2 ms·

I've had tech savvy friends have good brand (don't remember if qnap or synology) NAS devices compromised. OS patches help but for example the 3rd party stuff yo

I've had tech savvy friends have good brand (don't remember if qnap or synology) NAS devices compromised. OS patches help but for example the 3rd party stuff you install might be a risk, or things that are patched too slowly in the os, etc. In the end you still need to manage and monitor it. It seems a lot of guidance about securing your NAS (eg [1]) starts with "it's bad if it's directly connected to the internet". So if you want to use the internet, it may be a better bet to use a managed service (or maybe look for a more security focused product?). [1] https://www.backblaze.com/blog/recent-qnap-and-synology-security-alerts-how-to-protect-your-nas/ https://www.backblaze.com/blog/recent-qnap-and-synology-secu...

jhugo 4y ago
I usually turn off all "cloud" / Internet-accessible features of everything (and, where possible, even block things from Internet access), and then have a Wireguard VPN back to my home network. I think this is a better balance of security and usability than trusting that all of the NAS/camera/doorknob/printer/etc vendors are any good at securing these things.
- fulafel 4y ago
  The use of VPNs to mitigate iffy security in self-hosted stuff is common but comes with its own problems, simultaneously it makes your self-hosted services harder to access (or impossible from some contextx), and it hurts security by making your system more complex (harder to understand & manage & monitor). They're also seemingly going out of fashion as zero-trust/beyondcorp/identity-aware proxies gain mindshare. Of course if you (along with friends and family) are all-in on a overlay network like tailscale it can be a different story.
  - jhugo 4y ago
    Actually, I find that a simple wireguard tunnel giving boring old IP routing to my home network is a far simpler setup than every device having its own opaque tunnel back to its vendor which I have to use a vendor-specific method of connecting to. Tailscale is also more complex, though a nice product. So far I haven't encountered any context where I couldn't connect to my wireguard tunnel, but YMMV.
darkwater 4y ago
That's not self-hosting, that's giving direct access to your LAN to yet another corporation. Self-host ought to be 100% owned by you. (Yeah, it can be harder like this, I know)

jhugo 4y ago

I usually turn off all "cloud" / Internet-accessible features of everything (and, where possible, even block things from Internet access), and then have a Wireguard VPN back to my home network. I think this is a better balance of security and usability than trusting that all of the NAS/camera/doorknob/printer/etc vendors are any good at securing these things.

fulafel 4y ago
The use of VPNs to mitigate iffy security in self-hosted stuff is common but comes with its own problems, simultaneously it makes your self-hosted services harder to access (or impossible from some contextx), and it hurts security by making your system more complex (harder to understand & manage & monitor). They're also seemingly going out of fashion as zero-trust/beyondcorp/identity-aware proxies gain mindshare. Of course if you (along with friends and family) are all-in on a overlay network like tailscale it can be a different story.
- jhugo 4y ago
  Actually, I find that a simple wireguard tunnel giving boring old IP routing to my home network is a far simpler setup than every device having its own opaque tunnel back to its vendor which I have to use a vendor-specific method of connecting to. Tailscale is also more complex, though a nice product. So far I haven't encountered any context where I couldn't connect to my wireguard tunnel, but YMMV.

darkwater 4y ago

That's not self-hosting, that's giving direct access to your LAN to yet another corporation. Self-host ought to be 100% owned by you. (Yeah, it can be harder like this, I know)