You should backup your data. You should have multiple backups of your data. You should have multiple rotating or rolling backups of your data. You should have multiple rotating or rolling backups of your data saved to different types of backup media. Ideally, you should have multiple rolling or rotating backups of your data saved to different types of backup media including off-site backups.
Evidently, a PBS station didn’t follow any of these rules. Instead they handed their data to a third-party, said “Here, we’ll pay you to store it for us,” and now they’re screwed because the company went defunct.
Le sigh. Lawrence brings the hammer down on their IT organization:
Nor can this PBS station plead poverty: “2022 their gross income was [about] $13.5 million expenses 12.8 million. Their net was 3/4 of a million. So the net that is what they got to keep after paying all the employee salaries, after paying the directors 700,000 bucks.” Yeah, they could afford a local backup solution.
It used to be a real pain to install Linux. My first Linux distro was Slackware on a v0.99 kernel that came on 35 floppy disks (ask your parents, kids) way back in the early 1990s. Things have come a long, long way since that. You don't even need to muck around with dd and create a boot USB anymore. Super easy.
I've recommended Mint Linux before, but this is a great overview of why users new to Linux should consider Mint.
Tomorrow we'll talk about how a seasoned IT guy has moved from Windows to Linux. Spoiler alert: it's less technical work to make Linux work right than it is to make Windows work.
OldNFO has an important post about how Microsoft is moving very aggressively to a 100% online subscription licensing model. This is important enough that I won't excerpt any of this; instead, you should go read the whole thing. It's not too long, but if you care about the security of your home network (especially the whole who has access to my data and can I even know thing), go read. I'll wait.
What this means is that you don't own any Microsoft software. Sure, you may think that because you paid them money (most often when you bought your computer - some of that purchase price went to Microsoft in the form of a license fee for Windows). But you actually don't own "your" copy of software. At all.
Rather, you have the right to run the software on your computer. That may not seem like a big difference, but it is. The license agreement (you know, the one you didn't read before you clicked "I Agree") allows Microsoft to change the terms of the agreement at any time, at their pleasure.
Microsoft has just done this in a big, big way. Key new stuff in Windows 11 is:
AI integrated with your operating system
Online presence is critical for lots of Windows now (e.g. AI)
Windows will nag you until you put all your data online (OneDrive) whether you want to or not.
The proper technical term for that first bullet point is that your Windows operating system is essentially now an "AI Agent" which if you are a regular reader you know is very, very bad security juju.
Combine this enormous security hole with the requirement to essentially be online 100% of the time (bad security) and the liklihood that OneDrive will slurp all your data to some Internet black hole in a Microsoft data center, Windows is simply unsecurable.
Yes, I know that is inflammatory, but there is simply no way that you can get assurance that your security is sane. I say that as someone who has spent decades inn Internet Security (and particularly in security assurance). Not to put too fine a point on it, but I don't think that I could get decent assurance that things aren't going "bump in the Net". For most of the readers here, it's not even worth trying.
So what do you do, assuming that you are not a tech nerd like me?
Interestingly, Microsoft has just flipped the technical script on this. It used to be that it was easier to stay on Windows than to move to alternatives like Linux. Now that's out the window, at least if you want to protect your data from that OneDrive vacuum cleaner and whatever the AI agent will do to you.
This is really slick. The Linux equivalent of the Windows Start Menu lets you try all the apps (I use the Office apps which are every bit equivalent to Word and Excel, etc, and will save files in Microsoft format like .DOCX).
Take a few weeks poking around, you will likely see that it's not a big learning curve.
This post is the fourth in a series on how to make your home network harder to attack. Here are links to posts one, two, and three.
Now you might think the question in the post title is a bit strange - after all, these are you devices, so you'd think that they're all trustworthy. You'd be wrong. There are at a minimum two different categories of trustworthiness:
Your main computing devices. These are computers (duh) such as laptops and desktop computers, servers (a future post will talk about why these can be useful to you, and your cell phones (which are nothing but tiny hand held computers).
Now I've been in security for long enough that I get a bit twitchy about mobile phone security (I'll address this in a future post as well). However, that ship has sailed and even a security nerd like me won't bother making a separate network just for these. So they're computing devices for this discussion.
Then there's everything else. It's surprising how any Internet-connected thingies there are these days. Ring doorbells, Nest thermostats, online appliances (fridges, washing machines, etc). At this point the Borepatch from four years ago would have told you to just walk away from all this nonsense. Don't Internet-enable anything in this category.
Today's Borepatch sighs and tells you that this is coming to a home near yours. It's here in my home. No, not the thermostat (which was installed by the previous owner and which I have not connected to the WiFi). However, the TVs all come with streaming apps for Netflix, Prime, and Youtube (among dozens of others). And The Queen Of The World reminds me that the kids like to stream when they come and visit. She likes it when they come and visit, as do I. And so we have to do something for these devices.
Fortunately, you don't need any new kit to do this. If you remember from the last post on water tight compartments, you don't own the Internet box from your network provider. Basically, you can't trust it, so you install a new firewall box running DD-WRT. It's trustworthy because you own it and have your own software and configuration on it.
All of your main computing devices connect to it's WiFi. All of the other devices (doorbells, thermostats, TVs, appliances) connect to the WiFi from your network provider's box.
What you've done is to put a firewall between your computing devices and your untrusted devices. It doesn't matter if your TV gets hacked because it can't get through your DD-WRT firewall to your computers.
Likewise, your TV is at least somewhat protected from the outside world because it's behind the firewall in your network provider's box.
This post is the third in a series on how to make your home network harder to attack. Here are links to posts one and two.
Post two introduces the concept of a Firewall which is a device that lets you connect to the Internet without letting the Internet connect to you. Firewall technology comes embedded in your Internet provider's device like a Cable TV modem. A recent article does a comparison on a number of these devices.
