• 0 Posts
  • 14 Comments
Joined 3 months ago
cake
Cake day: June 8th, 2026

help-circle
  • There’s a comedian (I can’t remember their name) that has a bit about how they refuse to give their cat any kinds of beef-based food or treats.

    Salmon? Cool. Chicken? Great. But my cat’s ego is already big enough. There’s no way my cat could take down a cow, and she’d be insufferable if she ever thought she could.

    I bring this up to say that a six foot cat probably could take down a cow. I say this as someone who has a cat: cats are only cute because they’re like fifteen pounds soaking wet. If they were the same size as us, they would 100% consider us prey.



  • I used Google Timeline to prove I was at work one time. This was back when I was freelancing. My client tried to say I was stealing time, because I had an off-site meeting that ran long. They were threatening to withhold a few hours of pay, even though I was at the worksite the entire time. I pulled up my timeline and used it to prove that I was, in fact, at the meeting site for an extra few hours. Being able to de-Google that functionality has a lot of value to certain people.



  • I mean, would you want it to serve clients outside of your subnet? I guess maybe if you had something like a guest network. But I tend to take the “fuck it, you get basic service and nothing else” approach to things like guest networks.

    Isn’t it a potential security issue to have your pihole serve things on any subnet, because it allows an improperly configured firewall to stab at your pihole? I think you can specify any additional subnets it will serve in the settings somewhere. But IIRC, the default behavior is to intentionally drop traffic from unknown subnets. But that’s just off the top of my head.




  • I’m somewhere in the middle, because comments like yours actually reinforce my concerns. A reverse proxy isn’t really doing anything to make you more secure, unless you’re using it for some sort of access control. It hides which ports you’re using, and allows you to encrypt your traffic with TLS… But it doesn’t add any additional security to the services you are exposing.

    Maybe if you use it for access control, to add a secondary username/password to the services. But that breaks most legitimate things (apps, mostly) that try to reach the double-password-protected service. Because a user on a web browser may be able to type in two passwords, (one for the reverse proxy, and then one for the service itself) but an app will try to pass that info automatically using headers.

    Any vulnerabilities in the services will still become potential attack vectors. Anyone who remembers the Huntarr debacle will know exactly what I’m talking about, because a single service being vulnerable can do a lot of damage. Yes, containerization does a lot to help mitigate damage by excluding access to everything except what you give it. But it won’t completely stop things from going wrong.