this post was submitted on 03 Mar 2025
56 points (98.3% liked)

Selfhosted

59923 readers
560 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam.

  3. Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.

  4. Don't duplicate the full text of your blog or git here. Just post the link for folks to click.

  5. Submission headline should match the article title.

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
56
How do you keep track of vulnerabilities? (lemmy.world)
submitted 1 year ago by ueiqkkwhuwjw@lemmy.world to c/selfhosted@lemmy.world
37 comments fedilink hide all child comments
 

I'm having trouble staying on top of updates for my self hosted applications and infrastructure. Not everything has auto updates baked in and some things you may not want to auto update. How do y'all handle this? How do you keep track of vulnerabilities? Are there e.g. feeds for specific applications I can subscribe to via RSS or email?

you are viewing a single comment's thread
view the rest of the comments
[–] lambalicious@lemmy.sdf.org 2 points 1 year ago

Regarding things like dockers and flatpaks, I mostly "solve" it by only running official images, or at least images from the same dev as the program, where possible.

But also IMO there's little to no reason to fear when using things like flatpaks. Most exploits one hears of nowadays are of the kind "your attacker needs to get a shell into your machine in the first place" or in some cases evn "your attacker needs to connect to an instance of a specific program you are running, with a specific config", so if you apply any decent opsec that's already a v high barrier of entry.

And speaking of Debian, that does bring to mind the one beef I have with their packaging system: that when installing a package it starts the related services by default, without even giving you time to configure them.