As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

@thantik@lemmy.world
link
fedilink
English
34
edit-2
20d

I’ve replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) – whoami, uname, id, uptime, last, etc

With shell scripts which run the command but also send me a notification via pushover. I’m running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.

It doesn’t stop people getting in, I’ve set up other things for that – but on the off chance that there is some zero-day that I don’t know about yet, or they’ve traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.

The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it’ll be gotten into. I don’t trust being able to know every method that can be used, so I use this as a backup.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
720d

That’s a very good idea. Something to think about, especially if you have open ports and are paranoid enough (aren’t we all? Hehe). Thanks

How do you all that have your services on your LAN accessing it over wireguard when external pass the wife/kids/family test? If I had to have my wife activate a VPN before she could access our nextcloud or bitwarden, she’d just never use it

@Evil_Shrubbery@lemm.ee
link
fedilink
English
620d

Is always on not an option?

Always on wireguard kills battery life on mobile for me so I guess that’s a no.

that should not be the case because wireguard only ‘runs’ when it sends or receives packets. try setting the keepalive time a bit higher, 5 minutes maybe.

It also breaks android auto for me.

always on they wouldnt know about it and if the connection failed or the wg service crashed on their phone then the services wouldn’t work. It adds a complexity that you don’t want when you’re trying to pass the wife test. Plus yes battery.

no wireguard should not decrease batterylife (see my other comment) we use wg eith always on without any problems. sometimes it stops on one phone but l9oking for the key icon and clicking the action button in the navigationcontrolmenuthingy is quite easy

@MostlyGibberish@lemm.ee
link
fedilink
English
11
edit-2
20d

I’m not super paranoid about security, but I do try to have a few good practices to make sure that it takes more than a bot scanning for /admin.php to find a way in.

  • Anything with SSH access uses key-based auth with password auth disabled. First thing I do when spinning up a new machine
  • Almost nothing is exposed directly to the Internet. I have wireguard set up on all my devices for remote access and also for extra security on public networks
  • Anyone who comes to visit gets put on the “guest” network, which is a separate subnet that can’t see or talk to anything on the main network
  • For any service that supports creating multiple logins, I make sure I have a separate admin user with elevated permissions, and then create a non-privileged user that I sign in on other devices with
  • Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA. This is probably the most “paranoid” thing I do, because of the aforementioned not being accessible on the Internet, but it makes me happy to see the little lock symbol on my browser without having to fiddle around with trusting a self-signed cert.
@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
320d

Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA

I’m assuming this is in your internal network. The problem with this is that communication from the client to the reverse-proxy (unless you’re running a reverse-proxy sandboxed with each application/are directly decrypting traffic at the base of your application) is encrypted, but the traffic from the server to the reverse-proxy is not.

@MostlyGibberish@lemm.ee
link
fedilink
English
219d

Definitely a consideration. In my case, the vast majority of my services are running in docker on a single host box, including the reverse proxy itself (Traefik). That unencrypted traffic never goes out over a wire, so for now I’m not concerned.

@raldone01@lemmy.world
link
fedilink
English
2
edit-2
19d

Bonus points for creating lots and lots of networks grouping the databases together with only their respective containers.

ip a is a huge mess.

@Dehydrated@lemmy.world
link
fedilink
English
1120d
  • Custom Router/Firewall running OPNsense and the Sensei plugin
  • Extensive DNS filtering through Pihole
  • Redirecting all DNS requests to my Pihole through OPNsense
  • My entire network is behind a multi hop VPN
  • I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
520d

Since you’re running x86 for your router, do you actively prevent ME from trying to connect to the Internet?

@Dehydrated@lemmy.world
link
fedilink
English
120d

I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
320d

OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too

@Dehydrated@lemmy.world
link
fedilink
English
120d

I know, I tried OpenWRT on a Pi, but the experience wasn’t great (at least not as a home router).

Wouldn’t that last bullet mean you’re not updating the windows machines whatsoever? Would this not cause more security issues in the long run, considering “connected tot he internet” isn’t a requirement to spread an infection.

