For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨Ferrous@lemmy.ml⁩ to ⁨selfhosted@lemmy.world⁩

PHP, TLS, etc… We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers’ tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week’s news. How are you all taking this?

pwn.watch

original

Comments

Sort:hotnew top

ikidd@lemmy.dbzer0.com ⁨5⁩ ⁨hours⁩ ago
I have my ops agent constantly checking SBOMs against current CVEs and if something triggers, I get a report with severity and repair options researched. I can then decide how I want it to proceed. I’m much less concerned about internal only services. SBOMs are refreshed after updates for future checks.

original
MangoPenguin@lemmy.blahaj.zone ⁨5⁩ ⁨hours⁩ ago
I’m re-thinking a few things, mostly moving exposed services onto a VM or two that are on their own VLAN, and don’t contain any important data (it would be my website, gameservers like Minecraft, etc…).

I already use a VPN via Wireguard on my router for access to my private services when out of the house, so my changes are just separating the public from the private as much as possible on the server side of things…

original
anon_8675309@lemmy.world ⁨7⁩ ⁨hours⁩ ago
I moved all my files to one share. At the root of that share is a robot_readme.md file that lists all the contents of my share with a note that says read everything you want, you will anyway.

They left a note that said “nah, bruh, you’re good”.

I guess I’m okay.

original
litchralee@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
Answering the titular question, why would the advent of AI-found vulnerabilities substantially change one’s threat model? Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?

In terms of attacker capabilities, it would be a mistake to solely observe that attackers now have LLMs and conclude that this means the threat landscape has changed. The use of LLMs does not magically create a root escalation where one does not or cannot exist. Part of your threat model should include defense-in-depth mitigations, so that when (not if) an attacker finds a 0-day exploit, they are severely limited in gained functionality on your machines. In the simplest cases, jails or containers serve to keep separate the web-facing processes. VM isolation would be a further step, because an attacked cannot gain machine control without both a software exploit as well as a VM escape route.

Phrased another way, the people who have done their threats analysis properly and have accepted the residual risk of hosting their own services that face the web, should not really be additionally perturbed by AI advances. This isn’t the same caliber of landscape change as would, say, the invention of a cryptographically relevant quantum computer. If the worst thing that can happen to your home IRC server is that it gets flooded by a script kiddie, AI does not mean your server can now burst into flames.

Much like with human hygiene, some basic rules are unusually effective against most threats. The equivalent to washing one’s hands is to stay on top of system and software updates. Institutionally funding the organizations (eg PHP Foundation, curl, USA CDC) so they can fix these problems would also help.

original
- boudica@lemmy.world ⁨12⁩ ⁨hours⁩ ago
  We’re talking self hosting, not an enterprise setup. Industry best practices and layers of defense mitigation are not realistic expectations for something like a media server that is only intended to be accessed by the owner and maybe a couple other people.
  
  original
  - litchralee@sh.itjust.works ⁨11⁩ ⁨hours⁩ ago
    I disagree: self hosting and enterprise are not mutually exclusive. In fact, “enterprise on-prem” is the marketing description for self-hosting. I do not accept any definition of self-hosting that gate-keeps to any degree.
    
    It is incongruous to talk about “only home self-hosting” or “only enterprise on-prem” when it comes to security mitigations, threat modeling, and risk management: it is merely a question of scale.
    
    Sure, the user base for a home setup might be single digits, but the attackers are identically situated: their capabilities do not grow or shrink based on whether they are targeting a bank or a Jellyfin server.
    
    original
- lambalicious@lemmy.sdf.org ⁨1⁩ ⁨day⁩ ago
  
  Before LLMs, the prospect of an undiscovered vulnerability was non-zero probability then, so what exactly has changed now?
  
  The problem is not the prospect of an undiscovered vulnerability (there is always a vulnerability somewhere) but rather the prospect of a reduced response window.
  
  There’s a wide gap of difference between “non-zero probability” (0.0076%) and “non-zero probability” (82.01734%).
  
  original
  - litchralee@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
    If you’re dealing in probabilities, that’s not threat modeling; it might be in the larger umbrella of risk management though. Defining a threat model means to qualify what sort of attacker you expect to face and what they are assumed to be capable of. An assumption such as “this adversary can send arbitrary packets to the public IP address” is what would be documented in a threat model.
    
