Readit News logoReadit News
Jnr commented on Ban me at the IP level if you don't like me   boston.conman.org/2025/08... · Posted by u/classichasclass
jrgifford · 6 hours ago
The more egregious attempts are likely being blocked by Cloudflare WAF / similar.
Jnr · 5 hours ago
I don't think they are really blocking anything unless you specifically enable it. But it gives some piece of mind knowing that I could probably enable it quickly if it becomes necessary.
Jnr commented on Ban me at the IP level if you don't like me   boston.conman.org/2025/08... · Posted by u/classichasclass
poisonborz · 7 hours ago
Crowdsec: the idea is tempting, but giving away all of the server's traffic to a for-profit is a huge liability.
Jnr · 6 hours ago
You pass all traffic through Cloudflare. You do not pass any traffic to Crowdsec, you detect locally and only report blocked IPs. And with Modsecurity CRS you don't report anything to anyone but configuring and fine tuning is a bit harder.
Jnr commented on MCP Gateway and Registry   github.com/IBM/mcp-contex... · Posted by u/nikhilk218
Jnr · 7 hours ago
Looks similar to MetaMCP https://github.com/metatool-ai/metamcp

Not sure which of these tools is currently the best but they are clearly needed.

I am testing MetaMCP to expose internal MCP servers to the cloud version of Claude, enabling me to use Home Assistant and some other internal services in verbal conversations with Claude app on the phone.

I think 3rd party MCP server use is available in other AI assistants as well but Claude is the only one who allows using them in Europe.

I can only wish that this would become a standard approach with any AI assistants, including the built in phone assistants like Siri, but Apple is so so far behind and always trying to squeeze every bit of money wherever they can, I doubt they will ever do that.

This approach enables better integrations with local services specific to different regions, and I would somewhat compare this to RSS feeds which were popular 15 years ago. Would be nice if most e-commerce sites would provide their own MCP servers for managing carts, placing and tracking orders, etc. I don't want to see a world where single monopoly grabs this market and makes things shit again (like it happened with social media), especially for those who live outside of USA.

Jnr commented on Ban me at the IP level if you don't like me   boston.conman.org/2025/08... · Posted by u/classichasclass
Jnr · 7 hours ago
Externally I use Cloudflare proxy and internally I put Crowdsec and Modsecurity CRS middlewares in front of Traefik.

After some fine-tuning and eliminating false positives, it is running smoothly. It logs all the temporarily banned and reported IPs (to Crowdsec) and logging them to a Discord channel. On average it blocks a few dozen different IPs each day.

From what I see, there are far more American IPs trying to access non-public resources and attempting to exploit CVEs than there are Chinese ones.

I don't really mind anyone scraping publicly accessible content and the rest is either gated by SSO or located in intranet.

For me personally there is no need to block a specific country, I think that trying to block exploit or flooding attempts is a better approach.

Jnr commented on Nginx introduces native support for ACME protocol   blog.nginx.org/blog/nativ... · Posted by u/phickey
teruakohatu · 11 days ago
This has blown my mind. Its been a constant source of frustration since Cloudflare stubbornly refuses to allow non-enterprise accounts to have a seperate key per zone. The thread requesting it is a masterclass in passive aggressiveness:

https://community.cloudflare.com/t/restrict-scope-api-tokens...

Jnr · 11 days ago
When setting up the API key, use the "Select zones to include or exclude." section. Works fine on the free account.
Jnr commented on How I use Tailscale   chameth.com/how-i-use-tai... · Posted by u/aquariusDue
j45 · 15 days ago
Another approach I’ve seen is to route public access from Traefik/nginx through a single Cloudflare tunnel instead, and Tailscale/Headscale can be left for private network and server access.

The traefik box can have the single Cloudflare tunnel , and tailscsle can hang out behind the scenes.

This way tailscale funnel doesn’t need to be public.

There is the self hosted Cloudflare alternative that’s escaping my mind right now too.

