quaff

Sometimes your connection might not work correctly, and you’re not connected to your secure network. Like how VPNs will have kill switches (prevents you from accessing the Internet if the connection to the VPN isn’t successful) to prevent leaks during those spotty connections. Without HTTPS, during those spotty connection times, you’re sending your auth/session details plain-text on an unsafe network.

Yep! Definitely don’t add any of your internal domains on public DNS services. Be careful requesting SSL certs for the child subdomains too. They will show up on transparency logs like on shodan.io. Use internal DNS, and wild card certs for these things. And obviously, do not expose your ports publically.

Always use HTTPS. Especially if you’re using your services on mobile.

Imagine you’re on your friend’s WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to attempt requests to your internal services and sending auth/session token details along the requests.

A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those services are written.

This all may sound a bit paranoid, but it is what we are trying to mitigate here.

I have been selfhosting miniflux, and using Capy Reader on Android. Been using this for almost two years now. It’s been great.

Mostly use it for news and blogs. But I follow some lemmy community and mastodon feeds with this as well. Anything with an RSS feed can be followed.