navigatron

@navigatron@beehaw.org

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Random requests to my private Jellyfin instance

I have a Jellyfin instance on my local server which I forward to the public web via a cloudflare tunnel. I’m not sure how secure it is, and I keep getting random requests from all over the world. It’s my first experience maintaining something on a public domain so I may be worrying about something obvious, but some advice...

navigatron,

You can reduce doorknob turning dramatically by running on a non-standard port.

Scanners love 80 and 443, and they really love 20, but not so much 4263.

I used to run a landing page on my domain with buttons to either the request system / jellyfin viva la reverse proxy. If you’re paranoid about it, tie nginx to a waf. If you’re extra paranoid, you’ll need some kind of vpn / ip allow-listing

navigatron,

Other comments here do a great job pointing to DH key exchange; I’d like to try explaining it with the paint analogy.

You and Youtube need to agree on a “color of paint” (encryption key) without ever sending it over the network.

You and Youtube agree on a common “yellow” in the clear, and you each pick a secret color. Youtube mixes yellow and their secret and sends it to you. This is okay, because un-mixing paint (factoring large prime numbers) is really hard. You add your secret to the mixture, and now you have yellow+Youtube’s secret+your secret.

You mix yellow and your secret and send it to youtube. Youtube adds their secret; now they’ve got yellow+Youtube’s secret+your secret. You both have the final color!

An eavesdropper can’t reconstruct this - everything sent over the network had yellow mixed in, and un-mixing paint can be really hard. Maybe you can guess that green minus yellow is probably blue, but you can’t get close enough to decrypt anything. And what if it’s brown? Is that blue + orange, or is it red + green?

Cryptographers have worked very hard to make the communications secure. I would be more worried about the other end ratting you out - using a relay / proxy / vpn that you trust is a good idea :)

navigatron,

Are you telling me that pop tarts are not in fact ravioli?

navigatron,

I don’t do anything interesting. I’ve got the ten workspaces, and win+p to start stuff.

The only interesting thing is win+PrintScrn, which takes a screenshot to /tmp, and then opens it in pinta to crop.

Actually I also have win+z bound to turning off the laptop screen. That’s all I can remember

navigatron,

Make sure to use the “important” modifier, the “Yes Really” modifier, and adjust character by character until you realize you’re missing yet another modifier 🙃

Newbie tech (lemmy.dbzer0.com)

This is probably a ridiculous question, but I usually stream from my laptop to my LG tv or my phone to any other tv, and I find that using my VPN keeps the casting output option from working. Like in Popcorntime, the Watch Now doesn’t show my tv, only the laptop app or VLC. On my daughter’s fire stick I can’t even cast to...

navigatron,

The VPN catches all network traffic and puts it far away - you can’t be on vpn and see local network resources (casting targets) at the same time.

If your vpn has an app, check your settings for something like “local network access”.

Otherwise, start reading about split-tunnels and/or default gateways

navigatron,

Optimus gets complex quick. You’ll be reading pci bus ids before you know it. Keep the wiki open, go slowly; you got this :)

navigatron,

Yes - the nodes are obsidian pages (markdown files), this view is a napkin-type layout thing that is built in; I haven’t played much with it

navigatron,

You’re running docker inside a vm? Why?

The first thing I would do is learn the 5-layer OSI model for networking. (The 7-layer is more common, but wrong). Start thinking of things in terms of services and layers. Make a diagram for each layer (or just the important layers. Layers 3 and up.)

If you can stomach it, learn network namespaces. It lets you partition services between network stacks without container overhead.

Using a vm or docker for isolation is perfectly fine, but don’t use both. Either throw docker on your host or put them all in as systemd services on a vm.

navigatron,

Sir, you are a hero. Thank you for your service.

navigatron,
  1. Yes, because:
  2. It could
  3. And if it does, you probably can’t remove it

Streaming sites can embed an unhearable data stream into audio signal. It’s possible

That being said, it’s extremely improbable, given the costs to do it at scale.

If you’re part of a large company’s beta program and have access to some unreleased product, maybe worry.

If you grabbed a file from some mega host updown whatever site, don’t worry.

And if you’re still worried, take a sha256 hash and put it into google search. If you get any results that even mention your file’s title, then you’re good.

navigatron,

Spread-spectrum audio watermarks will survive multiple re-encodings and are extremely difficult to detect.

Iirc google widevine will embed a device code, and if a pirated copy of some content is found, they will blacklist the gpu’s device code so it can’t receive 4k content anymore. That’s video, but it’s the same idea.

navigatron,

Extremely. It’s just slow, but once you get used to that, it’s solid.

navigatron,

Why not? What if I want it to be

navigatron,

Go a level deeper, beyond this news about news, and read the moat memo.

The third faction is the open source community.

The memo has an entire timeline section, dedicated to showing the speed at which the open source community absorbed and iterated on the leaked facebook model, LaMMa.

The memo puts a lot of emphasis on how google and co are building new models from scratch, over months, with millions of dollars - and yet open source is building patches, in days, with only a few hundred dollars - and the patches stack, and are easily shareable.

The open source models, through these patches, are getting better faster than google can re-architect and re-train new models from scratch.

The main point of the memo is that google needs to change their strategy, if they want to stay “ahead” (some would argue they’re already behind) of the competition.

navigatron,

Wireguard creates a new network interface that accepts, encrypts, wraps, and ships packets out your typical network interface.

If you were to create a kernel network namespace and move the wireguard interface into that new namespace, the connection to your existing nic is not broken.

You can then use some custom systemd units to start your *rr software of choice in said namespace, rendering you immune to dns leaks, and any other such vpn failures.

If you throw bridge interfaces into the mix, you can create gateways to tor / i2p / ipfs / Yggdrasil / etc as desired. You’ll need a bridge anyway to get your requester software interface exposed to your reverse proxy.

Wireguard also allows multiple peers, so you could multi-nic a portable personal device, and access all your admin interfaces while traveling, with the same vpn-failure-free peace of mind.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #