Redirect 302 redirect from GET @entry_comment_create (704da4)

GET https://kbin.spritesserver.nl/index.php/u/@TechLich@lemmy.world/hot

Response
200 OK
IP
216.73.216.122
Profiled on
Token
073bdb

Security

Token

There is no security token.

Firewall

main Name
Security enabled
Stateless

Configuration

Key Value
provider security.user.provider.concrete.app_user_provider
context main
entry_point App\Security\KbinAuthenticator
user_checker App\Security\UserChecker
access_denied_handler (none)
access_denied_url (none)
authenticators 
[
  "two_factor"
  "remember_me"
  "App\Security\KbinAuthenticator"
  "App\Security\FacebookAuthenticator"
  "App\Security\GoogleAuthenticator"
  "App\Security\GithubAuthenticator"
  "App\Security\KeycloakAuthenticator"
]

Listeners

Listener Duration Response 
Symfony\Component\Security\Http\Firewall\ChannelListener {#723
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
  -logger: Monolog\Logger {#783 …}
  -httpPort: 80
  -httpsPort: 443
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\ContextListener {#706
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage {#1017 …}
  -sessionKey: "_security_main"
  -logger: Monolog\Logger {#783 …}
  -userProviders: Symfony\Component\DependencyInjection\Argument\RewindableGenerator {#705 …}
  -dispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
  -registered: false
  -trustResolver: Scheb\TwoFactorBundle\Security\Authentication\AuthenticationTrustResolver {#780 …}
  -sessionTrackerEnabler: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage::enableUsageTracking(): void {#703 …}
}
 0.91 ms (none) 
Symfony\Component\Security\Http\Firewall\AuthenticatorManagerListener {#584
  -authenticatorManager: Symfony\Component\Security\Http\Authentication\AuthenticatorManager {#595 …}
}
 0.00 ms (none) 
Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener {#582
  -twoFactorFirewallConfig: Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig {#842 …}
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -twoFactorAccessDecider: Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider {#581 …}
}
 0.06 ms (none) 
Symfony\Component\Security\Http\Firewall\AccessListener {#579
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -accessDecisionManager: Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager {#937 …}
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\LogoutListener {#786
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -options: [
    "csrf_parameter" => "_csrf_token"
    "csrf_token_id" => "logout"
    "logout_path" => "app_logout"
  ]
  -httpUtils: Symfony\Component\Security\Http\HttpUtils {#841 …}
  -csrfTokenManager: Symfony\Component\Security\Csrf\CsrfTokenManager {#1015 …}
  -eventDispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
}
 0.00 ms (none)

Authenticators

No authenticators have been recorded. Check previous profiles on your authentication endpoint.

Access Decision

affirmative Strategy
# Voter class
1 
"Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter"
2 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
3 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
4 
"Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter"
5 
"App\Security\Voter\EntryCommentVoter"
6 
"App\Security\Voter\EntryVoter"
7 
"App\Security\Voter\MagazineVoter"
8 
"App\Security\Voter\MessageThreadVoter"
9 
"App\Security\Voter\MessageVoter"
10 
"App\Security\Voter\NotificationVoter"
11 
"App\Security\Voter\OAuth2UserConsentVoter"
12 
"App\Security\Voter\PostCommentVoter"
13 
"App\Security\Voter\PostVoter"
14 
"App\Security\Voter\UserVoter"

