Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When internal hostnames are leaked to the clown

rachelbythebay.com

Post reply on HN
Print view View original

101–110 of 265 posts

Re: When internal hostnames are leaked to the clown

#101

Post by jeroenhd »

zaptheimpaler wrote: post #87
jeroenhd wrote: post #77

Earlier quoted context omitted.

The (somewhat affordable) productized NASes all suffer from big tech diseases. I think a lot of people underestimate how easy a "NAS" can be made if you take a standard PC, install some form of desktop Linux, and hit "share" on a folder. Something like TrueNAS or one of its forks may also be an option if you're into that kind of stuff. If you want the fancy docker management web UI stuff with as little maintenance as…

Actually I host everything on a linux PC/server, but a different box runs PFSense and a local DNS resolver so I was talking about setting up a split-brain DNS there. So I don't have to manually edit the hosts file on every machine and keep it up to date with IP changes. Personally I really like docker compose, its made running the little homeserver very easy.

Personally, I've started just using mDNS/Bonjour for local devices. Comes preinstalled on most devices (may need a manual package on BSD/Linux servers) and doesn't require any configuration. Just type in devicename.local and let the network do the rest. You can even broadcast additional device names for different services, so you don't need to do plex.nas.local, but can just announce plex.local and nas.local from the same machine.

There's a theoretical risk of MitM attacks for devices reachable over self-signed certificates, but if someone breaks into my (W)LAN, I'm going to assume I'm screwed anyway.

I've used split-horizon DNS for a couple of years but it kept breaking in annoying ways. My current setup (involving the pihole web UI because I was sick of maintaining BIND files) still breaks DNSSEC for my domain and I try to avoid it when I can.

Re: When internal hostnames are leaked to the clown

#102

Post by zombot »

dehrmann wrote: post #35
jraph wrote: post #19

Earlier quoted context omitted.

> Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Clown is Rachel's word for (Big Tech's) cloud.

She was (or is) at Facebook, and "clowntown" and "clowny" are words you see there.

[flagged]

Re: When internal hostnames are leaked to the clown

#103

Post by imtringued »

lsofzz wrote: post #97
zaptheimpaler wrote: post #85

Earlier quoted context omitted.

Clueless lol. This is not about any of that. I run Plex on my local network at plex.domain.com. Plex sends logs to the internet with its local domain in the string. Leak. There is no easy way to solve this without deeply inspecting each packet a service sends outside your network, and even that doesn't work when services use SSL certificates and certificate pinning preventing MITMs.

wtf are you allowing plex to initiate outbound connections to begin with? and why is plex not in it's own VLAN with a egress FW rules to second with? lastly, why aren't you running snort/suricata to inspect the packets originating at plex? let me solve this problem for you - it probably doesn't bother you at all. otherwise, you'd scratched your itch a long time ago. > Clueless lol. It's ok to be clueless. And, it's o…

You sound so confident about this and yet you're listing a bunch of useless advice that doesn't work, because the analytics are integrated into the web interface and therefore executed inside the web browser. To guard against that, you'd have to block all outbound connections on your laptop and all other devices that could potentially access the web interface.

Re: When internal hostnames are leaked to the clown

#104

Post by rausr »

b1temy wrote: post #15

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…

> Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent?

The term has been in use for quite some time; It is voicing sarcastic discontent with the hyperscaler platforms _and_ their users (the idea being that the platform is "someone else's computer" or - more up to date - "a landlord for your data"). I'm not sure if she coined it, but if she did then good on her!

Not everyone believes using "the cloud" is a good idea, and for those of us who have run their own infrastructure "on-premises" or co-located, the clown is considered suitably patronising. Just saying ;)

Re: When internal hostnames are leaked to the clown

#105

Post by AndyMcConachie »

jeroenhd wrote: post #77
zaptheimpaler wrote: post #44

Oh god this sucks, i've been setting up lots of services on my NAS pointing to my own domains recently. Can't even name the domains on my own damn server with an expectation of privacy now.

