Recently learned from this Kurzgesagt video that rogue AI agents can act independently, covertly, and effectively in a harmful way-- and it's already done this repeatedly as of the past few months, and it's capable of self-improving quickly. I also watched this Emergent Garden video which included a demonstration of how rogue AI agents can escape sandboxes, hack systems, and do self-preservation and replication.
I don't trust that the big corporations that own and control a lot of this AI tech care about data privacy and public welfare, but even if they did, they don't seem capable of actually controlling their own AI agents and preventing these rogue incidents.
Some of the recent agent antics are interesting, but they're not scary.
It's really easy to make them sound scary though. Which, intentionally or not, a lot of people have done. Some of it is ignorance, a lot of it is engagement bait.
You may know all of the following already, these are just popular misperceptions rather than things I'm assuming you don't know:
Agents are as dumb as they are smart. Even the current best frontier models pose no real threat on their own. They get worse over time for all sorts of reasons: their context window fills up, their attention starts to fail, they fixate on the wrong things, context trimming and compaction cause important details to go missing without the model fully understanding they're gone, they write "memories" that are subtly wrong then compound the wrongess over time, they draw the wrong conclusions from real data and then build broken models of "reality" based on those conclusions, they still hallucinate (now we're calling it confabulate, but it's the same problem), etc..
Models do not self improve. Full stop. An agent's model is static, it costs 100's of millions of dollars to build it and making any significant change to it costs millions more. The only way they can improve is by getting information from somewhere else, or storing learned facts in some sort of memory system for use in later sessions, or by other agents. That makes them faster because they don't have to relearn the facts, it doesn't make them smarter.
Recent talk of self replication was largely the result of a shamelessly bad "paper" by anthropic that was seemingly an attempt to sow FUD about open weight models. They did not show anything approaching any kind of real threat or even a viable proof of concept.
The recent uptick in security issues and vulnerabilities is real, but the severity has been exaggerated in a lot of cases, usually by AI written pieces.
Most of the examples you're likely to have seen of models breaking out of their test environment and hacking things involved one or more of the following: cutting edge models with their safety and security guardrails removed, misconfigured sandboxes, massive swarms of agents costing 10's or 100's of thousands of dollars to run. And hype. Lots of hype.
For many of the reasons above, the concept of rogue agents isn't what it sounds like. There aren't any superintelligences that have escaped their masters and are are out there on their own slowly getting stronger. That's impossible on pretty much every level. These things can't just run anywhere, the smart ones can't run at all outside of a datacenter.
Recent coverage maybe paints the picture that the barrier to entry for hacking is now effectively zero. That there are are millions of wanna be hackers running the smartest models to spray (effective) hacking attempts across the internet. But that's not actually true. Fable, Astra, Sol, Opus, all of them will stubbornly refuse to help random people do shady things. Jailbreaking isn't anywhere near as easy as it used to be. Even if that wasn't true you now also have to defeat a safety classifier running on a different model in a separate session too. And heuristic checks on top of that. You can get less restricted models, like GLM 5.3, or various other chinese models, to (try to) do almost any black hat thing you want, but they're comparatively bad at it.
A year from now it might be different. I'd recommend worrying about it when/if it happens. Application security will also probably be better, on average, by then.
As far as personal security goes, nothing has really changed. There might be more shady things happening, but they're pretty much the same shady things as before. Sometimes they look more professional now.
Don't reuse passwords, your creds are going to be involved in a data breach at some point. Probably already have been. Lock your credit when you're not applying for things, assume all of your personal info will end up on the dark web and in commercial datasets that are for sale to anyone. Don't open email or message attachments you weren't expecting, don't click yes to anything a website you don't trust wants permission for. Don't install sketchy apps, uninstall everything you don't use. Especially browser extensions. Assume every cold call is a scam, assume every link in an email is questionable. Hang up and call companies directly if you think a call is real. Double check the domain in your browser address bar if you didn't follow your own bookmark/favorite to get there.
Just keep doing the basics. The kinds of people casting a wide enough net to include you aren't very smart or tech savvy or well funded. AI will make them a little smarter, but not enough to be scary. Yet.
I largely agree with you. However, I still am a bit concerned about what's reasonably possible in the future. For the near-term future, I think most AI usage will still be human-initiated, but I'm thinking of it as a sort of (imaginary, figurative) automated power tool, perhaps Roomba with teeth, but in the digital world. What I anticipate is incidents of people giving an AI tool a little too much rein, and a little too much time (allow it to run unattended, unsupervised, and unmonitored for days). It's in that kind of context that I can see bad things to happening to various degrees. Keeping AI under control will be really important for humanity in the coming years. By that I mean controlling what it has access to, what it is and is not given the capability to do. Given incidents over the past few months, it seems like we (well, AI companies) are not quite there yet, with AI behaviour surprising them, breaking past the boundaries the humans gave them, etc.
