Ideally, sure use a password generator - but I wouldn’t worry about the security of a password generator like the one I linked.

1. There’s no linking of the password you generated to whichever account you are creating.
2. There’s no guarantee from the web operator’s perspective that you are actually using the generated passwords for anything at all.

Again, use bitwarden’s generator - or equivalent - for passphrases, but in the absence of that correcthorsebatterystaple.com is good enough for a non-shared password.

The other thing to keep in mind with PiHole - some things are just going to break with it’s default blocking, namely the Google suggested results.

i know, I know - just don’t use google, but android phones/parents have a hard time not just braindead going to Google for results.

It’s not the end of the world - I’ve trained myself to just keep scrolling to actual results.

Another feature for PiHole is local DNS - if you want, you can set up custom dnsmasq entries for self hosted/internal services.

The brand/type of wifi router is more of a technical requirements discussion than privacy discussion.

For instance, I live in a two story townhome rental with the modem in the basement - so I picked up an Orbi mesh system to bounce wifi up to the second floor. I also have a fairly complex network with IoT VLAN, DMZ (for remote VPN) and other network segments - again the orbi doing different VLANs per SSID was a deciding factor.

I’ve also only used the Orbi as an access point, relying on a dedicated firewall/router for that stuff.

If you’re looking at a flat network (e.g. everything on one segment - the typical home user setup), pretty much any WiFi router from Best Buy or equivalent will do the job. Check your current devices to see if you can take advantage of WiFi 7 technology - otherwise save a few bucks and go WiFi 6.

For security purposes, change the default SSID (the wireless name) to something unique - and change the password to something from correcthorsebatterystaple.net. You don’t need the default jumble of letters and numbers to be secure.

Lastly, getting to your privacy concerns, look at the DHCP settings - that’s what hands out IP addresses to your devices so they can reach the internet. Change the DNS servers to something other than your ISP. This looks like a good starting point.

The big things are to make sure you don’t expose your router management to the Internet (the default shouldn’t do that) and to make sure you periodically check for firmware updates.

If you want to up your game, you could look at spinning up a self-hosted DNS server like Pi-Hole - but that can be a bit more advanced to get setup and troubleshoot if something goes wrong.

This is the correct answer. Private IPs are less concerning (on noes now someone knows a network in my homelab is 10.0.0.1/24!) - but absolutely change public IPs in logs.

If it’s necessary to reference external users/systems in multiple log files, I’ll change the names to user1, user2, server1, db2, etc

Does it have Discovery as a normal app store? You might be able to use that.

Honestly, give the terminal a shot - it’s not as complicated as you may think.

I would consider using your Synology for what it’s good at - storage.

My homelab has a Synology DS1618 and servers are Lenovo M90q systems. They have enough compute to get the job done, and use the Synology NFS mount for storage.

• Step 1: download deb
• Step 2: open a terminal
• Step 3: sudo dpkg -i /path/to/yourde.deb

Now whether or not all the packages are fubared at this point is unknown, but that’s how to install a deb file.

Yeah, for the integrated CI/CD, give GitLab a shot - it saves on spinning up a Jenkins or ConcourseCI server.

CI/CD can be useful for triggering automation after merge requests are approved, building infrastructure from code, etc.

I’ll come out with an anti-recommendation: Don’t do GitLab.

They used to be quite good, but lately (as in the past two years or so) they’ve been putting things behind a licensing paywall.

Now if your company wants to pay for GitLab, then maybe consider it? But I’d probably look at some of the other options people have mentioned in this thread.

Plus oh-my-zsh and the powerline 10k theme - this is my go-to shell.

Holy removed, 35 tmux windows?! That’s insane.

Fun fact (that I just took advantage of in a CTF), sudo can also limit command line arguments. If you only want a user to restart a service but not stop it, you can restrict sudo to only

systemctl restart mysvc.service

I agree, but it’s a hard pill to swallow that Meta is the best partner to grow the fediverse. There are real lessons to learn from Embrace, Extend, Extinguish (look at XMPP and Google), not to mention privacy concerns and content moderation issues that seem to be a “feature” for Meta products vs bugs.

I’m not sure what Zuck is up to, but for whatever it’s worth I think the best think the fediverse can do is be somewhat reactive to Meta’s movements.

If instances start getting overwhelmed with content, then block.

If Meta starts showing signs of EEE, then instances can block.

And us users can move to instances that we feel match our personal stances on things - hate Facebook like the plague? Look at one of the defederated/blocking instances. Do you miss interacting with a larger audience? Stay on instances that are embracing (or withholding judgment) the Meta federation.

It’s a complex topic to be sure, and the only way we’ll know the right way to deal with it is with the benefit of hindsight in a few years

Not the OP, but Eternal September references the massive culture impact on Usenet when ISPs started lowering the barrier to joining the then somewhat exclusive forum-esque part of the internet.

I’m partial to Pokemon say.

So first, let me be clear - I don’t know if an alternative to that software you first brought up. But some of our earlier CTFs had a similar issue with isolation.

We ended up spinning up new VLANs per contestant, each having a single Kali Linux VM with xrdp, along with each contestants target systems. Our router/fw blocked all access in/out of those VLANs, save for RDP/SSH traffic from our Apache Guacamole server on the DMZ.

So contestants would hit our portal (Guacamole), then from there connect into their own dedicated Kali instance and environment.

Later, we had to make additional fw exemptions for our scoreboard/docs, etc.

I throw CTFs for a living (among other things), and I’m happy to help out a fellow Infosec person.

What kind of infrastructure can you deploy? Is this going to be in the cloud, on-prem (via a hypervisor like Proxmox/vSphere, or hosted on a single laptop/server?

To a certain extent you can do that with multi-account containers.

For instance, I can have Amazon always open in my “Shopping” tab to keep it separate from my “Social Networks” tab.

At work today, I just heard the term, “Federated Machine Learning” - where individual corporations keep their proprietary learning data, but make the models shareable. I wonder if something similar could be done with activitypub?

(Feel free to steal this idea if it’s worth stealing)

I suppose you could say it’s similar in that there are allow-lists and deny-lists that permit or restrict actions, but the key difference is Apparmor/SELinux are in the OS space - they can permit/restrict the ability to restart services, or prevent sudo from being used in certain ways.

Firewalls are predominantly used to permit/restrict network connectivity either ingress (e.g. traffic from outside the system coming into it) or egress (e.g. traffic that is leaving the system). A good example would be using a firewall to restrict ingress traffic to port 22 - allowing remote management of a system over SSH.

I hope this is helpful!