NaibofTabr

Your first concern should be your boundary firewall. You should have all ports closed except the ones that you are definitely using for external services. You should know which ports you have open and why, and what traffic, how much and how often you expect to see on those ports (8080 will have regular Internet use traffic, but your reverse proxy port should only have traffic when you’re away from home and actively using it), and you should monitor that traffic at the firewall every so often, and especially when you make changes to your network. Closed ports should be configured to drop packets rather than respond that the port is closed (stealth mode). On a home network, preventing unwanted incoming connections will protect you from the majority of malicious activity. It’s the most effective single thing you can focus on.

The next thing would be to separate untrusted devices onto dedicated VLANs. This would be for IoT devices, gaming consoles, “smart” appliances, anything that connects to the Internet whose software you don’t have control over. They get isolated on a VLAN that only connects to the Internet and doesn’t allow local connections to devices on other VLANs, so the rest of your network doesn’t exist as far as they’re concerned. This should cut down on things like “smart” appliances taking inventory of your home network and reporting it back to the manufacturer’s servers.

If you do these two things, and you’ve got your reverse proxy configured properly so that other people can’t break into it, you should minimize unwanted connections to your network and your server/containers should be fine with default internal firewall policies. The only reason you would need to do more is if you expect a direct/intentional attack by a motivated hacker, but in that case there’s not much you can do unless you’re an expert.

If you want to go further, try implementing the community version of runZero:

https://www.runzero.com/platform/community-edition/

https://help.runzero.com/docs/self-hosting/

https://www.cisa.gov/resources-tools/services/runzero-community-edition

This is a network visibility tool that will discover and identify devices. To get a really complete look, you would run it from inside your network and deal with anything that you don’t think should be accessible, then run it again from outside your network to see what a potential attacker would see.

Well, let me ask you a related question: do you think it is acceptable to ban books? Why or why not?

I have no objection to sites like Polymarket being made illegal. That is not the argument.

I don’t approve of people using Polymarket, but I would fight for their right to access the website without censorship.

The government can declare a business like Polymarket to be illegal, that’s fine. Take action against Polymarket directly. The government dictating which sites a citizen can or cannot access is not fine. It is exactly the same as what China does with the Great Firewall.

Control is never relinquished voluntarily, it only expands. If the government has the power to block access to one site they will do it with more, for increasingly less justifiable reasons, until they eventually don’t bother justifying it at all.

Government censorship is not permissible in a free society, period.

This isn’t blocking information or anything worthwhile

The government should neither know nor care what its citizens access on the internet, any more than they should have control over what books its citizens read.

Censorship is censorship regardless of what is being censored.

This is the wrong way to do things. The government should not be dictating what its citizens are allowed to access on the Internet. It seems like so many countries go after ISPs and DNS providers to solve their problems for them, and I think it’s mostly just laziness.

What France should be doing is making it illegal for Polymarket to operate in their country, and fining them for violations.

That’s right. You win. Congratulations.

Cleaning isn’t an inherently undignified job

So what? It is still a job that most people don’t want to do. It is a job that people do when they can’t find other work. And typically the working conditions are poor.

The point isn’t whether anyone would “do fine in a job like that”. The point is that very few people are signing up for those jobs voluntarily.

For work that is genuinely unpleasant, there’s no reason I know of there can’t be non-monetary perks that would make it worthwhile.

This I agree with. As a society we should be rewarding people who fill these very necessary roles. Janitors, especially those who work in medical facilities and have to regularly deal with biological waste, should be getting a lot more compensation.

Regardless of whether that compensation is in the form of money or not, I don’t think that’s an example of anarchy. Providing such compensation would require some form of organized group that distributes it to the people doing the work, which means that group would have to collect whatever resources are necessary in order to distribute them, and then we’ve just reinvented taxes.

Please apologize for your delusionally counterfactual bullshit and edit your original comment to point out you were wrong in case anyone else reads it.

You are way too adversarial to have a conversation with. Touch grass or something.

Which is why it’s a thought experiment. Come on, this isn’t complicated. Proof doesn’t happen in a thought experiment. Instead, you make a compelling argument based on logic and relevant examples.

I gave an example of a situation that I believe is too complicated to function properly under anarchy. What is your counterargument?

Also, if you don’t agree with me I’ll fucking kill you. Are you any more inclined to agree with me now?

You’re very zero-to-ten, aren’t you? As if authority necessarily means direct threats against life. How silly.

