difference I'm aware of is TLS 1.3 encrypts the initial handshake[0] in a way to prevent eavesdropping the hostname of the destination. Prior to that, you could get the hostname via network monitoring if you wanted. Encrypting the TLS handshake didn't maker sense to prioritize though as DNS requests were sent in the clear.

However with DNS increasingly being encrypted with DoH and DoT, the TLS handshake was one of the only places you could eavesdrop on the destination hostname, until it was removed in 1.3.

Of course network monitoring will still give you the destination IP, but those are increasingly overwhelmingly destined for a major cloud or CDN provider which doesn't provide much context about the actual destination.

If you'll forgive the shameless self-promo, I covered a decent amount of this in my Blackhat talk about encrypted DNS a few years back: https://www.youtube.com/watch?v=XCnE2o2pfxs

0: https://blog.cloudflare.com/encrypted-client-hello/

I'm not certain but might be related to the desktop client deleting files issue they had in Dec?

https://www.theverge.com/2023/12/6/23991183/google-drive-los...

I asked a cloudflare engineer this and the answer was a bit vague but amounted to the failure rate being something like 0.5% which was too high for the amount of TLS sessions being initiated all the time.

Although I always thought it would be a nice feature for security conscious folks to be able to ennable. Or go ahead and use it on more sensitive sites only, e.g. banks.

They work with Firefox for me on desktop (mac/linux). This is _very_ recent though.

Passkeys in Firefox also work for me on mobile but not with Bitwarden, Bitwarden's blog says passkey sync on mobile is "coming soon".

This might be due to Firefox often defaulting to sending DNS to cloudflare unless otherwise configured.

Looks like it can be run locally ok with npm https://github.com/cloudflare/har-sanitizer

## Data:

I have a Synology for data accessible via NFS, SMB, and a couple iSCSI mounts.

## Compute:

I have an off the shelf Thinkserve running Ubuntu + Cockpit for VM management via the Web. I I have 3 VMs running on the Thinkserve.

1) A single node microk8s instance. (This is mostly so I can stay familiar with k8s. Most of it could also be in a docker-compose file). This runs most stuff: portainer, Immich (photos), Jellyfin, Plex, Kavita (ebooks), Nextcloud, owntracks (location tracking), paperless-ngx, NodeRED, and Fasten (health tracking).

Most apps are deployed in portainer from a GitHub file, so a git commit is all it takes to update an app.

2) A VM for downloading things from YouTube and other places, categorizing/renaming them, and putting them on the NAS.

3) A VM dedicated to Home Assistant, with a pass-through USB to their SkyConnect device to control ZigBee/Thread home IoT stuff.

Each VM runs a cronjob to regularly put my Github pubkeys in my authorized_keys file for break glass SSH access. I detail my normal access below.

## Network/Security:

I use a Unifi Dream Router (UDR) with VLANs for most devices, one for IoT that's locked down, and one for my personal laptop with certain SMB traffic allowed for backups.

I don't allow incoming traffic (well one exception for Plex). I leverage Cloudflare pretty heavily for DNS, ingress, and access control.

I have 4 cloudflare tunnel pods on the k8s node. And a tunnel agent on each of the VMs, the Synology, the hypervisor, and the UDR. I use Cloudflare's ephemeral certs for SSH in tandem with cloudflared on my clients so I can SSH in a normal terminal (as opposed to the web SSH client).

Ingress traffic comes in via the tunnels which takes care of dynamic DNS. HTTP traffic runs through Cloudflare Access connected to my Google account which requires FIDO2 to log in. Non HTTP traffic (or non-browser traffic) are authorized via Cloudflare WARP + Gateway (mostly applicable to native Android apps).

## Internal DNS:

I have the cloudflared agent running in the UDR to allow incoming traffic for management, but it also creates a local DNS proxy that sends encrypted DNS requests to my Cloudflare Gateway allowing me to collect metrics and do filtering for any DNS on my home network.

## Backups:

I use rclone to backup an encrypted blob to Hetnzner storage.

https://blog.eldrid.ge

I write about tech culture/ethics, security and privacy online, and random technical projects I've been working on.

Some favorites are: Myth of the Necessary Jerk https://blog.eldrid.ge/2017/04/11/the-myth-of-the-necessary-...

The Silent AI Overlord is Already Here https://blog.eldrid.ge/2022/07/28/the-silent-ai-overlord-is-...

Online Identity is Complicated https://blog.eldrid.ge/2022/08/12/online-identity-is-complic...

It's a challenge but seems to be becoming moire prevalent for folks focused on supply chain attacks. Chainguard in particular has a bunch of standard containers (e.g. nginx) that reduce the container footprint as much as possible.

https://www.chainguard.dev/chainguard-images

SEEKING WORK | Remote or NYC

I'm an information security consultant. I have a broad skill set, but I specialize in younger organizations and/or SMBs who are looking to make sure they have good modern security baselines across their entire organization. I can tackle specific projects or can review systems and procedures and make recommendations.

I have extensive experience in deploying, automating, and securing corporate IT systems. For example: automating employee onboarding/offboarding, deploying Single Sign On, implementing account security best practices, and Zero Trust principles (e.g. microsegmentation, scoped access, device attestation, hardware backed authentication).