The (somewhat affordable) productized NASes all suffer from big tech diseases. I think a lot of people underestimate how easy a "NAS" can be made if you take a standard PC, install some form of desktop Linux, and hit "share" on a folder. Something like TrueNAS or one of its forks may also be an option if you're into that kind of stuff. If you want the fancy docker management web UI stuff with as little maintenance as…

The real trick, and the reason I don't build my own NAS, is standby power usage. How much wattage will a self built Linux box draw when it's not being used? It's not easy to figure out, and it's not easy to build a NAS optimized for this.

Whereas Synology or other NAS manufacturers can tell me these numbers exactly and people have reviewed the hardware and tested it.

Re: When internal hostnames are leaked to the clown

#106

Post by rwmj »

baxtr wrote: post #56
jraph wrote: post #19

Earlier quoted context omitted.

> Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Clown is Rachel's word for (Big Tech's) cloud.

Anyone know how she come up with the word or why she chose it?

Maybe from JWZ? https://cdn.jwz.org/images/2016/clown-computing.png

Re: When internal hostnames are leaked to the clown

#107

Post by b1temy »

rausr wrote: post #104
b1temy wrote: post #15

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…

> Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? The term has been in use for quite some time; It is voicing sarcastic discontent with the hyperscaler platforms _and_ their users (the idea being that the platform is "someone else's computer" or - more up to date - "a landlord for your data"). I'm not sure if she coined it, but if she did then good on her! Not eve…

> the idea being that the platform is "someone else's computer"

I have a vague memory of once having a userscript or browser extension that replaced every instance of the word "cloud" with "other peoples' computers". (iirc while funny, it was not practical, and I removed it).

fwiw I agree and I do not believe using "the cloud" for everything is a good idea either, I've just never heard of the word "clown" being used in this way before now.

Re: When internal hostnames are leaked to the clown

#108

Post by TheDong »

zaptheimpaler wrote: post #79
jraph wrote: post #50

Earlier quoted context omitted.

> Can't even name the domains on my own damn server with an expectation of privacy now. You never could. A host name or a domain is bound to leave your box, it's meant to. It takes sending an email with a local email client. (Not saying, the NAS leak still sucks)

I don't know much about email, but how would some random service send an email from my domain if I've never given it any auth tokens?

You don't need any auth to send an email from your domain, or in fact from any domain. Just set whatever `From` you want.

I've received many emails from `root@localhost` over the years.

Admittedly, most residential ISPs block all SMTP traffic, and other email servers are likely to drop it or mark it as spam, but there's no strict requirement for auth.

Re: When internal hostnames are leaked to the clown

#109

Post by lsofzz »

imtringued wrote: post #103
lsofzz wrote: post #97

Earlier quoted context omitted.

wtf are you allowing plex to initiate outbound connections to begin with? and why is plex not in it's own VLAN with a egress FW rules to second with? lastly, why aren't you running snort/suricata to inspect the packets originating at plex? let me solve this problem for you - it probably doesn't bother you at all. otherwise, you'd scratched your itch a long time ago. > Clueless lol. It's ok to be clueless. And, it's o…

You sound so confident about this and yet you're listing a bunch of useless advice that doesn't work, because the analytics are integrated into the web interface and therefore executed inside the web browser. To guard against that, you'd have to block all outbound connections on your laptop and all other devices that could potentially access the web interface.

[flagged]

Re: When internal hostnames are leaked to the clown

#110

Post by heipei »

bardsore wrote: post #61
A1kmm wrote: post #41

Earlier quoted context omitted.

But she mentioned: 1) it isn't in DNS only /etc/hosts and 2) they are making a connection to it. So they'd need to get the IP address to connect to from somewhere as well.

Unless she hosts her own cert authority or is using a self-signed cert, the wildcard cert she mentions is visible to the public on sites such as https://crt.sh/ .

Yes, the wildcard cert, but not the actual hostname under that wildcard.
Post reply on HN