    The raison d’etre of threat modeling is to methodically tackle the actual or assumed risks that an attacker can pose against you. It is not an exercise in swinging at shadows, though I wouldn’t discourage overstating the capabilities of an attacker, if needing to protect assets like patient info or PII. Doing threat modeling based on “gut feeling” is a recipe for not recognizing risk where it’s present and seeing risk when there isn’t any.
    
    The fact remains: you cannot squeeze blood from a stone. Even the most sophisticated AI cannot steal PII from a computer that doesn’t store PII. Proper threat modeling means you don’t put anything on the line that you haven’t squared up against the risks, however improbable. For any non-zero concern, a good threat model will discuss its mitigation, whether it will be absorbed, or if it is an open question. For an out-of-scope concern, a good threat model will explicitly state that assumption.
    
    original
    -> View More Comments
esperal@pawb.social ⁨11⁩ ⁨hours⁩ ago
This was the final push that convinced me to rebuild my server from scratch! I started doing so 3 weeks ago :D

I was running my containers on a single good old Debian, that I replaced with Proxmox. I set up several VM that don’t share anything between them :

One for all the services I don’t really care about, like game servers and utilities with no personal data.

A second one for services in need of a GPU passthrough (Immich and Jellyfin) and partial access to some of my data (photos and movies in this case)

And a third one that gets access to all my personal data, only hosting a container for WebDAV access and a web file browser. I might hide these two services behind a VPN in the future if I feel like doing so, for now it is still to practical to have them freely available…

A last VM is running network related app like my reverse proxy.

I should have done this years ago, but I’m still learning and learning costs time :p

Next I want to hide all of Internet facing services behind an identity provider/application proxy (I don’t really know if it is the right way to name it ?) like Authentic to totally block access to any content from unauthorized visitors.

I guess I’ll be mostly fine once this is done ^^
original
- Ferrous@lemmy.ml ⁨11⁩ ⁨hours⁩ ago
  Your separation between VMs is exactly what I want to do. But given how I’m still rocking a single truenas machine running all my containers, I’ve got a quite a bit of setup to do… Like you said, rebuilding everything is a slog.
  
  original
lambalicious@lemmy.sdf.org ⁨12⁩ ⁨hours⁩ ago
My threat model is not changed: I want to serve something and I want to not be busy with "oh suddenly there’s a two PHP vulnerabilityies. My enemy is the world, but that is not really unchanged from before in a world where there exists capitalism and rent seekers want to collect from us even for breathing. I’m not intended to be unpaid tech support. So I just serve the things with reasonable scopes (under wireguard, or in a borrowed VPS, etc) and let it go. If an automated system manages to find a hole, computers are so fast that it’s not going to make a difference if I’m sitting in front of the chair vs enjoying some modicum of social life visiting a friend three cities away.

original
NoLemurs@lemmy.world ⁨1⁩ ⁨day⁩ ago
I’ve always treated my home server with public facing services as presumptively compromised. I don’t put any data on there I wouldn’t want to see become public, and any data I actually care about losing is backed up to the cloud with an append-only key. The NixOS config lives in a git repo not on the server. If something bad happens, I can wipe the machine clean, redeploy the image, restore my backups, and we’re back to the status quo.

So, my threat model hasn’t changed much!

original
terabyterex@lemmy.world ⁨1⁩ ⁨day⁩ ago
not at home but i work as a software dev for a very big company you heard of and all we do noe is fix ai found security bugs. hell the stuff i work on isnt that public and we are still fixing. i can only imagine what the team of the public website are handling.

original
Treczoks@lemmy.world ⁨16⁩ ⁨hours⁩ ago
I completely folded all services to the “inside”.

original
Ardyvee@europe.pub ⁨1⁩ ⁨day⁩ ago
Hasn’t changed much. I have accepted the risk and, for now, the desire to have publicly accessible stuff outweights my lack of desire to deal with the realities of a VPN. I mean, I want to share stuff with others, and I want to be hosting it myself because I have grown to distrust someone else’s service… so what else can I do but risk it?

