• 2 Posts
  • 109 Comments
Joined 10 months ago
cake
Cake day: February 5th, 2025

help-circle


  • Let’s say you’re a student and poor. You live cheaply, eat ramen every day, etc.

    Now you get your first real job. The amount of money at first will seem crazy. There will be the temptation to just splurge, buy watches, fancy apartment, fancy car on loan, etc. This happens every time your income increases significantly.

    Now let’s say you get fired. Suddenly you have the loans, the bigger apartment, etc but no way to pay for it. This will be very stressful and you may have to do things you don’t want to.

    Imagine instead you didn’t have the car. You got a modest apartment, and saved some money. You have no debts, and can easily take half a year to get a new job no stress.

    So when I say live below your means, I mean do not give in to the temptation to splurge. Spend less money than you make.

    Try to put at least 30% or so of your income to the side (aim for 50%). Make an emergency fund of at least 3 months worth of expenses. Then start putting money into tax-deductible retirement funds and ETFs.

    Most importantly, never take loans and keep monthly expenses like subscriptions to a minimum.















  • The idea behind keys is always, that keys can be rotated. Vast majority of websites to that, you send the password once, then you get a rotating token for auth.

    Most people don’t do that, but you can sign ssh keys with pki and use that as auth.

    Cryptographically speaking, getting your PW onto a system means you have to copy the hash over. Hashing is not encryption. With keys, you are copying over the public key, which is not secret. Especially managing many SSH keys, you can just store them in a repo no problem, really shouldn’t do that with password hashes.


  • This is mostly nonsense.

    • Why block outgoing? Its just going to cause issues for most people. If you’re going to do that, do it centrally (hw firewall)
    • Why allow http and NTP incoming, when there is no http / NTP server running.
    • If there is http server running no mention of https://ssl-config.mozilla.org/ and modsecurity
    • If you’re using ufw anyway why not go with applications instead of ports?
    • In a modern distro, the defaults are usually sane (maybe except TCP), most of the stuff in the SSH config is already default.
    • Why change the SSH port of a home server, which most likely is not reachable from the outside anyway?
    • Actually potentially impactful stuff like disabling services you don’t need, such as cups, is not mentioned
    • unattended-upgrades not mentioned
    • SELinux / AppArmor not mentioned
    • LKRG not mentioned https://lkrg.org/
    • Fail2ban not mentioned

    Don’t just copy random config from the internet, as annoying as it is, read the docs.