Notices by Kev Quirk (kev@fosstodon.org), page 84

We have come up wit ha workaround to fixing the spambot issue. We've halted all registrations, and replaced the sign up button with a link to a form.

New users can then email us a request for an invite link. I think this is a good way for us to the protect the instance, at least in the short term.

If any other admins who are having issues with bots want the code for our form and details of what we did, let me know.

https://fosstodon.org/about

@h4ck3r9 I've used them professionally, never used them personally though,. So can't make any recommendations for a personal setup, sorry.

@tinker "(mumbles something about legal authorization something something don’t get caught something something seven proxies...)"

Actually made me laugh out loud.

@DistroJunkie @h4ck3r9 oh how wrong one person can be. 🤣🤣🤣🤣

@Matter @h4ck3r9 ah, maybe not then. Maybe a cheap Digital Ocean instance? $5/month should be enough.

@h4ck3r9 I wouldn't pentest your production site. Maybe set up a dev clone that you don't mind breaking and test that.

@h4ck3r9 hahahaha but it's fun to learn!

@h4ck3r9 what hardware are you running your new site on? It might be better for you to install and use a web server control panel, like VestaCP or ISPConfig. They will take a lot of the complicated config out of the equation for you. 👍

@h4ck3r9 I used to do network security, I now do incident response. It's literally minefield - it's a cat and mouse game, but there are some basic things you can do...

Always make sure you're patched. Only open the ports you need to open. If you need to open things like SSH, make sure it's only from certain IPs (IP Tables can help there).

Apache can be hardened in a number of ways. Google is your friend there. I only have 500 characters. 😀

@dtluna @zeta @brandon @h4ck3r9 😂😂😂😂😂 you're way too angry. It must suck to be you. I think I'm done engaging with you now, if I wanted to have arguments, I'd head back to Facebook. 👍

@dtluna pipe down princess, we're just having a discussion. There's no need to become aggressive. @h4ck3r9 asked about https, and I had an article that explains SOME of the advantages of https in a relatively easy to digest form.

@h4ck3r9 the difference between SSL and TLS, is that TLS basically took over from SSL. SSL is widely regarded as insecure, thanks to vulnerabilities like POODLE.

@brandon

@dtluna @h4ck3r9 @brandon I wrote an article on why https is important (link below). Also, it's not SSL, it's TLS. It's a common mistake that people make, but it's one of my pet HATES. 😉

TL;DR for the article: USE HTTPS!

Also FF and Chrome are going to start marking sites without TLS with a big red splash page, so worth doing it sooner than later. 👍

https://kevq.uk/why-https-is-important/

@rick_777 😂😂😂😂

@brandon @h4ck3r9 I gotta website, but it isn't using TLS.

@Gargron does email domain blocking support wildcards? For example, if I blocked *.xyz would that block all xyz TLDs?

@mike

@DistroJunkie @brandon what he said. ^^^

@shad DM me from your admin account and I will get you an invite link for the instance.

@mattmcnutt I've got Whalebird installed, which seems ok. For now though, I'm just using separate tabs. Not idea, but it's the best experience at the moment. I'll give Rambox a whirl though, thanks.

@ignitionigel thanks mate.

@brandon @DistroJunkie just read through it. Didn't think that kinda thing went on over here. Pretty obnoxious and pointless IMO.

I wouldn't lose any sleep over it, Brandon. I'm fairly sure those guys won't either - life's too short. 👍