At some level someone has to tell other people to do work that they don’t want to do, and those people have to do it or it won’t get done by anyone.

I know there is labor that won’t be done voluntarily, yes.

For instance, cleaning shit smeared over the walls of a restaurant bathroom, or sorting through garbage to separate recyclables, or changing catheter bags and diapers for adult patients.

Sure, somewhere in the world you might find a few people who are happy to do that kind of work. Are there enough of those people spread throughout every community to actually complete the volume of work that needs them?

Management with no authority to enforce its directives is just an advisor.

Here’s a thought experiment:

Imagine trying to operate a modern county hospital as an anarchist organization. For the sake of the experiment, let’s assume this is a miraculous money-free post-scarcity society and we’re not worried about the cost associated with anything or handling billing nonsense. We are absolving ourselves of all of the complexities of the accounting department, thus simplifying everything. Materials and labor are supplied for free, somehow (handwaving details TK).

OK, so what we’re concerned with is system management. Inputs and outputs, and internal processes. Patient appointments, work shifts, task assignments, surgery schedules, emergency response, education and training programs, laboratory analysis, medication distribution, food distribution, waste disposal, supply requisition, shipping and receiving, inpatient and outpatient care, and above all sanitation for everything. The goal is to have the right resources in the right places at the right times. If you miss the goal, people die.

Is this a system that can operate effectively without dedicated authority figures? without centralized management? Can a hospital be run effectively as a coalition of equals, with no empowered oversight?

No.

Why would the rest of a society that exists around a hospital be any less complex in practice?

More specifics are needed for a support request. Provide the baseline specifications please.

What OS are you using? What is the make and model of the drive? Is it internal or external? USB? SATA? SAS? NVMe? A PCIe adapter? Is this a desktop, laptop, NAS, server, NUC, Raspberry Pi with an expansion board?

For all we know you’re using a refurbished and relabeled SAS drive plugged into an adapter on an eSATA port on a 10 year old motherboard sitting in a cardboard box.

Are you familiar with SMART? Have you done any diagnostics?

Heh, I opened port 22 on my home network once. There wasn’t anything on it to connect to, but the firewall recorded thousands of SSH connection attempts within hours. Within a day it had over a million hits.

Yeah, you never really know how sheltered you are until you step out.

I wonder what you are securing against?

OK, you’re familiar with vulnerability scanners and port scanners right?

The threat model here isn’t really attackers specifically targeting your home network for any particular reason (unless you’re a LastPass engineer working remotely while running an exposed Plex server). They’re not looking for you, they’re looking for anything useful.

The threat model is attackers using scanning tools to discover vulnerable systems connected to the Internet. All they need from you is an active connection and a system that can store data, from which they can host malware files for distribution to other targets or conduct attacks or just run a cryptominer (if you’re lucky and they’re not very ambitious). They can find this by scanning for open ports and then running a vulernability scanner to figure out if there’s some exposed hardware that can be exploited.

An unsecured system is a hazard that could land you in jail when someone else starts using your device and network connection to commit crimes.

Now, as long as you’re behind a standard residential network service, and your ISP is in control of your gateway device, you’re relatively safe from this. Most ISPs will block any traffic like that very strictly. If your ISP is in control of your gateway device then they’re responsible for its behavior (demarcation matters).

But, most self-hosters run into limitations with their ISP blocking a lot of ports by default, because they want to access their personal server from outside their home, and so they take control by running their own gateway device or paying for a business connection which gives them complete control over which ports are open. This is where the risk comes in. You are assuming the responsibility for properly securing your connection to the public Internet, taking it off your ISP’s hands.

If you’re going to do this, you should know exactly which ports you have open to the outside and why, and a general idea of what traffic you expect to see on them when and how much. Monitor that traffic at your firewall. Every other port should be closed and your firewall (on your router, gateway device, or better yet a dedicated OPNSense firewall) should be configured to drop packets received by closed ports (“stealth” mode). You don’t want it to respond that those ports are blocked, you want it to appear to not be there at all.

Every other security implementation is a secondary concern for a home network. Yes you should patch your software regularly and you should practice deny-by-default and least-privilege as a matter of course, but you’re going to mitigate 90% of your risk by just not accepting incoming connections for anything you don’t need. Most vulnerable systems are discovered by automated scanning, so the less your system responds to external connections the better. If you’re going to worry about configuring, securing and patching one device, make it that front line firewall. And be very selective about which internally hosted services you expose externally.

wut.