::: spoiler Tap for spoiler Those are father figure figures, I figure :::

I’m setting up a new server and am planning to try applications such as Jellyfin, Baikal, Nextcloud, Syncthing, Immich, Home Assistant, SearXNG, CryptPad, and possibly Element/Synapse if my little pi4 can handle it.

I’ll probably only have three users, so I’m hoping to fit a fair amount on my pi4 (8GB RAM), but will add mini PC if I need to. I do not plan on making any service publicly available without logging in as a user on my Yunohost server. I will eventually switch to a Docker setup, but for now the Yunohost debian setup is much more user-friendly for me, and everything has been pretty functional as-is.

I’m mostly concerned for a baseline level of security. One user suggested:

• patch/upgrade your kernel and services regularly
• run a hardened kernel with stack protection and address space randomization
• Put a firewall between you and the internet with only minimal ports open
• Scan your machine and ensure no extra ports are open
• Disable/remove every device driver the kernel has that you aren't using
• Remove all software on the device that isn't in active use or part of your debugging toolset, and disable all features of services you don't need.
• Add an extra trustworthy layer of authorization to nextcloud before you can talk to PhP
• Disable root ssh access completely
• Disable user ssh access except for via ssh key
• Encrypt the most critical data client side, so access to the server doesn't give access to the data (e.g. my passwd database is in nextcloud, but the key to unlock it isn't)
• Use 2-factor authentication
• Only allow access over VPN
• Firewall whitelist only networks you know you and your users might be accessing from. No reason why a host on a random ISP from Kazachstan should be allowed to even attempt a login.

Plan: From that, I plan to take the suggestion for

• disabling root SSH and only use the authentication key setup
• change the default SSH port, port forward through a VPN service
• use encrypted backups on client side (phones and computers)
• Yunohost to my knowledge uses nftables built-in for a firewall, so I can default block everything and whitelist the services I need

Yunohost does not yet support 2FA login, but suggests to disable the web api if it will not be used, to decrease attack surface.

Questions:

1. Would security for ports be sufficient to use a VPN service like Wireguard or Proton VPN and enable port forwarding? Or simply disable unused ports?

2. Should I disable ports that Yunohost defaults on? These are: TCP ports 22, 25 53, 80, 443, 587, 993, 5222, 6269 and UDP ports 53, 1900, 5353. I am new to network stuff but understand that 22 is the default SSH until I were to change it, 80 is needed for HTTP, 443 is needed for HTTPS, and Element would probably need 5222.

3. Is blocking everything via firewall and only whitelisting services I use feasible? Is that necessary if running the whole thing with port forwarding through the VPN? I’m concerned that I won’t be able to manually figure out every service my applications need.

I understand there is a balance between security and compatibility/usability, but I would like to have a reasonable amount of confidence that my files and photos will not be easily taken. Any insight is greatly appreciated.

The mPing app is a user-reported weather service that is then made public for things like tornado touch down, power lines down, hail, severe rain, roof damage, flooding, etc.

I was looking for a free way to see what people are actually experiencing around WI, since the weather reporting has not been as accurate lately. Many apps are paid, but this one is funded through a university.

I have not yet reported anything myself, so please tell me if you have experience with mPing. I see others reporting as the weather evolves, so it must work on some capacity.

Stay safe out there folks.

The host Search Engine, PJ Vogt, and the host of Hard Fork, Kevin Roose, discussed their thoughts about a “new kind of Internet” possible with the Fediverse. They also talked about the challenges of the somewhat technical barrier to entry.

I especially liked them sharing their perspectives; the Fediverse seems to simultaneously be a recreation of a pre-shittified Internet and something new altogether.

They even created their own live Mastodon server to see how that would go: https://theforkiverse.com/explore They ended up testing OpenAI’s Operator to do the heavy lifting of coding, but did make the realization they did not know how their own user verification works or how to change it.

I am just elated that there is talk in the “mainstream” of the Fediverse. I’m hopeful that some attention such as this can help raise awareness and pique some curiosities.

The host Search Engine, PJ Vogt, and the host of Hard Fork, Kevin Roose, discussed their thoughts about a “new kind of Internet” possible with the Fediverse. They also talked about the challenges of the somewhat technical barrier to entry.

I especially liked them sharing their perspectives; the Fediverse seems to simultaneously be a recreation of a pre-shittified Internet and something new altogether.

They even created their own live Mastodon server to see how that would go: https://theforkiverse.com/explore They ended up testing OpenAI’s Operator to do the heavy lifting of coding, but did make the realization they did not know how their own user verification works or how to change it.

I am just elated that there is talk in the “mainstream” of the Fediverse. I’m hopeful that some attention such as this can help raise awareness and pique some curiosities.

Hi, I saw my beta for Arctic and was pretty bummed and switched to a couple of others. I thought Arctic had better UI than many others, namely custom theme abilities. I want to share a couple of themes I made for Arctic, in case anyone is still using Arctic and wants to use them. Please let me know if they don’t work; I don’t share links often:

https://drive.proton.me/urls/BMAJRJ4PV4#HJPslOve3tm8

https://drive.proton.me/urls/0C7BDRX1WG#1Rye2U6KraqK

Hi all, I’m looking at HYS accounts and I see Sofi and Openbank coming up as some of the higher rate options. It looks like Openbank is based in California and has 4.2% but poor customer service reviews on Trustpilot. Sofi is 4.3% but with a limited time 0.7% “boost,” so 3.60% normally, but appears to have better customer service. I’m more inclined to have better support through Sofi.

I also had many people tell me Ally gave them 3.30% and pretty good customer service and transfer times. Any thoughts?

Hi all, I'm just getting my feet wet in self hosting and have a plan to start with Nextcloud on a Pi 4 for photo backups, and then try other things for calendar, phone backups, media hosting, etc.

One thing I worry about is losing my data. I have heard "if it's not backed up in two locations, it's not backed up." I'm curious what all of you do for backing up the setup. Remote backup to hard drives in the garage? Pay for cloud backup and encrypt it? Just another backup site over wifi in the house?

I'd be most afraid of losing photos and if there were a house fire or something. So my inital thought was a way of backing up to a server in my detached garage in a weather resistent container, but I want to know what you all think. Thanks for any insight.

After watching a number of solo wildcards, I thought Improver was absolutely in and was not sure that Abo Ice had a very good qualifier performance. I’m also really disappointed Codfish didn’t qualify because he has a unique sound set and had some pretty hot drops lately.

It will be an interesting lineup. Wing is obviously a top-tier bearboxer but the crowds seem to respond more to heavier beats over clarity (eg Kaji). Den has such a unique sound set that I think he could win but I’m excited to see how it all shakes out.