• 0 Posts
  • 101 Comments
Joined 3 years ago
cake
Cake day: June 16th, 2023

help-circle
  • You misunderstood my point. LocalSend is great. It does exactly what it promises, and works well.

    But you’re claiming “AirDrop = LocalSend” and that is not true and causes false expectations. People used to Apple think they can use it in all the same situations and for the same things, which they can’t. Just because you mostly used it in the same network doesn’t mean most people use AirDrop that eat, and I know quite a few that mostly use it while out and about, meeting new people etc.

    The “Good advice” version is too tell them there is LocalSend, which can do quite a few things like AirDrop, but not all. Basically make it clear they need to be on the same network.


  • This is such bad advice. If you tell people that, people expect it too work like AirDrop, which it doesn’t.

    LocalSend is great, but it is much more limited than AirDrop. As the name suggest, it only works if people are in the same network. If you’re in your home network, and both devices are yours, that’s probably fair enough, but that isn’t the point or (only) use case of AirDrop.

    Also if you’re installing it on a Linux machine which happens to have a firewall enabled by default, you will have to open the correct ports for it to to work out even just see the other devices.



  • It’s all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).

    There’s also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.


  • Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible. This is fundamentally different than for example a web interface, which needs to present “the Web page” to allow the user to log in, which might involve multiple individual parts that can already have a 0-day.

    As a more direct comparison: look into historic vulnerabilities between ipsec VPN and SSL VPN. The former is the older technology, the second is more “web like”. The number of serious CVEs for the latter over just some manufacturers (Cisco, fortinet, …) in one year probably beats the number for ipsec in is entire life time.

    Going back to Tailscale (or netbird, …): it is one very secure layer which then secures everything. You can have 1 service or 20, same security. If you expose individual services, c you also expose every possible vulnerability of all of them, so all 20 services if that’s what you run.






  • My various servers, firewall and nas are relatively power optimized. Everything including switches (most with some 10g ports) and access points is 160 W or so. I can’t give you monthly usage, as I’ve got solar+battery so it’s frequently just 0 kWh for some days. It’s also rather hard to separate from the other power usage in the house when solar doesn’t fit cover it.




  • Lemmy has relatively good search, usually if you remember bits of the title that works?

    In any case: Both n100/n150 and raspi are in the <10W range. Obviously raspi is lower, but also A LOT slower and much worse connectivity. As the price is roughly comparable, I’d go for the much more capable N100/N150. Only go the full ‘minipc’ route if you don’t mind the (probably) higher power usage, which can depend highly on model. Older (but cheap on eBay) models can be 25W on idle.

    Depending on what you actually need, I’d setup a Sync thing or NextCloud or something and go from there.


  • A VPS is like 5 bucks. Which isn’t nothing but when used as a redundancy or place to send (reasonably sized) backups, it’s cheaper than most alternatives. It’s also still a form of “self hosting”, at least for me.

    Exporting, maybe on a schedule, to a keepass to keep somewhere, also works of course. But when hosting the only/main instance at home you’ll have at least one single point of failure, most likely many. Internet connection, server, network/switches, …






  • Until very recently, I exclusively used the /56 prefix I get from my ISP exclusively. This is still relatively annoying in my case as this prefix changes at least daily for some reason. Clients get their IP via SLAAC.

    I’ve added ULA literally less than a week ago as I have a local reverse proxy I want to handle both local and external request, in both v6 and v4. Obviously more hosts should be accessible from local clients. But I can’t tell local clients apart except by IP, and since the prefix is unstable this would require some sort of hook to update the proxy with that new prefix (might be possible, but seems like a real hassle). So here we are.