icedterminal

I was going to post this exact reasoning but you beat me to it.

It’s an industry security standard. Not a defect. If you don’t agree with it, fork the software and modify it to suit your needs.

Some self hosted services refuse to work if you use a self signed certificate with your public facing IP. They only allow self signed certificates when using one of the handful of private addresses.

Some apps on mobile devices for the service you use won’t work unless a trusted certificate is used. A self signed certificate behind the scenes creates an error that isn’t handled and you can’t connect.

You lose the ability to have a proxy in front to handle abuse so your server is spared the headache. You need a domain to do this.

TLS.

While technically you can use TLS with a self signed certificate, it creates additional problems with a public facing service. Only recommended for internal services.

Interestingly, that site is owned by ESPN and at some point in time it was archived by ABC. Why it was put to use for this is strange.

You either set the DNS settings per device to the system running PiHole / AdGuard Home, or if your router allows, set the DNS there. It’s ideal to set it on the router.

Any time a device makes a DNS request to a domain, it’s checked against the list. If found, it’s stopped. If not found, it gets sent upstream to your choice of a public DNS configured during setup. I use Cloudflare (1.1.1.1, 1.0.0.1).

Think outside the box. Get a previous generation. Pixel 8 was about to be released. To move inventory, Google discounted the 7 series by like 30-40%. I got the 256GB 7 Pro for $600. Without the sale, $600 is the same price as the 128GB 7. I got a top of the range flagship phone for the cost of a midrange. My mom did something similar with a Samsung phone. She got an S20 when the S22 released. Huge discount when Verizon offered it for $449.

I’m finding it hard to believe this statement.

System wide DNS over TLS (DoT) as it’s called “Private DNS” was introduced in Android 9. Which was released in 2018. I’d genuinely like to know what Android device today ships with 8 or older, or, ships with 9 and later but has it intentionally removed. If you’re still using an Android device running 8… Why?? It has not received security updates since 2021 and is officially unsupported.

iOS devices can import certificates to enable system wide DoT. This was introduced in iOS 14. Which was released in 2020. Given how Apple has a 7 year track record for device support, the oldest Apple device to get 14 was the iPhone 6. Which shipped with iOS 9 on release.

but the containers are still running as root, as the daemon itself raises the access to root.

No. The daemon can run without root, as such the containers don’t have root. My docker install doesn’t have root access. None of my stacks / containers need any root access tbh. I don’t have any troubles with deplyong stuff.

https://docs.docker.com/engine/security/rootless/

https://www.zigbee2mqtt.io/

https://www.home-assistant.io/installation/

As of 2020, Chromium was made more permissive in accepting additional code. Before this, Chromium rejected a lot of outside code. Microsoft is now the biggest contributor outside of Google. Samsung, Intel, ARM and Apple are other notable contributors. There are several features found in the code that aren’t used by Google at all. Chrome is 100% Google’s agenda. Chromium does include Google services that Google rejects the removal of. Of course Google would rather you use them. Microsoft just removes them. As do others. But the features others have submitted to the Chromium code are of course used in their forks and possibly others. I would say Chromium is less of Google’s agenda than it used to be. As it’s not entirely neutral, there is still Google influence behind it.

If you’re interested at all:

Google Chrome is a fork of the open source Chromium with several Google proprietary features. Chromium uses the Blink engine. Blink is a fork of a large component of WebKit called WebCore. Apple primarily develops WebKit (and by proxy WebCore), itself being a fork of KHTML and KJS which were actually discontinued this year.

Pg has significantly better performance in a smaller self hosted environment. Notably because you’re doing a balance of reading and writing, or mostly writing since data changes regularly. For large scale operations where reading data is the primary use, MariaDB/MySQL is faster.

Alternatively, put it across a doorway. I did this to some devious children (6 and 12). They eventually got me back.

“VPN user voting is not allowed”

Lol.

You should for sure move away from a proprietary OS. There are many ways to go about it. I personally use Arch minimal with hardened kernel. Everything runs in non-root docker containers. Commonly used distros are Ubuntu and Fedora. But there are many more to choose from. https://distrowatch.com/search.php?category=Server

To bypass their CDN (referred to caching) you need to setup a Page Rule for the entire Plex domain.

https://developers.cloudflare.com/support/page-rules/how-do-i-include-or-exclude-a-specific-url-from-cloudflares-page-rules/

Cache Level set to Bypass for https://plex.mydomain.me/*

Thanks for the information. Although Argo still greatly reduces latency if a user cares to reduce communication time.

Once you agree to letting friends and family access your hosted services, you become the tech support for any problems. Whether that be your fault, user error, etc. You should absolutely limit who you give access to. In my case, only three people can and that’s immediate family. No friends, no extended family. I don’t wanna deal with all that mess when I deal with it at work. Don’t over extend yourself by being nice.

Using Cloudflare is against the ToS when used for services like Jellyfin. Your account can be limited, closed, or find yourself getting a several hundred dollar bill for data usage because you’ve breached the terms of service. Additionally, streaming content on free accounts incurs higher latency which I’ve confirmed myself Argo smart routing massively reduces. https://github.com/jellyfin/jellyfin/issues/9295 - Don’t abuse what’s free or you may lose it.

Google shouldn’t be indexing your domains anyway. If it’s flagged your domain, it’s been indexed and scanned. Alternatively, it could indicate you have a weak point somewhere on your server and you’ve been breached. Google’s scan picked up whatever it was. Though I doubt this is the case and just a false positive. Double check your robots.txt files and disallow everything. Most index bots respect this. You can use a community sourced bot blocker. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

I’ve been running my own self hosted services for almost a decade. Though I have a background in IT directly doing this kind of stuff daily at work. As long as you have a strong firewall, modern TLS, relevant security headers, automatic tools like fail2ban, and have a strong grasp on permissions, you should be fine. Before I moved everything to non-root docker, it was given its own service user and SELinux policy. Using direct DNS isn’t so much of a problem. You shouldn’t have any issues. Feel free to reach out if you have any questions.

When Knox is tripped it sets off the root check. Your banks misleading statement is due to their own confusion. Knox is no longer active so it can’t guarantee there is no root access. The OS basically says it’s untrusted/insecure due to lack of Knox and always says it’s rooted regardless of that actually being true. You can hide root for all apps that check. Do note that while you can return the functionality of third party apps, Samsung baked in apps can be hit or miss. It’s a game of cat and mouse. I speak from experience.

Additionally here are some other conversations about it:

https://forum.xda-developers.com/t/tripping-knox-and-banking-apps.4390167/#post-86279609

https://forum.xda-developers.com/t/knox-efuse-and-banking-apps.4565143/