For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?

Submitted ⁨⁨5⁩ ⁨hours⁩ ago⁩ by ⁨Ferrous@lemmy.ml⁩ to ⁨selfhosted@lemmy.world⁩

PHP, TLS, etc… We appear to be facing a tsunami of vulnerabilities being discovered in record time. Further, the window to act on these vulnerabilities has basically closed to zero; hackers’ tools now automatically fold the very latest vulnerabilities into their botnets within minutes/hours of discovery. I have always been extremely reluctant to expose any of my services - even with the latest and greatest security tools. My choice to stay totally within the confines of tailscale seems vindicated given this week’s news. How are you all taking this?

pwn.watch

source

Comments

Sort:hotnew top

GreenKnight23@lemmy.world ⁨36⁩ ⁨minutes⁩ ago
exposure is unchanged. automated patching and upgrades are working. rollbacks, etc are working. minimal attack surface exposed and properly blocking traffic by geography. rotation of keys/passwords as well as short lived rotated TLS certs.

not one of those things alone is a solution, but together can make a solid dent in securing your infrastructure.

source

Decronym@lemmy.decronym.xyz [bot] ⁨38⁩ ⁨minutes⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
Git	Popular version control system, primarily for code
NAS	Network-Attached Storage
SSH	Secure Shell for remote terminal access
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #146 for this comm, first seen 23rd Oct 2026, 00:30] [FAQ] [Full list] [Contact] [Source code]

source

Ardyvee@europe.pub ⁨1⁩ ⁨hour⁩ ago
Hasn’t changed much. I have accepted the risk and, for now, the desire to have publicly accessible stuff outweights my lack of desire to deal with the realities of a VPN. I mean, I want to share stuff with others, and I want to be hosting it myself because I have grown to distrust someone else’s service… so what else can I do but risk it?

Besides: I expect tailscale or the underlying VPN services to already be a target. I would be surprised if they don’t find anything. What then?

source
truxnell@quokk.au ⁨2⁩ ⁨hours⁩ ago
I moved to closing everything down and wireguarding in to home 5 years ago and I’m glad I did. I only expose game server these days which have a different vuln profile.

If/when I open up for Jellyfin/etc, I’ll probably run them on a different box to my NAS in a DMZ with strong firewall rules. And use a VPS for anything else that doesn’t require NAS storage to reduce blast radius.

Can we go back to late 90s internet yet?

source
frongt@lemmy.zip ⁨1⁩ ⁨hour⁩ ago
The only thing I have exposed is my VPN, so no change here.

source
terabyterex@lemmy.world ⁨4⁩ ⁨hours⁩ ago
not at home but i work as a software dev for a very big company you heard of and all we do noe is fix ai found security bugs. hell the stuff i work on isnt that public and we are still fixing. i can only imagine what the team of the public website are handling.

source
non_burglar@lemmy.world ⁨2⁩ ⁨hours⁩ ago
I don’t expose much, just an always-on VPN. My HTML only site lives on vps, from which i can cut-and-run anytime. I don’t have much need for more, really.

Back when I was working more with raw infosec stuff like packet analysis, etc, I thought surely we would see machine learning in every router to dynamically manage firewalls in such a way that they became foregone conclusions. We don’t really have that, but code has sure changed, and you’re right, we will see lots more vulns discovered and exploited at a much faster pace.

source
NoLemurs@lemmy.world ⁨5⁩ ⁨hours⁩ ago
I’ve always treated my home server with public facing services as presumptively compromised. I don’t put any data on there I wouldn’t want to see become public, and any data I actually care about losing is backed up to the cloud with an append-only key. The NixOS config lives in a git repo not on the server. If something bad happens, I can wipe the machine clean, redeploy the image, restore my backups, and we’re back to the status quo.

So, my threat model hasn’t changed much!

source
joseki@lemmy.zip ⁨3⁩ ⁨hours⁩ ago
Eh between cloudflare blocking everything outside the US and tailscale for privileged control surfaces I’m not super worried.

source
confusedpuppy@lemmy.dbzer0.com ⁨4⁩ ⁨hours⁩ ago
My public facing server uses a wildcard domain cert plus it’s hosted on an uncommon higher port. It only serves static pages. My SSH port is hidden behind a WireGuard connection. I keep it extremely simple because simple is easy to maintain.

source
illusionist@lemmy.zip ⁨4⁩ ⁨hours⁩ ago
I had a public facing jellyfin. I took it down because of that.

Immich and nextcloud are still up.

I’m not saying there is a rational reasoning behind it.

source
magnue@lemmy.world ⁨4⁩ ⁨hours⁩ ago
If tailscale gets compromised I’m fucked. Otherwise I won’t be opening anything else up given my limited experience.

source
ChaosSpectre@lemmy.zip ⁨5⁩ ⁨hours⁩ ago
I don’t have a public facing website but I was in the process of building one for fun prior to all this.

I completely locked down. Nothing leaves tailscale pretty much. If I do need a public facing site it will be built on other peoples platforms and nothing local.

In my case, building a site would be for fun, not for anything else. AI turning it into a maintenance chore just kills any excitment that used to exist for it. If anything, I’ll probably build it on neocities at this point.

source