Re:FreedomBox
by canadaduane on Monday April 09, 2018 @03:22PM
(#16796095)
I love this idea, but my two "deal breaker" worries are: (a) data backup, and (b) security. I hate that this is the case, but when comparing a "box-at-home" vs. a "corporate-run service", the corporate-run service is less likely to lose my data and more likely to apply security patches and updates ASAP. Even with 0days and all of the "hackers stole millions of users' data" posts, think the point remains strong; although, I admit that these losses shift the value proposition towards box-at-home.
[ Parent
| on HN ]
> I love this idea, but my two "deal breaker" worries are: (a) data backup, and (b) security.
There's no reason why this system couldn't use duplicity with a password to back up to S3 or a similar service.
Since it's just a Debian package, it could use the standard Debian automated-update system to handle security.
re: (b) Security
Security through delegation vs security through obscurity imo here, follow simple things like use non-standard ports and your changes of getting hacked are likely shockingly low even if your behind on patches.
nmap, a standard pen tool, already sees through port mapping and other convenient obscurity tricks, there's just nothing like actually keeping your system up to date
Re:FreedomBox
by ocdtrekkie on Monday April 09, 2018 @04:41PM
(#16796806)
I don't disagree with regards to "nothing like actually keeping your system up to date", but in terms of defense-in-depth, non-standard ports are not a bad idea. IIRC, people who have monitored the volume of attempts to connect on a open standard port and a nonstandard port are different by orders of magnitude. It won't help you much in stopping a dedicated human attacker, but it'll probably drastically reduce the number of automated attempts to attack your network device.