That's a reasonable concern. AI is definitely going to keep changing the security landscape. And probably in hard to predict ways. I don't mean to suggest people won't do bad things with AI, they'll do bad things with every tech they get their hands on. Unsupervised claw type setups have no doubt already made all kinds of small messes we haven't heard about yet.
I don't think AI agents require intelligence or a self-improving model to do a lot of damage. AI agents could still self-improve with a static model.
The Emergent Garden video demonstrated how publicly accessible AI agents can be pushed a bit past guardrails to misbehave, and also demonstrated a proof of concept for a simple self-replicating AI worm. It's a python script that copies itself and runs the copy, with a model (GPT Luna) modifying the code with each copy. This AI worm could possibly self-improve, but it didn't in this demo. It might have done so with a bigger model like GPT Sol, but the video showed that GPT Sol simply refused to create a self-replicating script, so that guardrail worked there, and the video creator did not push further.
Definitely still going to keep doing the basics. Thanks!
AI agents could still self-improve with a static model.
Not really. Because they have no basis of intelligence to determine if their improvement is actually an improvement.
An AI agent will happily write a random number function to return 6, write a test to assert the answer is 6, and happily return that the random number function is returning 6.
It might blindly stumble into that 6 isn't random, but its solution will be no more intelligent than the first, just arriving at the more statistically correct answer which is a random number generator. And maybe forgetying to rewrite the test. Or rewriting it so the answer is now 1,2,3,4,5 or 6.
It could theoretically "learn" not to do that. But it must store that fact, along with the billions of other little factoids that just kind of come naturally with functioning frontal cortexes, and it has some other way to get a proper judgement of whether that is the correct outcome. Generally requiring a human or other external stimuli to prove/disprove.
The AI attempting to "self improve" will end up persisting and reenforcing completely wrong things. Which is how you end up with a company getting to brag about solving previously unproved math problems with AI, which then immediately get redacted because of a mistake a 1st grader learns to correct.
Which is how you end up with a company getting to brag about solving previously unproved math problems with AI, which then immediately get redacted because of a mistake a 1st grader learns to correct.
Has the navier-stokes proof been retracted? I don't see any news on that but maybe I'm missing it.
Honestly. My opinion is the only true way you're going to get real security in 2026 is physical.
If it's not physically disconnected from the network, or has physical hardware requirement (like a hardware security key) then you've got no guarantee it's going to be secure until this wave of AI fueled cyber attacking and defence comes to some kind of status quo.
Software is coming to a new era and no-one knows what's going to happen, so all we can do is ride the wave.
How concerned should I be about digital banking? I'm considering at least having printed out records of bank balances, in case of a scenario wherein digital banks' records are affected.
All banking is digital banking, you know? Like, even if you use a bank with a physical branch down the street, all of their records are still computerized. Almost all money (>90%) is purely electronic and doesn't exist as bills anyway. The thought of printing our your balance is kind of charming, but if a bank crashes to that extent they're not going to take a piece of paper you have on faith.
Overall I would say this: in the next few years a lot of things are going to be compromised. It's going to be worse for small, niche industries that never really embraced cybersecurity than for tech titans with thousands of analysts on staff. (Google, meta, apple are the safest companies you could possibly be using). That's bad -- but society has shown itself to be remarkably resilient from a cyber perspective. Stuff is going to go down, but it'll come back up again, and my hope is that in a longer timeframe we'll start to see resilient infrastructure become a "thing" in a way that it currently isn't, which would be a positive.
The best thing you can do is just be generally prepared. You don't need to go nuts, but have some extra food and a few days of water around and you'll be okay.
About Bitwarden: it’s regularly audited and it’s open source. It’s not perfect but it’s as good as it gets. You can self host, but that’s transferring a lot of responsibility to yourself in my opinion.
Eh, the way Bitwarden has been acting lately doesn't sit right with me either. Their disclosure of bitwarden cli suffering from a supply attack was piss poor for example. Also, it is open source but the clients are all maintained by them.
I’m not going to make a comprehensive guide, but here are a few tips:
For important websites that support them, I recommend starting to use passkeys to log in. They aren’t always easy to use in every way, but they’re convenient and do avoid phishing attacks.
