Also, it depends on the problem you are trying to solve and if the good deal lets you buy plenty of spare drives.

I have a 3 server cluster running 9 k8s nodes with persistent storage in Longhorn. While it thrashes the drives a bit more and I lose performance, I opted to use hardware RAID so a drive rebuild would be much easier. (I think with Ceph, it’s a step or two more to kick a drive out of the storage pool before you can swap the drive safely. The fact that I can’t remember much about Ceph already and it’s only been a month or two since I setup a Ceph testing cluster should alone explain my decision.)

Basically, I get volume replication backed by easy to manage and affordable drive replacements. I even get mirrored boot drives too. The setup is fault tolerant to a degree and it gives me enough time to shuffle things around if a server starts to die completely.

All the drives are used and have already had a full life, but yey, the risk is ok because the parts are cheap. I’ll probably buy another refurbished server of the same type just for the spare parts, drives and memory. I could even just use the extra server as a cold standby. Whatevers.

The cluster isn’t critical, to be perfectly honest. It really just holds a massive tool suite of containers that I need at random times and now I at least have solid templates and ansible confogs for all of those containers anyway. Even the data isn’t super critical.

Parts are cheap and my setup allows for disposable drives in a setup where risk tolerance is sky-high.

My NAS is RAID 10 with brand-new drives and read/write cycles are conserved. I care about that data and will probably mirror that storage that to an additional pair of mirrored m.2’s to absorb most of the read a cycles while adding an additional redundancy layer. (The hdds would primarily only see write cycles and probably just function as an incremental backup location for specific folders off of the m.2’s.)

Those are the cliff notes, and only I attempted to explain how I thought about risk in my setup. Volume over quality for my cluster: I think about fast recovery and how I can parch around a problem during a catastrophic failure. Long term: Multiple layers of redundancy for important data with less concern about price but I have less capacity and speed.

Having spent years around lots of equipment, I view a flashy red light on an HDD as a suggestion to do something about it in a couple of days if the server is just a worker node. (I have been desensitized to most hardware faults, TBH.)

What cat exfoliation feels like:

Trash app. If you actually want to see all of your data and have it recorded accurately, just switch to the Garmin ecosystem. Garmin isn’t without their own set of issues and problems, for sure. However, if you actually want data and not AI slop summaries, stay a far away from Google Health.

Simply put, it’s designed for people who think that wearing a fitness tracker will improve their health and want a chat bot that will make them feel better about that.

Most of this is just marketing crap from Anthropic.

Finding vulnerabilities in code and generating complex, multistep exploits with publicly available models is possible now. This biggest hurdles now is setting correct context and actually knowing what to look for. Any “guardrails” for this behavior are easily bypassed by framing the detection and exploit generation as a valid dev style question in the most difficult of situations.

They likely just trained a model without guardrails in this case.

What they are doing here is over-hyping a problem and framing it like they are the only ones with a solution. LLM security issues are more in-focus now that companies have dumped a ton of resources into building AI systems they don’t really understand.

Companies these days do what is right for their shareholders and if Claude makes money, or appears to make money, then the shareholders are happy.

Do a look-through of that XML folder as well. Images could be base64 encoded in those XML files. I remember several instances where XML was used as a template “language” for old style GUIs. (When XML and HTML diverged, a lot of that kind of thing was happening.)

There are some kind of instructions in this video that go through a logo change process. I don’t know if this helps, but I tried: https://youtu.be/QrobPTgu7C0

Also, does it use some kind of database? The images seem like they would be small enough to jam into a blob and just store alongside regular inventory information. If there is a database, it’s probably third-party. If it’s third-party, I would see if it had its own installer packaged inside of the application installer itself. (A third party database would likely be outside of the main app folder.)

Just dumping random thoughts.

Uh, the cat says its 9:15.

Apps are somewhat buggy right now. My shokz will partially disconnect after the first song and exercise audibles are non-existent. (The audio mutes, but the watch still responds to play/pause button presses. This could be just an issue with the shokz app being confused for the time being.)

No difference in GPS connect time from the pixel watch 3, which has been historically buggy at times.

But yeah, random glitches all over the place. It’s tolerable enough and would expect app updates to fix most of them.

