3 ms·

That's why a serious user sets up their own server, serves the images that they have selected and checked, and doesn't serve outside of their known netspace.

by dsr_ 4y ago

hnlmorg 4y ago
I did that for a while but keeping images up to date was a chore I’d often forget to do then regret not doing once I needed it. Sure I could probably automate it with a little effort but instead I switched to this service and have been running with it for a few years now without any issues. While I know there is a risk involved, pragmatically that risk is very low given I’m just an anonymous individual very occasionally using this for personal devices. You can actually run this service locally though. I did contemplate running their Docker container on my home server. However I use it so infrequently that even running their Docker container locally felt like an unnecessary additional piece of work.
- bravetraveler 4y ago
  I've found it convenient (once setup...) to run internal package mirrors. These with even relatively dated 'netinstall' media can provide you with current installations. Then provide you with super fast updates. I'm more familiar with doing this with RPM based distributions -- CentOS, Fedora, etc. It's basically a web server and rsync behind a [parameterized] systemd timer so you can centrally control existing/new mirrors The results can admittedly be a little funny. If the netinstall is so far behind that RPM doesn't know what to do with the new packages, then yea - time to get a new one :)
  - hnlmorg 4y ago
    That was the issue for me though. It would often be years between usages since the only time I needed it was when a computer stopped booting or I was repurposing a device. Neither being things that happens very often.
    - bravetraveler 4y ago
      Aye, that makes sense. It's hard to justify if you don't leverage it often I moved and I've been hard pressed to bother booting everything up and checking on it, and I have quite a lot of devices to manage
- dsr_ 4y ago
  The risk wouldn't be someone deliberately targetting you: the risk would be someone deciding that this is an excellent vector to gain backdoor root access on many random machines.
  - hnlmorg 4y ago
    I wasn’t suggesting I would be personally targetted. I was stating that the infrequency and low criticality of my usage vastly narrows the risk of getting exposed to the attack. Hence my point that if I were using this regularly then I might want to invest in a more secure mirror. But when it can be years between my usages the benefits of self hosting are vastly outweighed but the cost (both in time and electricity) of managing it. Thus I’m willing to take that slight risk in this specific instance.

That's why a serious user sets up their own server, serves the images that they have selected and checked, and doesn't serve outside of their known netspace.

by dsr_ 4y ago

That's why a serious user sets up their own server, serves the images that they have selected and checked, and doesn't serve outside of their known netspace.

hnlmorg 4y ago

I did that for a while but keeping images up to date was a chore I’d often forget to do then regret not doing once I needed it. Sure I could probably automate it with a little effort but instead I switched to this service and have been running with it for a few years now without any issues. While I know there is a risk involved, pragmatically that risk is very low given I’m just an anonymous individual very occasionally using this for personal devices. You can actually run this service locally though. I did contemplate running their Docker container on my home server. However I use it so infrequently that even running their Docker container locally felt like an unnecessary additional piece of work.

bravetraveler 4y ago
I've found it convenient (once setup...) to run internal package mirrors. These with even relatively dated 'netinstall' media can provide you with current installations. Then provide you with super fast updates. I'm more familiar with doing this with RPM based distributions -- CentOS, Fedora, etc. It's basically a web server and rsync behind a [parameterized] systemd timer so you can centrally control existing/new mirrors The results can admittedly be a little funny. If the netinstall is so far behind that RPM doesn't know what to do with the new packages, then yea - time to get a new one :)
- hnlmorg 4y ago
  That was the issue for me though. It would often be years between usages since the only time I needed it was when a computer stopped booting or I was repurposing a device. Neither being things that happens very often.
  - bravetraveler 4y ago
    Aye, that makes sense. It's hard to justify if you don't leverage it often I moved and I've been hard pressed to bother booting everything up and checking on it, and I have quite a lot of devices to manage
dsr_ 4y ago
The risk wouldn't be someone deliberately targetting you: the risk would be someone deciding that this is an excellent vector to gain backdoor root access on many random machines.
- hnlmorg 4y ago
  I wasn’t suggesting I would be personally targetted. I was stating that the infrequency and low criticality of my usage vastly narrows the risk of getting exposed to the attack. Hence my point that if I were using this regularly then I might want to invest in a more secure mirror. But when it can be years between my usages the benefits of self hosting are vastly outweighed but the cost (both in time and electricity) of managing it. Thus I’m willing to take that slight risk in this specific instance.