• StarDreamer@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    4
    ·
    edit-2
    15 hours ago

    Devil’s advocate here: switching to Linux wouldn’t help.

    I recently had to set up a public web server for a org that I belonged to. The idea was that I would set everything up in the most secure and unbreakable way I can think of, write documentation on how to do everything, transfer ownership of all the “break glass” credentials and lock my own account once I’m done.

    This turned out to be a huge mistake. What was supposed to be some free work for a hobby group turned into a massive pain every day at 3-4am (due to time zone differences)

    The person in charge of managing access control couldn’t figure out how wg-easy works. She managed to give her own credentials to EVERYONE who needed access, which obviously didn’t work due to IP conflicts. When pointed out, she modified the IP in every config file, which of course, still didn’t work. It took forever to tell her NOT to share credentials and create new peers for each user.

    The biggest problem is some how NOT windows or mac users. There is a single Linux user that is causing the most headaches. When I set up wireguard, I tested on both Linux and Windows, with Linux being what I used. I ran into some minor hiccups with getting split dns to work correctly, but it was relatively easy to fix in Network Manager. I assumed if there are other Linux users they would be able to fix it themselves. Obviously I was wrong.

    Said person had DoH enabled in their browser that they didn’t know how to disable, running varieties of “I don’t know” for their network stack, DNS resolver, etc. almost every question for dig, cat /etc/resolv.conf descended into “what’s that?” or completely incorrect commands (e.g. resolving a http url in dig). I could not figure out what the person was running, the person themselves had no idea what was running (I think it was systemd-resolvd, but I still don’t know as of now). Eventually, after 3 workdays of trying to help fix this at 3-4am, I gave up. I can’t help with a personal device belonging to somebody that has no idea what they’re doing.

    As for why I’m mentioning this story: switching to Linux wouldn’t help this lady with her problem. There are similar issues on linux that would prevent a login or a graphical session (there was an old work machine that ran VLC, where VLC threw GBs worth of QT errors, eventually causing systemd to crash on reboot when the drive was full). The problem here isn’t just the system, it’s the user. A lot of people seem to be allergic to providing more details than “it’s not working”, “I don’t know” and “I didn’t try anything”. If the general mindset is “I don’t know what’s wrong with no details”, there’s no savings the user from technical problems.

    On a side note for “why the hell did I knowingly volunteer to set up a web server for someone else”: the whole project was already 5 months overdue. It was beneficial for everyone for the server to be up asap. Said person in charge didn’t think of anything (dns, hosting, software stack) other than ask a bunch of CS college students to design a Web app for her. Needless to say the students bailed on her (which is probably the best scenario? In terms of maintainability and security concerns). It also only took me 2 weeks to set everything up (lamp stack, K3S, crowdsec, openappsec, wireguard, etc)

    • corsicanguppy@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      4 minutes ago

      2 weeks to set everything up (lamp stack, K3S, crowdsec, openappsec, wireguard, etc)

      If you’re pushing kubes onto a normie or a noob, the fault’s partially yours. Single-box apache, maybe samba xor git, depending on the workflow, and some audio hints in /etc/profile.d to remind them how to restart various pieces if they can putty in.

    • Muffindrake@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      edit-2
      5 hours ago

      Oh yeah, starting your post with

      I set up a web-facing server for this niche group so I can provide unpaid tech support at 4am

      is definitely on every normal user’s mind at all times.

      The missing undertone here, which is present in about every issue involving Windows 11 ever since it was released, is the corporate enshittification, the unerring fatigue of normal users of avoidance to

      go the fuck away from this cursed idiocy,

      and last but not least people like you going ‘hmm yes but akshually’ in sort-of-defense-but-not-really of the deliberately malicious and billion-dollar company.

      We have been conditioned to view people that criticize the corporatism in this Western society with the same lens as we used to conspiracy theorists. You need to call this out as propaganda wherever you see it. The people who cannot describe the price of a supermarket banana or bread are not your friends.

      Look at it this way: A normal dude with bad hair and questionable social intelligence isn’t getting up in the morning and deciding to fuck with a million or more users by making their computers unbootable. There is only good intentions. Sometimes the Lennart Poetterings fuck up - but we will send three long-haired dudes with funny glasses to your place to fix your tank for free, as you did.

      Whereas with Shitmicro Operating System, they have continually demonstrated that they’re here to sell you ads and make everything so much shittier like you would not have believed twenty years ago.

      • StarDreamer@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        edit-2
        55 minutes ago

        is definitely on every normal user’s mind at all times.

        That was the context. The problem wa connecting to Wireshark, which more and more people are doing thanks to general awareness of VPNs.

        and last but not least people like you going ‘hmm yes but akshually’ in sort-of-defense-but-not-really of the deliberately malicious and billion-dollar company.

        Huh? Where in my post did I defend MS? I was there when Balmer and crew decided to sue anyone with a pulse for using Linux. I was there when the Cathedral acquired the Bazaar (and I deleted my account for it), and I am still here using Linux and BSD for every single machine I own with the exception of one. I still hold a grudge against Mr. Bill “Jump on a roller to show how fit you are” Gates, and I refuse to purchase anything from their game catalog since 2011. Hopefully with this context, you would no longer misconstrue my point as “defending Microsoft”.

        Alas, normal users care about neither. The computer is just a tool that allows them to do work which allows them to put food on the table. If your assistance is just “boo hoo use Linux”. That’s not productive to them nor us. Joe Shmoe isn’t gonna care that you should save your documents as ODT instead of DOCX. They need that document working with no hassle NOW.

        Look at it this way: A normal dude with bad hair and questionable social intelligence isn’t getting up in the morning and deciding to fuck with a million or more users by making their computers unbootable. There is only good intentions.

        Case in video game modding: 1. GShade, where the developer deliberately made people’s game segfault if compiled on their own after an update 2. MultiMC, where the developer personally threatened to sue for trademark violation after packaging the application for a Linux distro 3. Bukkit, where one dev decided to DMCA and take down all instances of the project.

        Outside of video games: the entire university of Maryland, which attempt to inject backdoors into the Linux kernel that was not caught until they published a paper.

        Also, for the “good dudes part”: regardless of intentions, if the damage is done, the harm is done. If a suitcase falls from an airplane and kills me tomorrow, I wouldn’t care whether it was intentional or not. I would be dead.

        Going back to the original blog post: there is both a user problem and a technical problem here. The technical problem “could” be fixed by switching to Linux (assuming systemd or gnome doesn’t get to it first), but the user problem can’t. Calling out anyone who points out the user problem as “corpo drone” isn’t going to make it go away.