@Dehydrated@lemmy.world
link
fedilink
English
220d

It might sound ridiculous, but I currently also run a WSUS server to get Windows updates. But I will probably replace my entire Windows setup with a better solution. Since I don’t run Windows bare-metal anymore, I’m looking forward to using offline Windows VMs on my Proxmox host and just accessing the internet directly from my Linux machine.

My most paranoid config is disabling Ipv4

That’s it. If someone wants to attack me, they will need to adopt IPv6!

@dan@upvote.au
link
fedilink
English
1119d

they will need to adopt IPv6!

And find your IP in a /56 or /64 range (depending on what your ISP gives you). Good luck.

@JoeKrogan@lemmy.world
link
fedilink
English
16
edit-2
20d

Only remote access by wireguard and ssh on non standard port with key based access.

Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

Logs are encrypted and mailed off site daily

System updates over tor connecting to onion repos.

Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

Linux only on the main network.

I also make sure to backup often.

@constantokra@lemmy.one
link
fedilink
English
820d

Can you explain why you use onion repos? I’ve never heard of that, and I’ve heard of kind of a lot of things.

@JoeKrogan@lemmy.world
link
fedilink
English
8
edit-2
20d

Onion repositories are package repositories hosted on tor hidden services. The connection goes through six hops and is end to end encrypted. In addition to further legitimizing the tor network with normal everyday usage it has the benefit of hiding what packages have been installed on a system.

Here are some notes about them if you want to read more.

https://blog.torproject.org/debian-and-tor-services-available-onion-services/

https://www.whonix.org/wiki/Onionizing_Repositories

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
119d

That is very interesting, thanks!

@constantokra@lemmy.one
link
fedilink
English
219d

That’s pretty neat. I might start doing that, just for kicks.

Baut auf. she/her
link
fedilink
English
7
edit-2
20d

With Debian it’s just the apt-tor package, and the project maintains an official list at… onion.debian.org iirc?
I don’t know if serving onion traffic is more expensive for Debian/mirror maintainers so idk if this is something everybody should use

@rekabis@lemmy.ca
link
fedilink
English
219d

Fail2ban bans after 1 attempt for a year.

Fail2ban yes; one year, however, is IMO a bit excessive.

Most ISP IP assignments do tend to linger - even with DHCP the same IP will be re-assigned to the same gateway router for quite a number of sequential times - but most IPs do eventually change within a few months. I personally use 3 months as a happy medium for any blacklist I run. Most dynamic IPs don’t last this long, almost all attackers will rotate through IPs pretty quickly anyhow, and if you run a public service (website, etc.), blocking for an entire year may inadvertently catch legitimate visitors.

Plus, you also have to consider the load such a large blocklist will have on your system, if most entries no longer represent legitimate threat actors, you’ll only bog down your system by keeping them in there.

Fail2ban can be configured to allow initial issues to cycle back out quicker, while blocking known repeat offenders for a much longer time period. This is useful in keeping block lists shorter and less resource-intensive to parse.

@JoeKrogan@lemmy.world
link
fedilink
English
119d

My block list is very small actually due to the non standard ssh port. Everything else goes through wireguard.

If it was open to the public then yes I’d have to reconsider the ban length.

@rekabis@lemmy.ca
link
fedilink
English
119d

That makes a lot more sense for your setup, then.

Big P
link
fedilink
English
520d

Linux only on the main network.

Is that a security benefit?

Semperverus
link
fedilink
English
720d

If big corporations hoovering your data should be on everyone’s threat list, then yea, i’d say its a huge benefit.

@JoeKrogan@lemmy.world
link
fedilink
English
5
edit-2
20d

Well I dont trust closed source software and do what I can to avoid it when I can. At least foss can be audited. Also all the linux devices on the main network are devices I admin.

@NOPper@lemmy.world
link
fedilink
English
420d

I guess it cuts the attack surface profile down a bit?

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
420d

System updates over tor connecting to onion repos.

How does this help, assuming your DNS isn’t being spoofed?

@JoeKrogan@lemmy.world
link
fedilink
English
120d

Please see my reply below with links.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
219d

Thanks, never thought of that before. I’ll certainly try it, great way to help the network!

@Treczoks@lemmy.world
link
fedilink
English
820d

I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.

@constantokra@lemmy.one
link
fedilink
English
520d

Now that’s the kind of paranoid I was hoping to see in here. High five, pal.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
220d

Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!