LinkedIn: https://www.linkedin.com/in/eldridgea/

Contact me or book a free consultation: https://eldrid.ge/consulting/

Email: me@eldrid.ge

I have and I like it. It was in the apt repositories for Ubuntu so I use that to manage my hypervisor (which is just an Ubuntu LTS box). In browser VNC to manage/install VMs is pretty great for when SSH isn't set up yet or I'm having issues with it.

It has a libvirt extension you can use to manage the VMs which is nice. Kind of remind me of webmin tbh.

Kong | InfoSec Tech Lead (and lots of others) | Remote (US timezones) | Full-time

Kong(https://konghq.com) creates software and managed services that connect APIs and microservices natively across and within clouds, Kubernetes, data centers and more using intelligent automation. We have had an on-prem OSS and enterprise product known Kong Gateway that is an API gateway. We recently launched our first SaaS offering in Kong Konnect. I am looking to build out our Information Security program and need a right-hand person to assist. As an early team member, your skills and opinions will play a significant role in shaping our Infosec strategy.

More details at: https://jobs.lever.co/kong/48f63df0-84ce-4c35-b75a-1f449a0e1... Other job postings: https://konghq.com/careers/

If you're interested in the role please apply via the careers page. If you'd like to learn more please reach DM me on Twitter. https://twitter.com/magiceldridge

It's probably not completely off the table but unlikely in the near term since arm was just sold from SoftBank to Nvidia

While I share your general suspicion I don't think they need to see the messages to get a lot of privacy-violating use out of WhatsApp.

When the NSA was talking about metadata collection, they said it was more useful than actual data. Likely because it's already computer consumable, and less dense.

If FB gets your contact lists, and sees who you message, how much, and when, that's probably a hugely valuable commodity to them.

This appears to be Apple's implementation of WebAuthn which is a standard specification. So while this page is about the specifics of this in Safari, the WebAuthn spec in general is widely implemented. If your device has a TPM/secure enclave/etc (most modern devices do) then it works already in Chrome/FF/Safari/Edge on desktop and Chrome on Android and Safari on iOS.

If you want to see it in action you can try out a demo at https://webauthn.io

There are a few areas of concern here:

First, getting authentic data from the provider so that you know what they published is what you're reading.

But also links and embedded links/scripts. Since HTTP can be (relatively) trivially MITMd, it not only exposes end users to getting manipulated info, but also, having them running Javascript that's not what the site owner intended.

In fact that's exactly how China attacked GitHub recently: https://threatpost.com/github-attack-perpetrated-by-chinas-g...

I'm not sure about all the providers but Amazon's CloudFront CDN product has additional costs, so it's "bundled" but not in the sense that it's free, only that it's integrated.

And one of Cloudflare's selling points imo is the multi-cloud customers. Use AWS all the way but Cloudflare as your CDN and you could swtich to GCP seamlessly. Or route traffic based on pricing etc. I think you're right they will/have absolutely branch out from CDN but I think their CDN product is actually compelling especially to bigger companies that are more afraid of Amazon that they are of Cloudflare.

(Other interesting point - it's worth noting that IBM's CDN is essentially white labeled Cloudflare).

More like a bookstore that won't let you leave with your books.

So research library rules, but retail-ownership pricing.

A session token is "something you have" and paired with the password being "something you know" it's still 2fa.

Whether making that conversion or allowing disabling of 2fa without requiring the user to do a full authentication with both their password and a code is debatable. But 2fa is two of something you "know", "have", or "are" which password + session token meets.

My personal guess is that there'll be two main ways end users use WASM apps. One will be the browser naturally, but with a push for PWAs. If you go to an app URL and like it, you can "install" it from the browser menu. This isn't WASM specific and sites like Twitter and Instagram already do this, but I suspect we'll see a bigger push from players like Google to make WASM PWAs.

The other main way will likely be "native" apps that are based on Electron or a similar framework. Electron is already Chromium based so WASM support will likely be included in Electron (if it's not already) and devs will make "native" apps that way that are downloadable, or installable from OS app stores.

I'm not sure how true it is but I always heard Apple was very outspoken about how they never payed for product placement. What they would do was give away just about any Apple product to just about any production. And especially more than a few years ago Apple had some of the more photogenic devices so studio went with them for onscreen usage. You'll see them listed in lots of show credits as "hardware provided" or similar.

If this is true I bet that it was a condition of the giveaway relationship Apple has with studios.

I'm a fan of Fathom[0]. The amount of data and insight is light compared to GA and others but if it meets your needs it's pretty great.

[0] https://github.com/usefathom/fathom

Same here! I was making this before I saw the teaser announcement. Figured I'd wait until Friday before continuing work since it may obviate this entirely. :-)

I'll definitely admin that I'm interpreting the data to fit their own political/moral views but the conclusion "10 billion on drug incarceration almost pay for themselves through reductions in health care costs and lost productivity" seems that economically the difference in incarcerating addicts and providing them healthcare is negligible.

If the economic difference is negligible then what reason is there for incarceration over providing healthcare? Crime did drop in the 90s but there's also the reality that those with criminal records are predisposed towards recidivism, a complicated issue on its own, but it seems that incarceration leads itself to staying criminal while healthcare at least has less direct links to criminal recidivism.