Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
In the AI evolution we find ourselves in, I have long looked at the very real possibilities of AI being used in a cyber attack. It's is an obvious tool to me to use in such attacks. I am quite certain governments are experimenting with such capabilities. Where we used to use the old wardialing and sophisticated bots to jam communications when engaged in conflict, we would replace that with AI. I think that would be a natural progression of technology. For one, AI is relentless. It can find even the most minor soft spot in the 'armor' as it were, when programmed to do so.
We now use AI to find vulnerabilities in software like Linux which basically underpins the entire global internet infrastructure. It would only be obvious that nefarious actors, governmental or otherwise, would also use AI. It does present a lot of issues, but I honestly do not view this as alarming in as much as I see it as a natural technological progression. All technology since the dawn of time wields a double edged sword and that is inescapable.
I've long said AI desperately needs governmental regulation as much as I chafe against regulation which, in the hands of government, usually devolves into over regulation. Right now, it's a wild wild west from AI rice cookers, to cyber attacks. Some look forward to the AI bubble bursting with glee. However, all that means to me is that the pieces left will be retooled into something else as history has revealed time and time again. I don't think it's a fad. I don't think it's going away. It may evolve into something else, but at it's basis, I think AI is here to stay regardless of grassroots opposition.
Governments are captured by these companies. Any regulation would undoubtedly benefit these companies at the peoples expense. Right now, the best solution is probably open research and open weight models to keep the field level.
Curious to know how self hosters can use local ai to find and repair/mitigate vulnerabilities on their personal networks. Anyone working in this space?
So far the only real vulnerabilities that Ai have spun up seem to be really obscure edge case privilege escalation bugs that have been around for ages but nobody discovered. They then get patched in days if not less. I would expect them to run out of low hanging fruit pretty soon.
Most of them can even be mitigated by preventing local access to a system.
There's tools to audit your network and systems. You can setup a SIEM like Wazuh. It'll tell you the same kind of stuff that have been good practice for a while and mitigate most of the ai assisted vulnerabilities.
Wow! That is a very intriguing question, and one that I have never considered before. Just spitballing here but you could possibly use trad apps like Lynis, Greenbone, Nikto, etc. These apps often produce rather verbose and sometimes cryptic output, i know Lynis sure does. So, you could use a prompt like:
'You are a security analyst. Review the following Nmap scan results. Identify services running outdated or potentially vulnerable versions, suggest likely CVEs, and prioritize findings by risk.'
Then use something like llama3.1:70b, mistral-nemo or deepseek-coder-v2, and pipe your security scans into your local AI. You could feed it your NGINX, docker configs, pFsense firewall rules in and ask the model to audit them.
IDK, that's a very good question I think. It'll be interesting to see what others have to comment.
I've done this (asked a frontier model red team my server), and it just gave me false alarms that I went investigating and weren't really issues (would've been an issue if I had a very specific configuration, but not generally). They produce a lot of noise, so you still have to somewhat understand what you're looking at/for. It didn't find any legitimate issues, which is good I guess.
I'd buy that. I mean, Lynis produces volumes of info, not all are really related to your server.