WxFisch

Email is de facto not private/secure without adding additional layers to it, so using services like ProtonMail or Tuta are putting lipstick on a pig. They give a false sense of security and privacy that just doesn’t exist without a ton of additional overhead and opsec. Unless you plan to only email other Proton accounts, or use janky one-time password secure messages, your email isn’t E2EE, it’s just encrypted on Protons servers which is table stakes for most paid mail services. They are marketing something that just can’t fully work in the real world. You also then make a ton of trade offs like very limited client support (especially on mobile), and can’t even use S/MIME for compatibility with enterprise secure mail solutions.

To be clear, I think it makes sense to pay for something as critical as email so you aren’t the product, as well is using your own domain for portability. But I don’t recommend folks buy into the false security and privacy promises of services like Proton for email/calendaring.

There are two things in my house I don’t “play” with: internet connectivity and core home functions (lights, locks, garage doors, etc). That doesn’t mean I don’t self host anything or then, but I always start from a mindset of “must work”.

I run HA on a Yellow (functionally an RPi 5 with radios and storage interface built in). My lights are either Hue running as plain Zigbee devices, or Zigbee switches. I don’t necessarily want more customization with home automation, I want stable, extensible, and easy to use day today. HA checks all those boxes easily. I’ve not done much looking into OpenHAB, but I would caution against going with something for home automation just because it’s more customizable. Sure, it’s great to have an automation routine that turns on your lights when you get home, it’s less great to have an integration that misbehaves and now you cannot turn off a light, or lock your door, or turn down the volume on your music, etc. Be sure to know what you want to accomplish before you buy devices, build automations, and always build things with a manual backup operation option.

Eh, it can be a lot of work but doesn’t have to be. I’ve automated backups, and if you follow current best practice guidance from industry, you should use long pass phrases and not worry about regularly rotating them. For things like SSH keys, you can rotate them if you think you’ve had a breach but in normal usage there isn’t a huge benefit security-wise since they functionally can’t be guessed and would need to be stolen. If an adversary steals your SSH keys then you’re already pretty hosed as the next step is for them to establish another backdoor to access your server without needing your key.

Honestly it’s not a ton of time. A few minutes to run patches every few weeks, and the initial investment to plan, install, and configure your services (but then that’s the fun part no?). Self hosting IMO isn’t a great way to save time and money, or even to get out of the pocket of big tech. If those are your goals you’re better off looking at hosted solutions that are Open, and likely paying for it since running IT stacks isn’t free. Self hosting is a hobby, something you do to learn and because you enjoy it. It is hard sometimes, takes time, and comes with risks, but so do most other hobbies.

It doesn’t usually matter what the service is, the basic concepts are the same. If you want to access a service you host on your internal network from another external network you either need to use a VPN to securely connect into your network, or expose the service directly. If you are exposing it directly you should put it (or a proxy like NPM) in your DMZ. The specifics of how to do this though will vary from service to service and with your specific network config.

You can run a port scan against your public IP from another network to see what is open. But if you haven’t specifically set something up for external access through port forwarding you are probably fine.

Only expose services internally then use a secure VPN to access your services, this makes your network no more vulnerable in practice than not self hosting. If you need/want to expose something to the internet, make sure you setup your network right. Use a DMZ to separate that service and leverage something like CrowdSec along with good passwords, antivirus, and keep things patched.

This was posted here yesterday by the dev. Overall the reaction seems positive.

A quick look through the repo it looks pretty legit, it’s a lot of effort to create something that works, with all the documentation (including a lot of planning docs) just to collect data on you. Traffic to various IPs, foreign or otherwise, wouldn’t really be odd for an app like this either. You could try and run it through something like virustotal though to look for malicious code (there are more than a few docker scanning tools on GitHub that use virustotal).

I use cloudflare mostly because I buy my domains through them as they offer at cost domain names for many TLDs. Internally I use PiHole and then just point what I need externally to cloudflare trough a reverse proxy and a DMZ box.

It’s for a dog, that likely puts far worse than a couple of black hairs in its mouth, I wouldn’t bother honestly.

The technical term used in industry is confabulation. I really think if we used that instead of anthropomorphic words like hallucination it would make it easier to have real conversations about the limits of LLMs today. But then OpenAI couldn’t have infinite valuation so instead we hand wave it away with inaccurate language.

It wasn’t standard previously, and if you have TV service I think it’s still inconsistent but the past ~5 years it seems to be more common that they are setup that way from the start. If you have internet only service, and a newer ONT (like less than 10 years old) it is the standard configuration and is how the self install guide tell you to hook up the “quantum gateway” router from Verizon.

You can always call and ask to have your ONT converted to Ethernet output if it isn’t already and as long as it supports it I haven’t heard reports of much trouble there. The very early ONTs though don’t support it though IIRC but those should be being replaced at this point anyways.

I mean you can, an ONT is not a router, it’s essentially a media converter. I use my own router (and have for many years) and had no issues. The FiOS tech even ran a long Ethernet run in my basement to connect the ONT and my router in my rack when they installed service.

It depends, and without knowing your ISP I’m not sure there is a way to tell you for sure. I know for example Comcast gigabit Pro has been known to directly connect to an ISP SPF module in your firewall/router, but Verizon FiOS (and most FTTP that I know of) provide an ONT that converts the fiber to Ethernet which you would then connect directly to your hardware.

I would verify if the ISP router you refer to is not really an ONT in which case you are directly connected to the ISP functionally and there isn’t really an advantage to getting an SPF and getting the fiber directly connected if you even can.

I’m curious how everyone documents their core/critical configs to allow the non-technical in our homes work with it if needed. For instance if I’m on work travel and the Pi-hole goes down for whatever reason my wife wouldn’t be able to use pretty much anything online. I can remote in and fix it but that could be hours/a day or two later. Same then for the proxmox stack that everything runs on.

Along the same lines, how are folks documenting for EOL? It may not be a happy thought but we are all going to go someday, so what is your plan and how have you ensured loved ones can access/save important data?

No, it’s just normal DP but edited for content in addition to time.

There’s are two (that I’m aware of) versions of Deadpool that are shown on US TV. One is pretty normal, cut up mostly for time but with all the curseing and violence you’d expect, the other though has hilarious dubs over a good bit of the swearing (which is in theory easier when the main character is in a full face mask I guess?). The one that sticks out in memory is Deadpool’s line “Suck a cock” is dubbed as “ha ha ha”.

Agree 100%. Most of the former Plex users turned Jellyfin users I have come across did so better Plex was broken in some way for them. For me it was the general lack of care in creating/maintaining a good Apple TV app. Over the past few years it’s just gotten buggier and buggier with a lot of complaints on the Plex forums where devs would essentially stop by to say they weren’t working on any fixes.

Jellyfin doesn’t fix 100% of the issues, but at least there is active development on Swiftfin that showed a desire to fully support all devices.

So paperless works as a service that ties into your storage. I point mine at an NFS share on my Synology and just backup that share. The documents are all stored as PDFs still so worst case I still have “dumb” copies without all the tagging available if my paperless instance goes offline for some reason.

I would recommend prowlarr instead of jackett for indexer management, and pihole as at least an additional blocking service but in reality it’s really all you need for use at home. I’d also strongly encourage use of a VPN on your *arr download services. I use a separate box to run Plex and then have my *arrs all running on their own VM inside if it to provide separation and allow be to more easily segregate the network traffic (as someone that doesn’t really know docker that well it “just works” for me. Also probably worth looking at how to store your media on an external target, it’s easy to quickly accumulate 10s of TBs of media and trying to store that all on the server locally is asking for trouble. Better to set everything up on a NAS to start.