Bilingual

Make Your Own Backup System – Part 1: Strategy Before Scripts
a day ago
- Backup is often underestimated; common pitfalls include flawed techniques, untested backups, and confusion with RAID.
- Cloud providers operate on a shared responsibility model; users are ultimately responsible for backing up their data.
- A proper backup philosophy: data must be restorable quickly, in an open format, and consistent.
- Data loss can occur from fires, floods, earthquakes, ransomware, and human errors.
- A backup is not a simple copy; copying live database files is useless without a proper dump.
- Backup planning starts with questions about risk tolerance, critical data, acceptable downtime, and storage space.
- The safest backup is stored off-site, but this introduces challenges of space and bandwidth.
- Choose between full disk backup (complete recovery but may require downtime) and individual file backup (granular, portable, but needs snapshots for consistency).
- Snapshots are essential for consistency; methods include native filesystem snapshots (ZFS, Btrfs), LVM, and DattoBD.
- Prefer pull-based backups where a central server initiates connections; ensure the backup server is hardened and maintains its own snapshots for security.
- Good backup system features: instant recovery, external storage, security, efficient space management (compression, deduplication), and minimal invasiveness.
De Wet op Inlichtingen- en Veiligheidsdiensten 2017 - Bert Hubert's writings
a day ago
- The Dutch Intelligence and Security Services Act (Wiv) 2017 allows services to intercept, hack, or copy data globally when necessary.
- Internal and external oversight includes the TIB for pre-authorization and the CTIVD for post-action monitoring.
- Targeted surveillance can involve targets, non-targets (e.g., associates), and third parties (e.g., service providers), with strict necessity checks.
- Technical risks from hacking are assessed to prevent collateral damage, such as disrupting emergency services.
- Incidental interception of unrelated data (bijvangst) requires proportionality assessment and robust oversight.
- Bulk interception of cables or frequencies is permitted but data can only be accessed after specific selection tied to investigations.
- Emergency procedures allow immediate action with subsequent retroactive approval, used in ~2% of cases.
- Article 73 permits proactive measures like disabling malicious servers without external review.
Vervang vergeten verontwaardiging over privacyschendingen door inhoudelijke analyse - Bert Hubert's writings
a day ago
- The Dutch government proposed a law requiring all bank transactions to be monitored in a centralized database using algorithms, implemented by a commercial third party to prevent money laundering and terrorism financing.
- A 'temporary cyber law' would allow intelligence services to monitor telecom cables with reduced oversight, sharing data with foreign intelligence agencies for 'target finding'.
- Historical context: The introduction of the Citizen Service Number (BSN) faced decades of debate in the 1980s due to privacy concerns, but now links all aspects of life including medical, insurance, and financial data.
- Past resistance to government data collection was influenced by WWII experiences of a hostile government using personal data for oppression, but today's lack of direct memory weakens instinctual privacy defense.
- Modern examples like the Dutch childcare benefits scandal show algorithms and large datasets can cause harm even with good intentions.
- European governments, including Spain, Greece, and Poland, have misused surveillance powers against journalists and opposition.
- Current discussions often pit privacy against security abstractly, neglecting concrete questions about data collected, storage duration, algorithm contributions, and data sharing rights.
- The author urges politicians and media to focus on specific law texts and factual analysis rather than superficial debates.
GrapheneOS protections against data extraction from locked devices
3 days ago
- GrapheneOS builds on Android 17 security and requires Pixel hardware for now, with Motorola partnership expected in 2027.
- Disk encryption is robust; attackers must exploit OS after first unlock or brute-force PIN, with secure element enforcing strict rate limiting (20 attempts, escalating delays).
- Insider attack resistance prevents firmware update bypass of rate limiting by requiring owner authentication for secure element updates.
- GrapheneOS raises password limit to 128 characters for high-entropy passphrases independent of rate limiting.
- Optional 2nd factor fingerprint PIN reduces fingerprint attempts to 5 and requires a short PIN after fingerprint for unlock.
- Exploit protections include hardened memory allocators and hardware memory tagging (MTE) to block attacks.
- Physical attack defenses block USB connections when locked and disable USB data after disconnection.
- Auto-reboot timer (10 min to 72h, default 18h) returns device to Before First Unlock state with memory zeroing.
- Supports secondary user and Private Space end session to revert to Before First Unlock without reboot.
- Duress PIN/password wipes device immediately when entered in any PIN/password prompt, including secondary users and Private Spaces.

Hasty Briefsbeta

data protection

Make Your Own Backup System – Part 1: Strategy Before Scripts

De Wet op Inlichtingen- en Veiligheidsdiensten 2017 - Bert Hubert's writings

Vervang vergeten verontwaardiging over privacyschendingen door inhoudelijke analyse - Bert Hubert's writings

GrapheneOS protections against data extraction from locked devices