Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
Eh... I have my own repo that pulls the PVE repo and updates a bunch of things to how I want them to be and then runs a local version of the main page. While I don't stare at every update they make... There's likely enough of us out there looking at the scripts that we'd sound some alarms if something off was happening.
Which puts you ahead of the curve. But you are still depending on enough other people to be watching every update and so forth.
I am not saying I am much better. But it is one of those things where anyone considering the selfhosted Fun should REALLY spend some time dealing with software supply chains and the like. Too many people just figure "it is open source so it is safe" or, even in this thread, assume something is more or less safe based upon what app pulls it.
Sure, but my point is that it's no different to an AUR/user repo. At some point you're just trusting someone else.
I think the whole "Don't put bash scripts into a terminal" is too broad. It's the same risk factor as any blind trust in ANY repository. If you trust the repo then what does it matter if you install the program via repo or bash script. It's the same. In this specific case though, I trust the repo pretty well. I've read well more than half of the lines of code I actually run. When tteck was running it... he was very very sensitive about what was added and I had 100% faith in it. Since the community took it over after his death it seems like we're still pretty well off... but it's been growing much faster than I can keep up with.
But none of these issues are any different than installing from AUR.
The rule should just be "don't run shit from untrusted sources" which could include AUR/repo sources.