6
What service one should NOT self host (alien.top)
submitted 2 years ago by [B] to c/main@selfhosted.forum
116 comments fedilink hide all child comments
 

Like the title says, I'm new to self hosting world. πŸ˜€ while I was researching, I found out that many people dissuaded me to self host email server. Just too complicated and hard to manage. What other services that you think we should just go use the currently available providers in the market and why? πŸ™‚thank you

you are viewing a single comment's thread
view the rest of the comments
[–] [B] 1 point 2 years ago (3 children)

If your NAS is properly updated, and SSL is used, then the login screen it just as safe as any other web app with regular updates. I would ask why someone would want that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] [B] 1 point 2 years ago (2 children)

    It's not. SSL in itself doesn't make any exposed service safe, just safer. An updated service isn't necessarilu free of vulnerabilities.

    The difference between exposing your login page and most other services is the attack surface. If someone gets into your NAS administration, game over. You're getting hit with ransomware or worse.

    If someone gets into my Calibre Web server, for instance, my vulnerability is much more limited. That runs in a docker container that only has access to the resources and folders is absolutely needs. The paths to doing harm to anything besides my ebook library are limited.

    I of course still use SSL, with my Calibre Wev behind a reverse proxy, with long complex passwords, and I'll probably soon move it to an OATH login where I can use MFA (since it doesn't support it natively itself). And there are more measures I could take beyond that, if I chose.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [B] 1 point 2 years ago (1 child)

    I'll leave with this. ANY service exposed publicly or not should not have vulnerabilities. If there is any hint that your NAS webserver has vulnerabilities, it shouldn't even be used internally. So to me, it does not matter. I don't expose my NAS webserver because I have no reason to increase my attack surface that wide.

    But I'm comfortable exposing any of my internal services as needed because I've personally checked the source code for vulnerabilities, and have proper checks in place on top of regular security updates. I understand why others wouldn't think the same way, as this takes a high level of confidence in your ability to assess the security posture of your systems and network. I've had penetration tests in my network, conduct them myself for business.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [B] 1 point 2 years ago

    It would be nice if we, and apps' developers, always knew what the vulnerabilities are. They generally exist because the developer doesn't know about them yet, or hasn't found a solution yet (though ideally has been transparent about that). Zero-day exploits happen. There's always a first person or group discovering a flaw.

    If being up to date and using SSL was all it took, security would be a lot simpler.

    No one security measure is ever foolproof, other than taking everything offline. But multiple used in tandem make it somewhere between inconveniently and impractically difficult to breach a system.

  • permalink
  • fedilink
  • source
  • parent