Knocker, a knock based access control system for your homelab

Post by OrderlyTiamat » Wed, Oct 22, 2025, 1:42 PM UTC

sanex wrote: post #51

myzek wrote: post #2

I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though

It's open source. Audit it like you would any other service that exposed your homelab to the Internet. How do you know XYZ repo isn't coded for some bootcampers capstone project? I bet those are even less secure. Edit: should have mentioned I am a bootcamp grad, not just throwing random shade.

Post by OutOfHere » Wed, Oct 22, 2025, 1:48 PM UTC

scottydelta wrote: post #24

When every problem seems like a nail then every solution you come up with is a hammer. This is what it feels like people using AI for everything. AI is not good at telling you best solution but it will tell you that you can build it yourself since that approach is what AI is good at. Using self hosted vpn, cloudflare zero trust or Tailscale is the easiest way to go. I self host extensively and have multiple self host…

Post by mdhb » Wed, Oct 22, 2025, 1:54 PM UTC

nati0n wrote: post #65

mdhb wrote: post #54

Earlier quoted context omitted.

I mostly agree.. there’s a couple of very specific scenarios where maybe something like knockd makes sense I think but they are all scenarios where you’re doing things covertly, not as a general authentication mechanism. As a side note I just happen to be reading a book at the moment that contains a fairly detailed walkthrough of the procedure required to access the Russian SVRs headquarters in New York in 1995. Thin…

Enjoyed the read, thanks for passing along. What book is it from?

Post by mdhb » Wed, Oct 22, 2025, 2:00 PM UTC

slightwinder wrote: post #61

tptacek wrote: post #53

I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.

Every door you close, is one less someone can break. Every complex services running, is a door someone can potentially break. Even with the most secure and battle tested service, you never know where someone fucked up and introduced an exploit or backdoor. Happened too often to be not a concern. XZ Utils backdoor for example was just last year. > Your network authentication should not be a fun game or series of Rube…

Post by slightwinder » Wed, Oct 22, 2025, 2:20 PM UTC

mdhb wrote: post #68

slightwinder wrote: post #61

Earlier quoted context omitted.

Every door you close, is one less someone can break. Every complex services running, is a door someone can potentially break. Even with the most secure and battle tested service, you never know where someone fucked up and introduced an exploit or backdoor. Happened too often to be not a concern. XZ Utils backdoor for example was just last year. > Your network authentication should not be a fun game or series of Rube…

Just to be super clear.. using this in place of something like WireGuard is absolutely not an improvement. It’s actively worse in the majority of scenarios assuming you can manage to secure your keys.