Having 5900 hot to wan.. He wrote an article to tell the world that he doesn't understand basic networking.
I got confused for a second how Claude Code and agents are related to this piece. Of course they aren't. Anyone with a half brain about securing their system would never run into any of this in the first place. Hiring Claude Code to do scanning every half an hour is such a waste of tokens.
I'm not sure why a writer needs swarms of agents in the first place.
The 'built a server that's going to run linux' line confused me. gOiNg tO? This boy didn't have 20 minutes to write a usb, shred the disks in live boot and install?
He has decent business takes on tech, the podcast/articles are worth paying attention to. The actual tech takes are probably too dumb for the hn audience, but you aren't the target audience.
1. 5900 was always known to be an extra unsafe port to have open
2. all ports should be assumed unsafe without explicit vetting
I'm assuming the argument being made is (2), but it really is a sad safe of affairs because use cases from time to time do involve having ports hot.
Or should things be taken one step further to *always* use a vpn or similar?
If he is roaming freely, he had no business leaving port 5900 world accessible.
Yes. The vast majority of software is not hardened enough to be exposed to malicious actors. Any kind of control panel, device management interface, NAS/file sharing protocol, remote desktop protocols, and anything else that isn't explicitly designed to be a public service should be protected with a hardened outer layer like a VPN, SSH tunnel, or mutual TLS/client certificate authentication.