If you look at the device it will look a lot like this:
The red colored connection goes out to the Internet, the yellow ones go to your devices (as does the Wifi). This one has a connection for a landline telephone as well (ask your parents, kids).
Installing the device is really simple - red (labeled "WAN") goes to the outside which is untrusted, and yellow/WiFi go to your own devices which are trusted.
Except nothing is as simple as that. Your Internet provider actually owns the firewall device, it's not really yours. Some providers run their own WiFi network for other subscribers who happen to be passing by - Verizon is notorious for this, and you will often find all sorts of WiFi networks called "VerizonXYZ" or some such.
So who is outside the firewall, and who is inside? The question may sound pedantic but it's terribly important. Fortunately there is something you can do about this.
Ships used to sink all the time but this is pretty rare these days. One major reason for this is that they are divided into compartments which are watertight - if the ship hits a rock (or, like the Andrea Doria gets rammed by another ship) only one compartment will flood and the ship can likely make it to port.
USS South Dakota under construction
The network security analog of this idea is to use more than one firewall. Don't trust your provider's firewall? (and you really shouldn't) Buy your own and hook it up to your provider's firewall. The red (WAN) port on your firewall gets connected to the internal (yellow) connector on the provider firewall. Now anyone that the firewall lets in can't get past your firewall.
And it really is your firewall, although you'll have to buy it with cash money. But your devices connect to your firewall's yellow network connections, or to your firewall's (NOT your provider's firewall) WiFi.
Now you don't have to trust your provider because their device doesn't have access to your internal "watertight compartment".
Linksys, Netgear, and TP-Link are low cost options, running $30 - $70 or so.
The first thing you should do is replace your firewall's operating system with dd-wrt:
DD-WRT is a Linux based alternative OpenSource firmware suitable for a great variety of WLAN routers and embedded systems. The main emphasis lies on providing the easiest possible handling while at the same time supporting a great number of functionalities within the framework of the respective hardware platform used.
Here's a step by step tutorial on how to install dd-wrt on a Netgear device:
[UPDATE: Rick T in the comments says to check the dd-wrt website before buying a device, to make sure that the software supports that particular hardware.]
Why go to this hassle? Product longevity. Consider a $60 Netgear device. The profit margin on this to Netgear is probably $5. You can't pay for a lot of enhancements or security bug fixes with that. DD-wrt is an open source project with a bunch of passionate contributors. I like my chances on having a viable, supported software five years down the road with them. Not so much the device manufacturers.
So now you have a device you can trust for the long term. We're not done yet, because there's all sorts of new tech evil that people want to use - Ring doorbells, Alexa, etc. That's tomorrow.
Forget about the Internet and security for a moment - you already own something with a firewall. Your car has one between the engine and the passenger compartment, even if your car isn't a sweet 1969 Dodge Charger.
The firewall in your car is designed to contain engine fires to the engine compartment, not letting the flames spread to the passengers. Firewalls have been around cars for a long, long time - certainly since the 1930s, and probably a lot longer.
Now back to the Internet and security. Internet firewalls are designed to keep bad things (and Bad Guys) out of your network, so they don't burn down all your devices. Yes, I stretched that metaphor, but that's exactly where the name came from.
An old Internet wag once described a firewall as a device that "keeps the bad guys out while letting the good guys out". That's a really good description. Internet firewalls have been around for basically as long as there has been an Internet, say from around 1990. The technology is very well understood, and very mature. That's the good news.
The bad news is that there are a million ways to set up your firewall so it's more full of holes than Swiss cheese. This post will try to help you avoid this.
More good news: your Internet Provider almost certainly has a firewall capability in hte box that gives you Internet access. For example, if you get Internet via cable TV, you have not only a cable box that changes channels, you have a separate box that gives Internet. That thing has a firewall built in, so yay.
You an check this yourself via a web site that I've linked to a number of times over the years, Steve Gibson's Gibson Research. You should see something that looks like this:
Green is good.
So what went on when you ran that? There are a bunch of Internet services like web, email, and so on. Each uses a "port" - email is 25, web is 80, there are a bunch of others. What Gibson's app did was to try to connect to all of these posts on your IP address. Ideally, your firewall (like mine) dropped these connections in the trash can.
So from a first cut, your firewall is letting you out onto the Internet (so you can read this, hello!) but keeping the Bad Guys out.
But the devil is in the details of how we (and our devices) use the Internet. The next post in this series will explore this: Secure Your Home Network: Can (and should) you trust your devices?
This is the beginning of a new series about what (mostly) non-technical readers can do to lock down their home networks to a decent level of security. I need to start with some caveats here:
It's pretty easy to protect yourself from "script kiddies" (Bad Guys who just use canned exploits without knowing much (or anything) about you or your home network. Hopefully the posts in this series will make you, if not impervious to, at least unreasonably difficult for these attackers.
It's harder to protect yourself from a knowledgeable and determined attacker. Someone with skill, time, and motivation to attack you is a dangerous opponent. Hopefully the posts in this series will increase the required time, skill, and motivation needed for these Bad Guys to succeed. Basically, it raises the cost for them to attack you which is A Good Thing.
At the end of the day, you can't protect yourself from NSA or FSB (the KGB successor organization). Or the Chinese, who are quite active and skilled. Even keeping them from sniffing out your traffic is really, really hard. If you think that any of these organizations are likely to want to access your computers, then you should unplug from the 'Net right now. Not kidding.
So if you're interested in this kind of thing, and are willing to spend a nominal amount of time and money to raise the bar on your home network security, follow along on this series of posts.
Tomorrow's post: What is a Firewall and why do you care?
_under_construction,_1_April_1940.jpg)
