NaibofTabr

I’m not sure you know what SNMP is

Oops, I was definitely confusing that with ICMP. Good point.

https://oneuptime.com/blog/post/2026-03-20-block-icmp-firewall-risks/view

Also Iot devices aren’t really much of a threat.

I consider it a threat if a device maps my local network, identifies the other devices I have connected, and/or monitors my network traffic and then sends a report on that back to its control server.

Also don’t put things on the internet. That is generally a really bad idea and will bite you in the butt eventually.

Ain’t that the truth. We really should just not.

I’m looking for advice to maximize security.

The most important answers to this all live outside your server. What is your home network like? Do you control the gateway? Do you have a dedicated firewall? Do you have devices segregated into VLANs so they can’t observe each other (especially IoT devices)? Do you have SNMP disabled?

1. Containers are not a security barrier. They cannot be, they never will be.
2. If you are defending against intrusion at your local file server, it is already too late. The call is coming from inside the house.

If you want security, you block all inbound and outbound traffic by default at your network firewall (not the server OS firewall), and then you open only the ports that you actually need, one by one. You set all the closed external ports to do not respond (“stealth” mode), so that anybody trying to reach your network from outside just gets nothing back except on the ports you specifically need to use. You segregate your internal network into logical areas, and you put things that need to talk to each other on their own VLAN, which may or may not have access to the upstream WLAN trunk depending on what they’re doing. You don’t allow crosstalk between VLANs except in very specific cases. You set static IPs and document them, so that you never have to ping or traceroute internally to find something, so you don’t need SNMP. Anybody trying to use SNMP is conducting surveillance on your network and should stick out from other traffic (some “smart”/IoT devices do this automatically - they are bad and should be treated as malicious and should not be allowed to phone home). And then you monitor your traffic at the firewall, and you deal with anything unexpected as it comes up (like once a week review the logs until you have a sense of what normal looks like on different days at various times, then maybe set a few automatic alerts for things that exceed normal-ish boundaries, then go to reviewing like once a month or so - you don’t need to be checking your logs hourly unless you have some reason to be actively paranoid).

If you handle everything correctly at the router/firewall level, you’re way way beyond the security of most residential and small business networks. You’re not, you know, impenetrable, but you’re at the point where somebody with experience and resources will have to be trying to break into your network specifically on purpose. If you’re that kind of target then nothing short of an actual SOC is going to help you, and running self-managed servers on your home network is a bad idea.

Exactly correct.

Right now China is supplying military hardware to the Houthis, Iran and Russia (at least). We know they aren’t charging much for the war material. The PRC doesn’t care about the outcome of any of those conflicts, but the impact they’re having on the US, the US’s relationship with its allies, the stability of NATO, the security of Europe… all of that benefits China.

Even if there is no drastic collapse anywhere, even if the end result is that Western nations pull together and develop stronger relationships, China has forced its international rivals to expend extra resources and effort on military assets (as non-US NATO countries and the EU are currently doing), and to react defensively, while appearing to not be directly involved in any of the conflicts themselves. It’s very intentional, it’s a proven effective strategy, it will probably work out well for them.

China isn’t giving shit away for free, and the Houthis are funded by Iran…

True, but China may not be asking for money or anything else in return. The Houthis are acting as a proxy army against the US, and that’s probably all that the PRC really needs or cares about getting from them.

This is nothing new, the US did the same thing in Afghanistan against the USSR in the 1980s, and tried to do it in Somalia in the 1990s.

The UK did it everywhere.

China is just playing the same big-boy international power politics that every other imperialist nation has done in the Middle East since the Romans.

Nothing will change for the Middle East until everyone there starts rejecting foreign influence as a matter of course.

the best device for school is a generic laptop that you can easily find guides and replacement parts for. That way you can fix things

This is the right idea. The qualifier is unnecessary. Repairability is always valuable. The more generic a device is, the more spare parts for it there will be on the market, and the longer those spare parts will be continue to be available on the market.

Buy common refurb/resale tech. Keep it for years, or decades.

memory is impossible dream

Yeah, it’s one of the best reasons to actually RTFM: “How does the guy that designed this think it works? What did they intend for it to do?”

I also find it’s useful when I’m vague on the specifics, especially with network protocols. I might be expecting it to do something and then find out, oh, this doesn’t solve that problem, I’m in the wrong config file.

Well the “critical/irreplaceable” qualifier is kind of important - that’s why I specified it. It’s up to you to decide what that means for your data and risk tolerance.

For everything that I consider irreplaceable, I’m not comfortable with anything less than 100% duplication on the live system, and also an external offline backup. Even with enterprise-grade hardware, I don’t trust storage devices, they’re all destined to fail. Storage is the most important part of a data server, and should be treated like it is constantly trying to light itself on fire, like a library with wooden shelves lit with torches. All the other components are just as unreliable, but more expendable.

