BobbyB said:

It's hard to know exactly where to start, since I don't know what angle to take to answer this not knowing what you know or don't. Easiest answer is that a chain is only as strong as its weakest link. And I agree that even if a device is 100% dedicated to WCG and has literally 0 personal, private, or sensitive information on it, it still needs to be maintained with the latest security updates to protect the rest of your network (the things that actually do matter).

Every day there's hundreds of new vulnerabilities discovered, and fixes hopefully follow soon. Some vulnerabilities are more critical than others. Some can lead to Remote Code Execution (RCE) or Information Disclosure (ID), while others may only lead to Denial of Service (DoS).

I'll try to be more clear and specific: Even if a WCG device is meaningless and doesn't have anything on it that's worth stealing, leaving it unpatched leaves a massive "attack surface" that a hacker can exploit to take control of that WCG device. From there, the hacker can live, rent-free, undetected for months/years and use that WCG device as a home base of operations to live inside your home network and observe the important stuff coming from your main computers. And can even launch attacks on those devices/hack them/destroy them/steal private information and files, etc. It's easier to hack your home from the inside than from the outside, so an unpatched WCG device (even behind your home's firewall) is still a sitting duck in my opinion. It's just asking for compromise.

There's no reason to not have Windows machines get the monthly Microsoft updates just to stay current as best as possible. Same with Defender getting malware definition updates.



Windows is extremely bloated and can't really be barebones. The only slimmed down devices I know of are Windows Server computers that are command line only (no GUI) and only have the services necessary to do their jobs. So Microsoft IIS if it's a web server or SQL Server if it is a database server, for example.

Best thing for barebones is really Linux. I have my crunch machines on Linux as slimmed down as possible and no GUI. A GUI/Desktop Environment adds significant bloat and a thousand new files that have to be updated and kept secure and has zero value on a headless (no display) server.


Oof. I have "unattended-upgrades" installed and setup on my Linux boxes, and every night at 3 AM they check for updates and automatically install them. And every few months if they need a full reboot, they do that automatically as well at around 5-6 AM. And after they reboot, BOINC always starts up by itself and continues crunching WCG work units. I can sleep well knowing they're crunching away and secure, and I can go many months without needing to really check on them. It's beautiful.

(I have one of my servers on the floor under my desk now. I'm gonna put Linux on it very soon to do some Folding@home competitions for Christmas so I'll use this as an excuse to write my "How to install Linux and BOINC for beginners" guide. I feel like enough beginners would benefit from this and drink the kool-aid. It's blissful. Set it and forget it, AND they update themselves.

hchc:

My background is IT. I evaluated that the risks are negligible to none in my case. This is my personal point of view.

I tell people exactly what you say for their personal computers: good passwords, update, don't click on email links, etc, etc.

I know I've said it a few times but now that I've been using the Mac Mini M2s even longer I would highly recommend purchasing a few...you can easily find them for $499 or less, they use soooo little power, generate very little heat, are dead silent, tiny form size, and crunch a lot of WUs considering all the points I just listed! Apple probably has an M3 Mini coming in March with theoretically faster cpu and gpu but who knows.

https://www.bhphotovideo.com/c/product/174635...l_a_mac_mini_with_m2.html $499 with free next day shipping. They were $479 a few weeks ago. I'm hoping they will drop to $419 when the M3 version comes out and I would buy a few of the M2 versions. They are just awesome little machines.

I have 10 of the M2 flavor and 5 of the M1 flavor. All headless.

Windows 10 is no problem. Use 21H1 because in that version Windows updates can still be disabled. If the machines only purpose is to crunch, you don't need to worry about updates. https://youtu.be/jpbs9VNaUvY?si=kmdsN7MOwENjMPJ4
Wuauclt and wuaueng, set owner to everyone, then remove all permissions. Windows cannot re-enable it. Later additions can but 21 H1 cannot. Further I disable Windows defender by running a piece of software called AutoRuns in safe mode This saves a lot of clock cycles. I've done this on all my machines, no worries. And Windows never auto reboots no troubles!
I didn't know WCG mapping cancer markers supported Apple M architecture I need to research cost versus performance now versus my used i5-8500 SFFs I get off eBay for about 85 bucks now each usually.