Die wunderbare Welt von Isotopp

Rotating Accounts or Passwords?

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - February 20, 2023

Some applications allow you to have multiple passwords. For example, in MySQL, since 8.0.14 you can dual passwords for an account . Also, Redis 6 allows you to have multiple passwords on an account ACL .

Personal Accounts and Machine Accounts.

When running services in a production system, the services sometimes have personal accounts (PAs) that allow humans to login and perform actions on the service. Often, these accounts are very limited in number (in production), and privileged.

This is not a Drill, this is just Tuesday

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - February 18, 2023

Master of Disaster

With a previous employer there was the requirement to implement business continuity management and patch management. Specifically, there was a requirement to be able to lose a region completely without loss of business. The other requirement was to be able to have all systems CVE-free within 30 days (in emergencies: 3 days), and to be able to blackstart them.

That was of course impossible to implement.

Minecraft: unable to create native thread

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - February 17, 2023

A minecraft server has problems creating threads. The error message reads:

java.lang.OutOfMemoryError: unable to create native thread: possibly out of memory or process/resource limits reached
        at java.lang.Thread.start0(Native Method) ~[?:?]
        at java.lang.Thread.start(Thread.java:802) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor.addWorker(ThreadPoolExecutor.java:945) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor.execute(ThreadPoolExecutor.java:1353) ~[?:?]
        at java.util.concurrent.Executors$DelegatedExecutorService.execute(Executors.java:721) ~[?:?]
        at org.bukkit.craftbukkit.v1_19_R2.scheduler.CraftAsyncScheduler.mainThreadHeartbeat(CraftAsyncScheduler.java:73)

The server in question has 32 GB of memory (6 GB used), 8 cores, and processes threads running. It is mostly idle. There is no reason at all why this machine should be out of resources.

Service Directories, and what they are good for

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - February 6, 2023

At a previous job we had a home-grown application “Service Directory”, which allowed a team to declare a service or deployed application. The record for a service not only declared the application with pointers to the source code repository, artifacts and documentation.

It also pointed to the operational facts, such as criticality, the owning teams, the SLO, the alerts, and the collected stats and dashboards. And, most importantly, you had to declare dependencies – which other services you depend on.

Mastodon Interaction Counters

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - January 25, 2023

In this post , SirSquid@toot.io asks:

Can someone explain to me why seeing retoots and likes is wildly different across Mastodon servers?

From toot.io, a toot from @gamingonlinux@mastodon.social shows hardly anything. But when viewing it on mastodon.social, it has tons of both.

This is one thing I would love to see properly cleaned up on Masto.

Mastodon is using ActivityPub, a federated protocol. Nodes exchange articles, and each node caches articles.

I don't hate Let's Encrypt anymore

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - January 4, 2023

So, Rachel is in a bad mood: Why I still have an old-school cert on my https site and I feel her. Like her, for my own sites I have always been running Apache. There was never much need to upgrade, the software was available, stable, and fast enough.

At some point in time, I needed TLS and started to use Let’s Encrypt .

That was messy: Running dehydrated , a bunch of haphazard shell scripts trying to get certificates authenticated and installed, through a wild chain of callbacks and sourced scripts all over the system, driven by Cron, and with bad alerting.

MySQL: Ways to run mysqldump

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - January 3, 2023

This text exists mainly so that I paste the URL into the #mysql channel in Libera IRC.

The mysqldump tools allows you to convert a MySQL database server or individual schemas back to SQL. You are left with a script that is supposed to be loadable into a target server and gives you back the full database, including all objects in it.

You can read that SQL as a script into an empty server to create a new instance, or process it with different tools for different purposes. So in general, a workflow can look like this:

Was mein Kind in der Schule so macht

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - December 30, 2022

Die Niederlande sind ja ein Land, das mit WhatsApp funktioniert. “Ik stuur je snel een appie” und wenn WhatsApp mal down ist, wird das Land vorübergehend geschlossen.

Damit kann man einverstanden sein oder nicht, aber Metcalfe’s Law ist mächtig und wenn man das Land nicht in Hard Mode spielen will, dann legt man sich besser ein WhatsApp zu.

An ungefähr jedem zweiten Wohngebiet findet man ein solches Schild an der Einfahrtstraße. Es gehört zu WBAP (WhatsApp BuurtPreventie), einem System von mehr als 10.000 Nachbarschafts-Chatgruppen.

Chromebooks in der Schule

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - December 29, 2022

In Mein Sohn sitzt vor dem Computer und in Schulen digitalisieren ging es schon einmal um den Einsatz von Computern in der Schule, in Deutschland und in den Niederlanden.

VWO

Jetzt stand bei uns letzten Sommer nach dem Ende der 8. Grundschulklasse (der deutschen 6. Grundschulklasse) der Schulwechsel auf die VWO an. VWO steht für “Voorbereidend wetenschappelijk onderwijs”, studienvorbereitender Unterricht, und entspricht noch am ehesten einem deutschen Gymnasium. So wie es in Deutschland Gymnasien mit unterschiedlicher Ausrichtung gibt, gibt es das auch in den Niederlanden und der Name “Gymnasium” steht für eine VWO mit altsprachlicher Ausrichtung, der Name “Atheneum” für VWO mit einer technisch-naturwissenschaftlichen Ausrichtung, und es gibt noch ein paar weitere Geschmacksrichtungen. Die Schulart ist VWO.

MySQL: The command line client

Avatar of @isotopp@infosec.exchange Kristian Köhntopp - December 28, 2022

When asking for help in Libera Chat , in the #mysql channel, people will ask you to use the mysql command line client. They will also point you to dbfiddle.uk for asking questions. Specifically, when using phpMyAdmin, you will get hate.

Why is that?

When asking for help, it is almost impossible to help a GUI user, because they will need to paste screenshots in order to document what they did. The screenshots do not help us. They are hard to read, and do not contain the information about the problem you need help with in textual form.