If you have good IPv6 connectivity both at home and away you can look into the Yggdrasil network. It facilitates node-to-node encrypted communications, but it’s decentralized and community-run. Unlike Tailscale, each node can do both communication and relay.

You run the Y client on each device you want to use and if you want to keep things completely private (and you have at least one device that’s not behind CGNAT) you can only add your own devices as peers. If you need to bypass CGNAT you can use one of the community-supplied nodes to act as relays, or set up your own node on a VPS.

The cool feature of Y is that if you’re trying to communicate between nodes A and B and there isn’t a single node that’s peered with both A and B, you can still communicate as long as there are nodes somewhere in the network that know them both. The network will search for you and calculate the optimal relay path. Ofc like I said this is irrelevant if you decide to stick to your own devices, basically you will have your own personal mini Y network completely separate from the main public network.

Even when using the public network there’s no privacy issue, relay nodes cannot snoop on communications only facilitate the connection or not, and once relay to a node has been accomplished the nodes will communicate directly thanks to ICE+STUN, if possible, like Tailscale does.

Please note that nodes are identified by 2001:: random addresses. While the 2001:: address space is huge it’s still only obscurity not security. You still need to have a decent firewall setup on each node, Y does not enforce ACLs or anything like that. It’s also up to you to set up DNS and anything else you might need.

If your services are private they should be behind access authorization or completely private access. Scanning should be a non-issue.

You can further mitigate scanning by getting wildcard certs, putting A/AAAA records on an obfuscated sub-domain rather than the base domain, and not using wildcard CNAME’s.

If they services are public you should be using a CDN anyway. If you don’t like the way Cloudflare does things they’re not the only CDN around, but some of the privacy issue is moot when running a public service.

crowdsec has always struck me as a really odd approach to security. You give out your logs to strangers and block IPs based on their say-so.

The cause and effect are so far removed that I can’t wrap my head about how it’s supposed to be efficient. It’s been proven in real-world tests that it lags badly behind the first waves of new vulnerabilities and by the time it starts blocking IPs that were related to those attacks the attackers have moved on and there are also patches available.

The “thousands of IPs blocked” image reminds me of that WWII airplane bullet-holes image.

Oh it will be, shortly after people stop buying DRM.

It’s popular because it works. You don’t get a lot of choice in the NVR area, most of the other projects are kind of ass too. I’ve been trying lots of them and so far Frigate and Shinobi are the only ones that you can get to show your camera streams, and detecting & recording actually works.

I also don’t think many people care about the security that much. Either that or they run the container like I do in a completely isolated VLAN with the cameras. Honestly, if it wasn’t for the obscene amounts of RAM, CPU and storage it wastes for no good reason I wouldn’t care that much about the security either.

hoe come the developers are not improving the image?

Lots of developers are clueless about Docker. They are used to running their stuff on the metal and piling everything together and they don’t even consider they should clean things up before they ship a docker image.

Gramps Web for example is another humongous image, and it’s humongous because apparently the developer can’t be arsed to separate the building stage from the production stage in their Dockerfile, so they’re shipping all the build toolchains. People have pointed this out to them and they’re like “eh whatever”.

This camera (Reolink E330) doesn’t have HTTP (80 or 443), just RTSP (554), ONVIF (8000) and the proprietary interface that their own app uses (9000).

Yeah Frigate devs claim it can’t be done, but it works in other projects like Shinobi.

They don’t need to be actual users. When they’re trying to start Tailscale on a new device have them pass the authorization link to you and open it on your account. This way their devices are registered as devices for your user. You can tag the devices and write ACLs for them to determine what they can access.

I’ve tried LazyNVR but I couldn’t figure out how to make it work with my cameras. There seem to be no real instructions. I don’t even get how it’s supposed to find the cameras, there’s no place to put an IP.

