fonix232

iGPU+dGPU like most laptops are

To be perfectly fair, we’ve come a long, long way from 20-30 years ago when most firewalls were static or at best heuristic.

Today you can integrate solutions like CrowdSec into your reverse proxy setup (which, let’s be fair, most people hosting things will be using to some extent), and transparently scans all requests for known exploit fingerprints.

Basically, if you’ve done the bare minimum of opsec, most likely your setup will be safe from being compromised, even if you’re running an exploitable version of the problem software/stack.

And that’s just a free and open source solution to securing your hosting - you can further deploy DPI based IDPs, analytics that spots irregular traffic patterns, especially in commercial environments, to protect against such attacks. It’s not a guarantee, but such layered security at the very least adds some deterrence.

Random website: your password must include lower and upper case characters, numbers, special characters, emojis, invisible UTF-16 characters, be at least 32 digits long, contain no repeating sequences, mathematical sequences, musical sequences, a random episode number of Friends, parts of your username, email, mother’s name, father’s name, address, social security number, childhood address street name, first pet’s name, any date between 32 March 1928 and 1 Feb 2077, or the special character ë̷̡̡̨̡̬̜̲̫̼̠̙̱̝̖̝̞͕͉͎̿́̂͗͂̉͐͑͐̀͗̔̊̈́̅̑͘͠ͅ.

CA private key security: “Pick a number between 0 and 10443888814131525066917527107166243825799642490473837803842334832839539079715574568488268119349975583408901067144392628379875734381857936072632360 8785136527794595697654370999834036159013438371831442807001185594622637631883939771274567233468434458661749680790870580370407128404874011860911446797778359802900668693897688178778594690563019026094059957945343282346930302669644305902501597239986771421554169383555988529148631823791443449673408781187263949647510018904134900841706167509366833385055103297208826955076998361636941193301521379682583718809183365675122131849284636812555022599830041234478486259567449219461702380650591324561082573183538008760862210283427019769820231316901767800667519548507992163641937028537512478401490715913545998279051339961155179427110683113409058427288427979155484978295432353451706522326906139490598769300212296339568778287894844061600741294567491 9823050571642377154816321380631045902916136926708342856440730447899971901781465763473223850267253059899795996090799469201774624817718449867455659250178329070473119433165550807568221846571746373296884912819520317457002440926616910874148385078411929804522981857338977648103126085903001302413467189726673216491511131602920781738033436090243804708340403154190335”

User: guess 4 will do

exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers.

What? Which dumbass wrote this? A 10yo skiddie can do this with a simple enforced proxy on an open WiFi AP.

I could literally grab a travel router, use the already installed OpenWrt on it, and deploy a sniffer that proxies all traffic, and for any traffic using the specific keys that leaked… unpack and repack those requests and responses on the fly.

I love how they’re trying to downplay this.

What the fuck are you on about?

1. Docker doesn’t require podman at all
2. Learning the basics of Docker isn’t that complex. Certainly isn’t as complex as learning how to run VMs on a dedicated headless server.
3. If you look up “install docker”, the first hit is, 9 out of 10 times, Docker Engine. NOT the desktop app…
4. No, I am aguing that if you were capable of setting up Cisco BGPs in the mid-90s, when documentation was ass, network gear management was ass, and you didn’t have forums and Reddit and Wikipedia and websites hosting manuals, tech blogs and guides and so on… Then setting up Jellyfin, which is a fraction of the complexity of your job 30 years ago, should be straightforward. I am arguing that if you were capable of configuring complex services and devices 30 years ago, then today, with a million times more information readily available at your fingertips, you should be able to set up a simple service.

First it’s a VM because I’m not going mess around with stuff on bare metal.

Containerisation method doesn’t matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say “here’s your config folder where you can write shit, but not execute; here’s the data folder where you can neither write or execute shit; and here’s the read-only executable layer of the image/VM/container”.

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you’re hosting it, a reverse proxy is necessary. Even with a VM.

Here’s a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there’s setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”.

So the problem wasn’t Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP…

Beside, that wasn’t even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.

