Removed by mod

Removed by mod

Recently read a comment here: “Think you have a backup? Delete your drives now. If you’re hesitant, you don’t really have a backup.”

As true as that is: I’d be in the “hesitant” category because I only back up my data / containers, not my bare metal system and its config. Do you guys? (Proxmox users will probably do, but what about the rest?)

These are great proof of China’s superiority! Until you see the Chinese questionnaires:

Choose an option:
[ ] My government serves the people
[ ] I want my social credit score to take a nosedive. No more bank loans, government permits, study or career opportunities for me, please!

They did beat America in the race towards oppressive authoritarianism, but under Trump, the U.S. has caught up a great deal. So much winning!

That’s Apple’s (Watch 18) newest semantic shenanigans to get around privacy laws, and it’s being echoed by Amazon (Bee) and now Samsung, apparently. They argue that, if local AI processes an audio input stream, produces a transcript and does not store the audio as a file, that does not constitute a “recording”. I’m looking forward to the look on the judge’s face once this bullshit reasoning inevitably reaches their court…

To the shock and surprise of abso-fucking-lutely nobody who has been paying attention.

Lemmy put it like this: free courses in self-defence are cool and all. But do they really have to be organised by the town’s serial sex offender?

Thanks for your detailed reply and expertise! I really appreciate it!

First question you have to ask yourself is so what?

You’re right to call out my lack of threat modeling. I am aware that the “cost” of what I’m planning here likely outweighs the actual risks. That’s a deliberate choice though: one of my objectives in homelabbing is to “learn how the big guys do it”, i.e. learning and implementing, bit by bit, networking and security best practices.

That said,

• all of my drives are (LUKS) encrypted (although this will only help against evil maid attacks physically stealing my disks, since data is only encrypted at rest, not while the server is in operation)
• I do have some CPU monitoring in place
• I have applied the principle of least privilege (as far as I can see at least)
• I have set up an off-site backup server running (although I need to improve automation and deduplication; I’ll probably go with Borg here)

Thank you also for pointing me towards OWASP Docker cheat sheet! I didn’t know this resource yet, although I seem to have found others that said the same thing. I already have in place:

• no docker socket exposed to services
• user set for every service that didn’t give me a headache doing that (some assume root and won’t accept setting a user)
• username remapping is active
• all containers have their caps dropped and selectively only put those back in which they need
• I expose almost no container ports, and only those necessary; instead, communication with the containers is handled on my reverse proxy’s network (i.e. via the internal docker network)
• privilege escalation is disabled

I have played around with rootless docker (again, stubborn containers assuming root prevented me from going all-in) and considered Podman, although just putting containers in a VM looks like a more frictionless route to me.

All things considered, your advice seems to be:

1. to first consider whether I actually need all this security. I really don’t, yet I want to learn how to set it up anyway.
2. to first explore and all other hardening avenues. I have, to a certain degree, and beyond that run into brick walls.

If I might exhaust a little more of your time, I’d be curious how you judge the next step I’ve suggested: splitting duties between separate servers, thus segmenting public from private physically, or going the virtual route (again, by splitting into a public and a private VM and separate them through strict software firewalling).

Your post sounds like you’re honestly surprised. I wonder why though. Facebook/Meta has played a major role in a genocide, was involved in several election manipulation operations and had more scandals involving privacy violation, abuse of data and lying to lawmakers’ faces than I could possibly link to.