I understand some of these words.

@notgold@aussie.zone
link
fedilink
English
520d

all buzz :P

@Pika@sh.itjust.works
link
fedilink
English
27
edit-2
20d

My security is fairly simplistic but I’m happy with it

  • software protection

    • fail2ban with low warning hold
    • cert based login for ssh (no password Auth)
    • Honeypot on all common port numbers, which if pinged leads to a permanent IP ban
    • drop all firewall
    • PSAD for intrusion/scanning protection (so many Russian scanners… lol)
    • wireguard for VPN to access local virtual machines and resources
    • external VPN with nordVPN for secure containers (yes I know nord is questionable I plan to swap when my sub runs out)
  • physical protection

    • luksCrypt on the sensitive Data/program Drive ( I know there’s some security concerns with luksCrypt bite me)
    • grub and bios locked with password
    • UPS set to auto notify on power outage
    • router with keep alive warning system that pings my phone if the lab goes offline and provides fallback dns
  • things I’ve thought about:

    • a mock recovery partition entry that will nuke the Luks headers on entry (to prevent potential exploit getting through grub)
    • removing super user access completely outside of local user access
@Linguist@lemmy.world
link
fedilink
English
119d

Genuine question. What security concerns does luksCrypt have?

What honeypot are you using?

Could you please elaborate how you do the honeypotting?

@Pika@sh.itjust.works
link
fedilink
English
3
edit-2
20d

I just expanded the existing fail2ban config on the commonly used default ports such as 22, 21 Etc, any requests on those ports get sent into purgatory, so the ip gets blacklisted any connections from it hangs until it times out. It’s a super basic setup iptables logs whenever a request is not in the current firewall (last rule in the chain) and then fail2ban reads the log and handles the block. I don’t count it as part of the normal setup because they’re isolated Because the actual ports the service is on still have the normal rule set but the default port numbers are just an instant if there’s activity on it you’re gone

@Decronym@lemmy.decronym.xyz
bot account
link
fedilink
English
10
edit-2
9d

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
AP WiFi Access Point
CA (SSL) Certificate Authority
DNS Domain Name Service/System
Git Popular version control system, primarily for code
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
IP Internet Protocol
NAT Network Address Translation
PiHole Network-wide ad-blocker (DNS sinkhole)
SBC Single-Board Computer
SSH Secure Shell for remote terminal access
SSL Secure Sockets Layer, for transparent encryption
TLS Transport Layer Security, supersedes SSL
VPN Virtual Private Network
nginx Popular HTTP server

15 acronyms in this thread; the most compressed thread commented on today has 16 acronyms.

[Thread #493 for this sub, first seen 6th Feb 2024, 16:55] [FAQ] [Full list] [Contact] [Source code]

Kata1yst
link
fedilink
1820d

Really all I do is setup fail2ban on my very few external services, and then put all other access behind wireguard.

Logs are clean, I’m happy.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
520d

Standard and well-tested setup. Thanks for your reply!

dr_robot
link
fedilink
4320d

Logcheck. It took ages to make sure innocent logs are ignored, but now I get an email as soon as anything non-routine happens on my servers. I get emails with logs from every update, every time I log in, etc. This has given me the most confidence that nothing unexpected is happening on my servers. Of course, one needs to make sure that the firewall is configured well, and that you use ssh keys etc., but logcheck is how I know I’m doing enough.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
7
edit-2
20d

Very nice idea, and it’s quite simple too. Thanks

RedFox
link
fedilink
English
9
edit-2
20d

I’m an enterprise guy, so that’s the explanation for non home use things.

  • VPN for anything not my web or certificate revocation distribution point
  • Sophos IPS
  • sophos utm for web application firewall
  • transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don’t inspect medical or banking, other common sense stuff.
  • heavily vlan segmented with firewall between
  • my windows clients are managed by active directory with heavy handed GPOs.
  • least priv accounts, different accounts for workstation admin, server, domain, network devices
  • security Onion IDS
  • separate red forest that has admin accounts for my management access and accounts on devices
  • trellix antivirus and global reputation based file monitoring
  • I’ve started applying disa STIGs on servers
  • site to site VPN with other family member household. They get managed trellix av also.
  • my public identity accounts like MS,.Google, etc all need 2fa, token, etc.

