Posts about server, application, and WordPress security — incident response, hardening, audits.
The “I want my Go binary to bind port 80 without running as root” problem has three solutions of varying terribleness:
The first time I enabled auditd with the default rules on a small VPS, /var/log/audit/audit.log grew to 2 GB in eight hours and I watched the disk fill in real time. The default ruleset is built for compliance audits — …
You’ve cleaned the malware files, deleted the backdoor admin accounts, rotated everyone’s password. The site is fine, you’re fine. Three weeks later someone logs in with a session cookie they grabbed during the compromise window and creates a fresh admin …
You installed a beta of some app. It’s slow, the UI’s weird, and Activity Monitor shows it making outbound network calls every two seconds — telemetry probably, or analytics, or who-knows-what. You’d uninstall it but you actually need the app …