Access decision log

# Result Attributes Object
1 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
2 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1683
  +user: Proxies\__CG__\App\Entity\User {#2371 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
  +slug: "Nextcloud-zero-day-security"
  +title: "Nextcloud zero day security"
  +url: null
  +body: """
    What is everyone doing? SELinux? AppArmor? Something else?\n
    \n
    I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
    \n
    My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
    \n
    Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 28
  +favouriteCount: 74
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719128798 {#2422
    date: 2024-06-23 09:46:38.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2118 …}
  +votes: Doctrine\ORM\PersistentCollection {#2121 …}
  +reports: Doctrine\ORM\PersistentCollection {#2161 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
  +badges: Doctrine\ORM\PersistentCollection {#2307 …}
  +children: [
    1 => App\Entity\EntryComment {#1618
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > Tailscale isn’t an exposed service. Headscale is\n
        \n
        Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
        \n
        > it’s more work and may not always be worth the effort\n
        \n
        I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
        \n
        > I recommended SmallStep+Caddy.\n
        \n
        Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
        \n
        > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
        \n
        No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
        \n
        I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704672089 {#1628
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1597 …}
      +nested: Doctrine\ORM\PersistentCollection {#1731 …}
      +votes: Doctrine\ORM\PersistentCollection {#1723 …}
      +reports: Doctrine\ORM\PersistentCollection {#1721 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
      -id: 289930
      -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6486041"
      +editedAt: DateTimeImmutable @1719091260 {#1626
        date: 2024-06-22 23:21:00.0 +02:00
      }
      +createdAt: DateTimeImmutable @1704672089 {#1599
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +"title": 289930
    }
    2 => App\Entity\EntryComment {#1701
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > there’s an argument that HTTPS isn’t really required…\n
        \n
        Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
        \n
        The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
        \n
        If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704421498 {#1619
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1689 …}
      +nested: Doctrine\ORM\PersistentCollection {#1691 …}
      +votes: Doctrine\ORM\PersistentCollection {#1795 …}
      +reports: Doctrine\ORM\PersistentCollection {#1711 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
      -id: 281475
      -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6415615"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704421498 {#1702
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +"title": 281475
    }
    0 => App\Entity\EntryComment {#1727
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        Totally agree on all points!\n
        \n
        My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704693803 {#1734
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1733 …}
      +nested: Doctrine\ORM\PersistentCollection {#1724 …}
      +votes: Doctrine\ORM\PersistentCollection {#1715 …}
      +reports: Doctrine\ORM\PersistentCollection {#1718 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
      -id: 290640
      -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6492714"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704693803 {#1732
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +"title": 290640
    }
  ]
  -id: 26426
  -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
  -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704181458
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10188042"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704095058 {#2037
    date: 2024-01-01 08:44:18.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
3 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1683
  +user: Proxies\__CG__\App\Entity\User {#2371 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
  +slug: "Nextcloud-zero-day-security"
  +title: "Nextcloud zero day security"
  +url: null
  +body: """
    What is everyone doing? SELinux? AppArmor? Something else?\n
    \n
    I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
    \n
    My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
    \n
    Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 28
  +favouriteCount: 74
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719128798 {#2422
    date: 2024-06-23 09:46:38.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2118 …}
  +votes: Doctrine\ORM\PersistentCollection {#2121 …}
  +reports: Doctrine\ORM\PersistentCollection {#2161 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
  +badges: Doctrine\ORM\PersistentCollection {#2307 …}
  +children: [
    1 => App\Entity\EntryComment {#1618
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > Tailscale isn’t an exposed service. Headscale is\n
        \n
        Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
        \n
        > it’s more work and may not always be worth the effort\n
        \n
        I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
        \n
        > I recommended SmallStep+Caddy.\n
        \n
        Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
        \n
        > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
        \n
        No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
        \n
        I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704672089 {#1628
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1597 …}
      +nested: Doctrine\ORM\PersistentCollection {#1731 …}
      +votes: Doctrine\ORM\PersistentCollection {#1723 …}
      +reports: Doctrine\ORM\PersistentCollection {#1721 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
      -id: 289930
      -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6486041"
      +editedAt: DateTimeImmutable @1719091260 {#1626
        date: 2024-06-22 23:21:00.0 +02:00
      }
      +createdAt: DateTimeImmutable @1704672089 {#1599
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +"title": 289930
    }
    2 => App\Entity\EntryComment {#1701
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > there’s an argument that HTTPS isn’t really required…\n
        \n
        Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
        \n
        The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
        \n
        If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704421498 {#1619
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1689 …}
      +nested: Doctrine\ORM\PersistentCollection {#1691 …}
      +votes: Doctrine\ORM\PersistentCollection {#1795 …}
      +reports: Doctrine\ORM\PersistentCollection {#1711 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
      -id: 281475
      -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6415615"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704421498 {#1702
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +"title": 281475
    }
    0 => App\Entity\EntryComment {#1727
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        Totally agree on all points!\n
        \n
        My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704693803 {#1734
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1733 …}
      +nested: Doctrine\ORM\PersistentCollection {#1724 …}
      +votes: Doctrine\ORM\PersistentCollection {#1715 …}
      +reports: Doctrine\ORM\PersistentCollection {#1718 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
      -id: 290640
      -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6492714"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704693803 {#1732
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +"title": 290640
    }
  ]
  -id: 26426
  -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
  -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704181458
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10188042"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704095058 {#2037
    date: 2024-01-01 08:44:18.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
4 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1683
  +user: Proxies\__CG__\App\Entity\User {#2371 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
  +slug: "Nextcloud-zero-day-security"
  +title: "Nextcloud zero day security"
