3 ms·

Generally speaking unless you are prepared to (at a minimum) 1. Harden the operating system 2. Actively monitor logs, and apply updates upon release 3. Put a

Generally speaking unless you are prepared to (at a minimum) 1. Harden the operating system 2. Actively monitor logs, and apply updates upon release 3. Put a Firewall with IDS/IPS between the server and the internet (which most home "routers" do not provide) you should not put anything on the wider internet, instead using something like tailscale (which you mention in another post) to create a secured private network across unsecured inet

rektide 4y ago
That sounds way overblown on multiple levels. "Harden the OS"... why... if you are port forwarding samba? Firewall with IDP? Please. This kind of advice seems designed to intimidate & scare, and it's absurd & cruel to convince people self hosting is so impossible and terrifying. Geeks oversell their conservative paranoia & gate-keeping like this all the te but this naysaying is just posionous! I've gone through every CVE for Samba & there seemingly is 1 potential problem since 2007 that would possibly potentially be an issue for a basic non-domaim controller smbd fileshare that a random non-user could possibly exploit. If you dont trust your users, there's indeed some CVEs of real threat, but still, like... 4.. https://www.cvedetails.com/vulnerability-list/vendor_id-102/Samba.html https://www.cvedetails.com/vulnerability-list/vendor_id-102/... Yes you probably should update fairly regularly, just in case. But more often than not, if you are a couple years behind, it's not a problem. Maybe someday that goes bad. But... so far... being super lax on updates generally hasnt had much impact. Maybe check logs every now and then, but honestly... once you have some confidence, it's fine. This stuff runs fine. It's easy.
- dinosaurdynasty 4y ago
  One problem with (at least samba) is that the configuration is a PITA and it's easy to do a lot of unsafe things (which probably wouldn't get a CVE because "well you enabled anonymous users, which are often enabled by default by distributions...") (at least compared to caddy or wireguard...)

rektide 4y ago

That sounds way overblown on multiple levels. "Harden the OS"... why... if you are port forwarding samba? Firewall with IDP? Please. This kind of advice seems designed to intimidate & scare, and it's absurd & cruel to convince people self hosting is so impossible and terrifying. Geeks oversell their conservative paranoia & gate-keeping like this all the te but this naysaying is just posionous! I've gone through every CVE for Samba & there seemingly is 1 potential problem since 2007 that would possibly potentially be an issue for a basic non-domaim controller smbd fileshare that a random non-user could possibly exploit. If you dont trust your users, there's indeed some CVEs of real threat, but still, like... 4.. https://www.cvedetails.com/vulnerability-list/vendor_id-102/Samba.html https://www.cvedetails.com/vulnerability-list/vendor_id-102/... Yes you probably should update fairly regularly, just in case. But more often than not, if you are a couple years behind, it's not a problem. Maybe someday that goes bad. But... so far... being super lax on updates generally hasnt had much impact. Maybe check logs every now and then, but honestly... once you have some confidence, it's fine. This stuff runs fine. It's easy.

dinosaurdynasty 4y ago
One problem with (at least samba) is that the configuration is a PITA and it's easy to do a lot of unsafe things (which probably wouldn't get a CVE because "well you enabled anonymous users, which are often enabled by default by distributions...") (at least compared to caddy or wireguard...)