Following on from this post in Do you use LittleSnitch or the equivalent on your OS? I think it might be worth us creating this thread so we can share tips and tricks we might have picked up over the years to help secure our dev machines and home networks - if you have any please share!
macOS
Apart from the obvious like setting a password etcâŠ
- Turn on FileVault to encrypt your drive:
Privacy & Security > FileVault - Turn on your firewall:
Network > Firewall(then periodically click on âOptionsâ to check those in the list of incoming connections). - Enable end-to-end encryption of iCloud data:
iCloud > Advanced Data Protection
Oddly - none of the above is on by default!
- Install LittleSnitch to allow/disallow connections to the web (there are free alternatives)
- Set up Time Machine backups (encrypted and usually run two and keep old copies)
- Check
Privacy & Security > Files * Foldersto see which folders your apps can access - Check
Privacy & Security > Full Disk Access - Check
Privacy & Security > Accessibilityto see which apps can âcontrolâ your Mac - Check
Lock Screen > require password after screen saver beginsimmediately/whatever you require - Check
General > login itemsfor apps/services that automatically start at login - Check your folder permissions (particularly if you have added any to you home folder).
Folder > right click > info(should beyou>Read & Writeandeveryone>no access) Privacy & Security > Advanced > log out automatically after inactivity(means a password would be required instead of just Touch ID)
You may also want to look at Appleâs new Lockdown Mode, which they say can offer extreme protection.
2 Likes
-
For 16 years I have been securing my Windows machines with the one and only Kaspersky Internet Security and recently Kaspersky Endpoint Security.
-
My development systems are actually virtual machines inside the Windows host, not connected directly to the LAN.
1 Like
I use a Yubikey as a 2FA for doing anything with root access in my computer.
Also, for critical files, I create a vault with CryFS (which I can easily manage using the Gnome app called Vaults) and only mount it when I need something from it.
For firewall, I have a small device running PFSense that manage all the internet access to my local network instead of handling that in each computer.
Finally, for data storage and backup I use a NUC as a NAS with all data and I have a wireguard VPN setup on it so i can access it when Iâm not at home.
3 Likes
In 99.999999999% cases I prefer prevent instead of defend tactic. I block adds, 3rd part content (including cookies) and usually access sites I already known. I use Gentoo Linux and I decide whatâs inside my environment setup part by part. Maybe itâs a bit too manual, but in exchange I donât have support for everything like cups without a printer and so on. 
Most of apps and services is open source alternative for BigTech products. I rarely use Google, Twitter/X account only for giveaways, Discord only for a contact with family and Slack also for Elixir contacts. I had a LinkedIn account, but for some reason just checking inbox was a âsuspicious activityâ and because of that they require my ID scan (which in many countries is illegal btw.), so I showed middle finger and stopped using it.
I do not pay by card online. I prefer cash or âold, goodâ bank transfer. Simply most type of attacks that require ârush without thinkingâ does not work on me. On a single key I access a terminal with lots of useful information and actions.
6 Likes
I feel a little uncomfortable about running some code ârawâ on my machine, so I ended up writing a little âdevshellâ system to isolate projects inside their own containers. This also offers the benefit of very precise control over the build environment, of course.
At a lower level, I use full-disk LUKS encryption with an external USB key for 2FA, and Secure Boot. Thatâs getting pretty standard nowadays, though. And doesnât address the most important attack vectors in a remote-first environment anyway.
1 Like