  +url: null
  +body: """
    What is everyone doing? SELinux? AppArmor? Something else?\n
    \n
    I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
    \n
    My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
    \n
    Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
    """
  +type: "article"
  +lang: "en"
  +isOc: false
  +hasEmbed: false
  +commentCount: 28
  +favouriteCount: 74
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1719128798 {#2422
    date: 2024-06-23 09:46:38.0 +02:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2118 …}
  +votes: Doctrine\ORM\PersistentCollection {#2121 …}
  +reports: Doctrine\ORM\PersistentCollection {#2161 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
  +badges: Doctrine\ORM\PersistentCollection {#2307 …}
  +children: [
    1 => App\Entity\EntryComment {#1618
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > Tailscale isn’t an exposed service. Headscale is\n
        \n
        Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
        \n
        > it’s more work and may not always be worth the effort\n
        \n
        I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
        \n
        > I recommended SmallStep+Caddy.\n
        \n
        Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
        \n
        > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
        \n
        No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
        \n
        I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704672089 {#1628
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1597 …}
      +nested: Doctrine\ORM\PersistentCollection {#1731 …}
      +votes: Doctrine\ORM\PersistentCollection {#1723 …}
      +reports: Doctrine\ORM\PersistentCollection {#1721 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
      -id: 289930
      -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6486041"
      +editedAt: DateTimeImmutable @1719091260 {#1626
        date: 2024-06-22 23:21:00.0 +02:00
      }
      +createdAt: DateTimeImmutable @1704672089 {#1599
        date: 2024-01-08 01:01:29.0 +01:00
      }
      +"title": 289930
    }
    2 => App\Entity\EntryComment {#1701
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        > there’s an argument that HTTPS isn’t really required…\n
        \n
        Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
        \n
        The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
        \n
        If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704421498 {#1619
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1689 …}
      +nested: Doctrine\ORM\PersistentCollection {#1691 …}
      +votes: Doctrine\ORM\PersistentCollection {#1795 …}
      +reports: Doctrine\ORM\PersistentCollection {#1711 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
      -id: 281475
      -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6415615"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704421498 {#1702
        date: 2024-01-05 03:24:58.0 +01:00
      }
      +"title": 281475
    }
    0 => App\Entity\EntryComment {#1727
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
      +body: """
        Totally agree on all points!\n
        \n
        My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 0
      +score: 0
      +lastActive: DateTime @1704693803 {#1734
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@thisisawayoflife@lemmy.world"
        "@JustinAngel@lemmy.world"
        "@TechLich@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1733 …}
      +nested: Doctrine\ORM\PersistentCollection {#1724 …}
      +votes: Doctrine\ORM\PersistentCollection {#1715 …}
      +reports: Doctrine\ORM\PersistentCollection {#1718 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
      -id: 290640
      -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6492714"
      +editedAt: null
      +createdAt: DateTimeImmutable @1704693803 {#1732
        date: 2024-01-08 07:03:23.0 +01:00
      }
      +"title": 290640
    }
  ]
  -id: 26426
  -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
  -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1704181458
  +visibility: "visible             "
  +apId: "https://lemmy.world/post/10188042"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704095058 {#2037
    date: 2024-01-01 08:44:18.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
5 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
6 DENIED moderate 
App\Entity\EntryComment {#1618
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618}
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > Tailscale isn’t an exposed service. Headscale is\n
    \n
    Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
    \n
    > it’s more work and may not always be worth the effort\n
    \n
    I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
    \n
    > I recommended SmallStep+Caddy.\n
    \n
    Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
    \n
    > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
    \n
    No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
    \n
    I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704672089 {#1628
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1597 …}
  +nested: Doctrine\ORM\PersistentCollection {#1731 …}
  +votes: Doctrine\ORM\PersistentCollection {#1723 …}
  +reports: Doctrine\ORM\PersistentCollection {#1721 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
  -id: 289930
  -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6486041"
  +editedAt: DateTimeImmutable @1719091260 {#1626
    date: 2024-06-22 23:21:00.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704672089 {#1599
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +"title": 289930
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
7 DENIED edit 
App\Entity\EntryComment {#1618
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618}
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > Tailscale isn’t an exposed service. Headscale is\n
    \n
    Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
    \n
    > it’s more work and may not always be worth the effort\n
    \n
    I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
    \n
    > I recommended SmallStep+Caddy.\n
    \n
    Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
    \n
    > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
    \n
    No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
    \n
    I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704672089 {#1628
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1597 …}
  +nested: Doctrine\ORM\PersistentCollection {#1731 …}
  +votes: Doctrine\ORM\PersistentCollection {#1723 …}
  +reports: Doctrine\ORM\PersistentCollection {#1721 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
  -id: 289930
  -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6486041"
  +editedAt: DateTimeImmutable @1719091260 {#1626
    date: 2024-06-22 23:21:00.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704672089 {#1599
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +"title": 289930
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
8 DENIED moderate 
App\Entity\EntryComment {#1618
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618}
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > Tailscale isn’t an exposed service. Headscale is\n
    \n
    Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
    \n
    > it’s more work and may not always be worth the effort\n
    \n
    I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
    \n
    > I recommended SmallStep+Caddy.\n
    \n
    Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
    \n
    > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
    \n
    No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
    \n
    I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704672089 {#1628
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1597 …}
  +nested: Doctrine\ORM\PersistentCollection {#1731 …}
  +votes: Doctrine\ORM\PersistentCollection {#1723 …}
  +reports: Doctrine\ORM\PersistentCollection {#1721 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
  -id: 289930
  -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6486041"
  +editedAt: DateTimeImmutable @1719091260 {#1626
    date: 2024-06-22 23:21:00.0 +02:00
  }
  +createdAt: DateTimeImmutable @1704672089 {#1599
    date: 2024-01-08 01:01:29.0 +01:00
  }
  +"title": 289930
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
9 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
10 DENIED moderate 
App\Entity\EntryComment {#1701
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701}
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > there’s an argument that HTTPS isn’t really required…\n
    \n
    Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
    \n
    The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
    \n
    If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704421498 {#1619
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1689 …}
  +nested: Doctrine\ORM\PersistentCollection {#1691 …}
  +votes: Doctrine\ORM\PersistentCollection {#1795 …}
  +reports: Doctrine\ORM\PersistentCollection {#1711 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
  -id: 281475
  -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6415615"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704421498 {#1702
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +"title": 281475
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
11 DENIED edit 
App\Entity\EntryComment {#1701
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701}
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > there’s an argument that HTTPS isn’t really required…\n
    \n
    Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
    \n
    The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
    \n
    If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704421498 {#1619
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1689 …}
  +nested: Doctrine\ORM\PersistentCollection {#1691 …}
  +votes: Doctrine\ORM\PersistentCollection {#1795 …}
  +reports: Doctrine\ORM\PersistentCollection {#1711 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
  -id: 281475
  -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6415615"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704421498 {#1702
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +"title": 281475
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
12 DENIED moderate 
App\Entity\EntryComment {#1701
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701}
      0 => App\Entity\EntryComment {#1727
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          Totally agree on all points!\n
          \n
          My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704693803 {#1734
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1733 …}
        +nested: Doctrine\ORM\PersistentCollection {#1724 …}
        +votes: Doctrine\ORM\PersistentCollection {#1715 …}
        +reports: Doctrine\ORM\PersistentCollection {#1718 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
        -id: 290640
        -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6492714"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704693803 {#1732
          date: 2024-01-08 07:03:23.0 +01:00
        }
        +"title": 290640
      }
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    > there’s an argument that HTTPS isn’t really required…\n
    \n
    Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
    \n
    The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
    \n
    If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704421498 {#1619
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1689 …}
  +nested: Doctrine\ORM\PersistentCollection {#1691 …}
  +votes: Doctrine\ORM\PersistentCollection {#1795 …}
  +reports: Doctrine\ORM\PersistentCollection {#1711 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
  -id: 281475
  -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6415615"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704421498 {#1702
    date: 2024-01-05 03:24:58.0 +01:00
  }
  +"title": 281475
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
13 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
14 DENIED moderate 
App\Entity\EntryComment {#1727
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727}
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    Totally agree on all points!\n
    \n
    My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704693803 {#1734
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1733 …}
  +nested: Doctrine\ORM\PersistentCollection {#1724 …}
  +votes: Doctrine\ORM\PersistentCollection {#1715 …}
  +reports: Doctrine\ORM\PersistentCollection {#1718 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
  -id: 290640
  -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6492714"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704693803 {#1732
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +"title": 290640
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
15 DENIED edit 
App\Entity\EntryComment {#1727
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727}
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    Totally agree on all points!\n
    \n
    My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704693803 {#1734
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1733 …}
  +nested: Doctrine\ORM\PersistentCollection {#1724 …}
  +votes: Doctrine\ORM\PersistentCollection {#1715 …}
  +reports: Doctrine\ORM\PersistentCollection {#1718 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
  -id: 290640
  -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6492714"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704693803 {#1732
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +"title": 290640
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
16 DENIED moderate 
App\Entity\EntryComment {#1727
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1683
    +user: Proxies\__CG__\App\Entity\User {#2371 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
    +image: null
    +domain: Proxies\__CG__\App\Entity\Domain {#2114 …}
    +slug: "Nextcloud-zero-day-security"
    +title: "Nextcloud zero day security"
    +url: null
    +body: """
      What is everyone doing? SELinux? AppArmor? Something else?\n
      \n
      I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.\n
      \n
      My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.\n
      \n
      Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?
      """
    +type: "article"
    +lang: "en"
    +isOc: false
    +hasEmbed: false
    +commentCount: 28
    +favouriteCount: 74
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1719128798 {#2422
      date: 2024-06-23 09:46:38.0 +02:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2118 …}
    +votes: Doctrine\ORM\PersistentCollection {#2121 …}
    +reports: Doctrine\ORM\PersistentCollection {#2161 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2298 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2192 …}
    +badges: Doctrine\ORM\PersistentCollection {#2307 …}
    +children: [
      1 => App\Entity\EntryComment {#1618
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1625 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > Tailscale isn’t an exposed service. Headscale is\n
          \n
          Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.\n
          \n
          > it’s more work and may not always be worth the effort\n
          \n
          I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.\n
          \n
          > I recommended SmallStep+Caddy.\n
          \n
          Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.\n
          \n
          > Are you suggesting that these attack techniques are effective against zero trust tunnels\n
          \n
          No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.\n
          \n
          I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704672089 {#1628
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
          "@TechLich@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1597 …}
        +nested: Doctrine\ORM\PersistentCollection {#1731 …}
        +votes: Doctrine\ORM\PersistentCollection {#1723 …}
        +reports: Doctrine\ORM\PersistentCollection {#1721 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1728 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1730 …}
        -id: 289930
        -bodyTs: "'-2022':41 '-41924':42 'absolut':9 'actor':238 'advoc':183 'affect':70 'airgap':260 'alon':262 'although':48 'alway':103 'assum':250 'attack':21,195 'avail':263 'big':283 'bit':272 'break':298 'buy':112 'bypass':217 'caddi':158,163 'cert':114,175,187 'compromis':214,247 'cve':40 'defenc':90,208 'deploy':121 'depth':92,210 'dns':38 'door':277 'drive':221 'easi':119 'effect':198 'effort':107,132 'especi':154 'etc':43 'even':69 'exist':30,159 'expos':5 'failur':87 'feel':267 'fenc':287,296 'free':117,231,308 'fun':149 'futur':81 'get':173 'great':14 'happen':79 'head/tailscale':145 'headscal':7 'ideal':95 'imperson':234 'initi':246 'isn':2 'jump':294 'kind':62 'know':76 'leav':274 'let':261 'like':37,157,268,273 'local':242 'lock':300 'long':124 'm':50,181,205 'may':101 'much':130 'network':243 'non':29 'non-exist':28 'padlock':284 'past':46 'perfect':254 'pivot':239 'point':85,312 'rce':34 're':152 'realli':111 'reason':179 'rebind':39 'recommend':19,161 'reign':309 'run':141,153 'safe':255 'servic':6,137,150,229 'set':134 'sign':176 'singl':84 'small':25 'smallstep':162 'someon':219,289 'someth':225,252 'stuff':156 'suggest':52,192 'surfac':22 'system':15 'tailscal':1,212 'talk':206 'techniqu':196 'thing':36,64 'thorough':18 'threat':237 'time':125 'total':216 'trust':82,201 'tunnel':202,265 'unlock':278 'use':35,186 'user':72 'via':264 'vulner':59 'want':139,171,304 'war':220 'way':58,292 'well':143 'whatev':136,147 'wifi':223 'work':99 'worth':105 'yes':164 'zero':200"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6486041"
