I bet it will happen that some apps i now use, which are in the regualar app store, will be pulled in favor of a own app store which has more tracking and maybe even cost money. So it will be a downgrade if now working apps move to an ad and tracking app store which are not privacy sensitive like iAds.
> I bet it will happen that some apps i now use, which are in the regualar app store, will be pulled in favor of a own app store which has more tracking and maybe even cost money.
Did not happen for Andorid so there is no reason to think that it will happen in this case. Also, how would an app installed from another store be able to track you more if you are using the same OS. That just sounds like bad OS design from Apple.
I just dump my default changes here. Maybe somebody finds something usefull for themself. Added the command from this thread too. :)
Edit: Looks like i already did edit this before since mine was already at 8 and 12. Added the original source like its linked above.
* changing your SSH port means that you'll have to do a bunch of fuckery to get basic functionality working. you will very likely waste hours of your life. you will have to google "rsync ssh non standard port" every time you want to use rsync. you will have to remember scp flags. this is also bad. probably worse.
---
I dont need to remember non standard ports if i just use my .ssh/config.
Host myhost.tld
Hostname 127.0.0.1
Port 333
User MyUser
IdentityFile ~/.ssh/myhost.tld
I was brand new to managing an Ubuntu Hetzner server and the moment I saw how many port 22 scans the server received i decided to try changing the port number, followed by key-only passwordless logins. My logs immediately shrank in size. I have never once had an issue having moved to non standard ports and, moreso, feel almost naked logging into port 22.
I know security through obscurity is not an answer, but judging by the reduction in port scanning i've seen after moving as many standard ports as possible to new addresses above 20000 I have to believe its a reasonable first step. How many script kiddies are scanning all 65500 ports for each IP address?
I feel similarly. Switching ports is no real defense, but it at least means you are eliminating the drive-by attacks who are only interested in the trivially exploited. Such a simple thing to do and sharply reduces the log volume.
The next trick I think of implementing is port knocking. Should drop log noise to zero unless someone starts targeting me specifically. In which case, my goose is already cooked.
If it's not some sort of proxy/firewall remapping the port, you probably shouldn't use a port above 1000 for some services.
Consider this: an attacker (somehow) managed to get user access to your server. They can now dos the service until it crashes and then start their own service listening on that same port, maybe impersonating your service. Maybe they can use that to grab sensitive information or do something else.
Indeed, although because I heavily utilized Docker I also ended up using UFW-Docker. It was fairly straightforward to incorporate into my startup scripts.
Normally I might put a title like this down to opinion but here, the author suffers not knowing enough about the subject to justify having an opinion, let alone publish one.
Fail2ban is a stupidly easy way to block lazy hacking scripts. It's easy to extend to handle simple honeypot services. It's no replacement for real security but it makes focussing easier.
THIS. I use non standard port for SSH by default and my single SSH config file manages this for me with no extra effort. Seems like a common sense behavior to me.
Sure, if you use only the OpenSSH client and other software respecting its command line option paradigms or configuration files. But there's tons of other things connecting to SSH.
And even only in the OpenSSH universe, I find it quite annoying having to remember whether the `-p` can go after the hostname or has to appear before, whether SCP uses `-p` or `-P`, whether `ssh-copy-id` supports one or the other etc.
There are some protocols I wouldn't necessarily run on their default port and publicly accessible, but SSH is really not one of them, also given that sshd has been specifically hardened for that adversarial use case.
If you tap the wifi button in your controll center it just turns it off for 24 hours or when you switch locations. If you turn it off in the Settings App then it stays off.