The Frigate docker image is generally nasty. It’s humongous (5.5 GB), bundles and runs a ton of different things whether you use them or not, uses s6 as init and supervisor which is a piece of crap, and it cannot be secured – it won’t run as a non-privileged user, it won’t drop caps, you can’t make it read-only because some genius configured nginx to put temporary files in with the app files, it conveniently includes apt so the attacker can install anything they might want inside the container, and in fact recommends running in privileged mode(!).

I think it’s the most security-hostile docker image I have ever seen.

companies that sell our data

You can just say “Google”.

Always keep in mind that Google pays for Firefox. But in order to avoid a monopoly investigation they only need Firefox to exist, they don’t need it to be good.

If you ask AI to do all the work, including the smallest little things, I imagine you can burn through a lot of tokens very quickly.

It’s incredibly unlikely that a language teacher understands Git or cares to learn how to use Git.

Hm, it shouldn’t be that hard to point them at a Github/Gitlab/Forgejo repo. It’s basically a list of chronological entries, and when you click one you can see what changed. Not a terrible different concept from what Word/Writer are doing.

This reminds of that time during the crypto bubble when the Fashion Channel put out its own crypto currency.

I want to have a device (the server) present in multiple networks (and multiple different firewall zones) at the same time. I was given to understand I need tagged VLANs for this. I tried doing it with zones only but I couldn’t.

I think Pangolin would be massively overkill for this. It’s designed to be a CDN layer orchestrator and it’s primarily a HTTP reverse proxy. You can do it with Pangolin but it complicates things and you’d need more resources too.

All you really need on the VPS is to run a tunnel (WG or OpenVPN) and forward whatever ports the games need from the VPS public IP into the tunnel. Maybe a DDNS tool/script if the public IP is dynamic.

According to its Github page seems to be a container-oriented Linux distro, like Flatcar / Fedore CoreOS / Talos Linux.

The linked website is AI-generated so ofc it doesn’t say anything useful up front.

If it’s your first time with Arch. Because if it’s your first time with Linux there’s no point.

It’s fairly safe as long as you add a strong enough form of access control. For example if you put it behind a VPN, or a SSH tunnel, or require mTLS. Even a key in a custom HTTP header or Basic HTTP auth can be good enough if the key is strong enough.

You can further decrease the probability of drive-by bots reaching a publicly exposed service by merely scanning IPs and ports if you use a reverse proxy and hide your service FQDNs and IP.

You can do this by using TLS certs on wildcard domains rather than explicit domains, using explicit CNAMEs for the service subdomains rather than a wildcard domain, and keeping the A/AAAA records on an obfuscated subdomain rather than the base domain. If the bots can’t figure out a FQDN they’re not getting past the reverse proxy even if they find the IP and port.

This is obfuscation not real security but it cuts down tremendously on bot hits.

I just can’t find any single sentence in the license text covering SaaS.

SaaS is covered by the following fragment (emphasized by me below) which was added since version 1.1 to the last paragraph of Article 1:

• ‘Distribution’ or ‘Communication’: any act of selling, giving, lending, renting, distributing, communicating, transmitting, or otherwise making available, online or offline, copies of the Work or providing access to its essential functionalities at the disposal of any other natural or legal person.

regarding the compatible licenses, they say the other one wins.

If you combine the original work (licensed EUPL) with another work (licensed under weaker terms, but only applicable to one of the explicitly listed licenses), and there’s a conflict of obligations for the combined result, the terms of the lesser license prevail.

If there’s no conflict or the other license is silent, the stronger terms prevail (EUPL).

The original work always remains under the stronger terms (EUPL).

Hope this clears it up.

PS: I think maybe I understand the confusion. In the earlier comment I was talking about cross-licensing. That means making the software available under two licenses. That’s something that can only be done by the copyright holder.

What you’re describing is not cross-licensing. If someone takes EUPL software and combines it with code under one of the other listed licenses, the distribution alone of the mixed result can be done under the terms of the other license (if the obligations conflict etc. etc.)