        +editedAt: DateTimeImmutable @1719091260 {#1626
          date: 2024-06-22 23:21:00.0 +02:00
        }
        +createdAt: DateTimeImmutable @1704672089 {#1599
          date: 2024-01-08 01:01:29.0 +01:00
        }
        +"title": 289930
      }
      2 => App\Entity\EntryComment {#1701
        +user: App\Entity\User {#260 …}
        +entry: Proxies\__CG__\App\Entity\Entry {#1683 …2}
        +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
        +image: null
        +parent: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
        +body: """
          > there’s an argument that HTTPS isn’t really required…\n
          \n
          Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.\n
          \n
          The other thing to keep in mind is that HTTPS is **not** just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.\n
          \n
          If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
          """
        +lang: "en"
        +isAdult: false
        +favouriteCount: 0
        +score: 0
        +lastActive: DateTime @1704421498 {#1619
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +ip: null
        +tags: null
        +mentions: [
          "@thisisawayoflife@lemmy.world"
          "@JustinAngel@lemmy.world"
        ]
        +children: Doctrine\ORM\PersistentCollection {#1689 …}
        +nested: Doctrine\ORM\PersistentCollection {#1691 …}
        +votes: Doctrine\ORM\PersistentCollection {#1795 …}
        +reports: Doctrine\ORM\PersistentCollection {#1711 …}
        +favourites: Doctrine\ORM\PersistentCollection {#1611 …}
        +notifications: Doctrine\ORM\PersistentCollection {#1630 …}
        -id: 281475
        -bodyTs: "'actual':116 'also':106 'anyth':48 'anyway':153 'applic':29 'argument':4 'authenticity/integrity/non-repudiation':108 'avail':59 'awesom':13 'cert':110 'connect':117 'defenc':63 'depth':65 'effort':147,160 'encryption/confidentiality':104 'etc':140 'exploit':37 'fall':41 'go':144,157 'gotta':16 'hijack/arp':138 'host':149 'https':6,99 'imperson':131 'isn':7 'keep':94 'layer':87 'like':27 'lose':74 'man':134 'middle/dns':137 'might':154 'mind':96 'multipl':86 'network':52 'noth':72 'one':22 'poison':139 'potenti':32 'privat':51 'public':83 're':143 'realli':9 'rememb':17 'requir':10 'safe':54 'secur':89,162 'servic':25,78,120,152 'suscept':33 'talescal':11,19 'tell':111 'thing':68,92 'think':46,123 'though':80 'trap':44 'treat':76 'vpn':62 'vulner':35 'well':156 'yike':26"
        +ranking: 0
        +commentCount: 0
        +upVotes: 0
        +downVotes: 0
        +visibility: "visible             "
        +apId: "https://lemmy.world/comment/6415615"
        +editedAt: null
        +createdAt: DateTimeImmutable @1704421498 {#1702
          date: 2024-01-05 03:24:58.0 +01:00
        }
        +"title": 281475
      }
      0 => App\Entity\EntryComment {#1727}
    ]
    -id: 26426
    -titleTs: "'day':3 'nextcloud':1 'secur':4 'zero':2"
    -bodyTs: "'2fa':44 'allow':48 'anyth':75,161 'apparmor':6 'behind':23,148 'besid':144 'cert':139 'certif':132 'click':69 'come':119 'current':10,158 'els':8,162 'email':73 'enforc':43 'everyday':103 'everyon':3 'expos':14 'feed':97 'fpm':115 'frequent':98 'get':85,124 'goal':53 'hide':145 'hit':86 'https':127 'internet':17,142 'keep':90 'lan':130 'latest':112 'le':138 'leav':11 'like':76 'link':71 'm':80,109,153,164 'maintain':133 'much':61 'necessari':107 'nextcloud':13,91 'nginx':25,38 'opnsens':35 'overlook':165 'peopl':84 'php':114 'php-fpm':113 'possibl':63 'prepar':155 'protect':55 'proxi':27 'random':68 'ransomwar':57,88 'reboot':105 'repo':121 'revers':26 'router':36,136 'rss':95 'rule':41 'run':19,37,110 'selinux':5 'side':143 'sign':50 'sign-up':49 'someth':7 'subscrib':93 'sure':82 'thing':147 'up':51 'updat':92,96,102,125 'vm':22,30,101 'vpn':150 'waf':40 'zeroday':59"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1704181458
    +visibility: "visible             "
    +apId: "https://lemmy.world/post/10188042"
    +editedAt: null
    +createdAt: DateTimeImmutable @1704095058 {#2037
      date: 2024-01-01 08:44:18.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1687 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1735 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1680 …}
  +body: """
    Totally agree on all points!\n
    \n
    My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 0
  +score: 0
  +lastActive: DateTime @1704693803 {#1734
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@thisisawayoflife@lemmy.world"
    "@JustinAngel@lemmy.world"
    "@TechLich@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1733 …}
  +nested: Doctrine\ORM\PersistentCollection {#1724 …}
  +votes: Doctrine\ORM\PersistentCollection {#1715 …}
  +reports: Doctrine\ORM\PersistentCollection {#1718 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1716 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1739 …}
  -id: 290640
  -bodyTs: "'agre':2 'alreadi':26 'anymor':46 'arguabl':41 'assert':12 'away':18 'cert':28 'certs/https':21 'comfort':16 'could':15 'dispel':36 'favour':48 'headscal':52 'idea':38 'issu':8 'might':42 'need':44 'one':55 'op':14 'point':5 'post':31 'replac':58 'said':23 'though':54 'total':1 'use':27,51 'want':34"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6492714"
  +editedAt: null
  +createdAt: DateTimeImmutable @1704693803 {#1732
    date: 2024-01-08 07:03:23.0 +01:00
  }
  +"title": 290640
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
17 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
18 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1548
  +user: Proxies\__CG__\App\Entity\User {#2308 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: Proxies\__CG__\App\Entity\Image {#2221 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
  +slug: "Edit-What-do-you-call-this-dish"
  +title: "Edit: (What do you call this dish?)"
  +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
  +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 114
  +favouriteCount: 131
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1703269453 {#2321
    date: 2023-12-22 19:24:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2218 …}
  +votes: Doctrine\ORM\PersistentCollection {#2194 …}
  +reports: Doctrine\ORM\PersistentCollection {#2219 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
  +badges: Doctrine\ORM\PersistentCollection {#2205 …}
  +children: [
    App\Entity\EntryComment {#1566
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1548 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
      +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 5
      +score: 0
      +lastActive: DateTime @1702897903 {#1581
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Thegreyreyal@sh.itjust.works"
        "@KipmanDynamite@lemmy.world"
        "@SoleInvictus@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1562 …}
      +nested: Doctrine\ORM\PersistentCollection {#1554 …}
      +votes: Doctrine\ORM\PersistentCollection {#1556 …}
      +reports: Doctrine\ORM\PersistentCollection {#1555 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
      -id: 231419
      -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6109272"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702897903 {#1564
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +"title": 231419
    }
  ]
  -id: 22701
  -titleTs: "'call':5 'dish':7 'edit':1"
  -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702848015
  +visibility: "visible             "
  +apId: "https://sh.itjust.works/post/11130949"
  +editedAt: DateTimeImmutable @1705102410 {#2346
    date: 2024-01-13 00:33:30.0 +01:00
  }
  +createdAt: DateTimeImmutable @1702761615 {#2386
    date: 2023-12-16 22:20:15.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
19 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1548
  +user: Proxies\__CG__\App\Entity\User {#2308 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: Proxies\__CG__\App\Entity\Image {#2221 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
  +slug: "Edit-What-do-you-call-this-dish"
  +title: "Edit: (What do you call this dish?)"
  +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
  +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 114
  +favouriteCount: 131
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1703269453 {#2321
    date: 2023-12-22 19:24:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2218 …}
  +votes: Doctrine\ORM\PersistentCollection {#2194 …}
  +reports: Doctrine\ORM\PersistentCollection {#2219 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