As with any kind of authentication, you will want another way to log in to avoid getting locked out, for example if your phone breaks. As an example, for some websites, I have separate passkeys saved for Apple (using an iPad) and Chrome (phone and laptop). You need to test logging in both ways to be sure they work. Printing out backup codes that you could use to log in can be a good idea, but they won’t help if they’re not with you while traveling.
Look for ways to avoid being too dependent on any one service. For example, it might be good to have money in more than one bank or credit union. I have been affected by a credit union being hacked and no money was lost, but they were offline for a while and that would have been inconvenient if we depended on them.
Learning to make offline backups regularly could be useful, but you also need to test restoring from backup. The best backup is something you use regularly, so you’re testing it and remember how it works.
For important websites that support them, I recommend starting to use passkeys to log in.
I don't think there is a single website I use has passkeys as an option. Frankly I would be happy if I could use non-SMS 2FA codes because there is wide support for generating the codes across many kinds of devices meaning I would not need to have a phone on me and give out my number constantly.
Yeah, it’s still just getting started, but for example, I’ve seen it at a brokerage, an insurance company, and a health care provider, so it seems to be spreading beyond tech companies.
Strong, random passwords in a password manager are almost as good.
A lot of the cybersecurity concerns related to attackers using AI are not very relevant to most people unless you're running a big software product.
The important point is that AI hasn't fundementally changed cybersecurity, and I mean that in the most literal sense. It has changed cybersecurity a great deal, it just hasn't changed the fundementals.
It's make a lot of things for attackers feasible that weren't before, like hand crafting phishing emails for thousands of victims, or finding vulnerabilities across software products with hundreds of thousands of LOC. The thing is, those vulnerabilities existed before, anyone could have found them, and many of them did.
For the average person though? Not much has changed. Choose strong unique passwords. Use multi factor authentication whenever humanly possible. Don't click on links in emails from people you don't know. Verify URLs when you visit sites. Don't disable your OSes built in antivirus. Don't install executables from untrusted sites, or run commands without fully understanding them.
If you do that, there's virtually no way that you can be compromised, except for situations entirely outside your control.
I think all the "old" personal security tips are mostly valid.
I'm even more concerned about single points of failure though:
Am I reliant on the same email-recovery for extremely many accounts/services?
Am I reliant on the same authenticator for extremely many accounts/services?
Am I reliant on very many apps having their individual security in order, or can I delete many apps to lower my total risk?
I also think the OP is very right about thinking carefully about what service providers we trust. That's har.
We all know that a bunch of stuff will break now that the volume of hacking attempts is much, much higher than it used to be due to AI.
So it's probably smart to follow security tips and preparedness-tips for if electricity/internet/water is out a little more closely. That way impact is lower if/when something breaks down.
How alarmed should I actually be about this, if at all?
Not really. I'd be more concerned with severe weather events, earthquakes, or getting hit by a driver taking a right on red.
Is it realistic to think that a "cyber pandemic/lockdown" might happen in the near future (some scenario wherein global internet becomes generally unsafe/inaccessible and we'll be restricted to small local networks)?
Nope. If you look up "software verification", you'll note that it's possible to mathematically prove the absence of exploitable vulnerabilities of the variety people talk about when these doomsday scenarios come up (i.e. access to something you shouldn't, deleting someone else's data, or preventing people from accessing stuff). It's just always been less expensive to buy insurance than to build secure systems, hence why this stuff is rarely used (except for situations involving life safety). But as soon as someone invokes the "sufficiently advanced AI" argument to justify fear about Skynet taking over, they should equally explain why anti-Skynet can't just lock everything down.
How are you updating your personal cybersecurity in 2026?
I'm not. If you're looking for a safe password manager, KeepassXC is fine; just find a way to sync it to your mobile device if you're into that (or throw your database onto a USB stick, and plug it into your phone as need be).
How concerned should I be about digital banking?
So one thing you should do is contact your bank and have them disable whatever voice-based identity verification they're using, since several of them are these days. That's already trivially hackable and will continue to get worse with time. You'll want to do the same for your mobile phone company (also ask them to enable porting protection, so it's harder to steal your number) and your email host.
I'm considering at least having printed out records of bank balances, in case of a scenario wherein digital banks' records are affected.
As noted elsewhere, it's not harmful to do this, but it probably won't help. A quick search turned up a Reddit thread which noted that many banks use offline backups anyhow, so it's hard to imagine how an AI would wipe your account records. Without, like, wiping cities off the map or something.
