Recent tv’s became thin client’s. Turn it on and it first need to download the app('s)

“I don’t have anything to hide” is such an insidious little lie

And easy to debunk. Take their phone, ask the pin. 9 out of 10 won’t. Open bank app ask pin again. You won’t get that far.

I don’t use anything cloud based and much of my shit isn’t even allowed out to the internet.

It’s a drop in the ocean, for too many say “But it’s sooooo convenient and I’ve got nothing to hide” and open up all they got. Share camera’s with amazon, email address book with facebook etc. not realizing nor caring I make an appearance in their instances too and I DO mind.

There are variouse alternatives to see what ports are open. Usually they autyo scan just the ip you come from, to avoid being used to scan a potential target.

If you want more, just use Greenbone. Run it twice. Once from another IP just to know how the world sees you. One time internal network and add accounts to greenbone allowing it to login and check further.

If you run linux, then Lynis is awesome to verify your config

nail polish. cost next to nothing, any color you like

IT ALSO HAS DEDICATED BUTTONS FOR VOLUME CONTROL

Bro, that’s so cool … your keys have backup’s

Let’s be grateful, they could have swapped it with the spacebar.

Then don’t go to the cloud! (or use encrypted storage if you really have to)

My view: Unless I can access the hardware 24/7/365 the data isn’t mine for ‘they’ can deny me access to my data anytime while they keep full access. (hence store it decryped)

whitelist of allowed ips

Not exactly.

If source is whitelisted, Accept (avoid being locked out myself)

So all IP’s are allowed to begin with, but some (“my” IP’s like at home, my office etc) are on a whitelist ahead of everything else. They can’t become blacklisted to avoid myself becoming locked out. Then it’s the drop all on the blacklisted, followed by portscan detection. Only after that the ‘normal’ rules (allow https, smtp etc) begin.

the spacebar on my Remington isn’t what it used to be, maybe a drop of oil will help ;)

Well, here is the CPU load:

And there is no increase on delay’s or jitter compared to what i’m already facing on the WAN itself.

It keep’s 6000+ hosts with possible harmful intend away from the ports I need/want open to the world. Actually, the router -while still being bored- offloads the services behind it. I really can’t see a reason not to keep doing it. But, sure, it’s a personal choice.

I only use their WiFi because I got some in- and outdoor ap’s for free. The Wifi manager is selfhosted and has no internet access. For upgradesi downoad the deb file, trasnsfer and install. It’s not the best out there, but works for me and i’m still happy with it.

I’m using RouterOS. In the firewall rules you can create a rule that if an IP touches a port, it get added to a address list (optional with a time-out). So my FW rules begin like this:

1. If source is whitelisted, Accept (avoid being locked out myself)
2. If source IP is in the blacklist, drop all
3. if source IP tries to connect to port 21,22,25,137-139, 113 (and a bunch of others) add it to the blacklist
4. …
5. …

So using a portscanner will touch ports I’m not running any service on (like telnet) and you’ll be blocked. A time-out of one week on the blacklist usually gives me an blacklist of 6500+ addresses.

This too has endless possibilities. t.ex. like port knocking. (‘touch’ one or more ports in a specified sequence in a specified time to be allowed to access the actual service port)

Safety is relative.

It’s also not a state you can reach, it’s a mindset as well as an on-going process

I wasn’t being a total idiot

that goes unanswered ;) it’s not unlikely selfhosters have at least one loose screw.

It does not. It does not uses ports at all. Fail2ban monitors your logfiles and activates the firewall to block IP’s that matched your rules.

t.ex. You can block an IP that tried to access https://<url>/admin. You can block an IP that used wrong credentials x times to login on an ssh port. Or block one that tried to relay via your mailserver. The duration is configurable and alternative duration can be configured for recidivists.

And yes, you can whitelist IP’s to avoid locking yourself out. The possibilities are endless.

I have nagios to check the status, but librenms runs too in case i need trends, graphs etc etc

My usual additions:

1. Have the router to block portscanners
2. fail2ban on internet facing services.

To be honest, I did tried a couple of AI’s. But all I got where solutions that would never work on the stated hardware. Code full of errors and when fixed never functions as requested. On any non-technical questions it’s always agreeing and hardly (not at all actually) challenging any input you give it. So yeah, i’m done with it and waiting for the bubble to burst.

In that case, just a tube and a pressure sensor will do, no need to pump air. As the water level rises air pressure will build up in the tube. Mounting it in the well might be a challenge, but also an easy setup.