Norphy

That's right. If you try and get a public cert with a non-routable domain or for a domain that you don't own, the CA will tell you to go away and stop wasting their time.

This is what happens when you leave things like wearing masks to personal choice. Most people think at the beginning that they'll keep wearing them. Then those people go to the supermarket or where-ever. The majority are wearing them, but one or two people aren't so some of those people think "Well, if they're not why should I?". Less people are wearing masks, more people are thinking "Why bother?". It gets to the point where wearing masks is the exception rather than the rule I still think that wearing face coverings is still the way to go at the moment but even I'm getting to the point where I'm asking "Why bother?". Wearing a mask will help prevent me spreading the lurgy to other people, but it won't stop people from sneezing on produce, contaminating it and spreading it to me in other ways.

Can't see the attachments, but yes, if the certificates aren't in use you can get rid of them.

I would be amazed if devices like wireless access points didn't already have self-signed SSL certificates for their management interfaces. I've not seen one that doesn't in a very long time. Yes, your PC won't trust them but traffic will still be encrypted, you'll just get a warning in your browser. Of course, I've not used Unifi before so that could be complete balderdash. For internal websites, you have a choice: 1) Use an internal CA and push that CA's root certificate out to your clients, so that they trust it. Very easy with Windows devices, use a GPO. Easy with iOS and Macs, use a profile. Don't know with Linux, I don't know how you manage them. Worst case scenario, you'd need to manually put the Root CA certificate onto each device's trust store. Any server certificates issued by your internal CA are then trusted by the device and you can get on with your day. Advantages to this approach: No extra monetary cost, assuming you've got spare hardware capacity and licenses for whatever OS you're running your CA on You can issue them to any address. Public CAs will only issue certificates to resolvable DNS names that you control, so no .local etc Longer certificate life spans Disadvantages: Devices need to trust your CA to stop errors from appearing in the browser. Not suitable for BYOD devices, as they won't trust your CA It's another thing you need to support 2) Get publicly signed certificates for each web service. You could get a certificate for each website, a wildcard certificate for a domain (e.g. *.domain.com or *.internal.domain.com) or a certificate with multiple Subject Alternate Names (SAN), one for each website the certificate is on. I think the limit for SANs is something like 50 per certificate. You could use a paid for CA like Gandi or LetsEncrypt. LetsEncrypt is free but certificates last three months and they don't natively support Windows, so you'd need to use Linux to get them and convert them to something a Windows server can use. You'd also have to set up some kind of automated process to renew your certificate. Advantages to this approach: Devices should automatically trust a public certificate, so there's no further configuration needed on the device No errors when you try to access a site signed with a cert from a public CA Disadvantages: Depending on how many websites you need to secure, it could get expensive. Using wildcards or SANs can cut this expense, but you'd need to have enough sites to make the extra cost worthwhile Could be more time consuming, especially if you use LetsEncrypt Ultimately, you need to decide if the service that you're using needs to be encrypted or not. Using Papercut as an example, when you access the website you need to authenticate with it and that means putting your domain password into it. If the site isn't encrypted, that means entering your username and password in plain text, which isn't good. With other websites, you might not care.

I thought it would be hard to imagine a worse custodian for SIMS than Capita but, well, there you have it. I hope I'm wrong about that but my experiences with ParentPay aren't exactly positive. Glad I'm not in education any more.

Hosting it yourself does have some drawbacks, however. It assumes that you have the expertise, the time and resources to build and maintain whatever stack your website is running on. It’s an extra hole that you have to punch into your firewall to slow the outside world access. Ideally you’d have it on a separate segment of your network should it get compromised, to limit the amount of damage an attacker can do. It assumes that you have a decent internet connection and you’re eating into the bandwidth that your ISP provides. Ideally you’d have some kind of DDOS protection in place as well as having your website hosted on site makes you a bigger target. There was a time when I would have unequivocally agreed with you but these days, with schools and everyone else under constant cyber attack, I’d rather farm the running of a LAMP stack or whatever onto a third party and let them deal with the setting up, maintenance and security implications that come with it. Let’s face it, they’d probably be better equipped for it. It’s the same reason of never run my own Exchange server again, let Microsoft deal with that crap.

Text..

You are on the opposite side of the planet. It's more likely to be network contention between you and the UK I'd have thought. According to a whois search, Edugeek is hosted by AWS in Ireland so although Edugeek may be a small entity, Amazon sure ain't!

Agreed. You'd also have to make sure that there is no mDNS/Bonjour forwarding between the isolated VLAN and the VLAN that the printers sit in.

Jovi...

Didn't Extreme buy out one of the larger cloud wifi vendors? Aerohive wasn't it? I've had a bad experience with an Aerohive wireless network. If I wanted a cloud managed wifi system, I'd personally be looking at Meraki or Juniper, who bought out Mist.

For what it's worth, my testbed is a pair of VMs, one running Server 2016 and the other running Windows 10. Both are on 2021-09 and before that registry key was put in, I was getting the "error 0x0000011b" error.

Thanks, that's worked for me as well. Now the question is, what does this key do? /edit https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25 hmph. Looks like this was planned.

Kidd..

Blower

Howard

Thrower

Completely

Cool story bro. Glad you could share.

OK, with a couple of completely clean VMs: Server 2016 with one queue, patched to September 2021 Windows 10 1909, patched to August 2021 When attempting to connect from the client to a mapped queue on the server, error 0x0000011b. Bringing the client up to 2021-09 makes no odds. Even connecting to a queue with type 4 drivers doesn't make any difference. Pre-installing the printer drivers on the clients makes no odds either. I don't think this issue is with Point and Print

It definitely does something to break things further. The September 2021 patch was automatically installed on the print server at one of my customers and after that, noone could print. We removed the September patch and things started working again. The error was "Cannot connect to printer, operation failed with error 0x0000011b" All the Point and Print stuff and registry entries were present on the workstation.

Tennis

Neverwhere? Turns them into Chromebooks, pretty much the definition of what you want I think. edit - Ninja'd

Generally speaking, I tend to buy a new iPhone when Apple stop releasing operating system updates for the one I've got. I get the current model to stick with the phone as long as possible. With this iPhone 7, this has turned out to be a bit more difficult as they keep on supporting older models! I've had this iPhone 7 for five-ish years and iOS 15 is going to be supported on it. However, battery life on it has gone in the toilet and an iPhone 13 Mini is looking tempting right now. My progression has been: 3GS in 2009 5 in 2012 7 in 2016 13 in 2021/2022 maybe?

(thanks for) asking