It doesn’t improve security much to host your reverse proxy outside your network, but it does hide your home IP if you care.
If your app can exploited over the web and through a proxy it doesn’t matter if that proxy is on the same machine or over the network.
I would recommend automating only daily security updates, not all updates.
Ubuntu and Debian have “unattended-upgrades” for this. RPM-based distros have an equivalent.
Ironically, when I tried to load Wired’s story about this travesty, Wired quickly hid the content with pop-over asking me to subscribe.
What do you check two hours later?
https://www.cloudns.net/ Makes dynamic DNS very easy.
This is the day after iOS 18.2 was released with native ChatGPT integration.
It’s so old it’s not called self-hosted.
Moneydance https://moneydance.com/
Started using it close to twenty years ago and keep using it because it seems fine.
At one time there were browser extensions that allowed you to comment on any web page and allowed other extension users to see your comments.
The comments were hosted through the extension and not on the pages themselves.
Something like that would be possible but I don’t know anyone offering it now. I presume no one wants to moderate that.
Good example. It’s true that an even a GET request not designed to mutate data might still fail to validate input, allowing a SQL injection attack or other attack that escalates to the privileges that the running app has.
Immich has a whole set of end-to-end automated tests to ensure they don’t accidentally make public any URLs they went to be private:
https://github.com/immich-app/immich/tree/main/e2e/src/api/specs
As a popular open source project, that would be e glaring security hole.
Using this proxy puts the trust in a far less popular project with fewer eyeballs on it, and introduces new risks that the author’s Github account is hacked or there’s vulnerability in he supply chain of this docker container.
It’s also not true that you “never need to touch it again” . It’s based on Node whose security update expire every two years. New image should be built at least every two years to keep to update with the latest Node security updates, which have often been in their HTTP/HTTPS protocol implementations, so they affect a range of Node apps directly exposed to the internet.
Yes, there are broken uses of the HTTP protocol verbs where filtering to GET won’t work.
A simpler way to protect a private service with a reverse proxy is to only forward HTTP GET requests and only for specific paths.
It’s extremely difficult to attack a service with only GET requests.
The security of which URLS are accessible without authentication would be up to immich.
Although, If I have my own Amazon referral link in my blog post and they replace the referral code in their feed, I would not be happy about that.
They could be injecting their own ads or affiliate links into the content.
For example, if a post links to Amazon.
I have not looked at the source code.
The story hypes this to be a bit more than this is.
Framework sent a laptop to the lead Mint dev. He’s going to try make sure it works well with Mint, but it already does.
The more low key framing straight on the Mint blog is here:
WhatsApp is a Meta business unit, yes.
And it has its own rules and policies for what is shared with other Meta business units.
Google has spell out the same. Just because you provide data like location to one Google service doesn’t automatically mean every other Google service can access it.
And they can’t just change their internal data policies however they like as some of this is governed by legal regulations.
Here’s a a story about how Google is not allowed to share data across business units without user consent, at least in the EU.
https://www.theverge.com/2024/1/12/24036312/google-digital-markets-act-services-user-data-opt-out
Here WhatsApp spells out what it shares with Meta:
I love that a Twitter founder founded Bluesky and the logo went from the outline of a white bird on a blue background to the outline of a white butterfly on a similar shade of blue background.
Did see that recently LA kept sending out orders to evacuate and didn’t know the cause or how to stop them?