hietsu

@hietsu@sopuli.xyz

• ⁨Comment⁩ on ⁨Holy sh*t: Jack Dorsey just Announced Bitchat(A secure, decentralized, peer-to-peer messaging app for iOS and macOS that works over Bluetooth mesh networks) Licensed Under Public Domain.⁩ ⁨⁨4⁩ ⁨days⁩ ago⁩:
  • for Android (and Windows/macOS/Linux) but not iOS.

  And apparently never going to be as some key component is written in Java. Other technical obstacles should be solvable (like f.ex. getting continuous running in bg by exploiting location services like iSH can do)

• ⁨Comment⁩ on ⁨Windows seemingly lost 400 million users in the past three years — official Microsoft statements show hints of a shrinking user base⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  What is free though is LibreOffice, or some Nextcloud document addons (to a degree) if ”cloud” is the thing.

• ⁨Comment⁩ on ⁨Jellyfin over the internet⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Nice, but the bots may not understand the joke.

  And not only that but they will tag the domain with ”there is something here”, and maybe some day someone will take a closer look and see if you are all up-to-date or would there maybe be a way in. So better to just drop everything and maybe also ban the IP if they happen to try poke some commonly scanned things (like /wp-admin, /git, port 22 etc.) GoAccess is a pretty nice tool to show you what they are after.

• ⁨Comment⁩ on ⁨Jellyfin over the internet⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Not at hand no, but I’m sure any of the LLMs can guide you through the setup if googling does not give anything good.

  Nothing very special about all this, well maybe the subdir does require some extra spells to reverse proxy config.

• ⁨Comment⁩ on ⁨Jellyfin over the internet⁩ ⁨⁨2⁩ ⁨weeks⁩ ago⁩:

  Use a reverse proxy (caddy or nginx proxy manager) with a subdomain, like myservice.mydomain.com (maybe even configure a subdir too, so …domain.com/guessthis/). Don’t put anything on the main domain / root dir / the IP address.

  If you’re still unsure setup Knockd to whitelist only IP addresses that touch certain one or two random ports first.

  So security through obscurity :) But good luck for the bots to figure all that out.

  VPN is of course the actually secure option, I’d vote for Tailscale.

• ⁨Comment⁩ on ⁨Do you remember Windows 95? How about Windows 96?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  UTM is the way to go on modern Macs, and even iOS/iPadOS too! Built on QEMU and super easy to spin up virtual machines with any architecture.

  mac.getutm.app

• ⁨Comment⁩ on ⁨ELI5: How to put several servers on one external IP?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  Could be indeed. Looking at the nginx logs, setting a permaban on trying to access /git and a couple of others might catch 99% of bots too. And ssh port ban trigger (using knockd for example) is also pretty powerful yet safe.

• ⁨Comment⁩ on ⁨ELI5: How to put several servers on one external IP?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  I have wrestled with the same thing as you and I think nginx reverse proxy and subdomains are reasonably good solution:

  • nothing answers from www.mydomain.com or mydomain.com or ip:port.
  • I have subdomains like service.mydomain.com and letsencrypt gives them certs.
  • some services even use a dir, so only service.mydomain.com/something will get you there but nothing else.
  • keep the services updated and using good passwords & non-default usernames.
  • Planned: instant IP ban to anything that touches port 80/443 without using proper subdomain (whitelisting letsencrypt ofc), same with ssh port and other commonly scanner ones. Using fail2ban reading nginx logs for example.
  • Planned: geofencing some ip ranges, auto-updating from public botnet lists.
  • Planned: wildcard TLS cert (*.mydomain.com) so that the subdomains are not listed anywhere maybe even Cloudflare tunnel with this.

  Only fault I’ve discovered are some public ledgers of TLS certs, where the certs given by letsencrypt spill out those semi-secret subdomains to the world. I seem to get very little to no bots knocking my services though so maybe those are not being scraped that much.

• ⁨Comment⁩ on ⁨Jeff Geerling: Self-hosting your own media considered harmful (updated). Youtube removed his content, saying that self hosting content is "dangerous or harmful content"⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  Saw the video… It mentions ”ripping” and even shows clips of some blockbuster movies. No wonder any copyright-sensitive automation gets triggered pretty fast. This will only get worse.