Also, I’ve never been able to understand how something exposed to the entire internet (a WG server) is considered more secure than something that only connects peers privately to each other.

The attack surfaces are nothing alike.

Even if you limit access to WG with IP blocking there’s still no comparison to something you can’t access at all from outside.

With Migadu you can send email as anything you want @yourdomain, as long as you use the correct credentials (user+password) for SMTP. You don’t have to set up anything in advance, you just modify your “From” in the mail client. The “From” addresses don’t have to bear any relation to any alias or pattern or existing mailbox, just have to be @ the domain associated with the SMTP login. It’s entirely your problem if the address doesn’t make sense and whether the recipient will be able to reply.

There are mail clients that know how to work with this and let you set up multiple sender “identities” that are basically bookmarked “From” addresses. Migadu’s webmail also has this feature (not sure what webmail app it is, HTML source code says “SnappyMail”). But as long as the email client lets you edit the “From” field you can always change this on the fly.

I’m mostly done with video streaming but music discovery is still something I’m exploring. I got some good leads, just need some time to try them out.

But then there’s the separate issue of devices that can act as media renderers over LAN when attached to a TV screen and/or speakers. It’s not easy to find such devices that are capable, non-expensive and respect privacy.

Yes, you can send each pattern to one mailbox or to multiple.

Migadu will probably fit all your requirements.

Services that support multi-user accounts, where I can be the admin and manage our domains.

Migadu pricing only cares about storage space used and emails sent/received. You can have any number of domains or mailboxes or accounts otherwise, and there’s a lot of features and flexibility for the admin.

Ability to assign domains for specific user accounts.

Not sure how exactly you mean this but it’s probably more flexible than you intend. You can create any number of mail accounts under any of the domains you add to it.

Ease of use for users to create aliases on the fly within the password manager.

They have a thing called “pattern rewrites” that could be better called “wildcard aliases”. Basically you can have aliases with both variable and fixed parts. For example “shop-*@example.com” will receive email sent to “shop-amazon@” and “shop-walmart@” but not to “amazon@”. It’s a sort of catch-all’s, but mitigates some of the downsides of an actual catch-all because outsiders can’t guess what’s your fixed part of the alias.

They also have regular aliases, domain aliases, catch-all’s and some other stuff.

I typically use those wildcard things for all my needs.

European hosted and privacy focused, with good encryption.

They’re Swiss-based and committed to privacy.

Regarding encryption, if that’s a deal-breaker to you I’d urge you to reconsider. Encryption for email-at-rest is a gimmick. There’s only a handful of providers that even attempt it, because it’s nonsense, but if spinned right it appeals to the public. You will get away from Proton only to get locked down by Tuta or… actually I don’t remember if there was a 3rd.

Preferably open source clients.

You don’t want open source clients, you want standard protocols (IMAP and SMTP). You can use any standard mail client with those protocols, both open- and non-open-source clients.

The problem with “encrypted email” is that it doesn’t work without putting it through non-standard protocols, which lead directly to lock-in. So they’ve spinned it so that you need a “special client” to work with it. But whether Proton’s special client is open-source or not is irrelevant, because they can close down their non-standard protocol at any given moment and close source the client and your mailbox becomes their prisoner.

All you need is a provider with regular IMAP and SMTP, and when a provider starts acting up you can switch to another one with regular IMAP and SMTP as fast as your domain(s)’ DNS can propagate.

I’ll need to wrap my brain around this approach with sendspin / music assistant. But thank you, it looks very promising, and I already have a Linux server for the docker version to run in.

Can’t cut it from the internet, it needs it in order to play music streams.

That’s the problem with stream player devices (Chromecast included), you can’t isolate them and they know it. 😕

Anyway point taken, my next speaker will be Bluetooth only.

But what’s a decent alternative for a wifi-enabled speaker that won’t pull any shenanigans?

Or is the only solution to forget about wifi and use bluetooth-only speakers?

Any EU/Swiss-based provider that takes their job seriously, really. Here’s a starting point.

Proton’s encryption has always been more a publicity stunt than anything. A service that’s really committed to privacy shows it in their values and the way they act, not with technological gimmicks.

All that Proton’s encryption has really accomplished is that their services are one step away from complete customer lock-in: if they discontinue their “bridge” connectors tomorrow and force you to use their website and mobile app, and you haven’t backed up your email elsewhere, you’re fucked.

Migrating your email service to another provider should normally take one hour, provided you use your own domain(s) and back up your mailboxes regularly over IMAP to your own storage. Then it’s just a matter of changing some DNS records and waiting for them to propagate.