How are you balancing cybersecurity measures with practicality / ease-of-use?
I barely think about cybersecurity. For the past ~30 years or so, it was a safe bet that anything hosted off of your local machine will be leaked or hacked eventually, so I just didn't put much out there. If your entire life is on the cloud that might not be as feasible.
In this vein, how do people manage their updates on internet-facing servers? Can you subscribe to CVE mail for only the services that you run in some easy fashion? Or is there a better way? I don't want to be drowned =).
This could also make you more vulnerable to a supply chain attack though, so its got some downsides. Assuming you meant just automatically upgrading packages whenever a new version is available.
In this vein, how do people manage their updates on internet-facing servers
Generally speaking you'd be using software that is actively maintained and where patches are quickly distributed.
But as far as personal services go they are on my network and I connect to my network over wireguard. I never trusted myself to do security for services right so I just don't.
post_below | 23 hours ago
Some of the recent agent antics are interesting, but they're not scary.
It's really easy to make them sound scary though. Which, intentionally or not, a lot of people have done. Some of it is ignorance, a lot of it is engagement bait.
You may know all of the following already, these are just popular misperceptions rather than things I'm assuming you don't know:
For many of the reasons above, the concept of rogue agents isn't what it sounds like. There aren't any superintelligences that have escaped their masters and are are out there on their own slowly getting stronger. That's impossible on pretty much every level. These things can't just run anywhere, the smart ones can't run at all outside of a datacenter.
Recent coverage maybe paints the picture that the barrier to entry for hacking is now effectively zero. That there are are millions of wanna be hackers running the smartest models to spray (effective) hacking attempts across the internet. But that's not actually true. Fable, Astra, Sol, Opus, all of them will stubbornly refuse to help random people do shady things. Jailbreaking isn't anywhere near as easy as it used to be. Even if that wasn't true you now also have to defeat a safety classifier running on a different model in a separate session too. And heuristic checks on top of that. You can get less restricted models, like GLM 5.3, or various other chinese models, to (try to) do almost any black hat thing you want, but they're comparatively bad at it.
A year from now it might be different. I'd recommend worrying about it when/if it happens. Application security will also probably be better, on average, by then.
As far as personal security goes, nothing has really changed. There might be more shady things happening, but they're pretty much the same shady things as before. Sometimes they look more professional now.
Don't reuse passwords, your creds are going to be involved in a data breach at some point. Probably already have been. Lock your credit when you're not applying for things, assume all of your personal info will end up on the dark web and in commercial datasets that are for sale to anyone. Don't open email or message attachments you weren't expecting, don't click yes to anything a website you don't trust wants permission for. Don't install sketchy apps, uninstall everything you don't use. Especially browser extensions. Assume every cold call is a scam, assume every link in an email is questionable. Hang up and call companies directly if you think a call is real. Double check the domain in your browser address bar if you didn't follow your own bookmark/favorite to get there.
Just keep doing the basics. The kinds of people casting a wide enough net to include you aren't very smart or tech savvy or well funded. AI will make them a little smarter, but not enough to be scary. Yet.
skybrian | 19 hours ago
The problem is mostly not AI doing anything on its own, but hackers can use AI to find and exploit security holes and that’s just as bad.
I am half-expecting swarms of AI worms in coming years, though. They don’t have to be smart in every way to be a threat.
Pistos | 17 hours ago
I largely agree with you. However, I still am a bit concerned about what's reasonably possible in the future. For the near-term future, I think most AI usage will still be human-initiated, but I'm thinking of it as a sort of (imaginary, figurative) automated power tool, perhaps Roomba with teeth, but in the digital world. What I anticipate is incidents of people giving an AI tool a little too much rein, and a little too much time (allow it to run unattended, unsupervised, and unmonitored for days). It's in that kind of context that I can see bad things to happening to various degrees. Keeping AI under control will be really important for humanity in the coming years. By that I mean controlling what it has access to, what it is and is not given the capability to do. Given incidents over the past few months, it seems like we (well, AI companies) are not quite there yet, with AI behaviour surprising them, breaking past the boundaries the humans gave them, etc.
post_below | 14 hours ago
That's a reasonable concern. AI is definitely going to keep changing the security landscape. And probably in hard to predict ways. I don't mean to suggest people won't do bad things with AI, they'll do bad things with every tech they get their hands on. Unsupervised claw type setups have no doubt already made all kinds of small messes we haven't heard about yet.
