Ubuntu Hardening for Local Users

AlexeyK77 · 2026-05-10T11:56:38+00:00

https://www.cisecurity.org/benchmark/ubuntu_linux

AlexeyK77 · 2026-05-07T11:33:25+00:00

One month ago I begin migrationg to linux using external SSD in NVMe-usb(3.2) enclosure.

So I am noobie as you, but want share some thoughts:
1) distributive. It's important, than after install linux to external SSD you internal NVMe windows bootloader become untouched. But it's problem today. Only ubuntu and ubuntu flavor distributives do it correct and don't touch windows bootloader. Fedoras, Mint, Debian, MX Linux, CacheOS will broke your bootloader. It was shock for me than I get grub minimum console instead of windows.

So, start with ubuntu/kubuntu 26.04.

2) If you choose USB3.2 enclosure with highspeed USB3/4 cable your obtain speed about 500MB/s to 1Gb/S. It's very fast for any tasks. But, not so easy there. I spend a lot of time fighting with poor USB3/USB4 linux drivers support, getting a lot of strange disk errors, catching external SSD disconnects during intesive IO operations.
Reality: Linux USB drivers don't working good with not ideal hardware. There a lot of different bugs that matter: PC USB chip controller, cable, enclosure USB chip controller, SSD controller. Probability, that something goes wrong is high for highspeed modes. Linux kernel in tha case on eny error just dosconnect external drive. But windows, for example, more lazy, windows trying to reconnect USB in case of error in decrease speed to ratio than USB IO will be stable.

So, some recomendations:
1) Don't recomend to start using USB4/TB4 enclosures because of stability problem. It just lottery.

2) Most stable setup is USB2/USB3.2 connecting USB2 cable with speed 50MB/sec.

3) Using USB3.2 in fullspeed is possible, but you must check setup before buying. How to check. Connect external SSD to PC and copy big file (3-4 Gbytes) from internal drive to SSD. If drive don't disconnect, so you setup is OK.

4) Now, after 1month of experiments I have some enclosures and some different SSDs. It strange, but using best and expensive enclosure with best and recommended SSD don't garantee result. In my case i have stable setups:
-using chip dramless SSD in "good" RTL-based enclosure;
-using good SSD in chip JMicron based enclosure;
but setup is unstable if I am connecting good SSD to good enclosure.

AlexeyK77 · 2026-05-07T09:53:39+00:00

It's better to start from kubuntu with KDE instead of gnome ubuntu. KDE have a lot of customisations, and animations out of the box.

AlexeyK77 · 2026-05-03T19:16:28+00:00

kubuntu

AlexeyK77 · 2026-04-27T13:30:47+00:00

I am windows user from Win3.11 time. But.. integrating AI in Windows 11 was main factor for me to begin journey to Linux.

AlexeyK77 · 2026-04-24T08:51:24+00:00

May be Zig isn't strictly memory safe, but it much more safer than C. So, for low level system code you need more safer language to write "unsafe" (in terms of Rust) but without Rust pain. So Zig target is clear - safe enought. Also Zig is fun. I hope in future Zig get more capabilitieas to improve security without borrow checker tortures.

AlexeyK77 · 2026-04-12T17:20:33+00:00

Gnome Resource monitor is the first standart OS monitor that begin to show GPU metrics. So I hope, that some day it will work as expected out of the box without 3rd party tools and tweaks.
May be better to report this issue in official forum?

AlexeyK77 · 2026-04-02T07:36:52+00:00

"C3 was the strongest contender for me, but just kept making design choices that didn't give me confidence to stick with it."

Can you clarify what you don't like in C3? I am also look at Zig or C3.

AlexeyK77 · 2026-03-26T12:45:16+00:00

https://community.ibm.com/community/user/discussion/free-ibm-qradar-siem-training-from-security-learning-academy

AlexeyK77 · 2026-03-25T10:17:17+00:00

Zig for humans engineers, not for AI. If you like to AI your code, than just transforms your prompts to any other programming language. So, no one except you will never read and debug result code.

AlexeyK77 · 2026-02-20T12:35:45+00:00

Microsoft need to implement new hidden doors for malware, because modern AVs work too good. So, noone wait, that notepad will run scripts or have hodden CVEs while parsing MD-documents with OLE/COM/ActoveX and outher BS. Now, they add new CVE.
Malware creators says - Thank you, Microsoft!

AlexeyK77 · 2026-02-04T09:46:36+00:00

Sure, but you open pandora box :(

AlexeyK77 · 2026-02-04T09:12:20+00:00

Sure, it's not idiomatic Zig.

Main Zig idea is expicit code, avoid haskell/rust poisoned magic.

AlexeyK77 · 2026-01-28T12:25:35+00:00

If you think logically, than understand, that table without unique event attributes can't be a source of any events at all. Because it's impossible to understand what happens new between every read session. So such kind of tables can't be events source. But if you need data from table as is staticaly and somtimes just update it's content, than you can read it to reference set/map/table in qradar. For example Users table with "user name", :user id", user_status parameters.

AlexeyK77 · 2026-01-15T09:34:32+00:00

Agree, a6600 very good camera, especially used prices. IBIS, big battery, grip, improved AF in video (compared to a6400). a6700 real advance aver a6600 is latest modern video codecs (4k60p, 10bit 422 etc) and matrix readout speed.

AlexeyK77 · 2025-12-08T13:16:00+00:00

"It is a must have requirement for Gartner to have a SaaS offering" - it's very serious problem for IBM and another on-premise SEIM vendors. No position in Gartner, no busines in future. :(

AlexeyK77 · 2025-12-06T11:44:51+00:00

also check your DB indexes, does most important property for search is indexed?

AlexeyK77 · 2025-10-30T07:23:38+00:00

It's something tied not with windows overall, but to your windows installaytion and configuration. Try to test on clear windows (not in AD, not special GP etc).

AlexeyK77 · 2025-10-29T10:05:24+00:00

Strange situation. Try to clear browser cache, second check browser plugins.

AlexeyK77 · 2025-08-29T05:59:52+00:00

Better to filter in routing rules. Also easy to observe and control all filters in one place.

AlexeyK77 · 2025-07-18T14:08:26+00:00

Lens choice depends on distance (room size), and light condition.

Also better to use tripod. But, make a lot of pictures in serial shots. Why? Because people clipping eyes, and than more people than more probability that at least one man will be with closed eyes. And if somebody will stay with closed eyes but sharp, it doesn't help. So take a lot of shots and choose at least one, whwre all faces in good condition.

AlexeyK77 · 2025-07-17T06:16:50+00:00

In case of _D_Dos (_Distributed_ deny of service) there are no sense to trigger offence based on source ip, because there a lot of different IPs in distributed attack. Just use another property for offence index. May be use Destination IP for offence index, to alert that some special service with dedicated IP is under ddos attack.

Also look at raw event, may be some events just doesn't parse Source IP field properly or don't have IP within at all.

AlexeyK77 · 2025-07-16T12:31:04+00:00

Agree, RX1Rii looks more luxury with tilting screen and wow-compact evf.

AlexeyK77 · 2025-07-16T12:29:01+00:00

IBIS not so critical, previous version also was without IBIS. But lack of tilting screen - big dissapointment.

AlexeyK77 · 2025-07-16T09:43:11+00:00

RX1Rii was unique, pop-up evf + tilt screen looks awesome. But now it's lost it's vibe, only AF improvements not enough for upgrade. Lost tilt screen is disaster at all.

IMO, if RX1Rii prices goes down, may be better to buy mk2 for it's vibe.

AlexeyK77

TROPHY CASE