Hacker News Reader

Forgive me for being the idiot in the room but is the argument:

1. 5900 was always known to be an extra unsafe port to have open

2. all ports should be assumed unsafe without explicit vetting

I'm assuming the argument being made is (2), but it really is a sad safe of affairs because use cases from time to time do involve having ports hot.

Or should things be taken one step further to *always* use a vpn or similar?

View on HN

> Or should things be taken one step further to always use a vpn or similar

Yes. The vast majority of software is not hardened enough to be exposed to malicious actors. Any kind of control panel, device management interface, NAS/file sharing protocol, remote desktop protocols, and anything else that isn't explicitly designed to be a public service should be protected with a hardened outer layer like a VPN, SSH tunnel, or mutual TLS/client certificate authentication.

Very true. As a poor second option, if he is working from known fixed IP locations, he could have used a packet filter to allow access only from them.

If he is roaming freely, he had no business leaving port 5900 world accessible.

Reply on news.ycombinator.com