3 ms·

shrug In 25 years of hosting a dozen domain names on a server on my home connection, this problem has not surfaced for me.

• bayindirh 3mo ago
  In 20 years of managing server fleets, I always had the pleasure of watching bots taking a dig at my server(s) the moment I give their public IPs and enable their interfaces. For someone who knows what they are doing, it's more like mosquito noise, a mere nuisance, but even then, using a rock solid system with all updates installed carries the risk of having a zero-day. If your server is networked to the rest of the house, and if somebody manages to get in, then it's all fun(!).
• wolvoleo 3mo ago
  One time has to be the first and when you get hacked they're instantly inside your network unless you were smart enough to set up a DMZ or something. Especially if you host something like wordpress with plugins you really have to be on the ball with updates.
  • superkuh 3mo ago
    For 20 years this was not really an issue. From 2010 to 2020 there wasn't a single nginx cve that applied to my simple static setup. There were literally only a handful of remote CVE at all. With the advent of LLM AI exploit finding there have been 2 CVE this year that I had to look in to. Neither actually applied to me, but it is a different world out there. That said, the practice of running a modern corporate web browser that auto-executes all programs sent to it from arbitrary unknown third parties is a way, way, way bigger and more common and likely attack surface than a simple static webserver serving files in directories.
    • wolvoleo 3mo ago
      Ok fair enough yes a static site is really low risk. Usually it's more involved than that though.
• zikduruqe 3mo ago
  Yep, same here. fail2ban and some http 444 helps out.