You’re determined that I worry about my public server aren’t you? Your initial question wasn’t actually a question, but just a trap for you to lure me into to be converted to your way of thinking?!?! rumbled! 😂 There are always experts to quote for any argument. Personally, I don’t feel any more vulnerable than before ai decimated the security landscape.

Maybe not, but maybe, just maybe, the people with these exploits aren’t running round attacking Joe bloggs personal photo album server to steal some photos, but in fact are only using the exploit very carefully and sparingly so as not to be detected, and only targeting high value and highly confidential services, where even if they were hacked or a specific exploit was deployed, either are too big to notice, or to proud to divulge the fact they lost some data 🤷

To me there is no increased threat landscape. The world is a scary place, full of baddies trying to get you. Since the dawn of the internet there has been vulnerabilities being found and used maliciously. Just because the big tech sota models are shouting about how great they are by finding them, giving them some nice free marketing, doesn’t mean that much has changed.

Ok, ai has increased the frequency and amount being found, but that is equally increased both for malicious and cybersec, so it essentially cancels out.

My server is public facing and secure, so that both myself, family and friends can use it, especially for the less tech savvy.

10000% correct! I bet the NSA or KGB has had that PHP exploit for close to a decade and they are gutted its finally been patched! There are probably an infinite number of vulnerabilities in currently running servers and clients, a few 100 will already be known and being quietly exploited. Yes, ai will find some completely unknown ones for malicious actors, but it will also find those same ones for cybersec bods, so effectively cancel each other out.

Thats exactly what all this is. If the SOTA models find a “critical” vulnerability every month or so, they get a huge shout out in the news and press globally which is some really appreciated and positive free marketing. Yes, ai has changed alot of things, some for the good some for the bad, but i dont feel like online risk has changed massively. AI finds vulnerabilities for milicious actors and cybersec bods quicker and more regularly than pre-ai, but both sides have the same tools so the same improvements, net effect is they cancel each other out. Anybody with serious about there stuff online already has sytems and processes setup to deal with patching stuff immediately. i barely touch my server for maintenance, just check stuff when im bored and make sure everything is doing what it should.

I have no idea what you are on about. What do you want me to do? Turn the internet off? Lock my doors and not leave the house? Sit here crying and quivering because the world is gonna end? My head is deffo not in the sand, I’m looking out the window at the rain, enjoying my life, looking forward to tomorrow.

I’m not worried about my web server any more today then I was last year. It’s a web server, it’s not me or my life, yes it how important stuff, but if the world ends it’ll be the last thing I think of.

My web server is as safe as it needs to be. Thanks for your concern.

Ai tomorrow better than ai today? Yes, that is true any day of any year. I don’t get your point 🤷

A vulnerability was found, that vulnerability was patched. I think it’s great news that vulnerabilities are being found and fixed faster than ever. Do you agree?

To be fair, my server has been public facing for the entire time these ai models have been finding vulnerabilities.

I’m not worried. I have auto updates on and have a well hardened setup following all the good basic principles. I have had a fully public facing server for years with no issues. My php was patched and updated totally automatically a few hours after the update became available. My web server is extremely low volume traffic and there is hardly any reason for random people to be using it, so chances of somebody attempting something against it at just the right time a vulnerability has been discovered but not patched is very low chance. When a critical vulnerability appears, hackers are going to target the big fish for big wins initially, even so, it takes effort to turn a vulnerability into an actual exploit and deploy it. I could step out my front door and get run over by a bus, but I don’t worry about it and stay on doors all day to mitigate the risk.

Yeah, I know how to do that very easily, but I don’t want to have my pc running 24/7 just so I can use the llm when I’m out of the house. My heaviest use is at home. It’s a large power requirement for minimal use.

Yeah, I have a fairly useable setup although it’s only accessible on my lan. I have a web server but it doesn’t host the llm as it’s not powerful enough.

Rx7600 8gb vram GPU 5700x CPU 64gb 3600mts ram

Hosting ornith 35b a3b iq4_xs Llama.cpp server Pi harness or llama.cpp webui Searxng web search Coding sandbox Restricted filesystem access

Get around 40 tok / sec and it’s really useable. Not as good as Claude sonnet, but good enough for most things.

My always on server hosting 20+ services draws no more than 50w at peak during the night backup, but that lasts maybe an hour or so, normally runs nearer 5w-10w when the hdd’s are spun down and unmounted 22 hours a day. I use an Intel n97 CPU in a mini pc. Navidrome, immich, adguard home, Lemmy, find my device, forgejo, file browser quantum, sterling pdf, valutwarden just to name some of the services it runs easily. Paying 22p per kWh in the UK.

Anything slightly better than a potato will run all of that except the llm’s. To have a useful llm you need to spend circa £1k on a GPU and even then it won’t come close to Claude or chatgpt. Skip the llm’s for now. Just get yourself a solid little server to do everything else you need. Add dedicated hardware specifically for llm’s in future if you really want to. An old used gaming pc will be plenty for your server. I personally use Debian , but there are loads of suitable options available

uk can go to 13A peak load on the standard 230v socket, but drawing that for a prolonged period will nuke the socket. 10a prolonged is perfectly safe in the uk.

No, I have the file system mounted to my pc with sshfs. My pc comes on and my server gets mounted in fstab using sshfs, and then I can use anything on my pc to interact with the files and data just like it was directly on my pc. I use WebDAV for my android phone to be able to access office files with only office. I also have file browser quantum on the server providing access through a web interface to the files.

Instead of installing a massive all in one solution, why not install individual services specifically to cover your requirements? Navidrome for music consumption, synching to actually sync files, WebDAV and OnlyOffice for office docs, VLC, Kodi or jellyfin for video consumption, immich for photos, etc.

It will end up being much lighter and more specialised

Ive been self hosting for years, have a 24/7/365 web server public facing, with 20+ services hosted, including a Lemmy instance. No formal education, qualification or any actual experience in any way. Never had a single course or anything. I work as a commercial manager on complex and large infrastructure construction and engineering projects.

Setup a matrix or xmpp server for the messaging.

Welcome to the club! I too have an fyi tld!

I set my Lemmy instance a couple of weeks ago. But hosting isn’t new to me so wasn’t a huge hurdle.

im on a basic uk isp, with no fancy router, just the isp provided one. i have a fully exposed web server, im even hosting a lemmy server. Thats my domain, radiantfig.fyi, totally public, has been for nearly 2 years now. From that you can get my servers IP address. My IP is dynamic, changes roughly every 6 weeks. I have a ddns script that updates my server IP address to my domain name provider automatically. I have certbot running updating my TLS certs with lets encrypt, and if a cert dies or fails or is compromised, my server will refuse to serve. Everything is behind an nginx reverse proxy through port 443. I also have an ssh port open on a random port. Have fail2ban setup fairly aggressively to prevent brute force attacks, and have crowdsec which also kind of does the same but in a slightly different way. the internet requires ip addresses. to protect your ip address you have to give somebody elses. that somebody is a 3rd party you have no control or say on the decisions they make. i must have over 20 individual services that are public facing. 3 fully federated, lemmy, forgejo and matrix. Im as secure as any other website. nothing is unhackable, no matter how far down the rabbit hole you go. its all just layers of difficulty.

The important thing is dont listen to random internet people about security. dont listen to me. dont listen to anybody who tells you they know best. do your own research, understand the options, the risks, the compromises. only then do you put anything up. but if you are going to anxious or worried about your server and data, no amount of security guarantees you safety, so be warned.