NaibofTabr

The IT worker pipeline:

help desk > sysadmin > CTO/CISO > goat farmer

Punitive measures might feel emotionally satisfying in the moment, but what they actually incentivize is hiding the corruption and exploitation better (avoiding getting caught, rather than avoiding the bad activity in the first place). Also, while an angry mob might have a taste for violence and actually perform it for a little while, it doesn’t last and it’s not a basis for a stable government or economy.

If you want long-term stability you have to organize a system so that it incentivizes the behaviors that you want, even more than it disincentivizes the behaviors that you don’t want.

I’m not sure what that looks like in this context, in a practical sense. But ultimately the problem is that everything in our society rewards the hoarding of wealth. This is not just a problem with capitalism - every communist or supposedly socialist society ever established also rewarded hoarding of wealth.

For things to be different, actually different, a different value system with a fundamentally different reward structure needs to be established, and it needs to be competitive long-term with the current system in order to exist alongside it and/or eventually replace it.

Like I said I don’t really know what that looks like in practice. The only example I can think of is the “gift economy” described in Kim Stanley Robinson’s Green Mars, in which the participants in every exchange always seek to give more than they get (essentially the reverse of normal behavior).

OK, you’re right, in a purely ethical world.

But why would the economy change its behavior on a broad scale? What practical incentives would you use to adjust it?

European far-right has received Russian financing for decades. Probably US too.

The NRA was a funding conduit between the Kremlin and the GOP:

https://www.npr.org/2019/09/27/764879242/nra-was-foreign-asset-to-russia-ahead-of-2016-new-senate-report-reveals

First and most important:

In the context of long-term data storage
ALL DRIVES ARE CONSUMABLES

I can’t emphasize this enough. If you only skim the rest of my post, re-read the above line and accept it as fundamental truth. “Long-term” means 1+ years, by the way.

It does not matter what type of drive you buy, how much you spend on it, who manufactured it, etc. The drive will fail at some point, probably when you’re least prepared for it. You need to plan around that. You need to plan for the drive being completely useless and the data on it unrecoverable post-failure. Wasting time and money to acquire the fanciest most bulletproof drives on the market is a pointless resource pit, and has more to do with dick-measuring contests between data-hoarders.

Knife geeks buy $500+ patterned steel chef’s knives with ebony handles and finely ground edges and bla bla bla. Professional kitchens buy the basic Victorinox with the plastic handle. Why? Because they actually use it, not mount it on a wall to look pretty.

The knife is a consumable, not an heirloom. So are your storage drives. We call them “spinning rust” for a reason.

The solution to drive failure is redundancy. Period.

Unfortunately, this reality runs counter to the desire to maximize available storage. Do not follow the path of desire, that way lies data loss and outer darkness. Fault-tolerant is your watchword. Component failure is unpredictable, no matter how much money you spend. A random manufacturing defect will ruin your day when you least expect it.

A minimum safe layout is to have 2 live copies of data (one active, one mirror), hot standby for 1 copy (immediate swap-in when the active or mirror fails), and cold standby on the shelf to replace the hot standby when it enters service.

Note that this does not describe a specific number of disks, but copies of data. The minimum to implement this is 4 disks of identical storage capacity (2 live, 1 hot standby, 1 on the shelf) and a server with slots for 3 disks. If your storage needs expand beyond the capacity of 1 disk, then you need to scale up by the same ratio. A disk is indivisible - having two copies of the same data on a disk does not give you any redundancy value. (I won’t get into striping and mucking about with weird RAID choices in this post because it’s too long already, but basically it’s not worth it - the KISS principle applies, especially in small configurations)

This means you only get to use 25% of the storage capacity that you buy. Them’s the breaks. Anything less and you’re not taking your data longevity seriously, you might as well just get a consumer-grade external drive and call it a day.

Buy 4 disks, it doesn’t matter what they are or how much they cost (though if you’re buying used make sure you get a SMART report from the seller and you understand what it means) but keep in mind that your storage capacity is just 1 of the disks. And buy a server that can keep 3 of them online and automatically swap in the standby when one of the disks fails. Spend more money on the server than the disks, it will last longer.

Remember, long-term is a question of when, not if.

Um, do you have some contrary evidence to present? Or is your position just “US bad”?

It looks like the pivots are on opposite sides of the disk platters, which means that if one fails you essentially lose access to the data on that side.

That’s not really appreciably different from the same failure happening in a single-pivot drive, though it is more mechanical complexity packed into the same amount of space.

I’m not sure what the failure rates on HDD pivots are like. In my own experience the control board or motor is more likely to fail.

I’ve got a USB SSD that I can’t use, because I need to “unlock” it in a windows device first. I can’t even re-partition it in linux.

Is this Bitlocker FDE? Have you tried using Dislocker?

