Are your exposed services all on their own ports externally, or behind a reverse proxy?

Putting them behind a reverse proxy makes sure that attackers at least need to know the correct hostname to access your service.

This is security by obscurity which isn’t proper security but it means that all of the port scanners out there likely won’t know your jellyfin server exists when a vulnerability for jellyfin is released.

If you use let’s encrypt or something similar be aware that all issues certs show up in a public log so attackers like to harvest that log as a list of valid domain names. Switch those certs to wildcards so that you aren’t advertising those valid hostnames.

There are often options in reverse proxies, or sometimes your router to do geo based blocking. If you can limit connections to your local country only you eliminate huge portions of the botnets out there.

Combining this with auto updates/reboots on your services is probably enough to keep you safe, but if you want to really secure things a separate DMZ vlan for your services to prevent an attacker from compromising additional services on your LAN.

The more network segmentation you can do the better. An ideal setup is every app/container in its own network/ACL that only allows traffic to the specific network devices that it needs to talk to. This is a lot to manage if you do this with your router/vlans. Containers orchestrators (i.e. k8s) make this easier, but don’t protect you from kernel level exploits to break out of the containers. I believe proxmox has VM level ACLs now so you could skip the vlans and do your segmentation at that level instead.

It certainly isn’t good to depend on it but security by obscurity is your first and probably most important line of defense. When these vulnerabilities come out they need to know your service exists to exploit it.

The best way to do that is to setup a reverse proxy to reject invalid hostnames. A single port is all you need exposed for multiple web services, and the IP scans won’t find the script kiddies anything valuable. Be careful with lets encrypt, there is a public journal of all issued certs, so make sure to get yourself a wildcard cert so that you aren’t advertising your valid hostnames to the world.

Use the reverse proxy to put basic auth in front of your services (if they can handle that). Basic auth is very simple, no web forms to attack, just a single header. If your php site is vulnerable they won’t ever be able to even attempt to reach it without a valid username/password.

I’ve got a mix of containers and VMs behind that reverse proxy. The containers have network security groups around them limiting network access. The VMs are in a Harvester hypervisor with KubeOVN for software defined networking. That means each VM is in its own subnet with network security groups around the subnet preventing any unnecessary network access.

For machines/containers that need Internet access I have a Squid proxy with an explicit whitelist of allowed URLs so that the machines can’t reach out to unauthorized sites to download their malware or contact command and control nodes.

Unattended updates for the VMs, and FluxCD keeping helm charts up to date hourly for the containers. For my own containers, weekly scheduled container rebuilds.

I do have one public website that I host for a friend (indexed by search engines so the sites name is known to the world). My friend had originally deployed that as a WordPress site, but WordPress/PHP don’t have the best security track record so I was concerned about that. The site was pretty simple so I recreated it as 100% static content, so now the attack surface is just a nginx container with a read-only filesystem.

I’ve bought about 16 drives from goharddrive (through eBay). Most of them 5+ years ago without any failures. So I can’t say how well they honor their warranty, but they have been around for some time so that is probably a good sign.

If you are running your power supply near its limit I have seen that cause drive drops as well. If you continue to see drives drop that seem to be functional and cables/HBA don’t seem to be the cause, you might want to swap/upgrade power supplies if you can.

It is as much a scam as the cards themselves. Artificial scarcity designed to addict our brains to gambling.

The grading feeds on/into the main scam of the cards themselves. The whole cycle requires that we place “value” on their slabs of paper and grading helps make that value more concrete in your brain. The more value you see in the cards the more of them that you want to buy. More cards sold means more grading, so the cycle goes round.

Have fun playing the game, just be aware the whole thing is no different than going to the casino. They just hope the psychological effect of not gambling with money addicts extra people who wouldn’t normally gamble with money (i.e. children or those morally opposed to gambling)… and the house always wins.

E=mc^2

Energy and mass are just different measures of the same thing. The transporters job is to take mass and turn it into something that it can more easily move around (a wave? Particle stream?) and back. So as long as the transporter is connected to the ship’s energy supply it should theoretically be able to use that energy (instead of the energy from your body) to reassemble any pattern it wants without breaking the law of conservation of mass.

Riker is 6’4 let’s say 200lbs, which is 8,153,369 terajoules.

DATA: Imagination is not necessary. The scale is readily quantifiable. We are presently generating twelve point seven five billion gigawatts per (an alarm goes off)

One watt is one Joule per second, there is some debate out there about the “per” part of the quote since watts already implies per second, but we probably assume the ship is capable of generating 12,750,000 terawatts, or 12,750,000 terajoules per second.

8,153,369/12,750,000 gets us about 0.64 seconds of the ships output to create our duplicate Riker.

However the quote above was when the ship was basically idling, (not actually at warp) so the actual output of the ship is likely exponentially larger.

Basically they have so much power available, that they can just rearrange it into whatever mass they want.