41–50 of 175 posts
I implemented something similar as a caddy module, then I realized that if I was connected to a public wifi network I was actually authorizing the whole bunch of people that were connected to it with me. How do you avoid this, or is it just not important?
IPv6 of course.
> or is it just not important
Port knocking not a security feature anyway.
I had hoped this would allow me to use various patterns of knocking on my desk to perform system actions. Do the cut-and-a-hair-shave knock to log in, or taptaptaptap-wait-tap to lock the screen, etc. Maybe with two microphones you could even distinguish between left and right handed knocks. ...now I'll have to make this myself.
I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though
I'm pro security. The gall to put something out there, pretend it being vibe coded is not a big deal and possibly exposing hundreds of people to security issues. Jesus.
I had hoped this would allow me to use various patterns of knocking on my desk to perform system actions. Do the cut-and-a-hair-shave knock to log in, or taptaptaptap-wait-tap to lock the screen, etc. Maybe with two microphones you could even distinguish between left and right handed knocks. ...now I'll have to make this myself.
TIL that that has a name.[1] All I ever knew it as was "the knock from Roger Rabbit".
Earlier quoted context omitted.
> IP based exclusion should not be considered a security measure Apologies in advance if I'm missing something obvious here, but are you saying an IP allow list is not a standard security practice? If so I'd appreciate further explanation.
It's useful when the client always has its own static IP that _doesn't change_ between sessions. In this case, where the public facing IP may be shared by thousands of users, it provides no real security. All you'd have to do to gain access would be getting the client IP and finding some way of getting on the same network. Which in many cases could be as easy as subscribing to the same cell network or other ISP, or c…
Earlier quoted context omitted.
Fwiw I bought an Asus router that came with Wireguard pre-installed & has a nice management UI. It handles client onboarding via a simple QR code that integrates with the Wireguard mobile app - even my mother had no issue setting it up. Buying hardware is an investment (& not something everyone can do) but I've really never understood the point of the control server from the perspective of an open-source self-hoster…
There’s a cost with using Asus firmware instead of using stock OpenWRT, which might even be compatible with your router. Many Asus products are compatible, and may even be running OpenWRT themselves. The upshot is you get a nice GUI and a nice out of the box experience, but you’re also phoning home to Asus in small ways, just like one would be if they ran Tailscale. I would agree that stock WireGuard is going to have…
However, while you can never really trust anything you run with internet access, I feel there's a fundamental line between an explicitly cloud-dependent service like Tailscale (e.g. a Tailscale control server outage incident would impact your home server access) compared to a fully self-hosted service that may or may not phone home if you don't put preventative measures in front of it, but will continue to function fine if you do put said measures in place.
The Asus mobile app is another potential concern but the Merlin browser UI is fine for most purposes.
I implemented something similar as a caddy module, then I realized that if I was connected to a public wifi network I was actually authorizing the whole bunch of people that were connected to it with me. How do you avoid this, or is it just not important?
It’s the third option: Port knocking is stupid. https://news.ycombinator.com/item?id=39898061 >