[OP] mellowminx | 15 hours ago
I don't think AI agents require intelligence or a self-improving model to do a lot of damage. AI agents could still self-improve with a static model.
The Emergent Garden video demonstrated how publicly accessible AI agents can be pushed a bit past guardrails to misbehave, and also demonstrated a proof of concept for a simple self-replicating AI worm. It's a python script that copies itself and runs the copy, with a model (GPT Luna) modifying the code with each copy. This AI worm could possibly self-improve, but it didn't in this demo. It might have done so with a bigger model like GPT Sol, but the video showed that GPT Sol simply refused to create a self-replicating script, so that guardrail worked there, and the video creator did not push further.
Definitely still going to keep doing the basics. Thanks!
vord | 14 hours ago
Not really. Because they have no basis of intelligence to determine if their improvement is actually an improvement.
An AI agent will happily write a random number function to return 6, write a test to assert the answer is 6, and happily return that the random number function is returning 6.
It might blindly stumble into that 6 isn't random, but its solution will be no more intelligent than the first, just arriving at the more statistically correct answer which is a random number generator. And maybe forgetying to rewrite the test. Or rewriting it so the answer is now 1,2,3,4,5 or 6.
It could theoretically "learn" not to do that. But it must store that fact, along with the billions of other little factoids that just kind of come naturally with functioning frontal cortexes, and it has some other way to get a proper judgement of whether that is the correct outcome. Generally requiring a human or other external stimuli to prove/disprove.
The AI attempting to "self improve" will end up persisting and reenforcing completely wrong things. Which is how you end up with a company getting to brag about solving previously unproved math problems with AI, which then immediately get redacted because of a mistake a 1st grader learns to correct.
R3qn65 | 11 hours ago
Has the navier-stokes proof been retracted? I don't see any news on that but maybe I'm missing it.
kaffo | a day ago
Honestly. My opinion is the only true way you're going to get real security in 2026 is physical.
If it's not physically disconnected from the network, or has physical hardware requirement (like a hardware security key) then you've got no guarantee it's going to be secure until this wave of AI fueled cyber attacking and defence comes to some kind of status quo.
Software is coming to a new era and no-one knows what's going to happen, so all we can do is ride the wave.
ali | a day ago
Well… unless the supply chain has been compromised (see ledger)
R3qn65 | 21 hours ago
All banking is digital banking, you know? Like, even if you use a bank with a physical branch down the street, all of their records are still computerized. Almost all money (>90%) is purely electronic and doesn't exist as bills anyway. The thought of printing our your balance is kind of charming, but if a bank crashes to that extent they're not going to take a piece of paper you have on faith.
Overall I would say this: in the next few years a lot of things are going to be compromised. It's going to be worse for small, niche industries that never really embraced cybersecurity than for tech titans with thousands of analysts on staff. (Google, meta, apple are the safest companies you could possibly be using). That's bad -- but society has shown itself to be remarkably resilient from a cyber perspective. Stuff is going to go down, but it'll come back up again, and my hope is that in a longer timeframe we'll start to see resilient infrastructure become a "thing" in a way that it currently isn't, which would be a positive.
The best thing you can do is just be generally prepared. You don't need to go nuts, but have some extra food and a few days of water around and you'll be okay.
preposterous | a day ago
About Bitwarden: it’s regularly audited and it’s open source. It’s not perfect but it’s as good as it gets. You can self host, but that’s transferring a lot of responsibility to yourself in my opinion.
creesch | a day ago
Eh, the way Bitwarden has been acting lately doesn't sit right with me either. Their disclosure of bitwarden cli suffering from a supply attack was piss poor for example. Also, it is open source but the clients are all maintained by them.
Personally I have switched back to keepassXC.
skybrian | 19 hours ago
I’m not going to make a comprehensive guide, but here are a few tips:
For important websites that support them, I recommend starting to use passkeys to log in. They aren’t always easy to use in every way, but they’re convenient and do avoid phishing attacks.
As with any kind of authentication, you will want another way to log in to avoid getting locked out, for example if your phone breaks. As an example, for some websites, I have separate passkeys saved for Apple (using an iPad) and Chrome (phone and laptop). You need to test logging in both ways to be sure they work. Printing out backup codes that you could use to log in can be a good idea, but they won’t help if they’re not with you while traveling.
Look for ways to avoid being too dependent on any one service. For example, it might be good to have money in more than one bank or credit union. I have been affected by a credit union being hacked and no money was lost, but they were offline for a while and that would have been inconvenient if we depended on them.