  +badges: Doctrine\ORM\PersistentCollection {#2205 …}
  +children: [
    App\Entity\EntryComment {#1566
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1548 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
      +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 5
      +score: 0
      +lastActive: DateTime @1702897903 {#1581
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Thegreyreyal@sh.itjust.works"
        "@KipmanDynamite@lemmy.world"
        "@SoleInvictus@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1562 …}
      +nested: Doctrine\ORM\PersistentCollection {#1554 …}
      +votes: Doctrine\ORM\PersistentCollection {#1556 …}
      +reports: Doctrine\ORM\PersistentCollection {#1555 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
      -id: 231419
      -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6109272"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702897903 {#1564
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +"title": 231419
    }
  ]
  -id: 22701
  -titleTs: "'call':5 'dish':7 'edit':1"
  -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702848015
  +visibility: "visible             "
  +apId: "https://sh.itjust.works/post/11130949"
  +editedAt: DateTimeImmutable @1705102410 {#2346
    date: 2024-01-13 00:33:30.0 +01:00
  }
  +createdAt: DateTimeImmutable @1702761615 {#2386
    date: 2023-12-16 22:20:15.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
20 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1548
  +user: Proxies\__CG__\App\Entity\User {#2308 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: Proxies\__CG__\App\Entity\Image {#2221 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
  +slug: "Edit-What-do-you-call-this-dish"
  +title: "Edit: (What do you call this dish?)"
  +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
  +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 114
  +favouriteCount: 131
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1703269453 {#2321
    date: 2023-12-22 19:24:13.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2218 …}
  +votes: Doctrine\ORM\PersistentCollection {#2194 …}
  +reports: Doctrine\ORM\PersistentCollection {#2219 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
  +badges: Doctrine\ORM\PersistentCollection {#2205 …}
  +children: [
    App\Entity\EntryComment {#1566
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1548 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
      +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
      +lang: "en"
      +isAdult: false
      +favouriteCount: 5
      +score: 0
      +lastActive: DateTime @1702897903 {#1581
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Thegreyreyal@sh.itjust.works"
        "@KipmanDynamite@lemmy.world"
        "@SoleInvictus@lemmy.world"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1562 …}
      +nested: Doctrine\ORM\PersistentCollection {#1554 …}
      +votes: Doctrine\ORM\PersistentCollection {#1556 …}
      +reports: Doctrine\ORM\PersistentCollection {#1555 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
      -id: 231419
      -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/6109272"
      +editedAt: null
      +createdAt: DateTimeImmutable @1702897903 {#1564
        date: 2023-12-18 12:11:43.0 +01:00
      }
      +"title": 231419
    }
  ]
  -id: 22701
  -titleTs: "'call':5 'dish':7 'edit':1"
  -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1702848015
  +visibility: "visible             "
  +apId: "https://sh.itjust.works/post/11130949"
  +editedAt: DateTimeImmutable @1705102410 {#2346
    date: 2024-01-13 00:33:30.0 +01:00
  }
  +createdAt: DateTimeImmutable @1702761615 {#2386
    date: 2023-12-16 22:20:15.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
21 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
22 DENIED moderate 
App\Entity\EntryComment {#1566
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1548
    +user: Proxies\__CG__\App\Entity\User {#2308 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
    +image: Proxies\__CG__\App\Entity\Image {#2221 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
    +slug: "Edit-What-do-you-call-this-dish"
    +title: "Edit: (What do you call this dish?)"
    +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
    +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 114
    +favouriteCount: 131
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1703269453 {#2321
      date: 2023-12-22 19:24:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2218 …}
    +votes: Doctrine\ORM\PersistentCollection {#2194 …}
    +reports: Doctrine\ORM\PersistentCollection {#2219 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
    +badges: Doctrine\ORM\PersistentCollection {#2205 …}
    +children: [
      App\Entity\EntryComment {#1566}
    ]
    -id: 22701
    -titleTs: "'call':5 'dish':7 'edit':1"
    -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702848015
    +visibility: "visible             "
    +apId: "https://sh.itjust.works/post/11130949"
    +editedAt: DateTimeImmutable @1705102410 {#2346
      date: 2024-01-13 00:33:30.0 +01:00
    }
    +createdAt: DateTimeImmutable @1702761615 {#2386
      date: 2023-12-16 22:20:15.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
  +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1702897903 {#1581
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Thegreyreyal@sh.itjust.works"
    "@KipmanDynamite@lemmy.world"
    "@SoleInvictus@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1562 …}
  +nested: Doctrine\ORM\PersistentCollection {#1554 …}
  +votes: Doctrine\ORM\PersistentCollection {#1556 …}
  +reports: Doctrine\ORM\PersistentCollection {#1555 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
  -id: 231419
  -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6109272"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702897903 {#1564
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +"title": 231419
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
23 DENIED edit 
App\Entity\EntryComment {#1566
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1548
    +user: Proxies\__CG__\App\Entity\User {#2308 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
    +image: Proxies\__CG__\App\Entity\Image {#2221 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
    +slug: "Edit-What-do-you-call-this-dish"
    +title: "Edit: (What do you call this dish?)"
    +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
    +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 114
    +favouriteCount: 131
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1703269453 {#2321
      date: 2023-12-22 19:24:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2218 …}
    +votes: Doctrine\ORM\PersistentCollection {#2194 …}
    +reports: Doctrine\ORM\PersistentCollection {#2219 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
    +badges: Doctrine\ORM\PersistentCollection {#2205 …}
    +children: [
      App\Entity\EntryComment {#1566}
    ]
    -id: 22701
    -titleTs: "'call':5 'dish':7 'edit':1"
    -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702848015
    +visibility: "visible             "
    +apId: "https://sh.itjust.works/post/11130949"
    +editedAt: DateTimeImmutable @1705102410 {#2346
      date: 2024-01-13 00:33:30.0 +01:00
    }
    +createdAt: DateTimeImmutable @1702761615 {#2386
      date: 2023-12-16 22:20:15.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
  +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1702897903 {#1581
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Thegreyreyal@sh.itjust.works"
    "@KipmanDynamite@lemmy.world"
    "@SoleInvictus@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1562 …}
  +nested: Doctrine\ORM\PersistentCollection {#1554 …}
  +votes: Doctrine\ORM\PersistentCollection {#1556 …}
  +reports: Doctrine\ORM\PersistentCollection {#1555 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
  -id: 231419
  -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6109272"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702897903 {#1564
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +"title": 231419
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
24 DENIED moderate 
App\Entity\EntryComment {#1566
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1548
    +user: Proxies\__CG__\App\Entity\User {#2308 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
    +image: Proxies\__CG__\App\Entity\Image {#2221 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2222 …}
    +slug: "Edit-What-do-you-call-this-dish"
    +title: "Edit: (What do you call this dish?)"
    +url: "https://sh.itjust.works/pictrs/image/f16e5601-5500-4db9-8610-4d805638e89a.jpeg"
    +body: "Edit: (Slice of bread with a hole cut in the middle and an egg fried in it.) I have always called them daddy-o eggs but I have recently been informed that is incorrect.-"
