Top all-time · #16048
Noah Bailey
Personal blog · nbailey.ca/postsystemssecurity
Noah Bailey's personal blog at nbailey.ca covers systems and security. Since 2020, 4 different Hacker News readers have linked it 25 times, most often “Simple server alerts on a need-to-know basis”. It is still writing: the last post was on 2026-07-01, and you can follow it by feed.
Kubernetes is our generation's Asbestos.
Most-linked posts?
- Simple server alerts on a need-to-know basis2 people · 3 mentions · first linked 2021-12-20
What Hacker News says?
I resisted for a long time, but after finding that there is no good home router that doesn't have major security drawbacks I decided to just build my own [1]. It's a bit of a chore to set up but works better than any off-the-shelf device I've ever owned. I run Debian, but I've heard other people using OpenBSD with great results as well; it's all about personal preference and what you're familiar with... [1] https://…
Comment linking /post/linux-firewall-ids
on “Ubiquiti Networks Breach”Submitted Windows 11 will create heaps of needless trash as a story · 293 points
HN discussionI do something similar. Any hits on the default nginx vhost get logged, logs get parsed out and "repeat offenders" get put on the shitlist. I use ipset/iptables but this can also be done with fail2ban quite simply. https://nbailey.ca/post/block-scanners/
Comment linking /post/block-scanners/
on “Ask HN: How did the internet discover my subdomain?”Submitted Block web scanners with ipset and iptables as a story · 110 points
HN discussionThe state of all network firewalls/routers is appalling. Even high end Cisco, Fortinet, or even Palo Alto gear is riddled with security issues, critically outdated packages, and general poor maintenance. IMO, the only way to have a reasonably secure device is to build it yourself. That's not going to be a popular opinion where the prevailing motto is "nobody gets fired for buying Cisco", but I don't really see any a…
Comment linking /post/linux-firewall-ids/
on “Avoid Consumer Routers”Submitted Monitor Radiation with a Raspberry Pi as a story · 82 points
HN discussionA super easy way to protect yourself is to just block any IP that hits `/.env` or `/wp-admin`. I've taken this as far as to ban any IP that hits my default vhost (hitting the IP instead of actual hostname) more than ten times, and I get about about 99% less scanners and spam as a result. https://nbailey.ca/post/block-scanners/
Comment linking /post/block-scanners/
on “Exploiting CI / CD Pipelines for fun and profit”Submitted Simple server alerts on a need-to-know basis as a story · 62 points
HN discussionI've found that the most effective way to secure a webserver is to just block any IP that pounds on the default vhost by IP. No WAF, no fuss. After a few months of building up a denylist, I get almost zero hits from scanners and spambots. https://gist.github.com/noahbailey/474922b752ee733d639c91e27... https://nbailey.ca/post/block-scanners/
Comment linking /post/block-scanners/
on “Discouraging the use of web application firewalls”Submitted Making VoIP Calls with Antique Rotary Phones as a story · 45 points
HN discussionIf you're willing to put an afternoon's work into it, you can easily and inexpensively build a home surveillance system with ZoneMinder that stores all data securely and safely on-prem. The cops can still take it, but it requires a few warrants to do so. Shameless plug -> https://nbailey.ca/post/nvr/ But it's also important to only record what you absolutely must. I think putting CCTV cameras inside your house is in…
Comment linking /post/nvr/
on “The privacy loophole in your doorbell”Submitted How to Turn Anything into a Router as a story · 28 points
HN discussionFrigate is very good: https://frigate.video/ Personally, I use Zoneminder: https://zoneminder.com/ Zoneminder is very "janky" but predictable. I set mine up about three years ago, and it's been nice and boring since: https://nbailey.ca/post/nvr
Comment linking /post/nvr
on “Ring owners are returning their cameras”Submitted Simple webserver protection with OSSEC and Suricata intrusion detection systems as a story · 15 points
HN discussionYou can use basically any hardware. I've done it with trash-picked laptops and USB ethernet adapters. Best option these days is a N100/N150 mini-pc with multiple NICs onboard, but with the price of everything going up maybe trashpicking will make a return. https://nbailey.ca/post/router
Comment linking /post/router
on “Tenda firmware (multiple versions) contains hidden authentication backdoor”Submitted The spelling error made 200B times a day (2025) as a story · 2 points
HN discussionSubmitted The Cursed Certificate as a story · 2 points
HN discussionSubmitted The Zeroshell Botnet Returns as a story · 2 points
HN discussionSubmitted Our mostly disposable and stupid world (2021) as a story · 1 points
HN discussionSubmitted Simple server alerts on a need-to-know basis as a story · 1 points
HN discussionSubmitted Simple server alerts on a need-to-know basis as a story · 1 points
HN discussionSubmitted Castles, alligators, machine guns, and mail as a story · 1 points
HN discussionSubmitted Domesticated Kubernetes networking – Making it work on bare metal behind NAT as a story · 1 points
HN discussionSubmitted ElasticSearch broke all my nice things (a story of cascading failure) as a story · 1 points
HN discussionSubmitted A new botnet is targeting network infrastructure – but this time we got lucky as a story · 1 points
HN discussion