gepeto42

Reminded me of tmbg37 going to the market…

And secure the email addresses used for your registrar account with 2FA, and disable weak recovery methods.

Very niche product but I was happy to find a real use case for 3D printing!

Mermaid is great for keeping simple diagrams in Markdown documents, and GitHub very recently started supporting it. Beats taking screenshots and uploading PNGs to the repo for sure!

For those using VS Code, this GitHub Markdown extension also renders mermaid: https://marketplace.visualstudio.com/items?itemName=bierner....

I am a big fan of using the CDM to understand and explain things clearly. I especially liked the graphic in this post that shows the awareness levels and the boom within the CDM.

I have used mostly Synology in the past, so I have no hands-on experience with QNAP, but I am also pretty sure they are very similar types of Linux based with tons of features boxes.

QNAS does have a guide:

https://www.qnap.com/en/how-to/faq/article/what-is-the-best-...

However, I want to stress the following points:

0. Do not use a NAS as your only backup, and definitely back up data only on the NAS to another location (cloud?). 1. Do you need to access the NAS from elsewhere? Do you REALLY need it? If yes, consider setting up a VPN, but no matter what you do, do not expose the NAS directly to the Internet through your firewall or a cloud service. 2. Enable automatic updates - there are enough vulnerabilities in these boxes that it is worth patching first and asking questions later. 3. Depending on the data you store, consider encryption. For example, if you only use a NAS to do Time Machine backups, encrypt your backups. Most NAS boxes also support encrypting entire drives, which is very practical if someone steals the box away from you physically, but will not add protection to attacks once it is powered on.

Our specific macOS configuration is available on https://fleetdm.com/handbook/security#how-we-protect-end-use... - but I wanted to take advantage of working at an open-source company to write more about how we ended up doing what we do in terms of security, in a medium that is more appropriate to the story rather than lists of settings.

Hope it is useful, and can help some get started on the path to securing their laptops while leaving them usable by engineers!

I would only enable Google Drive local sync on laptops that we know are company owned. The guide didn't cover "Context-aware access". Depending on how you work, it is surprising to see that most people don't even mind that they can't sync files locally, where in other companies it would be completely impossible. I guess it comes down to how much of your work is Google Docs/Sheets vs other file types.

That is exactly what it is for! We will be adding more about how we secure Fleet to our handbook, check it again in a few weeks and it should have even more stuff that a startup CTO can use!

That is true especially if your sessions are made very short, which requires the more expensive Google Workspace edition. But if sessions are long, the risk is users lose access to their 2FA and don't notice until it becomes a bigger problem...

There is, though it is not ultra granular. They introduced it last year and we mention it in the guide.

https://workspaceupdates.googleblog.com/2019/03/more-control...

Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only.

The middle option for most people is a great one as it allows Google Prompt (push notifications) as well as Google Authenticator style OTPs, plus security keys.

Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...

We did mention DMARC DKIM etc but I did not put a link to this very useful tool. Feel free to submit a PR and we'll merge it - https://github.com/fleetdm/fleet/edit/main/handbook/security... - or if you don't mind I can also add it on my side next time I make an edit.

The API Access section covers OAuth apps. Essentially you:

1. Mark Google services you consider critical as "restricted" (ex: Drive, gmail) 2. On Gmail and Drive, you can then allow apps that use lower levels of permissions, but not those who need "dangerous access" 3. Then on a per app basis you can mark apps as "trusted" which lets them access "restricted" Google services.

It is not super granular in the sense that you can't easily say - Calendar2000 can be used by my sales team, and should have access only to the invites date and time but not attendees, body or attachment, but it is better than nothing!

Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot.

Would be nice if Google allowed enforcing it with a grace period for new accounts though!

You are 100% right that the domain is the keys to the kingdom.

Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs/register-domain and https://cloud.google.com/dns. By using those you can leverage your Google account's security (use separate accounts for admin level access on GCP and enforce hardware 2FA), and control who gets access using IAM. AWS has similar options.

Thanks. There is no need to keep most security controls for common tools secret, and the more organisations discussing how they do it the better.

For example, a small org with no security people or a non-profit could be made much more secure by following this, so why not publish it?

This is how we secure Workspace here at Fleet. We figured the guide could be useful to companies of a similar size. The next step would be to enable Endpoint Verification to control access to specific apps such as Drive so it could only be done from up to date, encrypted devices, but that requires a the highest Google subscription.

It depends what you’re allowing it for. For most companies, letting people use gmail with strong authentication and short sessions on personal computers that are patched, encrypted and up to date is a very small risk compared to the productivity gains. If you’re a bank and you’re giving access to an internal app with customer data or worse money then definitely not!

Reminds me of the old plastic iBooks (white ones) which would either snag the cables in the housing, or have the backlight power lines crack in the logic board.

Define "evidence".

I found that the easiest way to do it on Mac is to download the Chrome Enterprise bundle, edit the .plist and convert it to a profile with McxToProfile, to get something like this:

https://twitter.com/gepeto42/status/1043587638568079360

And yet, it does not mean you would not re-run queries to confirm even if you did.

I have encountered very few (not saying it's good, just that's how it is) companies with detailed database query+results logging that was stored for long enough, in any usable way...

Could it be that waking up the discrete GPU, on laptops that in some cases disable it by default on battery power, takes more juice than rendering in software on the CPU? Though I wonder how many MBPs in circulation have the dual-GPU configuration...

It was about timeeeeeeeeeee

Of course this is not to address the case where the recipient would take a screenshot. I still find disappearing messages useful to reduce attack surface if say, the phone gets taken away and unlocked by someone else, or a backup of it is found and restored on something else, or if the phone gets compromised at some point at least not all previous messages are exposed, etc. A useful feature, not meant to address scenarios or malicious recipients or previous compromised devices.

But they are not updating it. It would be better to kill it than to make us believe an update is coming. To be clear: I WANT a USB-C Mac Mini. Basically there's 5 ways Apple could get me to spend on new Mac hardware and none of them is realizing.

They should kill the Mac Mini. Until they do, I'll keep waiting and hoping for a Mac Mini with USB-C that can drive external monitors well.

The iMac Pro is awesome, but the lack of target display mode makes it use a lot of space that can't be used with anything else. Older 27in iMacs were awesome for that - personal Mac for home, use as an external screen for work when working from home, or as an external display for a gaming PC.

Where are we supposed to place the sacrifices to the gods who will keep all of our 5-7 year old Macs alive until the new ones come out?

You're right, I think the last time the delay was this long was exactly that. Better (?) than the times Apple self-dropped 0day on themselves by disclosing Safari bugs that were not fixed on the other platforms I guess.

I have seen this many times.