starkzarn

joined 2 years ago
[–] starkzarn@infosec.pub 1 points 2 days ago

Agreed, prosody is great! I've been doing some experimenting with ejabberd and it seems more enterprise-ready, but I haven't found anything that is discernable as far as feature advantages.

[–] starkzarn@infosec.pub 1 points 2 days ago

Sounds like a great opportunity to breath some life into it! If you really have the itch for IRC, there's a slidge bridge to connect IRC to XMPP!

[–] starkzarn@infosec.pub 1 points 3 days ago (2 children)

Agreed! Runtime environment management is so much nicer with modern containerization. You or ally can't overstate how much better it is to have app stack state be entirely divorced from OS state. I'm very pleased they're back on the bandwagon as well.

Stand up a server and come join our MUC!

[–] starkzarn@infosec.pub 6 points 5 days ago

UPDATE: For anyone who comes back to this, or any new readers -- I have added a MUC (chat room) on my XMPP server for discussion of any tech-related things, akin to the subject-matter of this blog. Hope to see you there!

xmpp:roguesecurity@groups.hackofalltrades.org?join

[–] starkzarn@infosec.pub 1 points 6 days ago

I have experimented with Simplex, but it feels less tuned toward hosting federated infrastructure and more tuned toward participation with the greater network in a pseudo-anonymous fashion.

Adoption is also always a hurdle with any ecosystem like this, and XMPP is certainly ahead of Simplex in that avenue.

[–] starkzarn@infosec.pub 7 points 6 days ago

It has a long healthy life ahead! Come join the party, the proof is in the pudding.

[–] starkzarn@infosec.pub 2 points 6 days ago

😆 +1 for reading enough to see that! Thank you!

I'm one of those people that ends up using the vocabulary I once learned to get the most value out of it. Would hate to waste all that. Haha.

[–] starkzarn@infosec.pub 6 points 1 week ago

This is also a great article! Thanks for the link.

One cool point in favor of XMPP is that in a public setting (MUCs), there's community. Moparisbest is an active participant in several of the MUCs that I'm in. Very cool!

[–] starkzarn@infosec.pub 4 points 1 week ago (4 children)

Yeah they just redid their container image pipeline and these containers are the result!

[–] starkzarn@infosec.pub 5 points 1 week ago

Super true. I think this was best exemplified by SignalGate

[–] starkzarn@infosec.pub 8 points 1 week ago (10 children)

This is great, I have not seen this post before. Thank you for sharing.

You make an excellent point here, that the burden of security and privacy is put on the user, and that means that the other party in which you're engaged in conversation with can mess it up for the both of you. It's far from perfect, absolutely. Ideally you can educate those that are willing to chat with you on XMPP and kill two birds with one stone, good E2EE, and security and privacy training for a friend. XMPP doesn't tick the same box as Signal though, certainly. I still rely heavily on Signal, but that data resides on and transits a lot of things that I don't control. There's a time and a place for concerns with both, but I wanted to share my strategy for an internal chat server that also meets some of those privacy and security wickets.

[–] starkzarn@infosec.pub 5 points 1 week ago (1 children)

Yes, absolutely. It all depends on implementation. I am using VLANs for L2 isolation. I have a specific DMZ VLAN that has my XMPP server and only my XMPP server on it. My network core applies ACLs that prevent any inter-VLAN traffic from there, so even if STUN/TURN pokes holes, the most that is accessible is that single VLAN, which happens to contain only the single host that I want to be accessible.

Great question.

 

cross-posted from: https://infosec.pub/post/36118098

Take control of your data, join the tech chat. Host an XMPP server and leverage end-to-end encryption for your personal data

 

Take control of your data, join the tech chat. Host an XMPP server and leverage end-to-end encryption for your personal data

 

cross-posted from: https://infosec.pub/post/32937284

This one is a little self-hosting specific, and more casual Linux best practices, but I've got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

 

This one is a little self-hosting specific, and more casual Linux best practices, but I've got a new blog post down for general security! Harden your systemd units (especially custom ones) for better peace of mind on the internet!

 

cross-posted from: https://infosec.pub/post/32151664

This is a generic metrics post to leverage a spare ESP32 meshtastic node to ingest metrics into Grafana! We've had some congestion issues due to poor config in my area, and this has helped me pinpoint which nodes are causing the biggest problems, and block them at my repeater.

 

This is a generic metrics post to leverage a spare ESP32 meshtastic node to ingest metrics into Grafana! We've had some congestion issues due to poor config in my area, and this has helped me pinpoint which nodes are causing the biggest problems, and block them at my repeater.

 
 

This one is less focused on self-hosting a homelab service, but I thought might be interesting for the homelabbers here. I got into this hobby through my career in cybersecurity, and decided to write up a little post about a tool I frequently use, mitmproxy!

 

If you've followed any of my self-hosted headscale with Podman series, I wrote up another "bonus" post talking about OIDC configuration with Authelia. Took some trial and error, so I figured I'd document it in the public notebook.

 

cross-posted from: https://infosec.pub/post/28196930

Another post in the records for the tech blog, this time all about opensource network monitoring with LibreNMS!

view more: next ›