ShortN0te

What do you mean with encryption? Does it need to be transport encrypted, end to end encrypted or is encryption at rest (when the server is offline) good enough?

Open standards are the first step of a functional transition to an open government. From there Open Source Software can compete against commercial software, once the ppl see that the FOSS offers the same features then the proprietary paid software they can easily switch to it. With open standards they only need to train the users, no data to migrate etc.

Focus instead on enforcing standards' compliance so i can open a .docx with any program and be usable anywhere.

That's an impossible task. Not even Microsoft manages that. Do not want to count how often i used libreOffice to repair or convert an older MSOffice file so it can be opend with modern Versions of MSOffice.

Once there was a 500MB Excel Sheet with lime 500-1000 used Cells, opened and saved it to.a xlsx file using libreOffice and reduced it to a few MB while still being fully functional.

Yes i do i and you do you. But advertising those things as security measures while not adding any real security is just snake oil and can result in neglecting real security measures.

As i said, the whole internet can be port scanned within seconds, so your services will be discovered, what is the risk you assume to have when your IP address is known and the fact that you host a service with it? The service has the same vulnerabilities if it is hosted via cloudflare tunnels or directly via port forwarding on the router. So you assume that your router is not secure? Then unplug it, cause it is already connected to the router.

Geoblocking is useless for any threat actor. You can get access to VPN services or a VPS for very very very little money.

2. Guess what, all IP addresses are known. There is no secret behind them. And you can scan all IPv4 addreses for ports in a few seconds at most.
3. So some countries are more dangerous than others? Secure your network and service and keep them up to date, then you do not have to rely on nonsense geoblocking.
4. Known bots are also no issue most of the time. They are just bots. They usually target a decade old Vulnerabilities and try out default passwords. If you follow my advice on 3. this is a non issue

You want your backup functional even if the system is compromised so yes another system is required for that, or through it to the cloud. Important that you do not allow deleting or editing of the backup even if the credentials used for backing up are compromised. Basically an append only storage.

Most Cloud Storage like S3 Amazon (or most other S3 compatible providers like backblaze) offer such a setting.

I doubt that this is the case, whether it is encrypted or not. The complexity and risks involved with decrypting it on the fly is really unrealistic and unheard of by me (have not heard of everything but still)

Also the ransomware would also need to differentiate between the user and the backup program. When you do differentiated backups(like restic) with some monitoring you also would notice the huge size of the new data that gets pushed to your repo.

Edit: The important thing about your backup is, to protect it against overwrites and deletes and have different admin credentials that are not managed by the AD or ldap of the server that gets backed up.

During that time, your data is encrypted but you don't know because when you open a file, your computer decrypts it and shows you what you expect to see.

First time i hear of that. You sure? Would be really risky since you basically need to hijack the complete Filesystem communication to do that. Also for that to work you would need the private and public key of the encryption on the system on run time. Really risky and unlikely that this is the case imho.

Would it be not much easier (and more portable) if you create a Linux VM in for example VirtualBox? From there you could just follow any Linux guide.

The cheap models can not be flashed with openwrt since they use some proprietary drivers or something.

The complete Opal series is not supporte iirc.

You should have read the post more carefully. The CVE affects every OS. Just the first shown example is Windows only.

Also, the relevant commits are outlined in the first paragraph. This article is not for the stupid user it's a technical analysis on a few ways to exploit it and for those cases the commits are more relevant than the version. Also saying which versions are affected is not that easy, commits can be backported into an older version by for example the packager.

This is not really correct. Those companies take complete control of the secret keys. And no, it is not the same effect when you use tailscale compared to wireguard cause of various reasons. CGNAT, no port forwarding, funnels etc.