Comment

Comment on How to reverse proxy?

<- View Parent

WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago

The funnel exposes your local services to the public over https . Like what you want to accomplish with reverse proxy .

they did not say they want it public, and that’s an additional security burden they may not need

source

Sort:hotnew top

ippokratis@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
He he didnt but ghats what he meant

I mean 99% of users use reverse proxy for https public access

Also read the threat replies …

That’s what this thread is about

…

No?

source
- WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  if that’s true, I assume it is because they don’t know about the security consequences, nor about more secure ways. and for 99% that is the worst solution, because they won’t tighten security with a read only filesystem, DMZ and whatnot, worse, they won’t be patching their systems on schedule, but maybe in a year.
  
  99% users should not expose any public services other than wireguard or something based on it. on a VPS the risk my be lower, but on a home network, hell no!
  
  source
  - ippokratis@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
    Ok I’m not any networking expert but I think you are overestimating the risk here.
    
    Opening a port doesn’t mean you are opening your whole home network just the specific services you want. And those not directly but with a web server in front of them . Web servers talked in this tgread that sit in front of open ports are well audited . I think that measures like mtls a generic web server hardening are more than ok to not ever be compromised.
    
    But yeah I’m surely interested to listen if you could elaborate.
    
    Thanks
    
    source
    WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
    
    Opening a port doesn’t mean you are opening your whole home network just the specific services you want.
    
    until a new high severity vulnerability gets discovered and some bot exploits it on your server, taking it over. and you won’t even know. if they were a bit smart, you won’t notice it ever either.
    
    but there’s more! its not only the reverse proxy that can be exploited! over the past few years, jellyfin has patched a dozen vulnerabilities, some of which allowed execution of arbitrary system commands. one of the maintainers have expressed that nobody should be running those old versions anymore, because they are not safe even only on the LAN. and this was just jellyfin.
    
    source