3 ms·
A self-hosted personal server very much needs to be kept up to date. This isn't a "state-level actor" issue; any vulnerabilities in software like this, especial
by JoshTriplett 3y ago
A self-hosted personal server very much needs to be kept up to date. This isn't a "state-level actor" issue; any vulnerabilities in software like this, especially in software that someone might not update in a timely fashion, will get scanned for automatically and exploited when found.
In theory, the portions that are only accessible with authentication are less security sensitive if you have only a small set of trusted users, but that's still reducing the security of your server to the security of your least security-aware user.
- xp84 3y agoHmm. I was imagining a personal server. If I were hosting a webmail client personally, I wouldn't expose it to inbound connections from the Internet at all, preferring to keep such a thing inside my LAN and via VPN only. Clearly I overassumed though, because you're right, when it could be that one would have such a thing accessible to a small team of people who don't use a VPN.
- deleted 3y ago[deleted]
- yjftsjthsd-h 3y agoYou could also just stick it behind a reverse proxy with basic HTTP Authentication; that means you have to keep Apache/nginx/caddy/whatever up to date but that part is easy and then nothing else can get to the actual application if you've done it right.