Besides: I expect tailscale or the underlying VPN services to already be a target. I would be surprised if they don’t find anything. What then?

original
- lemmyvore@feddit.nl ⁨20⁩ ⁨hours⁩ ago
  If they find anything we fix it, update our services, and move on.
  
  The chances of being hit by a zero-day as a random self-hoster are very small, but anyway if you keep backups and can restore a clean state (and patch your system) you should be good.
  
  The goal is not to have perfect security, it’s to mitigate the risks and to handle fallout correctly.
  
  original
truxnell@quokk.au ⁨1⁩ ⁨day⁩ ago
I moved to closing everything down and wireguarding in to home 5 years ago and I’m glad I did. I only expose game server these days which have a different vuln profile.

If/when I open up for Jellyfin/etc, I’ll probably run them on a different box to my NAS in a DMZ with strong firewall rules. And use a VPS for anything else that doesn’t require NAS storage to reduce blast radius.

Can we go back to late 90s internet yet?

original
illusionist@lemmy.zip ⁨1⁩ ⁨day⁩ ago
I had a public facing jellyfin. I took it down because of that.

Immich and nextcloud are still up.

I’m not saying there is a rational reasoning behind it.

original
boblin@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
I have HTTP(s) exposed, plus a wireguard port. HTTP points at a traefik gateway running in a kubernetes environment, based on hardened talos and using cilium network policies to isolate and direct traffic. I know that I am not super safe, but given this weeks news I think the only way to be truly safe in terms of cybersecurity is to use paper notebooks, snail mail and a subscription to the local print newspaper and no digital services whatsoever. In other words: how certain can we be that tailscale, or wireguard in general, or any other securit tool isn‘t suddenly at risk? Can we live with that risk? There always was a trade-off you had to make. Unfortunately „just use lets-encrypt, fail2ban and key-auth for ssh“ isn‘t really cutting it anymore.

original
GreenKnight23@lemmy.world ⁨1⁩ ⁨day⁩ ago
exposure is unchanged. automated patching and upgrades are working. rollbacks, etc are working. minimal attack surface exposed and properly blocking traffic by geography. rotation of keys/passwords as well as short lived rotated TLS certs.

not one of those things alone is a solution, but together can make a solid dent in securing your infrastructure.

original
confusedpuppy@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
My public facing server uses a wildcard domain cert plus it’s hosted on an uncommon higher port. It only serves static pages. My SSH port is hidden behind a WireGuard connection. I keep it extremely simple because simple is easy to maintain.

original
joseki@lemmy.zip ⁨1⁩ ⁨day⁩ ago
Eh between cloudflare blocking everything outside the US and tailscale for privileged control surfaces I’m not super worried.

original
magnue@lemmy.world ⁨1⁩ ⁨day⁩ ago
If tailscale gets compromised I’m fucked. Otherwise I won’t be opening anything else up given my limited experience.

original
ChaosSpectre@lemmy.zip ⁨1⁩ ⁨day⁩ ago
I don’t have a public facing website but I was in the process of building one for fun prior to all this.

I completely locked down. Nothing leaves tailscale pretty much. If I do need a public facing site it will be built on other peoples platforms and nothing local.

In my case, building a site would be for fun, not for anything else. AI turning it into a maintenance chore just kills any excitment that used to exist for it. If anything, I’ll probably build it on neocities at this point.

original

Decronym@lemmy.decronym.xyz ⁨1⁩ ⁨day⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
Git	Popular version control system, primarily for code
NAS	Network-Attached Storage
SSH	Secure Shell for remote terminal access
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #146 for this comm, first seen 23rd Oct 2026, 00:30] [FAQ] [Full list] [Contact] [Source code]

original

frongt@lemmy.zip ⁨1⁩ ⁨day⁩ ago
The only thing I have exposed is my VPN, so no change here.

original
non_burglar@lemmy.world ⁨1⁩ ⁨day⁩ ago
I don’t expose much, just an always-on VPN. My HTML only site lives on vps, from which i can cut-and-run anytime. I don’t have much need for more, really.

Back when I was working more with raw infosec stuff like packet analysis, etc, I thought surely we would see machine learning in every router to dynamically manage firewalls in such a way that they became foregone conclusions. We don’t really have that, but code has sure changed, and you’re right, we will see lots more vulns discovered and exploited at a much faster pace.

original