Of course they read. Do you think those ticked tock subtitles are going to read themselves when they “do their own research”?

It’s the budget version of Zootopia.

The fan is good, but the orientation seems like it would struggle pushing air between the drives. Maybe a push-pull setup with a second fan?

My general attitude is similar to yours. Let OP figure out that the reporting and blocking is basically just creating more noise that has to gets filtered out and bot supply is basically infinite.

“It’s a learning experience.”

Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.

But hey! Change the world, amirite?

Instructions: 1. Please read instructions

This has been a thing for years now. While I am sure it might annoy some pirates, it’s likely aimed at easily executed malware.

I deal with spam filtering on a daily basis and about 90% of it originates from Gmail. Most of that is just fishing/fraud. It would really suck if my users could easily detonate malware attachments, so this Gmail policy is a good thing for me.

I taught myself QuickBasic as it was the only thing I knew that was related to copying C64 BASIC out of magazines. (QBasic was packaged with DOS 3.11 I think and I was able to get a full copy of QuickBasic somehow. That was about +30 years ago? Dunno. I was about 12 at the time.) I didn’t know what other languages were out there besides TurboPascal. I did learn simple Pascal, but that was a short chapter.

I actually met someone else in the area that was learning to code, and of course, we wanted to write a game. The only way to code for a mouse at the time was to write an INT33 handler, so it kicked off our interest in asm. (I still use asm for MCU stuff on occasion, but it’s limited.) I quickly diverged into writing some really nifty… eh… “boot sector code” so that kicked off my career in security.

And yeah, it’s the same phenomenon for me: I just think in terms of bits and bytes getting shifted around and I still refuse to believe in “magic”. (Slight jab at Rust coders there, but in good fun.)

Fast forward to today, I train “kids” fresh out of college as part of my job now. The first thing I do is start giving them weird tasks that require they actually understand how something like an fopen() actually works.

(Funny story. I refused to “show my work” in math class for simple f(x) problems as I viewed it as unoptimized code. Lulz. I was such an autistic dork.)

That, 200%!

When I started in computers, years ago, I transitioned from QuickBasic directly into assembly. Ever since then, I can kinda “read the Matrix” (Blond, Brunette, Redhead…) and forget about how confusing a raw binary or how a mess of a dmp looks to someone else. (To me, I really just see patterns and nothing massively complicated.)

“It’s just data.” - You would be surprised how fuzzy that statement is for some people. It’s almost exactly like telling someone who doesn’t speak any English that “the sky is blue”. It’s totally cool though! Learning about the internals of any computer is really just a very long chain of “aha moments” as many concepts aren’t intuitive.

I would look into something like Doppler instead of Vault. (I don’t trust any company acquired by IBM. They have been aquiring and enshittifying companies before there was even a name for it.)

Look into how any different solutions need their keys presented. Dumping the creds in ENV is generally fine since the keys will need to be stored and used somehow. You might need a dedicated user account to manage keys in its home folder.

This is actually a host security problem, not generally a key storage problem per se. Regardless of how you have a vault setup, my approach here is to create a single host that acts as a gateway for the rest of the credentials. (This applies to if keys are stored in “the cloud” or in a local database somewhere.)

Since you are going to using a Pi, you should focus on that being a restricted host: Only run your chosen vault solution on it. Period. Secure and patch it to the best of your ability and use very specific host firewall rules for minimum connectivity. Ie: Have one user for ssh in and limit another user account to managing vault, preferably without needing any kind of elevated access. This is actually a perfect use case for SELinux since you can put in some decent restrictions on the host for a single app (and it’s supporting apps…)

If you are paranoid enough to run a HIDS, you can turn on all the events for any type of root account actions. In theory once the host is configured, you shouldn’t need root again until you start performing patches.

I dump memory more often than you would think. It’s usually not obfuscated or encrypted in any meaningful way even though it is fairly trivial to do so.

It’s good practice to scour through any bloatware installed on windows laptops. Since bloatware is generally written by the lowest bidder, you can find all kinds of keys and phone-home urls (sometimes with all the parameters) and other weird things. Just fire up a decent hex editor and search for strings in the dump file. You don’t need to know jack about reverse engineering either.