Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to...

This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for responsibly reporting this.

Challenge accepted. "All files loaded" is probably not what you want to do however. It is much easier to just ask rpm directly which files under your library directory has been modified, and treat any files outside known library directories as suspicious.

Anyway, this is how you check which open files match ".so" and see if they are modified since installation:

  lsof | grep -o "/[^ ]*\.so[^ ]*" | while read path ; do
    pkg=$(rpm -qf "$path" 2>/dev/null)
    if [ $? != 0 ] ; then
      echo "$path does not belong to a package"
    else
      rpm -V $pkg | grep -F "$path"
    fi
  done

Why is something like Proxmox a bad target for IAC?

It is also worth mentioning that Proxmox uses ZFS making snapshotting quick and Proxmox also has a very good backup system.

If you want to treat your self-hosted applications as "sheep" (1) , then terraform k8s etc. is a better bet.

But if you are happy to manually restore from a backup or snapshot when something goes wrong, or automatically have your LXC container shifted to different hardware if you have a cluster, then Proxmox is for you. The reality is that in a home setup you will spend about as much or less time maintaining your "pets" than than you would your "farm".

(1) I write this from New Zealand

Are there any projects that generates random traffic? Like a website where you have it open it keeps sending random traffic. It will make traffic analysis very hard.