JustinAngel

How about we all stop paying taxes until the fucks start using the income for things other than making foreign peoples dead?

There's enough money in the pot, it's just squandered on things that don't benefit the people. We could accomplish so fucking much with just the amount of cash that the Pentagon misplaces every year.

I'll never understand the obsession with demanding more from the rich while we can't even account for what we already have. Is everything a goddamn distraction campaign?

/rant

My claim is that Headscale has a lesser likelihood of compromise than Nextcloud, and that the E2EE provides an encrypted channel between nodes without an immediate need for TLS. Of course TLS over E2EE enhances CIA. There's no pushback to defense in depth here. But in the beginning, the E2EE will get them moving in the right direction.

OP began the post by stating that the login page to a complex PHP web application is internet facing (again, yikes). Given the current implementation, I can only assume that OP is not prepared to deploy a CA, and that the path of least resistance -- and bolstered security -- can be via implementation of HS+TS. They get the benefit of E2EE without the added complexity, for which there is plenty, of a CA until if/when they're ready to take the plunge.

If we're going to take this nonsense all or nothing stance, don't forget to mention that they're doing poorly unless they implement EDR, IDS, TOTP MFA on all services, myriad DNS controls, and full disk encryption. Because those components don't add to the attack surface as well, right?

Tailscale is one of those services..

Tailscale isn't an exposed service. Headscale is, and it isn't connected to the Tailnet. It's a control server used to communicate public keys and connectivity information between nodes. Sure, a threat actor can join nodes to the Tailnet should it become compromised. But have you looked at Headscale's codebase? The attack surface is significantly smaller than anything like OpenVPN.

A cert tells you that you are actually....

I'm all for ssl/tls, but it's more work and may not always be worth the effort depending upon the application, which is exactly why I recommended SmallStep+Caddy. Let's not pretend that introducing things like a CA don't introduce complexity and overhead, even if it's just distributing the root cert to devices.

MITM/DNS Hijack/ARP Poisoning....

Are you suggesting that these attack techniques are effective against zero trust tunnels? Given that the encryption values are sent out of band, via the control channel, how would one intercept and replay the traffic?

Nero has entered the chat

Marx was also racist and antisemitic.

Going from bad to worse in terms of privacy.

The idea that centralized social media should serve as an emergency broadcasting system is....a bad one. It's only guarantee is that ads are to be served alongside propaganda.

Plot twist: it explodes after 3 wrong guesses.

Yikes! I'd avoid leaving any services externally exposed unless they're absolutely necessary..

Tailscale+Headscale are pretty easy to implement these days. Since it's effectively zero trust, the tunnels become the encrypted channel so there's an argument that HTTPS isn't really required unless some endpoints won't be accessing services over the Tailnet. SmallStep and Caddy can be used to automatically manage certs if it's needed though.

You can even configure a PiHole (or derivative) to be your DNS server on the VPN, giving you ad blocking on the go.

Argument dismantled via typo detection. I'll never recover from this.

Anecdotal, but Ive had a container running Nextcloud in an LXC on Proxmox along with PiHole, Step CA, Bacula, and quite a few other services and I've had zero downtime since June 2023. Even have Tailscale rigged to use PiHole as the tailnet DNS to have adblocking on the go.

Guess that restart: always value in the Compose config is pulling it's weight lol

The TrueType vulnerability they patched in January 2023 without notifying the public of active exploitation, leaving Kaspersky to discover it while responding to security incidents.