Assume your devices are compromised

Re:Assume your devices are compromised by colordrops on Sunday April 17, 2022 @11:59PM (#31067270)

For sure. I first focused on setting up a homelab and de-googling my phone and whatnot for privacy reasons, but it's nearly impossible to not be spied on. You can certainly reduce it. In the end I'm still doing this for data sovereignty more than for privacy now, but I don't mind the boost in (imperfect) privacy.

[ Parent | on HN ]

Re:Assume your devices are compromised by Tijdreiziger on Monday April 18, 2022 @07:57AM (#31069549)

Well, you gain privacy from corporations. You have to keep your software up-to-date, though, or you risk losing privacy to hackers.

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @09:17AM (#31070139)

Or you can simply run an application level default-deny firewall and never use a web browser. You don't need to keep your software up-to-date in a homelab.

[ Parent | on HN ]

Re:Assume your devices are compromised by Tijdreiziger on Monday April 18, 2022 @10:06AM (#31070768)

But then you can't access your data outside your local network. That may be acceptable depending on your use case, but at that point it's not a 1-to-1 alternative to cloud services.

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @11:14AM (#31071801)

SSH tunnel with passwords disabled; use ed25519 keys. Or wireguard if you are feeling adventurous

[ Parent | on HN ]

Re:Assume your devices are compromised by Tijdreiziger on Monday April 18, 2022 @11:58AM (#31072453)

So then you need to keep SSH or WireGuard up-to-date (at least in terms of security patches).

Also, are you going to SSH in every time you need to access a document from your phone? Again, use-cases differ, but that's not a 1-to-1 alternative to, say, Dropbox.

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @01:52PM (#31074115)

You would use wireguard for that use case, possibly on a regularly updated computer, and update your network firewall rules to accommodate that setup.

[ Parent | on HN ]

Re:Assume your devices are compromised by Tijdreiziger on Monday April 18, 2022 @02:32PM (#31074641)

Yes, but you agree you need to apply security patches in that case, right?

Your original comment amounted to "you don't need to apply updates if you firewall everything", to which I replied "that's not a replacement for a cloud service". Your subsequent comments then amount to "well you can just poke a hole in your firewall for WireGuard". So which is it, do you need to apply updates (e.g. to WireGuard) or not?

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @04:32PM (#31076101)

I suppose you can maintain secure remote access if you run a very minimal wireguard server on a low power device similar to a raspberry pi running on a updated/patched distro. You can still keep 99% of your gear running in the back without updates. This way the amount of update churn can be minimized.

[ Parent | on HN ]