Comment by old-gregg | Hacker News Reader

Comment by old-gregg | Hacker News Reader

I care about owning my own data very much. This makes me conservative when it comes to these solutions, despite otherwise being an early adopter of everything tech.

For that reason I always recommend Synology NAS machines. They have been around forever, they work for years on autopilot and feel very similar to a microwave in terms of operational overhead. One-time purchase. No subscriptions. But most importantly, the ecosystem is stable and mature. And they are easy to understand and reason about and come with a slick UI with mobile apps. My favorite feature is having my massive photo collection always available on my phone, served from my own basement (with encrypted AWS Glacier backups).

[EDIT] This is Brandon Phillips of CoreOS fame sharing this! Maybe I should take a closer look then.

Synology boxes phone home, to Chinese IP space no less.

> to Chinese IP space no less

What's wrong with this?

Is the phone home to Taiwanese IP space, or mainland China IP space?

I think it's important to point out Synology is a Taiwanese company, not Chinese.

for now...

The device in TFA seems to primarily serve as a mailserver.

AIUI that's not really what a NAS does.

How do you access your NAS remotely? Does it end up creating some kind of backdoor into your network with cloud support? That makes me nervous…

In a very boring and traditional way: you buy a domain name, configure dynamic DNS, and then use port forwarding in your home firewall. No 3rd party proxies.

Not sure that makes me anymore comfortable! Open port to my storage from the internet?

But I’m glad they’re not backdooring anything….

What I do is use L2TP/IPsec VPN to phone into my home network and then login and use Synology NAS "locally". There's no inherent need to open your NAS to the internet if you don't want to.

To be clear, the storage app is not bound to the port, rather it’s a VPN server.

It’s how most companies operate (RBAC behind a private key challenge).

Exposing anything to the internet carries intrinsic risk, but exposing a VPN door is among the least risky of the available options, if internet accessibility is an essential feature. The only realistic compromise vectors are private key disclosure, bad VPN configs, or operating an outdated version of WireGuard with a known vulnerability.

Reply on news.ycombinator.com