sergsoares

For who is curious about this PDF issue like me.

The case of the 9 bit AES key [1]

[1] https://news.ycombinator.com/item?id=50280722

I really ditched now VScode/Cursor after the extension vulnerability (beside I never used that, only the Claude code CLI).

Despite no using full VM's I using Orbstack Isolated machines to some level of restrictions https://docs.orbstack.dev/machines/isolated for coding.

Yep, that triggered in my mind to move the last public service (not critical) I was hosting inside a third party saas because of little conveniences.

Agree in don't ever expose if not needed.

And keep private and public personal hosted services in different contexts.

He probably is referring to Copy Fail/Dirty Flag exploits.

Not expose the server IP is one practice (obfuscation) in a list of several options.

But that alone would not solve the problem being a RCE from HTTP, that is why edge proxy provider like Cloudflare[0] and Fastfy[1] proactivily added protections in his WAF products.

Even cloudflare had an outage trying to protect his customers[3].

- [0] https://blog.cloudflare.com/waf-rules-react-vulnerability/ - [1] https://www.fastly.com/blog/fastlys-proactive-protection-cri... - [2] https://blog.cloudflare.com/5-december-2025-outage/

Same doubt here, a disaster even bigger (Maybe in Mac ?)

That is why I prefer OTP all the time, easier to backup and restore.

Some Cloud functions like lambda support OCI container as a runtime target for example.

I understand that feeling but can be hard a provider that fill all that requirements without a expensive cost.

Integrate with the edge computing is part of the price you pay for all the conveniences like automatic builds, Cron and public reachable endpoints (and some of them almost free).

A minimal VPS with linux is always an alternative.

Really great post with that interactive examples and the example of mysql x postgrel too.

I would like read more about that topics with that level of detail.

Using podman for years for local containers development and the last months for hosting my personal services is good to see that.

Congrats to podman team.

For me replicate an old P3 1000mhz that I study and played a lot of games.

The attention and care to the details of that post are incredible.

Easy and useful, usually the basic is better.

I ever plan do it with sqlite, loading it at memory during app start and flush data to s3 during runtime but it create more corner cases and logic to handle.

I understand that disks snapshots with ZFS for example can cover most part of the needed on recovery scenarios.

But immutable OS are helping in progress some sandbox tools and allowing new workflows to manage the OS (virtualized or not).

You can use a localhost Cockpit with SSH Port Forwarding.

> Configure Cockpit to listen only loopback/127.0.0.1[1]:

[Socket]

ListenStream= #This remove 0.0.0.0:9090 bind based on the docs

ListenStream=127.0.0.1:9090

> Execute in your machine a port forward with SSH[2]:

ssh -N -L 9090:127.0.0.1:9090 host@ip

> Then you can open localhost:9090 in your browser securely only using SSH (that is already part of your actual workflow).

[1]: https://cockpit-project.org/guide/latest/listen

[2]: https://coder.com/docs/code-server/guide#port-forwarding-via...