Christina 🇺🇸

😈 Don't miss your chance to connect tonight

[Christina 🇺🇸 @chenille96]

Two words during sex

[Christina 🇺🇸 @chenille96]

Netflix or quickie with me? ...yes or no

[Christina 🇺🇸 @chenille96]

One word for this?😉

[Christina 🇺🇸 @chenille96]

ou rather cuddle me or take me shopping? 👀❤️

[Christina 🇺🇸 @chenille96]

@GavinNewsom @adammocklerr lmaowowso truethis is greatsfactso true

[Daniel Newman @danielnewmanUV]

Down 75% from the highs, but nice to see a day like this for $CIFR. Been adding all the way down to $6.90. Still a believer.

[Christina 🇺🇸 @chenille96]

@ProcessinhoBR lmaowowso truethis is greatso true

[Jack “CouRage” Dunlop @CouRageJD]

Kicking my feet and giggling at these MAGA tears

Great night!

[Fili @filiksyos]

I'm 22.

locking in before the real world hits

let's connect

[Christina 🇺🇸 @chenille96]

@uspolitics1111 lmaowowso truethis is great

[Christina 🇺🇸 @chenille96]

@BarackObama lmaowowso true

[Christina 🇺🇸 @chenille96]

@isamesihsahin lmaowow

[Marcos Placona @marcos_placona]

Self-hosting is great. It's also now my job.

A month ago I moved most of my stuff off Vercel and Railway onto two Hetzner boxes. Cheaper, faster, and I own all of it. Zero regrets.

Then this kernel bug dropped. It's a 9.8, triggered remotely during the TCP handshake, before any app login. And as of this morning Ubuntu still hasn't shipped a fixed kernel for 24.04.

So I checked my servers.

The small box was fine. It only accepts web traffic from Cloudflare's IP ranges, and SSH is Tailscale only. Nothing from the open internet reaches the TCP stack. Exactly what Pieter's been saying.

The main box was not. Ports 80 and 443 are open to the world, because that's how I set it up first and never went back.

The bit that actually scared me: that server had been running the same kernel for 279 days. 17 newer kernels were sitting there, installed, never booted. Unattended upgrades did their job. I just never rebooted.

Nine months of kernel fixes I thought I had, I didn't.

On Vercel none of this is my problem.

Someone else patches, someone else reboots, someone else gets paged.

When you self-host, you're the security team. There's no ticket to open.

What I did, from my phone:
- a firewall rule that drops TCP packets carrying IPv4 options (normal traffic doesn't use them)
- turned off MPTCP, which the known exploit relies on
- checked every site still returned 200

Two minutes. Not a fix, just a stopgap until Ubuntu ships the kernel and I reboot.

What I'm changing:
- The main box goes behind Cloudflare only, like the small one. No open ports.
- An alert when a reboot has been pending for more than a week.
- A watcher that pings me the moment the patched kernel lands.

Still worth it. I'd do it again tomorrow. But "I self-host" means "I'm on call".

Make sure you know that before you leave Vercel.

[Christina 🇺🇸 @chenille96]

@MarioNawfal lmao