cecilkorik

if you are a creator and you’d prefer to not make use of JS (there’s dozens of us) then forcing people to go through a JS “security check” feels kind of shit. The alternative is to just take the hammering, and that feels just as bad.

I’m with you here. I come from an older time on the Internet. I’m not much of a creator, but I do have websites, and unlike many self-hosters I think, in the spirit of the internet, they should be open to the public as a matter of principle, not cowering away for my own private use behind some encrypted VPN. I want it to be shared. Sometimes that means taking a hammering. It’s fine. It’s nothing that’s going to end the world if it goes down or goes away, and I try not to make a habit of being so irritating that anyone would have much legitimate reason to target me.

I don’t like any of these sort of protections that put the burden onto legitimate users. I get that’s the reality we live in, but I reject that reality, and substitute my own. I understand that some people need to be able to block that sort of traffic to be able to limit and justify the very real costs of providing services for free on the Internet and Anubis does its job for that. But I’m not one of those people. It has yet to cost me a cent above what I have already decided to pay, and until it does, I have the freedom to adhere to my principles on this.

To paraphrase another great movie: Why should any legitimate user be inconvenienced when the bots are the ones who suck. I refuse to punish the wrong party.

They both have their place. WebDav is an established standard, by implementing it you are collaborating with all the other implementations that already use and are compatible with WebDav in some way. You join a growing ecosystem of many choices and people can easily plug your software into their architecture and plug their architecture into your software with an absolute minimum of work on their part, potentially allowing it to become widely used. This is good.

Having a socket and API allows anyone who wants to, to collaborate with your software specifically, allowing them to be able to do things highly specific to your software, but requiring more specialized work to implement. These kind of implementations can deliver great functionality but they’re likely going to be few and far between because they are more work to develop and maintain. These are very different situations, being sought by different people with different goals.

Not with the protections that Cloudflare provides, no. The DNS itself can be self-hosted, yes. You will likely have even more downtime from your own problems and screw-ups than you will from ever using Cloudflare. There is likely little practical benefit. But I don’t think it’s as hard as people make out. So without further ado:

##The really simple guide to self-hosted authoritative DNS:

###Step 1: glue and static IPs (the hardest part)

“Glue records” are used to tell the root servers about your authoritative servers, and very specifically, what IP they have. For reasons that will become obvious, this needs to be a pretty static IP if possible, because the glue records will need to be changed whenever your authoritative DNS moves. Two or more authoritative DNS servers are “recommended” and in some cases assumed, but for self-hosting purposes it’s really over-encouraged in my opinion. A single authoritive DNS is not ideal, but neither is self-hosting with limited resources, which is something we all do. Worst case scenario, if they force you to have two DNS servers, just use different names and set them to the same IP, that usually works. You do not need to (or want to) use glue records for ANY other DNS entries, IPs, or any normal day-to-day changes to your DNS. Only if your static IP changes.

“Glue records” are typically not hard to update, but they do often take quite a lot of time, called “propagation delay” and during that time, your DNS will be intermittent or down. In modern times I find the propagation delay for glue records is sometimes a matter of minutes and typically less than an hour for like 90% of users, but it can be up to several days in the worst case scenarios. This is why static IP is important, changing your glue records is free to do but very disruptive.

In order to actually do this, get a domain from, or transfer your existing domain to, a registrar that lets you set up glue records for self-hosting authoritative DNS. This is effectively not self-hostable, this has to be done through a registrar. In my experience, this is most of them that aren’t big-names. Cloudflare is a notable exception, you should not be using them as a registrar for self-hosting authoritative DNS. I have used misk.com for decades and am happy and familiar with them, and they call these custom nameservers. I have heard the best reviews lately for porkbun.com and their documentation for the process is here](https://kb.porkbun.com/article/112-how-to-host-your-own-nameservers-with-glue-records) but I do not use them personally. “The best” is a moving target, anyway. In any case, review the documentation and support for your chosen provider to figure out how to specify a glue record, which in almost all cases is as simple as putting in a name (the traditional old-school choice is “ns” or “ns1”) and an IP address associated with that name, which you will then use to specify as the “nameserver” for all your other domains. There should be no additional charge for this. Once it’s “glued”, then you wait. Eventually, it will start working, and third-parties outside your network will be able to ping that ns1.yourdomain.com address and get the IP you specified.

###Step 2: the DNS servers

You’ve done the “hard” work of getting the glue pointed at your IP, but that’s just a single DNS name and a single IP, and you’re not actually self-hosting anything yet. Now you have to make sure an authortitative DNS server is responding on that IP so people can get all the real details for any and all of your domains right from the source, YOU, authoritatively. That’s why it’s called authoritative DNS, you are the final authority for your domains and everyone knows it thanks to those glue records.