So call me paranoid but I’ll never use a provider that doesn’t offer standard IMAP and SMTP access to the mailbox.

Google started as a search engine and ad company, and has since reinvented itself with investment in new areas like photos, email, Android, etc.

There’s really no point in comparing Google to Yahoo. Google actually developed a solid strategy fairly early on, which involved (1) collecting data from any source possible (all their services are designed around collecting data), (2) selling that data to advertisers, and (3) (very important) creating and owning platforms (Android, Chrome, Youtube, Pixel, GCP etc.) that allow them to not depend on anybody else.

Yahoo owned so many interesting services at some point or another over the years it’s absolutely insane.

Some Yahoo-branded services that spring to mind (really just off the top of my head) are things like the Yahoo Directory (larger than DMOZ at some point), Search (more popular than Google at some point), GeoCities, Maps, Mail, Messenger, Groups, Games (online boardgames) and Answers.

And then there’s all the stuff that wasn’t Yahoo-branded, which includes some absolute bangers like del.icio.us, Flickr, Tumblr, AIM, MapQuest, RYOT, or fucking AOL and Netscape(!)

It boggles my damn mind that anybody could own and squander that much stuff. Properly managed they should have been an internet service giant today.

Why not use PHP hardened (distroless) images as a base for the final image?

Why build your own images at all? I’m not sure I understood what advantage that gives you.

Harbor looks interesting but that install procedure is ridiculous. Why would I run an installer script just to pull docker images, just give me a compose file ffs. The only way I’d ever consider it is inside an LXC container or a VM.

Also, it sounds like they’ve never heard of a reverse proxy and don’t know you can do TLS that way? That does not inspire confidence.

In my case I have defined a fallback in Caddy so any request that doesn’t match one of the explicitly handled domains will be an error.

I use a route {} block with handle {} blocks inside it, and the last handle has an error directive in it.

https://*.example.com {
  route {
    @foo host "foo.example.com"
    handle @foo {
      reverse_proxy http://whatever:12334/
    }
    ... more proxy hosts ...
    handle {
      error 400
    }
  }
}

The route block is essential here because handlers inside a route block are processed strictly in the order they are defined. Outside route blocks that is not true, caddy will try to optimize and can execute directives in any order it sees fit.

Yeah I can understand small self-hosters having maybe a handful of domains but some users were coming in with thousands. I mean if you have thousands of domains there’s obviously something else going on and maybe you should be paying someone for that.

If they find anything we fix it, update our services, and move on.

The chances of being hit by a zero-day as a random self-hoster are very small, but anyway if you keep backups and can restore a clean state (and patch your system) you should be good.

The goal is not to have perfect security, it’s to mitigate the risks and to handle fallout correctly.

I also practice domain/IP obfuscation in addition to high port:

• TLS certs are wildcard certs, so bots can’t get my subdomains from transparency logs.
• My DDNS IP is on a subdomain (random string) not on the base domain.
• My public services are also on random subdomains, CNAME’d individually to the IP subdomain.
• There is no wildcard CNAME that the bots can query to get the IP.

This eliminates scanning almost completely. They can’t find an IP to go with my base domain, first of all. And even if a bot is scanning the IPv4 address space and all the ports and it finds the reverse proxy it can’t get past it without knowing a FQDN. I still get the occasional hit from such bots but it’s very rare.

Also, all my public services are secured with mTLS (preferably) or at the very least a long key in a custom HTTP header (both enforced at the proxy).

Get a .nl and call it a day?

the exploit has been out for over 10 hours

According to the PHP Foundation the OOM vulnerability was originally found by the security audit they commissioned back in 2024.

They never fixed it because there was no working exploit at the time and also because all the fixes had important downsides and they went into decision paralysis.

I do believe that two years is plenty of time for someone to figure out a working exploit, especially with AI assists.

Bottom line, the timing of this recent debacle is centered around the moment that the PHP Foundation decided to finally eat crow, not around when the exploit was actually available. The embargo was just for spectacle. PHP circles are already spinning it as “see how important PHP is, how much of the internet runs on it, how it’s critical infrastructure”.

Yeah, they still host for free. I think they’ve limited the amount of domains you can host per account though, again due to abuse because there were actors that were bringing in thousands of domains I believe. But if you just want to host one domain it’s fine.

The API makes the difference (vs DNS services at the registrar), DeSEC is well supported by most tools so you can do DDNS and DNS-01 with it without problems.