Jnr · 15 days ago
Cloudflare also issues certs and logs them in transparency logs. If you do not create a wildcard cert in Cloudflare, your subdomains will leak. And Cloudflare offers free wildcard certs only on the domain root.
Jnr commented on How I use Tailscale   chameth.com/how-i-use-tai... · Posted by u/aquariusDue
abdusco · 16 days ago
I tried using `tailscale funnel` against a dummy server `python -m http.server`, and within 10 seconds the bots started to check for vulnerabilities.

Tailscale warns you about how enabling it will issue an HTTPS certificate which will be in a public ledger. But I wasn't expecting it to be this quick.

    127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /@vite/env HTTP/1.1" 404 -
    127.0.0.1 - - [10/Aug/2025 00:11:34] code 404, message File not found
    127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /actuator/env HTTP/1.1" 404 -
    127.0.0.1 - - [10/Aug/2025 00:11:34] code 404, message File not found
    127.0.0.1 - - [10/Aug/2025 00:11:34] "GET /server HTTP/1.1" 404 -
    127.0.0.1 - - [10/Aug/2025 00:11:35] code 404, message File not found
    127.0.0.1 - - [10/Aug/2025 00:11:35] "GET /.vscode/sftp.json HTTP/1.1" 404 -
    127.0.0.1 - - [10/Aug/2025 00:11:35] code 404, message File not found
    127.0.0.1 - - [10/Aug/2025 00:11:39] "GET /s/7333e2433323e20343e2538313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1" 404 -

Jnr · 16 days ago
I use Headscale, an open source implementation of Tailscale control server. And it doesn't have funnel functionality implemented out of the box, but I use a custom Traefik proxy manager Web UI in which I can expose ports on different Tailnet nodes.

In order to avoid exposing something unnecessarily in the certificate transparency logs, I use a single wildcard certificate, so all the subdomains are not listed anywhere automatically.

I use the same approach for services hosted in the internal subdomain, because I don't want everyone to know what exactly I'm running in my homelab.

Jnr commented on Ubuntu: Introducing Debcrafters   discourse.ubuntu.com/t/in... · Posted by u/jnsgruk
simion314 · 2 months ago
I like using snap on my LTS servers, I can test new CLI tools there and see if the new version has soem fixes that I need or not, if the snap works better I can use it without messing around with installing some PPA to update the tool and it's dependencies.
Jnr · 2 months ago
What I dislike about snaps is the performance. Somehow they have managed to make them practically unusable on computers older than a few years.
Jnr commented on I built an app to backup Live Photos from iPhone to external hard drives    · Posted by u/xmasterdev
HuwFulcher · 2 months ago
You’re looking at £300ish for an entry level Synology and the storage. That isn’t a realistic expense for many users.
Jnr · 2 months ago
Over time it saves money. I got a home server and a tiny remote backup server 8 years ago and it runs quite a few services saving me hundreds each month and costing in electricity and hardware (over time) about 15EUR/mo. The longer it runs, the cheaper it is. Most of the updates are automatic so no babysitting required.
Jnr commented on Better Auth, by a self-taught Ethiopian dev, raises $5M from Peak XV, YC   techcrunch.com/2025/06/25... · Posted by u/bundie
Imustaskforhelp · 2 months ago
I remember how basically better auth got a huge lead because lucia was shutdown by its dev for their own reasons which I admittedly have forgotten but they made sense and the community had accepted it.

But those who hadn't started using better auth more. And now I guess its crazy how I felt as if this would be just a small project like lucia in the sense of its just created for the passion and the art, but now it has raised 5 mill$ , I wonder if the community wanted this to be an artisanal like project like lucia before its end or what the community thinks of this move. Since VC and open source have some inherent compromises with each other and I guess I just wanted to write this to hear more about people who are using better auth in prod and what they think of what this VC funding.

Jnr · 2 months ago
I wonder how many users of Better Auth are individuals using it for their hobby projects and how many are companies/freelancers making money. Everyone is expecting great software but almost no one is contributing back in any way. If people were supporting such projects, there would be no need for vc money, right?

u/Jnr

KarmaCake day989March 14, 2018View Original