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 114
    +favouriteCount: 131
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1703269453 {#2321
      date: 2023-12-22 19:24:13.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2218 …}
    +votes: Doctrine\ORM\PersistentCollection {#2194 …}
    +reports: Doctrine\ORM\PersistentCollection {#2219 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2199 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2193 …}
    +badges: Doctrine\ORM\PersistentCollection {#2205 …}
    +children: [
      App\Entity\EntryComment {#1566}
    ]
    -id: 22701
    -titleTs: "'call':5 'dish':7 'edit':1"
    -bodyTs: "'alway':20 'bread':4 'call':21 'cut':8 'daddi':24 'daddy-o':23 'edit':1 'egg':14,26 'fri':15 'hole':7 'incorrect':35 'inform':32 'middl':11 'o':25 'recent':30 'slice':2"
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1702848015
    +visibility: "visible             "
    +apId: "https://sh.itjust.works/post/11130949"
    +editedAt: DateTimeImmutable @1705102410 {#2346
      date: 2024-01-13 00:33:30.0 +01:00
    }
    +createdAt: DateTimeImmutable @1702761615 {#2386
      date: 2023-12-16 22:20:15.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1567 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1550 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1563 …}
  +body: "“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison."
  +lang: "en"
  +isAdult: false
  +favouriteCount: 5
  +score: 0
  +lastActive: DateTime @1702897903 {#1581
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Thegreyreyal@sh.itjust.works"
    "@KipmanDynamite@lemmy.world"
    "@SoleInvictus@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1562 …}
  +nested: Doctrine\ORM\PersistentCollection {#1554 …}
  +votes: Doctrine\ORM\PersistentCollection {#1556 …}
  +reports: Doctrine\ORM\PersistentCollection {#1555 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1620 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1604 …}
  -id: 231419
  -bodyTs: "'break':21 'gritti':7 'hbo':8 'hood':4 'place':18 'prison':24 'sequel':9 'take':17 'toad':1,20 'willow':15 'wind':12"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6109272"
  +editedAt: null
  +createdAt: DateTimeImmutable @1702897903 {#1564
    date: 2023-12-18 12:11:43.0 +01:00
  }
  +"title": 231419
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
25 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
26 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1583
  +user: Proxies\__CG__\App\Entity\User {#2138 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: Proxies\__CG__\App\Entity\Image {#2212 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
  +slug: "Can-you-hear-the-drums"
  +title: "Can you hear the drums?"
  +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
  +body: null
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 40
  +favouriteCount: 640
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701251101 {#2202
    date: 2023-11-29 10:45:01.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2204 …}
  +votes: Doctrine\ORM\PersistentCollection {#2211 …}
  +reports: Doctrine\ORM\PersistentCollection {#2266 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
  +badges: Doctrine\ORM\PersistentCollection {#2274 …}
  +children: [
    App\Entity\EntryComment {#1610
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1583 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +body: """
        No, that’s “Monk”\n
        \n
        A manc is a place where you can go to deposit your money and get home loans and stuff.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 20
      +score: 0
      +lastActive: DateTime @1700790253 {#1434
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Facelikeapotato@lemmy.ml"
        "@tastysnacks@programming.dev"
        "@Kusimulkku@lemm.ee"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1650 …}
      +nested: Doctrine\ORM\PersistentCollection {#1671 …}
      +votes: Doctrine\ORM\PersistentCollection {#1667 …}
      +reports: Doctrine\ORM\PersistentCollection {#1670 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
      -id: 157028
      -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5541750"
      +editedAt: null
      +createdAt: DateTimeImmutable @1700790253 {#1699
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +"title": 157028
    }
  ]
  -id: 15720
  -titleTs: "'drum':5 'hear':3"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700804908
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/8349254"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700718508 {#2303
    date: 2023-11-23 06:48:28.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
27 DENIED edit 
Proxies\__CG__\App\Entity\Entry {#1583
  +user: Proxies\__CG__\App\Entity\User {#2138 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: Proxies\__CG__\App\Entity\Image {#2212 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
  +slug: "Can-you-hear-the-drums"
  +title: "Can you hear the drums?"
  +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
  +body: null
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 40
  +favouriteCount: 640
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701251101 {#2202
    date: 2023-11-29 10:45:01.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2204 …}
  +votes: Doctrine\ORM\PersistentCollection {#2211 …}
  +reports: Doctrine\ORM\PersistentCollection {#2266 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
  +badges: Doctrine\ORM\PersistentCollection {#2274 …}
  +children: [
    App\Entity\EntryComment {#1610
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1583 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +body: """
        No, that’s “Monk”\n
        \n
        A manc is a place where you can go to deposit your money and get home loans and stuff.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 20
      +score: 0
      +lastActive: DateTime @1700790253 {#1434
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Facelikeapotato@lemmy.ml"
        "@tastysnacks@programming.dev"
        "@Kusimulkku@lemm.ee"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1650 …}
      +nested: Doctrine\ORM\PersistentCollection {#1671 …}
      +votes: Doctrine\ORM\PersistentCollection {#1667 …}
      +reports: Doctrine\ORM\PersistentCollection {#1670 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
      -id: 157028
      -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5541750"
      +editedAt: null
      +createdAt: DateTimeImmutable @1700790253 {#1699
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +"title": 157028
    }
  ]
  -id: 15720
  -titleTs: "'drum':5 'hear':3"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700804908
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/8349254"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700718508 {#2303
    date: 2023-11-23 06:48:28.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
28 DENIED moderate 
Proxies\__CG__\App\Entity\Entry {#1583
  +user: Proxies\__CG__\App\Entity\User {#2138 …}
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: Proxies\__CG__\App\Entity\Image {#2212 …}
  +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
  +slug: "Can-you-hear-the-drums"
  +title: "Can you hear the drums?"
  +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
  +body: null
  +type: "image"
  +lang: "en"
  +isOc: false
  +hasEmbed: true
  +commentCount: 40
  +favouriteCount: 640
  +score: 0
  +isAdult: false
  +sticky: false
  +lastActive: DateTime @1701251101 {#2202
    date: 2023-11-29 10:45:01.0 +01:00
  }
  +ip: null
  +adaAmount: 0
  +tags: null
  +mentions: null
  +comments: Doctrine\ORM\PersistentCollection {#2204 …}
  +votes: Doctrine\ORM\PersistentCollection {#2211 …}
  +reports: Doctrine\ORM\PersistentCollection {#2266 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
  +badges: Doctrine\ORM\PersistentCollection {#2274 …}
  +children: [
    App\Entity\EntryComment {#1610
      +user: App\Entity\User {#260 …}
      +entry: Proxies\__CG__\App\Entity\Entry {#1583 …2}
      +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
      +image: null
      +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
      +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
      +body: """
        No, that’s “Monk”\n
        \n
        A manc is a place where you can go to deposit your money and get home loans and stuff.
        """
      +lang: "en"
      +isAdult: false
      +favouriteCount: 20
      +score: 0
      +lastActive: DateTime @1700790253 {#1434
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +ip: null
      +tags: null
      +mentions: [
        "@Facelikeapotato@lemmy.ml"
        "@tastysnacks@programming.dev"
        "@Kusimulkku@lemm.ee"
      ]
