is paperless-ngx secure? reddit / selfhosted ---------------------------------------------------------------------- IceMenora · 2023-10-04 00:18 I was researching paperless-ngx and have seen a lot of favorable comments here. I haven't seen anyone mention safety and security. I noticed on their website that it uses machine learning. Connecting documents with my personal information to something that uses machine learning or anything really makes me pause. Is paperless-ngx secure to use? ---------------------------------------------------------------------- 0100000101101000 · 2023-10-04 00:25 Privacy and security are two different things. I can't speak on privacy. For security, make sure you use a reverse proxy with SSL and Fail2ban, and follow their best documented security practices. ---------------------------------------------------------------------- RuaidhriM · 2023-10-04 00:32 Why does machine leaning make you feel insecure? It’s local so no specific risk in this case. ---------------------------------------------------------------------- IceMenora · 2023-10-04 00:54 It being local does make a difference, it wasn’t clear to me if the ML is done locally or on a network. ---------------------------------------------------------------------- IceMenora · 2023-10-04 02:38 this is a stupid question, but how can I make sure that it isn't exposed to the internet? I was planning on running it on a raspberry pi. ---------------------------------------------------------------------- nurseynurseygander · 2023-10-04 03:09 Whether something is exposed to the internet (in the sense of anything being able to remote in to it) depends on: (a) what port(s) the application is listening on (paperless-ngx defaults to 8000 but you can change that) (b) whether the computer is set up to allow traffic in/out at that port (eg, computer firewall rules, if using docker also depends on docker networking settings), and (c) whether those ports are opened to outside networks on the router between it and the outside world (typically determined by options under port forwarding and/or firewall). ---------------------------------------------------------------------- chaplin2 · 2023-10-04 03:10 You should be careful of self hosting, if you ask that question. ---------------------------------------------------------------------- nurseynurseygander · 2023-10-04 03:13 I run paperless-ngx and I believe it's local. It didn't seem to come in with any knowledge, it seemed to just learn from me tagging the initial set of files. ---------------------------------------------------------------------- Reiep · 2023-10-04 05:13 All the text recognition part is done locally: https://docs.paperless- ngx.com/setup/?__cf_chl_rt_tk=hgpe538nvrzny8gyebphjlpyonfowzg2u5y6y2pq cms-1679327742-0-ganycgzncda ---------------------------------------------------------------------- gramoun-kal · 2023-10-04 06:03 Not exposed to internet: the Pi is connected to your router. You need to be at home to access it. Exposed to the internet: 1. The above, but you also did some gymnastics that include keywords such as "port forwarding" and "dynamic DNS". 2. