Adding cert badges

Articles/Grow_Your_Homelab.md

@@ -8,6 +8,8 @@ The first things to buy are a surge protector, a flash drive, Raspberry Pi, and
 
 Easy services to install to this initial server are [web-based revision control](/AniNIX/Ubiqtorate/src/branch/main/roles/Foundation), [ssh protections](/AniNIX/Ubiqtorate/src/branch/main/roles/Sharingan), and [a DNS sinkhole](/AniNIX/Ubiqtorate/src/branch/main/roles/Nazara). Adding these two improves your security posture and gives you a good revision-controlled web frontend for your content with MFA authentication supported.
 
+A good addition would also be a pair of backup drives to use for backups. More details on how we do offsite backups are with [AniNIX/Aether](/AniNIX/Aether#relevant-files-and-software).
+
 # Initial Growth
 
 Some easy wins to grow your ecosystem after this are a privacy server for OSINT research and a home IOT management system. We document [AniNIX/DarkNet](/AniNIX/Ubiqtorate/src/branch/main/roles/DarkNet) and [AniNIX/Geth](/AniNIX/Ubiqtorate/src/branch/main/roles/Geth) for these two functions respectively. These can easily be addded onto new Raspberry Pi's or onto a server as virtual machines.
@@ -20,8 +22,6 @@ An alternative to this is a large scale of Raspberry Pi's as a Kubernetes cluste
 
 It's at this stage that one would start looking at adding convenience services like [AniNIX/Singularity](/AniNIX/Ubiqtorate/src/branch/main/roles/Singularity), IDS/IPS/SIEM solutions, and development CI/CD orchestration into the ecosystem.
 
-A good addition would also be a hot-swap cage attached to some server to use for backups. More details on how we do offsite backups are with [AniNIX/Aether](/AniNIX/Ubiqtorate/src/branch/main/roles/Aether). 
-
 # Multi-site Enterprise
 
 This is our future state, and one we're still exploring. The idea is that one would scale out the number of replicas at various different physical sites and anycast their network front-end with BGP or similar technologies. The anycasted services would need to be replicated -- PostGreSQL, InspIRCd, Graylog, and a number of other tools we're using have clustering configuration to make this possible. For larger organizations serving a large customer base, having at least two physical offices with their cluster racks would be best. ISP's will offer dark-fiber backend connections between these sites to secure the replication with point-to-point VPNs. The goal here is improved availability and throughput for the additional customers. Network edge throughput will probably require business-grade connections.

Articles/Lunch-And-Learns.md

@@ -1,7 +1,14 @@
 I've had a request to do some lunch-and-learns about the AniNIX, how we self-host, and how we manage some of our tools. We'll burn roughly the first 30-45 minutes talking through some concepts of how the AniNIX does what it does -- the rest of the time will be an open floor to ask anything you'd like.
 
-We are going to use [Discord](https://discord.gg/2bmggfR), just for bandwidth reasons and ease of setup, to host the call. If you don't have a Discord account, it's pretty easy to sign up. We may look at livestreaming out to YouTube and taking questions by IRC for those folks looking for a little more anonymity. Just swing by our Discord link and ask for the Lunch&Learn role.
+We are going to use [Discord](https://discord.gg/2bmggfR), just for bandwidth reasons and ease of setup, to host the call.
+* If you don't have a Discord account, it's pretty easy to sign up. Just swing by our Discord link and ask for the Lunch&Learn role after creating your account.
+* We are taking questions by IRC for those folks looking for a little more anonymity.
 
-We hope to see you there! [Click this Google Calendar link](https://calendar.google.com/event?action=TEMPLATE&tmeid=MjcwcHUxYmE5Y2lsOHNjMDRnaW81ZDZwb2ZfMjAyMjA0MTlUMTcwMDAwWiBjeGZvcmRAbQ&tmsrc=cxford%40gmail.com&scp=ALL) to add it to your calendar -- we'll be meeting in the 1200-1300 [US Central](https://time.is/CT) block.
+Due to real-life obligations, the livestream portions are paused but we will be opening the floor for discussions each week with a commit and some discussion on its relevance. Hope to see you in the channel!
+<!--
+We are testing live-streaming to [Twitch](https://www.twitch.tv/darkfeather0664) and [YouTube](https://www.youtube.com/channel/UCe-WNM2mbI51xoVZp3K_wFQ). If you're interested but not ready to join the Discord community, those options are open to you.
+-->
 
-There's no listed schedule right now.
+<!-- We hope to see you there! [Click this Google Calendar link](https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=bzk4YmplZWpvdW52NWNoZjZna2dtZTNlNWJfMjAyMzExMjNUMTgwMDAwWiBjeGZvcmRAbQ&tmsrc=cxford%40gmail.com&scp=ALL) to add it to your calendar -- we'll be meeting in the 1200-1300 [US Central](https://time.is/CT) block on Thursdays.
+
+There's no listed schedule of topics right now -- request some on IRC or Discord!-->

Articles/The_Complicated_Cloud.md

@@ -47,9 +47,9 @@ We use Google for a few things.
 
 Effectively, Google services here are handling all the legacy cruft for us in dealing with the external world. These services are typically more difficult to secure, though they are more familiar to average users.
 
-## Stripe: Payment and PCI compliance
+## Venmo: Payment and PCI compliance
 
-[PCI compliance](https://www.pcisecuritystandards.org/pci_security/completing_self_assessment) is a necessary part of doing business within the US. This is presently more impactful for our [martial arts](/martialarts) division than the tech one, but it's still necessary to support. We host links to PCI sites, so we have to annually review a self-assessment, but our obligations are limited. It would be possible for us to develop a complete payment portal against a banking institution ourselves, but because we are not a bank, we'd still be dependent on that bank's cloud services and API's. Such development would also make us liable for more expenses in needing to hire a PCI auditor and other overhead we simply cannot afford. As such, we offload our payment system by linking out to [Stripe][stripe] which directs payment into our bank.
+[PCI compliance](https://www.pcisecuritystandards.org/pci_security/completing_self_assessment) is a necessary part of doing business within the US. This is presently more impactful for our [martial arts](/martialarts) division than the tech one, but it's still necessary to support. We host links to PCI sites, so we have to annually review a self-assessment, but our obligations are limited. It would be possible for us to develop a complete payment portal against a banking institution ourselves, but because we are not a bank, we'd still be dependent on that bank's cloud services and API's. Such development would also make us liable for more expenses in needing to hire a PCI auditor and other overhead we simply cannot afford. As such, we offload our payment system by linking out to [Venmo][venmo] which directs payment into our bank.
 
 We are investigating using a USDCoin wallet to offer operating on the blockchain, but that is still a weird middle ground of self-hosting and cloud all at the same time, being a peer-to-peer protocol. One could argue that running a miner for that protocol would make it somewhat self-hosted and that we are simply participating in the protocol with a much wider audience in the same way that providing an RSS feed puts us in the conglomeration of information provided by RSS. However, adoption for this is still low and more traditional banking will likely dominate any business ventures in the near future.
 
@@ -132,7 +132,7 @@ Self-hosting is still the best route, we believe, for your organization to contr
 [analytics]: https://analytics.google.com
 [domain]: https://domains.google.com
 [voice]: https://voice.google.com
-[stripe]: https://stripe.com
+[stripe]: https://venmo.com
 [freshping]: https://aninix.freshping.io/
 [zapier]: https://zapier.com
 [discord]: https://discord.gg/2bmggfR

Operation/Continuity.md

@@ -0,0 +1,27 @@
+Operational concerns are as important as development or security ones. Having a good layering of operational continuity will allow services to continue while the network operators follow the [incident response guidelines](./Incident_Response.md). Users should understand the posture outlined here to know how an incident will affect them.
+
+# Self-recovering Services
+
+Ideally, services should be designed & developed to recover themselves. This is the second-best option to not having problems in the first place. Tools like systemd can restart services, or monitoring can identify & remediate issues. This kind of automation can sort out issues before users or admins know about them.
+
+# High Availability & Geodiversity
+
+High availability can allow inconsistently failing nodes to not take the service down with them. If one node fails, the traffic will get routed to the next one so that users don't see issues. Admins can get the notification and sort the problem out before users even see the issue. Tools for this can be in webservers or appliances like F5 load balancers.
+
+Geodiversity allows some kind of resilience against environmental issues. One needs tools like round-robin DNS or eBGP to broadcast the fallback sites, but if an ISP suffers a line cut or the site endures a natural disaster (or planned maintenance), traffic will fall over to the next site. This can be a cost issue, since the deployment needs to decide the cost model. If any site can handle peak load, then the organization is wasting compute & power that's not doing work during normal operation. If any site can handle median load, peak will get handled by both nodes but it saves some cost during normal operation. If both sites are needed to handle peak activity, then you will see a service degradation during an event but this will be the most fiscally conservative option. Don't design services to only handle median load.
+
+This option is not currently available to us, as we don't have a second site for peering.
+
+# Disaster Recovery
+
+Disaster recovery is responding to terrible issues that can't be caught by the prior two solutions. This includes options like Infrastructure-as-Code, backups, and AniNIX/Aether, that provide various options for rebuilding services during an event. DR procedures are critical for resolving ransomware.
+
+# Business Continuity
+
+Business continuity operation is perhaps the most critical to AniNIX operations, since it allows the best options when issues take long enough to resolve that a user will notice. AniNIX/Yggdrasil, AniNIX/Foundation, and AniNIX/Singularity allow offline options for when the services aren't available but still allow users to use the content. Other services, like AniNIX/WolfPack or AniNIX/Maat, are convenience and if they aren't available users have the option to wait before using them. Discord is currently providing our fallback for IRC.
+
+Core business continuity procedures:
+
+* Maintain local clones of any AniNIX/Foundation projects you're working on.
+* Use the "Download Media" option in the Emby web interface for AniNIX/Yggdrasil
+* AniNIX/Singularity's TT-RSS mobile app has a "work offline" feature -- this will let the user look through the last set of articles the app downloaded.

Operation/Hire.md

@@ -0,0 +1,42 @@
+# Looking to hire me?
+
+I am available to represent AniNIX as a consultant. Sometimes various SMB's (small/medium businesses) need assistance -- not everyone can afford to have a full-time staff on-hand. What's more, the [average IT shop](https://www.linkedin.com/learning/paths/devops-professional-certificate-by-pagerduty-and-linkedin) has a ratio of 100 developers to 10 operations persons to 1 security staffer -- this leaves most SMB's reaching to outside assistance for security work. You are welcome to contact me to get some experienced assistance with your projects.
+
+## Services
+
+### Small/Medium-Business Security Auditing
+
+[Your average penetration test](https://www.getastra.com/blog/security-audit/penetration-testing-cost/#:~:text=Testing%20Cost%20%E2%80%93%20FAQs-,How%20much%20does%20a%20Pentest%20cost%3F,on%20a%20number%20of%20devices.) will cost around $2,500 to $50,000. That's a hefty sum for an organization with a tech staff of 0-5 full-time employees. Especially for a smaller lab, coffee shop, or store, online presence is important for being able to reach customers, but that presence needs to be secured in order to protect the brand.
+
+[AniNIX believes strongly](https://aninix.net/AniNIX/Wiki/src/branch/main/Policies/User_Ethics.md#our-mission-statement) that everyone deserves to be secure online, even if they can't afford to pay for the larger cybersec firms to do their audits. I will audit your ecosystem for:
+
+* [OWASP Top 10 vulnerabilities](https://owasp.org/www-project-top-ten/)
+* [OSSTMM Maturity Evaluation](https://www.isecom.org/OSSTMM.3.pdf)
+* System fingerprints that could lead attackers to exploiting the [CISA Known Exploited Vulnerabilities list](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
+* Misconfigurations that could lead to abuse of your platform
+* Anything else we can recommend for improvements
+
+I will do this for only **$1000**, significantly lower than the market cost. This is only open to select small/medium businesses -- contact us [on our chat](https://irc.aninix.net) or email us at contact@aninix.net to inquire. If you are running a 501(c)(3), we may be able to run an audit for a reduced cost -- contact us to discuss your situation.
+
+We have more details available in [this whitepaper](https://aninix.net/assets/resources/auditing-whitepaper.pdf).
+
+### DevSecOps Consulting
+
+I've been a DevSecOps engineer for more than a decade -- if you are looking for help with your IT operations, I'm happy to look at your operations and offer recommendations on potential improvements. From operational mean-time-to-recover to Infrastructure-as-Code and self-hosting vs. cloud offerings, my goal is to help you find the best tool for the job. Development gives a market edge, and security protects the business from liability. However, unless you are in either business, it's operations that makes tools useful -- the availability of your tools is what makes the business money & builds reputation with your clientele.
+
+My typical rate is $60/hour. I can be contracted for small work related to small/medium business operations, or I can consider full-time employment for an offer in the right pay range.
+
+## References
+
+The following are my professional accounts & references. Please connect with me on any of these platforms to stay in touch.
+
+| [<img src=https://aninix.net/assets/img/social/resume.png width=50 height=50/><br />Resume](https://aninix.net/assets/resources/Resume.docx) | [<img src=https://aninix.net/assets/img/social/linkedin.png width=50 height=50 /><br/>LinkedIn](https://www.linkedin.com/in/connor-ford-b6495412a/) | [<img src=https://aninix.net/assets/img/social/github.png width=50 height=50 /><br/>GitHub](https://github.com/Dark-Feather) | [<img src=https://aninix.net/assets/img/social/hackerone.webp width=50 height=50 /><br/>HackerOne](https://hackerone.com/darkfeather) | [<img src=https://aninix.net/assets/img/social/htb.jpg width=50 height=50 /><br/>HTB](https://app.hackthebox.com/profile/415332) |
+| --- | --- | --- | --- | --- |
+| <div data-iframe-width="150" data-iframe-height="270" data-share-badge-id="11bcd5ba-0fe7-4951-8693-1e7c36e30ace" data-share-badge-host="https://www.credly.com"></div><script type="text/javascript" async src="//cdn.credly.com/assets/utilities/embed.js"></script> | <div data-iframe-width="150" data-iframe-height="270" data-share-badge-id="8e6b81ce-5986-4872-a7c2-54faaaed3dba" data-share-badge-host="https://www.credly.com"></div><script type="text/javascript" async src="//cdn.credly.com/assets/utilities/embed.js"></script> | <div data-iframe-width="150" data-iframe-height="270" data-share-badge-id="42ecde01-4f99-456a-b82c-33d27d51590d" data-share-badge-host="https://www.credly.com"></div><script type="text/javascript" async src="//cdn.credly.com/assets/utilities/embed.js"></script> | &nbsp; | &nbsp; |
+
+## Trying to pay a contract?
+
+If you have contracted us to conduct an audit or some DevSecOps work, please pay via one of the following methods. Please include your invoice number in the payment notes.
+
+| <img src=https://aninix.net/assets/img/pay/coinbase-usdcoin.png width=200 height=200><br/>USDCoin address<br />0x21a05e628Ed622F7594f62Ea3C764bAEF7fE3Bf3 | <img src=https://aninix.net/assets/img/pay/venmo.png width=200 height=200><br/>Venmo |
+| --- | --- |

Operation/Incident_Response.md

@@ -17,6 +17,10 @@ An [incident][2] is an unplanned event affecting a service or agency, where a di
 # Required Follow-ups
 See TOGAF, COBIT, and ITIL standards for design methods for incident response. Also available is documentation from [NIST](https://duckduckgo.com/?q=NIST+Creating+security+plans+for+federal+information+systems&ia=web) on how to formulate security plans.
 
+## Monitoring and Alerting
+
+Network operators should follow the `#sharingan` IRC & Discord channels for a redundant method of being alerted when there are issues. While we have no mean-time-to-acknowledge (MTTA) or mean-time-to-recover (MTTR) service-level agreements (SLA), on-call operators should attempt to respond with all available expediency to issues.
+
 ## OSINT feed
 
 Significant non-disruptive incidents detected by [AniNIX/Sharingan](https://sharingan.aninix.net) will be recorded as part of our [OSINT feed](https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml). This feed is intended to be a public service to help improve the general community. Those watching this feed are encouraged to examine their own incoming traffic for the adversaries listed and take appropriate protective action.

PKGBUILD

@@ -16,7 +16,7 @@ license=('custom')
 groups=()
 provides=("${pkgname}")
 conflicts=()
-replaces=("${pkgname,,}", "aninix-${pkgname,,}")
+replaces=("${pkgname,,}" "aninix-${pkgname,,}")
 backup=()
 options=()
 install=

Policies/Design_Principles.md

@@ -31,9 +31,9 @@ For services that are hosting information like passwords, the device should be p
 ##  Privacy
 Guarantees of privacy are a major concern in designs. The AniNIX needs to be able to protect itself while doing its best to provide the same right to others. This ties in with concerns of Remote Access -- remote access that isn't by read-only transport requires an account which can be paired with an individual. This should be used for collaboration with the network and for maintaining user preferences.
 
-However, tools like documentation and source code should be available from behind privacy tools and without identifying a user. When governments can outlaw information, as many repressive regimes in the Middle East and elsewhere have done, the AniNIX seeks to make sure that the peopke still have power by information.
+However, tools like documentation and source code should be available from behind privacy tools and without identifying a user. When governments can outlaw information, as many repressive regimes in the Middle East and elsewhere have done, the AniNIX seeks to make sure that the people still have power by information.
 
-Furthermore, any communication across a wwider network should be encrypted. [WebServer](../Services/WebServer.md) controls most of this via the Let's Encrypt SSL certificate for the web apps, but SSH also encrypts its communication. Unencrypted communication is insecure and not private by default and should be prohibited as much as possible.
+Furthermore, any communication across a wider network should be encrypted. [WebServer](../Services/WebServer.md) controls most of this via the Let's Encrypt SSL certificate for the web apps, but SSH also encrypts its communication. Unencrypted communication is insecure and not private by default and should be prohibited as much as possible.
 
 #  End User Experience
 
@@ -63,11 +63,21 @@ With the rise of the smartphone, remotely accessible services should offer a sim
 
 ##  Etymology
 
-The AniNIX attaches a unique name, such as Sora for OpenLDAP or Yggdrasil for Emby, to packages and services it instantiates. The reason for this is that the name defines a scope of functionality the AniNIX expects to rely on -- should the underlying package change, such as replacing Plex Media Server with Emby, documenation and AniNIX packages will use the same name.
+The AniNIX attaches a unique name, such as Sora for OpenLDAP or Yggdrasil for Emby, to packages and services it instantiates. The reason for this is that the name defines a scope of functionality the AniNIX expects to rely on -- should the underlying package change, such as replacing Plex Media Server with Emby, documentation and AniNIX packages will use the same name.
 
 Names given should be chosen for relevance to the function being provided (Singularity being a pull service, Foundation being the basis on which we're built, etc.) and for ease of memory. Only the most basic services, such as IRC, WebServer, and SSH, will be left unnamed.
 
-These names are not intended to supercede the licensing or attribution of other packages -- applications, once installed, should only update the minimal allowable elements to be usable under AniNIX principles. Whereever possible, this should be done via the application's provided interface, such as enabling dark modes. We also should not remove any links that the application provides to its own documentation, licensing, or websites. This means that AniNIX etymology only applies to administrators and is otherwise invisible to end users. 
+These names are not intended to supersede the licensing or attribution of other packages -- applications, once installed, should only update the minimal allowable elements to be usable under AniNIX principles. Wherever possible, this should be done via the application's provided interface, such as enabling dark modes. We also should not remove any links that the application provides to its own documentation, licensing, or websites. This means that AniNIX etymology only applies to administrators and is otherwise invisible to end users.
+
+Additionally, these names should be selected from one of the following categories:
+
+1. A natural phenomenon that describes the function, such as Singularity or Aether
+1. Mythological figures that provide wisdom (such as Odin for Yggdrasil, Raven, and Wolfpack), truth (like Wiccan Grimoire), and morality (such as Maat)
+1. The technological function being served, such as Password or DarkNet
+1. Cyber-themed science fiction with moral human protagonists
+    1. This last is the most complicated but most fun category.
+    1. Arguments must be clearly made in the etymology how the organization being selected is a commonly-accepted protagonist.
+    1. The human-centric focus is to maintain alignment with the people using the systems.
 
 #  Maintainability
 Make sure that a project can be easily maintained. This means following the Development Best Practices and submitting Markdown documentation for the project.

rss/aninix.xml

@@ -11,6 +11,36 @@
 
     <id>https://aninix.net/</id>
 
+    <entry>
+        <title>Lunch-And-Learns Paused Until 2024FEB29</title>
+        <link href="https://aninix.net/AniNIX/Wiki/commit/48e6e1b31adaf649d9f375570bd85109fa694d9b"></link>
+        <updated>2023-10-23T04:09:00Z</updated>
+        <id>https://aninix.net/AniNIX/Wiki/commit/48e6e1b31adaf649d9f375570bd85109fa694d9b</id>
+        <summary>
+            Lunch-and-learns are paused until February 29th -- I have real-life obligations that won't allow me to keep the streaming window. We will instead hold conversations in our Discord #tech channel. I'll post something there when I can and mention the Lunch&amp;Learn role with a commit of interest off the AniNIX projects. If you have questions you want to talk about, ask away!
+        </summary>
+    </entry>
+
+     <entry>
+        <title>Expanded Lunch-And-Learns</title>
+        <link href="https://www.youtube.com/channel/UCe-WNM2mbI51xoVZp3K_wFQ#20231023"></link>
+        <updated>2023-10-23T04:09:00Z</updated>
+        <id>https://www.youtube.com/channel/UCe-WNM2mbI51xoVZp3K_wFQ#20231023</id>
+        <summary>
+            We are expanding our Lunch-and-Learns to both YouTube and Twitch in an attempt to reach more people. Lunch-and-learns will also move to Thursdays to try to better reach our existing contributors.
+        </summary>
+    </entry>
+
+    <entry>
+        <title>Outage 2023-10-23</title>
+        <link href="https://aninix.net/AniNIX/Wiki/src/branch/main/Operation/Continuity.md#business-continuity"></link>
+        <updated>2023-10-23T04:09:00Z</updated>
+        <id>https://aninix.net/aninix.xml#20231024</id>
+        <summary>
+                We will have an extended outage 2023-10-24 0700 US Central until late in the evening, as our primary site is undergoing construction. Please watch #tech on Discord fo r tracking service recovery. During this time, please fall back on business continuity procedures to keep access to services provided by the AniNIX.
+        </summary>
+    </entry>
+
     <entry>
         <title>OSINT Feed</title>
         <link href="https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml"></link>

rss/osint.xml

@@ -11,6 +11,28 @@
 
     <id>https://aninix.net/</id>
 
+    <entry>
+        <title>2024MAR11 ACEVILLE PTELTD, Singapore</title>
+        <link href="https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#ACEVILLEPTELTD"></link>
+        <updated>2024-03-11T07:52:00Z</updated>
+        <id>https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#ACEVILLEPTELTD</id>
+        <author>DarkFeather</author>
+        <summary>
+            Provider "ACEVILLE PTELTD" from blocks 43.156.0.0/16, 43.134.0.0/15, 43.134.0.0/17 was detected trying to bruteforce our network with a distributed attack network. We are blocking these networks for malicious attempts in the hundreds.
+        </summary>
+    </entry>
+
+    <entry>
+        <title>24.144.93.118/32</title>
+        <link href="https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#24.144.93.118"></link>
+        <updated>2023-11-17T03:30:00Z</updated>
+        <id>https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#24.144.93.118</id>
+        <author>DarkFeather</author>
+        <summary>
+            24.144.93.118/32 was detected using a network scanner against our external address. Total volume was 55 -- this action repeated on 2023-11-18 at 08:40Z.
+        </summary>
+    </entry>
+
     <entry>
         <title>46.101.38.229/32</title>
         <link href="https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#46.101.38.229"></link>