This is when you fire up a DNS server, the standard traditional choice for old grumpy curmudgeons like me is “bind” (version 9) to be specific, which has all kinds of crazy functionality that you don’t really care about because all you’re really going to be using it for is to read a text file called a “zone” file for each of your domains, which has an ugly archaic format but at it’s simplest is just an $ORIGIN line saying what domain it is, a $TTL line (how many seconds other DNS users are supposed to cache things before coming back to you to check if its changed), the SOA line which is a mess of stupid arbitrary info most of which is irrelevant these days and in this configuration, then a whole bunch of lines with other records (mostly A records for IPv4 addresses, but there are plenty of other options for different types of DNS records for various purposes)

So, install bind9, add a zone into the configuration for each of your domains that has type master; and file "/your/zone/file/path"; and create each text zone file for it to read. Then reload or restart bind, and your DNS should just start working.

It’s not magic and it’s really not that complicated, it’s just telling someone to start pointing your domain at your server’s IP, and then running a program on that IP that turns turn some text files into DNS. Then you can go ahead and make it complicated, if you want. There are lots of ways to make it complicated. This isn’t one of them.

###Conclusion: Why and why not

Cloudflare brings a lot of value to the table, which is why they’re so popular, but there is a cost for that. They need full control of everything and have it running on their own networks so they can protect it from DDoS and other attacks. They’re your bodyguard, they’re standing in front of you to protect you from bad guys, but the downside is, you’ll always have that guy standing in front of you. It can be kind of annoying. It’s a question of priorities. If you want to self-host your DNS, you’re effectively giving up Cloudflare’s protections. If you want Cloudflare’s protections, you’re effectively giving up self-hosting DNS. Your call, either way.

Self-hosting my own DNS, I have little to no protection from DDoS attacks. Sure I get hammered by the occasional password attempt bot or data scraper that makes my server slow and overwhelmed, that mostly gets dealt with manually or with defensive monitoring tools like fail2ban. A larger, more targeted or sophisticated attack could easily wipe my sites off the internet and probably even my intranet. If it didn’t stop, my only resolution would be to unplug the targeted machine or machines from the internet. Maybe unplug my whole network. And just wait it out. Maybe I’d have to rely on my phone hotspot, or even change ISPs if it refused to stop. I actually don’t know, because it’s never happened. If I was hosting anything controversial or highly lucrative, I might have a different experience and I might make different choices. But I’m not, I’ve never been attacked on a large scale for a long duration and I can’t really imagine any motivation or purpose that I ever would be.

Hate has to be taught. That’s the difference between children and fascists. As children they usually haven’t been taught how to hate yet, once they get taught to hate they can become fascists. Or they can learn to think instead.

On a similar but unrelated note, Lemmy also displays the two-hyphens as an em-dash, but unlike the trailing slashes, it does not encode that into the comment, so on piefed you still see the two-hyphens in both comments.

Fun!

And posting from piefed, is the result the same?

https://piefed.ca/ – has a trailing slash https://piefed.ca – does not

That is kind of the UNIX philosophy at work and you’ll find that in a lot of open-source and self-hosted projects. The goal is to do one very specific thing really well in a small and streamlined package that integrates into other processes in a clear, defined and transparent way, not to be one of these super-convenient but bloated “it does everything and the kitchen sink” behemoths. It’s a different style of software development but it’s popular in the open source community for a lot of reasons, for example it’s a lot more maintainable by a single person or small team with limited time. You’ll find most of these large complex open source projects are organized and developed by companies (like Pangolin is), while the smaller UNIX-style projects are often written by individuals or very small teams volunteering their spare time. There are tradeoffs in either direction, but for self-hosting I think following the UNIX philosophy has a lot in common with a typical goal of self-hosting, reducing your dependence on for-profit companies that have a financial incentive to enshittify or otherwise try to squeeze money out of you.

Do it the other way around then. All devices have youtube blocked by default UNLESS you have a reserved DHCP where it is allowed. I imagine if the former is possible, the latter should be possible too.

Assuming it’s compatible with the hardware at all, it should. You would have to install it on the Proxmox host itself, but Proxmox is basically just Fancy-Debian-for-Virtual-Machine-Hosting and it has Debian packages so that shouldn’t be a problem. Login to the Proxmox itself and install it there.

The US has a “left” it has just been beaten into submission and told to vote for D or it gets the hose again. And I think now it’s realized it’s not alone, and it’s fighting back. This country fought a war to depose a king. This country fought a war to end slavery. This is a country that has spent basically all its history trying to protect itself and others from what exactly is currently happening. Yeah obviously they didn’t do a great job stopping this earlier, but this is not a country that is going to let itself be taken over by conservative right-wing religious fascist authoritarianism, despite the current evidence to the contrary. The country just needs a little time to remember who it really is and shake some of the rust off, because yeah, it’s been quite awhile since any of us in the west actually needed to fight for anything significant in our lives. But I also think it’s silly to expect we won’t. I don’t think the great American experiment is over, I think it’s going to continue and we’re going to see how that actually works.

Maybe I’m wrong, but there are still way too many good people down there, and there are good people outside the US who want them to succeed too. The real fight will come eventually. It’s anybody’s guess when, where, and how. They may be down right now but don’t count the US out just yet I think they’ve still got lots of rounds left in them.