I bet this can still get exploited, just would take effort hopefully none does for a home network.

I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

@shadowintheday2@lemmy.world
link
fedilink
English
12
edit-2
19d

deleted by creator

RedFox
link
fedilink
English
619d

Also laughing because that’s how some companies get owned, IP stolen, etc.

There has to be balance, if your life using their system sucks so hard you can’t do your job or meet production marks, you get creative.

My industry has to prioritize security over productivity. It’s almost impossible to get work done.

@shadowintheday2@lemmy.world
link
fedilink
English
2
edit-2
19d

deleted by creator

RedFox
link
fedilink
English
219d

Your working environment sounds gross :)

IT is hard. Finding good IT people is harder in my opinion. Working for a company that is not super squared away with good security and great usability sucks. At least you found some work arounds and are trying to do it well.

@shadowintheday2@lemmy.world
link
fedilink
English
1
edit-2
19d

deleted by creator

RedFox
link
fedilink
English
119d

Ha yeah.

Id say the same for trellix.

You should try doing things with installs or updating apps when the edr product blocks write access to all temp locations. You have to do an exclusion for every installer, signing cert, or turn it off to install programs.

@XTornado@lemmy.ml
link
fedilink
English
419d

I’m still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

As somebody taking like 0% of all that measures and not having any problem, luck was involved for sure, unless they have a good reason to attack you in particular… I feel like you will be fine…

RedFox
link
fedilink
English
219d

Ha, probably. It’s fun to learn stuff though.

Working in this field, almost every company has been beached, IP stolen, etc.

Sometimes your home IP gets hit in an automated scan for a vulnerability and then auto exploited by automation. I’m hoping not to get random chance added to a botnet.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
119d

You seem to have a great setup. Since this comment touches on slightly advanced topics, I’ll ask this here:

  1. What use do you have for a WAF?
  2. How did you get your Android clients to trust your certificate? Do you use an MDM? Did you root your devices to access the trusted root store?
  3. Segmenting stuff with VLANs, subnetting and ACLs is a great idea, but do you also make sure that the firmware of the device is somewhat robust? Although I suppose you don’t have to worry about it if Sophos sends out regular updates, however I hate the idea of my switches and routers having to connect to the Internet, pass along credentials and the sort to be able to get updates.

Your measures seem to be focussed more on security than privacy - which is great! It’s my fault for not specifying it in the post, but I’d definitely like to know if you have done anything specific to keep your network private as well as secure.

Thanks for your wonderful comment - saved!

RedFox
link
fedilink
English
119d
  1. Exchange on prem 😳
  2. Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don’t have to root Android for that. It presents some warnings, appropriate.
  3. My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.

I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.

Privacy. 🤔

Not much. I have certain traffic go through a VPN to the Internet, but that’s split tunneled.

I use incognito? That doesn’t really do anything, ha.

I’m slowly killing web browser tracking and cookie stuff that group policy allows.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
119d

I didn’t know MS exchange could be used as a WAF. Will need to read more about that.

Can I host Intune completely on-prem?

What do you mean by “My Sophos is self-contained”?

Does your Cisco router get updates? My problem with these companies is that they build backdoors in their firmware for agencies to use. Are you monitoring the network usage of your Cisco gateway?

Using AD/RADIUS on-prem is an intriguing idea. I didn’t consider it because if my AD server goes down I’m essentially locked out of my services. I need to think more on this. Thanks.

RedFox
link
fedilink
English
119d

I have the older Sophos utm, which doesn’t use the Sophos cloud central manager.

I think their new firewall utm can work disconnected, but I don’t know.

Sophos has a home use license that’s free for non business use.

I love companies that do community edition or free home use.

Sophos, Veeam has nfr, Elastiflow has community edition, which is a netflow.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
119d

This is the first time I’ve come across Elastiflow, thanks for mentioning it. Seems like an intriguing service to add.

I was considering using Suricata/installing Security Onion to do IDS from the certificate from a private CA. Sophos firewall seems pretty good too.

RedFox
link
fedilink
English
219d

Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.

I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.

MS got rid of intune on prem. It’s only Azure service now. I think.

My router is my biggest vuln. Oddly the most important. It’s an enterprise ISR. It’s updated as far as possible. My paranoia ends with the US gov/NSA. I don’t care if they want back door oddly. I don’t want China using me for attack relay however.

Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that’s a level I can’t deal with.

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
219d

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

This is such a great and a simple idea. Thanks.

I think I followed your setup at a high level, but because I don’t have hands-on experience with AD I didn’t quite catch the scope of it. Thanks for letting me know, I’ll get some reading done when I get the time!

@NuXCOM_90Percent@lemmy.zip
link
fedilink
English
42
edit-2
20d

Never used it “in anger” but:

I have my firewall plugged into a metered outlet (plugged into a UPS). I have it set up to send me alerts if power draw increases beyond a certain threshold. I’ve tested it and wireguard is measurable (yay) but so are DDOS attacks. If I get that alert, I can choose to turn off that plug and take my whole network offline until I get home and can sort that out.

Gotten a few false positives over the years but mostly that is just texting my partner to ask what they are doing.

@const_void@lemmy.ml
link
fedilink
English
319d

Aren’t you just DoSing yourself at that point?

Care to share what outlet you had success with? I’m comfortable with Home Assistant and ZigBee/Z-Wave. Something this critical probably shouldn’t be wireless, but I digress. I’m also interested in what software you’re using for monitoring and alerts (if you’re willing to share). Cheers!

I just use a pretty generic z-wave plug and home assistant. In the past I did more complex setups that actually determine what process is spiking and so forth. But eventually realized that “this is doing a lot of compute…” is a catch all for a LOT of potential issues.

And I guess I don’t understand what you mean by “shouldn’t be wireless”. It is inherently going to be wireless because you will be on your phone on the other side of the planet. If you genuinely suspect you will be vulnerable to attacks of this scale then you… probably have other things to worry about.

But as a safety blanket?

Gotcha. A ZigBee/Z-wave plug was the first thing that came to mind. I’ll probably go the same route. I was merely saying that wireless-anything is less dependable than wired. But I don’t even know if wired smart plugs exist. I use wireless sensors around my home and I’ve never had an issue with dependability. I definitely wasn’t considering Z-wave as a local attack vector. I was just brainstorming some way to avoid a wireless solution for something where dependability is paramount.

Well damn that’s clever. I will have to try that.

Avid Amoeba
link
fedilink
English
220d

Or you could trigger automation that turns it off for hours, then turns it back on. That way you could get around the need to physically turn it on, in case everyone is away.

With my firewall disabled a lot of my internal network (including home assistant) will fall over sooner than later.

But that is also a recipe for mass stress. Because I know “something happened”. And now I know “in six hours, I need to check in and make sure that ‘something’ is still not happening”. Which is extra shitty if I got the notification late evening local time.

I have friends/neighbors that I trust to swing by and push a button in the event I need to bring it back up before I get home. But if I have reached the point of “it is possible my wireguard credentials were compromised?” then I really don’t need to be able to download the next episode of ATLA NOW.

Nice try, attacker trying to get me to do their reconnaissance work for them. I’m on to you.

@hakunawazo@lemmy.world
link
fedilink
English
13
edit-2
20d

No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.

Credit card number: _____________
CVV: ___
Expiration date: ______

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
1920d

It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about

Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
920d

I’d love to play paranoid admin over my network. Thanks!

Spfff me, never Anyway please tell me more about your IP adress and your private keys.

@Auli@lemmy.ca
link
fedilink
English
820d

Ok my ip address is 192.168.3.200.

Im gonna hack u now

My private key has a 3 in it

“I’m in”

@JoeKrogan@lemmy.world
link
fedilink
English
220d

Hackerman

@ripcord@lemmy.world
link
fedilink
English
720d

Hey its me your friend Aaron how are you. Hey i was just wandering, what is your credit card details again? just wandering

Create a post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

  1. Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

  • 1 user online
  • 261 users / day
  • 728 users / week
  • 1.83K users / month
  • 4.61K users / 6 months
  • 1 subscriber
  • 2.32K Posts
  • 37.5K Comments
  • Modlog