raesene6

well it's a view of the world that adding two words to a sentence is unreasonable, but (and this is just a suggestion) I think you'll find that you get less negative feedback if you make it clear when something is an opinion rather than a statement of fact.

If they like a drink (or several) and a party, indeed it's a good place to go.

I've been to Shetland 7-8 times for holidays, lovely place, but not really in the winter. Apart from anything else the crossings can be really rough, or cancelled altogether if the weather is bad.

I only did the ferry from Aberdeen once in really bad weather, they handed out leaflets to everyone getting on saying it was "at the passengers own risk"!

Lets just say, even several of the crew were seasick on that voyage...

Saying that you're part of the culture doesn't really remove the suggested universal negative, it just implies that you feel that you are part of that demographic.

The point I was going for was that I'd suggest that all humor is so subjective that it's impossible for a universal negative to apply.

In the same way that beauty is in the eye of the beholder, humour is in the ear of the listener.

I would suggest the backlash would likely be due to the wording of your original comment.

you stated that "Programmer humor is really cringey."

Cringey is generally a negative sentiment and saying "is" implies that this negative sentiment is a generally accepted fact.

I'd suggest that humour is almost entirely subjective, and therefore attempting to suggest that any form of humour is objectively bad makes no real sense.

If you had said "I find programmer humor to be really cringey" you may well have received fewer negative reactions.

Up Helly Aa isnt' designed to capitalise on credulous foreigners, it's very much a festival for the local population of Shetland.

Apart from anything else, I can't imagine many people wanting to go to Shetland in January for a holiday :)

Savitech didn't rebel against control, they were just lazy in not revoking/limiting something they, by their own admission, did not need any more.

If you don't want to participate in mainstream computing with it's certificate authorities and authoritarianism, there are always alternatives for you to use.

Use Linux, use hardware which focuses on freedom and privacy, these options are freely available.

that looks like an interesting guide :)

One thing you might want to add is a bit of a warning about the risks of exposing a Docker daemon to the network with tlsverify=false as that would enable anyone who can reach the port on the network to run docker commands and likely take over the host OS.

So to elaborate. Many Internet facing systems are application servers (e.g. web servers). They typically have very few local users, administrative/Ops staff are the primary users.

At that point an attack requiring the ability to execute arbitary code on the host as a local user is possibly less relavant as, if an attacker is in that position, they likely have a number of other options to further their goals.

The reason I made the comment about alternate controls, is that the original discussion and point I was making revolved around Internet focused attackers, rather than local attackers, so it's not too surprising that I didn't try to cover that case :) No sinister intent, honest!

Heck however if we want to then lets theorize that I can just use some form of firewall to port forward the high port that's presented externally to 22/TCP internally to get the best of both worlds, both a less visible external service and an internal port that requires root to bind.

malicious local user is a slightly different threat model though with a number of other possible controls.

Do you think there's any benefit in reduced log noise making a serious attacker more obvious to SoC analysts?

I.e. if I run SSH on 24956/TCP and start seeing attacks, it's a fair bet this is targeted (someone has taken the time to do 65K port scans, not common for untargeted attackers), so it's a stronger signal for the blue team to look at that activity more closely than the noise on 22/TCP.

I don't think it gives you nothing. As an example, say a 0/1-day gets dropped and someone starts compromising systems.

You're trying to get round your estate ensuring patches are in place, but that takes time.

The bots are starting with the low hanging fruit, systems on default ports.

Being not on a default port helps, by buying you more time to react.

So to me the answer there might be to address the complacense which is the real problem and not remove obscurity ...

The idea of revealing all to improve paranoia rather sounds like the idea of attaching a sharp spike to your steering wheel to encourage safe driving :P

eh?

runnning a service on an alternate port is generally extremely easy to do and has several benefits

1) It makes it easy to pick out the serious attackers. If you run SSH on 34985/TCP for example and start getting password brute force, you've got an idea it's a targeted attack, whereas on 22/TCP you get hammered by dumb bots all the time.

2) If someone is slamming round as fast as possible popping boxes with an 0-day they'll likely only bother with default ports (e.g. SMB worms, they compromised a lot of systems, but only on default ports)