Port setup and it’s perceived impossibility by you has naught to do with that topic.

It’s literally just:

• create docker container
• forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
• forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS

I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

Not if your Jellyfin is set up correctly.

Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

Removed by mod

And if you run a reverse proxy, put crowdsec on it. The free options for filters are pretty well maintained.

“I wholly disagree with the direction this project is taking and I want nothing to do with said direction” is already an opposition of collaboration… just saying.

I have tablets in my home, with batteries (as fallback in case of power loss - my HA instance and router/APs are on UPS).

I’m using older (thus cheaper) Samsung tablets. Fully Kiosk works well, but recently I’ve started adding kiosk features to the HA Android app (no public PRs yet so it’s a few months away) to add some features (mostly sleep/wake via audio/camera motion, sleep screens, default pages for the specific instances etc.), so I can ditch FK.

Battery bloat is an issue - my Tab S6 is on its third battery (though admittedly it is nearly 7 years old now, got it January 2020), and my Tab S5e lasted 3.5 years until its battery started getting spicy. I’ve switched both to LineageOS to reduce heating + have more control over charging/discharging, and that so far seems to have helped. Unfortunately Samsung tablets don’t support running off of USB without a battery (they bootloop if no cell is detected), so pulling the battery and running them off a wall outlet isn’t really an option.

To me, a Pi or similar SBC with a touchscreen just seemed like a very hacky solution. I rent so I can’t add a box in the wall for the board and PSU, and tablets are just more elegant. Throw in a 3D printed enclosure/mount, and you’re golden.

I use mine regularly, especially since they wake whenever I walk past them.

E-ink, unless you’re writing your own frontend, I’d recommend against. There isn’t really a good eink theme for HA at the moment, and most panels that are good sized (10-13-16") cost a fortune (£250-300 just for the display, and you’d still need the brains). Meanwhile older tablets in good condition go for £70-150, and you get the full kit for that price, plus generally, brilliant displays (just limit your search to AMOLED tablets).

If anything, this should’ve been a read-only, monitoring/alerting system.

I have something similar for my freezer because sometimes the door doesn’t close properly and, well… I too dislike tossing out a lot of food because it spoiled. A simple £10 sensor and a crafty little rule in my home automation system (sliding window averages, stored as historical data points, live comparison + alert if value is higher than usual for longer than 5 minutes), and I know if shit is going wrong.

No supermarket needs remote controllable systems for a fucking fridge. Period. Set up monitoring, alerting, and some minimal local presence. Bam, you’re done, if shit goes south, you can have a person there to fix it manually within 30-45 minutes. And hackers can’t fuck up your food.

TBF I was going all out 😂but yeah the fact that my build essentially tripled in price is insane.

Fridge temperature sensors are super useful to notice if you accidentally left the door open.

Similarly, sensors in a coffee machine are useful to detect limescale buildup, water level, etc.

The issue isn’t the data but the fact that these “smart” devices aren’t local-first.

I built my PC in 2024. Okay specs - 7950X3D, 2x 48GB DDR5-6400, 4090, 1+4TB Samsung 990, all watercooled. About £4k total.

Today I could sell that PC for about 10-12k. RAM was originally £300, now it’s £1800 IF you can buy it. The storage also cost me around £400, today, easily £1500.

They’ve been pushing it for ages, especially the “ID yourself for adult content” laws.

It’s partly to indeed combat the AI/machine noise of the internet, but also to improve their own dataset of people. What kind of porn you watch. What kind of “adult” products you buy (soon to include knives, kitchen and garden tools, etc., because “blade”), they want to know EVERYTHING.

Not just so your ads can be targeted, but because these companies want to replace governments, and that data will be extremely useful to push people into specific roles.

Oh, you’re a rebellious anarchist? Well enjoy the shitty life or we tell people about your kinks - and I 100% guarantee there will be fabricated ones too. Everyone has secrets, and these companies want to learn them all to have absolute control over you.

Doesn’t have to be vandalism, you can edit the site with Developer Tools and take a screenshot…

I think even a simple ESP32 would serve well as a serial to TCP adapter. And it’s considerably cheaper.