If that doesn’t work, I recommend building a gparted live USB. Once you’re up and the SSD is visible, create a new partition table

Complete this step with no other changes. This shouldn’t care if the partitions on the disk or encrypted, it will reset the partition table which will make the disk appear blank, as if it was never formatted. You should then be able to create any new partitions you want in the available space.

! THIS IS DESTRUCTIVE !

But if you couldn’t access the encrypted partition then the data was effectively destroyed already.

Everything old is new again.

Remember, RAID (or RAID-adjacent) is not a backup.

This. So much this. OP please listen to and understand this.

Even with full mirroring in RAID 1, it’s not a backup. Using the second drive as an independent backup would be so much better than RAID.

You SHOULD NOT do software RAID with hard drives in separate external USB enclosures.

There will be absolutely no practical benefit to this setup, and it will just create risk of transcription errors between the mirrored drives due to any kind of problems with the USB connections, plus traffic overhead as the drives constantly update their mirroring. You will kill your USB controller, and/or the IO boards in the enclosures. It will be needlessly slow and not very fault-tolerant.

If this hardware setup is really your best option, what you should do is use 1 of the drives as the active primary for the server, and push backups to the other drive (with a properly configured backup application, not RAID mirroring). That way each drive is fully independent from the other, and the backup drive is not dependent on anything else. This will give you the best possible redundancy with this hardware.

“I’m gonna make ya an offah ya can’t refuse”

the free market at work

I want the Centrino Nano Duo

Sure Jan.

Whatever you do, and whoever you end up working with, document document document. Take.notes.

And I mean on paper, in a notebook, something that can’t crash or get accidentally deleted and doesn’t require electricity to operate.

You’re doing this for yourself, not for a boss, which means you can take the time to keep track of the details. This will be especially important for ongoing maintenance.

Write down a list of things you imagine having on your network, then classify them as essential vs. desired (needs and wants), then prioritize them.

As you buy hardware, write down the name, model and serial number and the price (so that you can list it on your renter’s/homeowner’s insurance). As you set up the devices, also add the MAC and assigned IP address(es) to each device description, and also list the specific services that are running on that device. If you buy something new that comes with a support contract, write down the information for that.

Draw a network diagram (it doesn’t have to be complicated or super professional, but visualizing the layout and connections between things is very helpful)

When you set up a service, write down what it’s for and what clients will have access to it. Write down the reference(s) you used. And then write down the login details. I don’t care what advice you’ve heard about writing down passwords, just do it in the notebook so that you can get back into the services you’ve set up. Six months from now when you need to log in to that background service to update the software you will have forgotten the password. If a person you don’t trust has physical access to your home network notebook, you have a much more serious problem than worrying about your router password.

Because they want step-by-step guidance and support, and design help, and long-term support, not just a few questions answered.

This is a job. The kind of work that IT consultants get paid for. A fair rate would be US$100/hr, minimum, for an independent contractor.

How is America relevant to OP?

obvious whataboutism is obvious

You can just use openssl to generate x509 certificates locally. If you only need to do this for a few local connections, the simplest thing to do is create them manually and then manually place them in the certificate stores for the services that need them. You might get warnings about self-signed certificates/unrecognized CA, but obviously you know why that’s the case.

This method becomes a problem when:

1. You need to scale - manually transferring certs is fine maybe half a dozen times, after that it gets real tedious and you start to lose track of where they are and why.
2. You need other people to access your encrypted services - self-signed certs won’t work for public access to an HTTPS website because every visitor will get a warning that you’re signing your own encryption certs, and most will avoid it. For friends and family you might be able to convince them that your personal cert is safe, but you’ll have to have that conversation every time.
3. You need to implement expiration - the purpose of cert expiration is to mitigate the damage if the cert private key leaks, which happens a lot with big companies that have public-facing infrastructure and bad internal security practices (looking at you, Microsoft). As an individual, it is still worthwhile to update your certs every so often (e.g. every year) if for no other reason than to remind yourself how your SSL infrastructure is connected. It’s up to you whether or not it’s worth the effort to automate the cert distribution.

I’ve used Letsencrypt to get certs for the proxy, but the traffic between the proxy and the backend is plain HTTP still. Do I need to worry about securing that traffic considering its behind a VPN?

In spite of things you may have read, and the marketing of VPN services, a VPN is NOT a security tool. It is a privacy tool, as long as the encryption key for it is private.

I’m not clear on what you mean by “between the proxy and the backend”. Is this referring to the VPS side, or your local network side, or both?

Ultimately the question is, do you trust the other devices/services that might have access to the data before it enters the VPN tunnel? Are you certain that nothing else on the server might be able to read your traffic before it goes into the VPN?

If you’re talking about a rented VPS from a public web host, the answer should be no. You have no idea what else might be running on that server, nor do you have control over the hypervisor or the host system.