Linux Security Tools

As we move finally into the new century, it becomes less and less clear who the enemy is. Is it the NSA as so many think, or is it the FBI, the DEA and local law enforcement as I believe? The IRS or the Franchise Tax Board? Does it matter? Well yes, I think it does matter but that may be above our collective heads.

After all, we, the citizens are not organized, can not defend ourselves, and for the most are, in my humble opinion, too stupid to understand the issues even though they are right before our tightly shut eyes. Like happy sheep, shorn for the benefit of the rich, we bleet our way through our pathetic lives on the way to the butcher. One last time through the scissors our happy middle class says as the harvest of their pathetic wealth, valuable only in aggregate, is extracted by our ruling classes. They only have our interests at heart we can be sure.

But there are tools which may be of use to the dissident, the criminal, or merely the consumer who does not want to share their pathetic lower middle class peccadilloes with our nosy neighbors. These tools provide a certain level of security to the computer user as long as some guidelines are followed, and these guidelines include (a) great diligence and attention to detail is required to use these tools successfully, (b) these tools and the details change constantly and it is up to you to not be complacent and stay up to date, and (c) any security can be penetrated if the adversary wants to enough, although different costs are imposed for different levels of security.

But with that in mind, here is a list of Linux security tools and guides as provided indirectly through www.cryptome.org and submitted for your consideration.

https://cryptome.org/2016/07/new-linux-security-guides.htm

If you read to the end, you will find links to security guides for Windows and Android as well.

You Max OS X and IOS users are on your own.

Here is a quote in case the references post goes away, although Cryptome.org has been very good about such things.

Security in-a-Box is a joint project of Tactical Tech and Front Line Defenders which provides practical help and information on digital security, published in 17 languages and reaching over 2 million people every year.

The six new Linux tool guides offer in-depth step-by-step help in installing and running six of the most essential open-source digital security tools, including the Tor Browser, Thunderbird with Enigmail for encrypted email and the Firefox browser with privacy Add-ons:

- Tor Browser for online anonymity & censorship circumvention:
https://securityinabox.org/en/guide/torbrowser/linux

- Thunderbird, Enigmail and OpenPGP for secure emails:
https://securityinabox.org/en/guide/thunderbird/linux

- VeraCrypt for secure file storage:
https://securityinabox.org/en/guide/veracrypt/linux

- Jitsi and OTR for encrypted instant messaging and VoIP calls:
https://securityinabox.org/en/guide/jitsi/linux

- Firefox add-ons for secure browsing:
https://securityinabox.org/en/guide/firefox/linux

- KeePassX for secure passwords:
https://securityinabox.org/en/guide/keepassx/linux

The new guides add to our existing 25 tool guides for Windows, Android and social media, as well as 11 in-depth tactics covering all aspects of digital security.

Remember, none of these are a panacea. Real security requires constant vigilance.

_____________________________________________________

New word note: “aggregrate” for “aggregate”.

Do Not Leave Those Naked Pictures of Yourself on Github

One of the not-so-entertaining results of our civilization's obsession with computing and cash is the "fuck our customers we don't care" approach taken by the consumer electronics and computing industry towards such things as systems administration, backup administration and security administration and its impact on our lives.  Now we are all forced to take on these dreary sub-specialties or face one of many horrible fates that this technology mania has brought down upon us: the wiped disk, the non-working backup, the zombie computer used by Chinese or Russian spies, or worse, the "hactivist" holier-than-thou swine ready to exploit your assets to mine Bitcoin or some other juvenile and anti-social goal for their self-appointed crusade.   We are all now responsible for these and many other tasks and woe unto those of you who think you are above such things for then your sins as documented by your iPhone will appear on social media and there you will be, in full color, engaging in some drunken bisexual orgy as an undergraduate for everyone to see just as you are running for your first political office or other responsible position.

Be warned, if you wish to avoid this or some other horrible fate, there are a few hundred things you need to pay attention to at any one time, although that list is a moving target. You have to know enough to keep yourself out of trouble.  No one else will do this for you. 

Many of us use Github as a repository for source code for our projects and collaborations. In the past I have used it off and on, but these days I use it more or less 7/24. As part of your repository, one could keep security strings that give access to various other resources that exist out there, such as the Amazon cloud. A friend did just that and forgot about it. Although he certainly knew better a few years later he made that repository public (it was either that or delete it, he wasn't working on that particular idea anymore).

Well his repository contained security information for his cloud account on Amazon which he also wasn't actively using and some hackers grabbed it and ran up a bill in the many 10s of thousands of dollars per day. Amazon.com caught it nearly immediately and my friend will not be liable for most of this bill, hopefully not any of it.

My friend is beating himself up because of course he knew better. He does know better, by the way. Don't let this happen to you. He suggests reading the following discussion on these issues to learn how to keep passwords out of your Git repository.

http://programmers.stackexchange.com/questions/163506/how-does-one-handle-sensitive-data-when-using-github-and-heroku

Never forget it's a jungle out there and that, generally speaking, people are scum.