• 0 Posts
  • 108 Comments
Joined 3 years ago
cake
Cake day: July 8th, 2023

help-circle






  • Not to mention how apparently 2.5 and 5ghz bands suffer on the Flint 3 just to get Wifi 7.

    Hope no one’s buying them (though I imagine a lot of people see 3 > 2 and blindly trust it’s better in all cases).

    Flint 3 probably would’ve been better as a different product line. As it currently stands, It seems a bit misleading to attach it to the Flint 2 when so much is different at its core.




  • Maybe easier to setup because routers that support vpns come with nice-ish web uis.

    That said, if you have a server (pc, pi, etc), setting up wireguard with wg-easy is mostly painless (comes with a nice web ui), so there is no reason to replace your router in this case!

    Instead of replacing a router, I’d prefer buying a pi anyways.

    Unless you want to route all outbound traffic through a vpn with zero config on devices, I can’t see why you’d replace a router.

    Final note: most people prefer hosting a vpn on a server, even if their router supports it as far as I’m aware at least (edit: this might be erong judging from the rest of the comments saying they use their router).





  • dogs0n@sh.itjust.workstoProgrammer Humor@lemmy.mlmoney
    link
    fedilink
    arrow-up
    2
    arrow-down
    1
    ·
    1 month ago

    There could be too many people too, but A.I. is taking (atleast some) junior dev jobs.

    Companies are not hiring juniors and instead giving A.I. to the rest of their employees thinking that that will offset the loss of junior jobs.

    Of course not every company will be like that, but it seems to be a common trend. If the trend continues, we could end up in a world where there’s a big mid-level to senior shortage because juniors stopped being hired (and therefore trained).



  • No problemo.

    Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.

    The benefits may only be minute or non-existent if you don’t use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).

    It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).

    Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).


  • Your SSH setup is good.

    ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.

    Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.

    I thinj you’ll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).

    What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

    It’s down to how secure the software is really.

    Jellyfins (and other software) don’t use really secure web servers for getting themselves accessible via the network.

    Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.

    So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

    Have fun on your journey!


  • Hm, I’m gonna remain skeptical.

    Using the random ip you get from mobile data or using dynamic dns feels risky. Maybe that’s because I’m not smart, but the whole trust level is mail thing seems very heuristical and the risk of damaging my domains trust factor doesn’t seem worth it.

    I’m not skeptical about having two ip addresses, but rather using ones that I don’t have control over (i don’t have the only right to use).

    I might be wrong on the PTR record thing, seems it might be possible with DDNS providers but not 100% sure.


  • For mail this won’t work.

    For one, you have to now think about dynamic dns because you have your one static ip and then whatever ip your data backup will rollover onto. This isn’t ideal. Probably going to ruin any trust your domain will have.

    Second, there is no way you’re getting a reverse PTR record setup to work in this config.

    So, no, it’s not gonna work (clarification, technically may work, but you are gonna have issues and it’s probably not recommended).

    It may work fine if you have random services, but tbh I don’t ever want to use or deal with a ddns service myself.


  • If you don’t want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.

    Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I’m not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.

    Personally, using a vpn for when I want access to SSH when I’m out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.

    (Tl;dr personally I’d use a vpn to access ssh specifically rather than exposing it to the internet)

    Same thing for Jellyfin?

    Not 100% sure what you mean, but to clarify: Don’t accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.