Post

this PHP apocalypse is further affirming my idea that easiest threat posture is simply assume patches will not come in time and act like the box is already compromised. no secrets stored at-rest unencrypted, no secrets in nix store, no secrets in argv or cli history or clipboard or terminal output

this is really easy for me with nixOS because killing a machine and then rebuildinh the exact same machine from first principles other than losing files in /home/ is a five minute action (longer if I need to format a disk), and part of why I learned it in the first place but it's very overkill

tailscale always feels like a great solution until you realize it kinda means revealing your entire lan to the Internet if your device gets compromised, unless you do extra configuration

As my ass was thinking about configuring WireGuard like ten minutes ago

to be clear to people who don't know much about computer security: you don't have to worry about it this much, I just have a lot of web facing stuff that's selfhosted. it is worrying, but this is more about like, the future and not now