Patrick

mossymaker.comHow to Self-host a Password Manager

30 June 2025

Maybe you've been curious about password managers? I wrote a how-to about self-hosting one: mossymaker.com/articles/202...

Patrick reposted

Sara Soueidan

@sarasoueidan.com

Tomorrow, October 16th, marks Practical Accessibility's third birthday. 🎂 To celebrate, I am gifting everybody 25% off for the next 48 hours 🎁 Individual and team licenses alike! The discount is automatically applied during checkout—no code is needed. 👉🏻 practical-accessibility.today Enjoy! #a11y

practical-accessibility.todayThe Practical Accessibility CourseA get-right-down-to-it online course for Web designers and developers who want to start creating more accessible Web user interfaces and digital products today

mossymaker.comHow to Self-host a Password Manager

8 Sept

1Password is in the news again. 😅There are shinier options, sure; this strategy has been rock solid for years.

Patrick@mossymaker.com

Maybe you've been curious about password managers? I wrote a how-to about self-hosting one: mossymaker.com/articles/202...

Patrick reposted

Rosemary Mosco

@rosemarymosco.com

5 July

Heat waves. Thanks to @climateadam.bsky.social's most recent video, which helped inform this comic and gave me the kick I needed to make it.

Patrick reposted

Christine Lemmer-Webber

@dustyweb.bsky.social

1 July

What happened to the fight for the Internet? dustycloud.org/blog/what-ha... As the internet has become centralized, it's felt less like ours. But it can be ours, if we fight for it. And the fight has never been more critical or dire.

dustycloud.orgWhat happened to the fight for the Internet? -- Dustycloud Brainstorms

28 Apr

sweep em up

machinefun.bsky.social@machinefun.bsky.social

🚨 Giveaway time! 🚨 We're giving away a hand crafted Kujisama 500 print! HOW TO ENTER? You must QUOTE POST THIS POST with the phrase "sweep em up" so we can easily track your entry. The winner will be randomly selected on the 6th of May. We'll ship this item anywhere globally. Good luck!

Is my NodeJS container supposed to be running netcat? 😅 I usually wake up sipping coffee, not choking on it seeing my cloud usage, but I made the most of the situation by doing some amateur forensics. #selfhosting has its ups and downs...

I tried to inspect its available /proc/<pid> info, but either got nothing back or permission denied. Not sure what was up with that, but I'm sure I have more to learn there. Netstat showed a connection to we.love.servers.at.ioflood.net—super legit looking. I suspect C2, but I left it alone.

attack.mitre.orgHide Artifacts: Bind Mounts, Sub-technique T1564.013 - Enterprise | MITRE ATT&CK®

18 Jan

Looked into the /proc issue a bit: seems like with recent #react2shell exploit activity, bind mounts have been used to hide malicious process info. attack.mitre.org/techniques/T...

In this case, it looks like there was probably a remote code execution vulnerability in NextJS that allowed an attacker to steal my hosting resources to mine crypto. I have major respect for folks doing this professionally, using the knowledge to layer security and detect attacks as they occur.

If you selfhost (or otherwise run workloads for fun, etc.), what are your experiences handling attacks or compromised hosts?

Circling back to the poorly obfuscated "node" process, the file linked to in the process command line was configuration for SupportXMR, a monero crypto miner. 🙄

As more of the services we rely on do awful things, some of us are inclined to selfhost out of spite, but as this incident shows, there are risks. This was isolated, but could have been much worse. It's easy to miss an image update that patches a CVE, or not have time to set up alerting.

Had to sift through some metrics, but eventually found the outlier, a NextJS container using 2 vCPU and 3GB ram. Once I got to a shell, the problem was pretty clear: in addition to the expected Node processes, there was a process running from /tmp/.libsystem/node and—uh oh! Netcat.