      +children: Doctrine\ORM\PersistentCollection {#1650 …}
      +nested: Doctrine\ORM\PersistentCollection {#1671 …}
      +votes: Doctrine\ORM\PersistentCollection {#1667 …}
      +reports: Doctrine\ORM\PersistentCollection {#1670 …}
      +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
      +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
      -id: 157028
      -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
      +ranking: 0
      +commentCount: 0
      +upVotes: 0
      +downVotes: 0
      +visibility: "visible             "
      +apId: "https://lemmy.world/comment/5541750"
      +editedAt: null
      +createdAt: DateTimeImmutable @1700790253 {#1699
        date: 2023-11-24 02:44:13.0 +01:00
      }
      +"title": 157028
    }
  ]
  -id: 15720
  -titleTs: "'drum':5 'hear':3"
  -bodyTs: null
  +cross: false
  +upVotes: 0
  +downVotes: 0
  +ranking: 1700804908
  +visibility: "visible             "
  +apId: "https://lemmy.ml/post/8349254"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700718508 {#2303
    date: 2023-11-23 06:48:28.0 +01:00
  }
  +__isInitialized__: true
   …2
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS DENIED 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
29 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
30 DENIED moderate 
App\Entity\EntryComment {#1610
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1583
    +user: Proxies\__CG__\App\Entity\User {#2138 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
    +image: Proxies\__CG__\App\Entity\Image {#2212 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
    +slug: "Can-you-hear-the-drums"
    +title: "Can you hear the drums?"
    +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
    +body: null
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 40
    +favouriteCount: 640
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701251101 {#2202
      date: 2023-11-29 10:45:01.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2204 …}
    +votes: Doctrine\ORM\PersistentCollection {#2211 …}
    +reports: Doctrine\ORM\PersistentCollection {#2266 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
    +badges: Doctrine\ORM\PersistentCollection {#2274 …}
    +children: [
      App\Entity\EntryComment {#1610}
    ]
    -id: 15720
    -titleTs: "'drum':5 'hear':3"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700804908
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/8349254"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700718508 {#2303
      date: 2023-11-23 06:48:28.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +body: """
    No, that’s “Monk”\n
    \n
    A manc is a place where you can go to deposit your money and get home loans and stuff.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 20
  +score: 0
  +lastActive: DateTime @1700790253 {#1434
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Facelikeapotato@lemmy.ml"
    "@tastysnacks@programming.dev"
    "@Kusimulkku@lemm.ee"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1650 …}
  +nested: Doctrine\ORM\PersistentCollection {#1671 …}
  +votes: Doctrine\ORM\PersistentCollection {#1667 …}
  +reports: Doctrine\ORM\PersistentCollection {#1670 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
  -id: 157028
  -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5541750"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700790253 {#1699
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +"title": 157028
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
31 DENIED edit 
App\Entity\EntryComment {#1610
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1583
    +user: Proxies\__CG__\App\Entity\User {#2138 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
    +image: Proxies\__CG__\App\Entity\Image {#2212 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
    +slug: "Can-you-hear-the-drums"
    +title: "Can you hear the drums?"
    +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
    +body: null
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 40
    +favouriteCount: 640
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701251101 {#2202
      date: 2023-11-29 10:45:01.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2204 …}
    +votes: Doctrine\ORM\PersistentCollection {#2211 …}
    +reports: Doctrine\ORM\PersistentCollection {#2266 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
    +badges: Doctrine\ORM\PersistentCollection {#2274 …}
    +children: [
      App\Entity\EntryComment {#1610}
    ]
    -id: 15720
    -titleTs: "'drum':5 'hear':3"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700804908
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/8349254"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700718508 {#2303
      date: 2023-11-23 06:48:28.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +body: """
    No, that’s “Monk”\n
    \n
    A manc is a place where you can go to deposit your money and get home loans and stuff.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 20
  +score: 0
  +lastActive: DateTime @1700790253 {#1434
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Facelikeapotato@lemmy.ml"
    "@tastysnacks@programming.dev"
    "@Kusimulkku@lemm.ee"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1650 …}
  +nested: Doctrine\ORM\PersistentCollection {#1671 …}
  +votes: Doctrine\ORM\PersistentCollection {#1667 …}
  +reports: Doctrine\ORM\PersistentCollection {#1670 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
  -id: 157028
  -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5541750"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700790253 {#1699
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +"title": 157028
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
32 DENIED moderate 
App\Entity\EntryComment {#1610
  +user: App\Entity\User {#260 …}
  +entry: Proxies\__CG__\App\Entity\Entry {#1583
    +user: Proxies\__CG__\App\Entity\User {#2138 …}
    +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
    +image: Proxies\__CG__\App\Entity\Image {#2212 …}
    +domain: Proxies\__CG__\App\Entity\Domain {#2209 …}
    +slug: "Can-you-hear-the-drums"
    +title: "Can you hear the drums?"
    +url: "https://lemmy.ml/pictrs/image/0055c74f-192a-45c8-90f7-5325ed07ce55.jpeg"
    +body: null
    +type: "image"
    +lang: "en"
    +isOc: false
    +hasEmbed: true
    +commentCount: 40
    +favouriteCount: 640
    +score: 0
    +isAdult: false
    +sticky: false
    +lastActive: DateTime @1701251101 {#2202
      date: 2023-11-29 10:45:01.0 +01:00
    }
    +ip: null
    +adaAmount: 0
    +tags: null
    +mentions: null
    +comments: Doctrine\ORM\PersistentCollection {#2204 …}
    +votes: Doctrine\ORM\PersistentCollection {#2211 …}
    +reports: Doctrine\ORM\PersistentCollection {#2266 …}
    +favourites: Doctrine\ORM\PersistentCollection {#2268 …}
    +notifications: Doctrine\ORM\PersistentCollection {#2273 …}
    +badges: Doctrine\ORM\PersistentCollection {#2274 …}
    +children: [
      App\Entity\EntryComment {#1610}
    ]
    -id: 15720
    -titleTs: "'drum':5 'hear':3"
    -bodyTs: null
    +cross: false
    +upVotes: 0
    +downVotes: 0
    +ranking: 1700804908
    +visibility: "visible             "
    +apId: "https://lemmy.ml/post/8349254"
    +editedAt: null
    +createdAt: DateTimeImmutable @1700718508 {#2303
      date: 2023-11-23 06:48:28.0 +01:00
    }
    +__isInitialized__: true
     …2
  }
  +magazine: Proxies\__CG__\App\Entity\Magazine {#1587 …}
  +image: null
  +parent: Proxies\__CG__\App\Entity\EntryComment {#1655 …}
  +root: Proxies\__CG__\App\Entity\EntryComment {#1652 …}
  +body: """
    No, that’s “Monk”\n
    \n
    A manc is a place where you can go to deposit your money and get home loans and stuff.
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 20
  +score: 0
  +lastActive: DateTime @1700790253 {#1434
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +ip: null
  +tags: null
  +mentions: [
    "@Facelikeapotato@lemmy.ml"
    "@tastysnacks@programming.dev"
    "@Kusimulkku@lemm.ee"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1650 …}
  +nested: Doctrine\ORM\PersistentCollection {#1671 …}
  +votes: Doctrine\ORM\PersistentCollection {#1667 …}
  +reports: Doctrine\ORM\PersistentCollection {#1670 …}
  +favourites: Doctrine\ORM\PersistentCollection {#1560 …}
  +notifications: Doctrine\ORM\PersistentCollection {#1585 …}
  -id: 157028
  -bodyTs: "'deposit':15 'get':19 'go':13 'home':20 'loan':21 'manc':6 'money':17 'monk':4 'place':9 'stuff':23"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/5541750"
  +editedAt: null
  +createdAt: DateTimeImmutable @1700790253 {#1699
    date: 2023-11-24 02:44:13.0 +01:00
  }
  +"title": 157028
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
33 DENIED ROLE_ADMIN 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
34 DENIED ROLE_MODERATOR 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details