Admittedly, when you account for hot standby drives, the cost is that my storage availability is only 40%. A 16TB storage pool is in fact 5x 8TB drives: 2 mirrored pairs and 1 standby. On the plus side, thanks to ZFS and TrueNAS those drives can be whatever, no need to worry about RAID considerations for matched drives. SAS or SATA? who cares? They can even be different speeds, ZFS will compensate. Buy whatever is the right size for the pool, let the system deal with the other issues.

Can you put a price on stability? longevity? peace of mind?

The server hardware is all old repurposed stuff - a desktop build from 2013, secondhand data center surplus, refurbished/used drives, none of it’s worth much and almost all of it is well past end of life, any part of it could fail without warning at any moment. It doesn’t matter, it is highly reliable because the redundancies have redundancies, including the boot drives. Trying to squeeze every bit of value out of the hardware is a losing game because it’s basically worthless anyway, but the same would be true if it were all new top-of-the-line gear. The hardware is expendable, the data is not. Buy more cheap hardware, plan for it to explode, learn how to build stable, recoverable systems.

Used data center drives are great for a home lab. They’re built like tanks for hundreds of thousands of hours of constant operation. Unless you’re running a business hosting a bunch of public-facing websites out of your garage, you don’t have that kind of workload (and if you are doing that you should just be buying new drives anyway and writing them off as a business expense).

Data center drives get replaced when they hit a ceiling of operating hours, with no actual faults, or if they experience any minor faults (it’s a business expense - drives are consumables - data centers have storage rooms of spares sitting around, they just replace them).

Any competent reseller should be able to give you a SMART report, and that should tell you if there are any major issues (generally they don’t get resold if there are, nobody will buy them). If the seller won’t give you a SMART report then obviously don’t buy, they’re either a scammer or incompetent.

If your array redundancy is set up properly then there’s no reason to be “scared” or trust in “good luck”. Assume luck will be bad. Mirror every storage device that has critical/irreplaceable data on it, and have at least one hot standby drive in every pool. Don’t bother with complicated striping schemes to try and scrape a little more storage space out of your drives, that’s dumb. One-to-one mirroring for every drive. Storage drives are consumables. They will fail, not if but when, even if you only buy new. Learn to read a SMART report. Enjoy quality hardware with no real problems at low prices.

Some people chose to not see America.

We’re all trying to find who could’ve done this…

This is basically how Elon responded to advertisers not buying ads on X.

You say you got PEBKAC faults, I feel bad for you son.
I got 99 problems but wetware ain’t one.

Computer networking is basically a completely different field from operating systems and programming, though obviously some of the concepts are relevant. Turns out plugging these things into each other so that they can share information in a useful way is kind of difficult. A lot of very smart people have been working on it for almost 70 years, and frankly it’s still a fucking mess, so don’t feel bad if you feel a little lost.

Starting with the basics is the right instinct, in my opinion. Start with the OSI model:

https://jakarta.telkomuniversity.ac.id/7-osi-layer-the-building-blocks-of-networking/

https://www.geeksforgeeks.org/computer-networks/osi-model-analogy-osi-7-layers-explained/

This helps to break down the actual functioning of the network into logical steps. It’s very helpful when you’re trying to visualize the operation of some of the more abstract bits of the technology stack (like TCP/UDP), and when you’re trying to think through what piece of it might be causing your problem in the moment (the router is on and the cables are plugged in, why is there no connection?). It’s a map that can help you when you’re lost. It’s also a guide to how a lot of people who work on networking technology think, so it can help you understand how things are supposed to work.

Beyond that, Professor Messer is a great resource: https://www.professormesser.com/

If you feel reasonably confident with computer hardware components and various types of cable connectors, you can probably skip the A+ part and go straight into Network+. Because you’re doing this as a home hobbyist (not for the actual certification), I recommend just listening to the courses like you would a podcast. Don’t try to memorize or fully understand everything, just use it to get a grasp of the terminology and purpose of the various pieces.

I also recommend taking on a project to gain experience. Implenting PiHole https://pi-hole.net/ for your home network will cover routing, DHCP and DNS, plus you can do it with a Docker container.

They can always buy more weapons from China, Iran and North Korea.

I don’t know… nukes are not exactly discriminatory weapons… If I were Poland or one of the other bordering countries I might retaliate, because I would probably be affected by radioactive fallout.

This rhetoric seems familiar somehow…

Time for a boycott.

By the time one of these housings is getting phased out, the turbine design is years or decades out of date. The internal components are all going to be different. The exterior of the housing is also part of the airflow design.

Considering the amount of torque being applied to the components in the housing by the rotor, it probably wouldn’t be safe to drill new mounting holes in an old housing to fit a new generator &etc.

It’s common for China to do.

The police operations are generally illegal in the host countries, but they’re “allowed” in the sense that most countries can’t afford to end their economic relationship with China.