It would be hilarious if the more security focussed hobbyists were to pen-test that link, eh? Careful where you spam.

Yeah. I’m still too scared to host my own email. Its too vulnerable an attack surface for me to be confident in my security.

Data bandwidth is a good point. Especially where some people either have data caps or pay per data.

Moral obligation is a good point. Maybe I’m just lucky that authorities really dont enforce DMCA complaints much where I live, so I dont worry too much about that.

Has anyone actually had the police come to complain about pirated media?

Yeah. A lot of inexperienced self-hosters probably don’t appreciate how much their ISP has protected them honestly. The first time you open a port on a truly public trunk line at a datacenter is certainly an eye-opening experience!

Fair. I guess what really prompted this question was a chat with a “normie” relative who was self-hosting jellyfin on their main computer, no security (username: user, password: pass, SSL: disabled). I had to explain all the issues (even no fail2ban on their server with an exposed port 22). They thought I was paranoid. But even my suggestions weren’t as extreme as many people put.

That’s actually a good point. Especially since I think most of us share our services with family members who may be less equipped to protect themselves.

Yeah, my thought here is that dockerization isn’t a security measure really. I, for one, run my jellyfin on bare metal with nixos, but secure it behind a keycloak SSO system.

That’s fair. Though a compromise enough to run arbitrary scripts on a system to use it in a bot net doesn’t take nearly as much security as some people install.

I’m not saying 0 security. A VPN is sensible, or in absence, some good firewalling, a&a, ddos&bot protection, etc. But I’ve seen posts of people seemingly worrying about security while running a system that’s more secure than some systems that hold top secret data.

I just wanted to know why they do it (since I do it too lol).

Not to mention the obvious anti-synergy of other people’s eyes and book sword. Reading from other people’s eyes would be tricky to say the least.

Except that AWS is (for better or for worse) a tier 1 network solutions provider, in part because of advertised uptime. Due to that, it is possible for a minor AWS outage to result in lack of 911 service in an area, for example. Hopefully they have the common sense to try out these new things on less critical nodes though.

I decided that at my scale, NixOS is easier to maintain. So for me its just a `systemctl status <thing I host>ˋ

Thats exactly what I so often find myself saying when people show off some neat thing that a code bot “wrote” for them in x minutes after only y minutes of “prompt engineering”. I’ll say, yeah I could also do that in y minutes of (bash scripting/vim macroing/system architecting/whatever), but the difference is that afterwards I have a reusable solution that: I understand, is automated, is robust, and didn’t consume a ton of resources. And as a bonus I got marginally better as a developer.

Its funny that if you stick them in an RPG and give them an ability to “kill any level 1-x enemy instantly, but don’t gain any xp for it” they’d all see it as the trap it is, but can’t see how that’s what AI so often is.