Category: Debian

Keep calm and keep patching

OMG, I’m seeing PHP in the mainstream media news.

Today I checked in on this platform, as PHP powers WordPress, which is this blog platform. I self host, on my own VM (EC2 Instance), sitting behind Amazon CloudFront.

CloudFront is natively providing some protection, as only specific URLs I expose have support for HTTP POST actions. Most URLs only accept HTTP GET.

But there’s another power move: I’m running Debian; and the Debian team had patched PHP versions out earlier today. But on top of that, I have automated package installation active.

You can too, with:

dpkg-reconfigure -plow unattended-upgrades

So when I checked in my system today, it was already patched.

Meanwhile, we see legacy organisations panicing, taking systems offline, or worse – doing nothing and remaining vulnerable.

It reminds me of the recent article where an individual in Australia used an AI tool to try and book a gym session, and the AI tool found the API was unprotected, and proceeded to cancel someone else’s booking to take their slot. The issue is not the AI tool; is the unprotected vulnerable API.

Do better, people. Patch, secure, authenticate, log, provide minimal exposure. Use AI tooling to help you. Get experts in. Experience counts.

My own little server

In 2004, I was living in London, and decided it was time I had my own little virtual private server somewhere online. As a Debian developer since the start of 2000, it had to be Debian, and it still is…

This was before “cloud” as we know it today. Virtual Private Servers (VPS) was a new industry, providing root login to virtual servers that individuals could rent. And so I started being a client of Bytemark, who in turn offered me a discount as a Debian Gnu/Linux developer. With 1 GB of RAM, the initial VPS was very limited, but I ran my own mail server (with multiple domains), several web site s(all with SNI TLS enabled web sites, my own DNS server, and more.

Several years back I took the move to migrate my domains from being self-hosted on a VPS, to using AWS Route53. It was a small incremental cost, but I had long since stopped playing around and experimenting with DNS, and I wanted something that had high availability then a single virtual machine.

I have run a blog on my web site since the mid 1990’s (30+ years now), and WordPress has been my main platform since the late 2000s. This is WordPress now (2024), however a few years back I slotted AWS CloudFront in front of my origin service, to provide some level of global caching.

Several of the websites I run have also moved off to Amazon CloudFront, in particular all my small MTA STS web sites that serve just one small text file: the Mail Transport Agent Strict Transport Security policy document.

I still run my own mail server, with Exim4, PostgresQL, DoveCot Spamd, ClamD, etc. It lets me experiment with low level stuff that I still enjoy.

I have a few other services I want to move out of my VPS and into individual cloud-hosted platforms, but not everything is ready et. However a recent review of my VPC costings, and a forced migration from ByteMark (ioMart) to a new organisation UK Hosting, forced me to reconsider. So I took the inevitable change and migrated the entire VPS to AWS EC2 in Sydney, closer to where I am most of the time.

And so it comes to pass after 20 years, thank you to the team at Bytemark for my UK VPS.

20 Years of Linux.conf.au [Memoirs]

Memoirs of LCA

On the first night I arrived in Christchurch, New Zealand for Linux.conf.au 2019, a group of around a dozen attendees went to dinner. Amongst them were Steve Hanley and Hugh Blemmings, whom I have known since the early 2000’s at various LCAs around the region. They asked for some memoirs of LCA – something small; what follows was my throughts, far longer than expected

Continue reading “20 Years of Linux.conf.au [Memoirs]”