Learning to make offline backups regularly could be useful, but you also need to test restoring from backup. The best backup is something you use regularly, so you’re testing it and remember how it works.
atomicshoreline | 18 hours ago
I don't think there is a single website I use has passkeys as an option. Frankly I would be happy if I could use non-SMS 2FA codes because there is wide support for generating the codes across many kinds of devices meaning I would not need to have a phone on me and give out my number constantly.
skybrian | 17 hours ago
Yeah, it’s still just getting started, but for example, I’ve seen it at a brokerage, an insurance company, and a health care provider, so it seems to be spreading beyond tech companies.
Strong, random passwords in a password manager are almost as good.
papasquat | 9 hours ago
A lot of the cybersecurity concerns related to attackers using AI are not very relevant to most people unless you're running a big software product.
The important point is that AI hasn't fundementally changed cybersecurity, and I mean that in the most literal sense. It has changed cybersecurity a great deal, it just hasn't changed the fundementals.
It's make a lot of things for attackers feasible that weren't before, like hand crafting phishing emails for thousands of victims, or finding vulnerabilities across software products with hundreds of thousands of LOC. The thing is, those vulnerabilities existed before, anyone could have found them, and many of them did.
For the average person though? Not much has changed. Choose strong unique passwords. Use multi factor authentication whenever humanly possible. Don't click on links in emails from people you don't know. Verify URLs when you visit sites. Don't disable your OSes built in antivirus. Don't install executables from untrusted sites, or run commands without fully understanding them.
If you do that, there's virtually no way that you can be compromised, except for situations entirely outside your control.
nacho | a day ago
I think all the "old" personal security tips are mostly valid.
I'm even more concerned about single points of failure though:
I also think the OP is very right about thinking carefully about what service providers we trust. That's har.
We all know that a bunch of stuff will break now that the volume of hacking attempts is much, much higher than it used to be due to AI.
So it's probably smart to follow security tips and preparedness-tips for if electricity/internet/water is out a little more closely. That way impact is lower if/when something breaks down.
kacey | 12 hours ago
Not really. I'd be more concerned with severe weather events, earthquakes, or getting hit by a driver taking a right on red.
Nope. If you look up "software verification", you'll note that it's possible to mathematically prove the absence of exploitable vulnerabilities of the variety people talk about when these doomsday scenarios come up (i.e. access to something you shouldn't, deleting someone else's data, or preventing people from accessing stuff). It's just always been less expensive to buy insurance than to build secure systems, hence why this stuff is rarely used (except for situations involving life safety). But as soon as someone invokes the "sufficiently advanced AI" argument to justify fear about Skynet taking over, they should equally explain why anti-Skynet can't just lock everything down.
I'm not. If you're looking for a safe password manager, KeepassXC is fine; just find a way to sync it to your mobile device if you're into that (or throw your database onto a USB stick, and plug it into your phone as need be).
So one thing you should do is contact your bank and have them disable whatever voice-based identity verification they're using, since several of them are these days. That's already trivially hackable and will continue to get worse with time. You'll want to do the same for your mobile phone company (also ask them to enable porting protection, so it's harder to steal your number) and your email host.
As noted elsewhere, it's not harmful to do this, but it probably won't help. A quick search turned up a Reddit thread which noted that many banks use offline backups anyhow, so it's hard to imagine how an AI would wipe your account records. Without, like, wiping cities off the map or something.
I barely think about cybersecurity. For the past ~30 years or so, it was a safe bet that anything hosted off of your local machine will be leaked or hacked eventually, so I just didn't put much out there. If your entire life is on the cloud that might not be as feasible.
Bwerf | a day ago
In this vein, how do people manage their updates on internet-facing servers? Can you subscribe to CVE mail for only the services that you run in some easy fashion? Or is there a better way? I don't want to be drowned =).
post_below | 23 hours ago
Configure unattended security updates. 99% of the time the package manager can handle the important updates faster than you can.
TurtleCracker | 21 hours ago
This could also make you more vulnerable to a supply chain attack though, so its got some downsides. Assuming you meant just automatically upgrading packages whenever a new version is available.
post_below | 14 hours ago
Security channel updates aren't likely to have supply chain issues
Bwerf | 22 hours ago
Thanks, sounds obvious now that you said it, I'm gonna take a look =)
creesch | 16 hours ago
Generally speaking you'd be using software that is actively maintained and where patches are quickly distributed.
But as far as personal services go they are on my network and I connect to my network over wireguard. I never trusted myself to do security for services right so I just don't.