The DMZ

« first day (3763 days earlier) ← previous day next day → last day (1415 days later) »

Conor Mancone

09:41

@OakDEV Hard to say. Looks like you're using a slightly modified or slightly old version of KijijiBot. The overall issue though is that the class you are using is expecting to find a requests session in the session attribute, and it isn't there. In short, you're missing this:

github.com/george-lim/kijiji-bot/blob/main/kijiji_bot/…

4 hours later…

Fire Quacker

14:05

Does 2FA make sense on devices that aren't accessible from the Internet?

Apparently, there have been a lot of complaints from Ubiquiti users because the UniFi controller doesn't do 2FA unless you connect it to the cloud

Unless you're going for zero trust, I'm not sure how 2FA is useful

Conor Mancone

2FA everywhere!

No, seriously though

"it depends on your threat model"

For a device that is only accessible on my home network? No, I don't think 2FA would be worth the effort

If i'm managing devices that are not internet accessible, but I have thousands of them in in an airport? Yes, 2FA please

Fire Quacker

Right... if it's just on your network, not port forwarded then why do you want it other than it makes you feel so secure?

Yeah, big important systems

If you're doing a big important system then why are you using Ubiquiti?

Ubiquiti is like the cheap easy solution

Conor Mancone

To be fair, given the long history of poor security practices in IoT devices, a push for slightly excessive security is not exactly the worst thing in the world

but yeah, for a home network, there isn't as much of a need for 2FA. A lot of that may be from people who have gotten in the habit of "2FA everywhere!"

Fire Quacker

@ConorMancone I dunno, a lot of the problems in IoT are in areas like outdated firmware and poor programming by the manufacturer, and 2FA couldn't do anything about that

2 hours later…

Fire Quacker

16:02

PCI question: For a restaurant, how is port forwarding TCP 80 to the DVR a vulnerability that breaks PCI compliance? What attack does it allow?

Nevermind, I think I understand it. It's not HTTP that's the problem, it's the fact that anything is being forwarded to something not in a DMZ.

7 hours later…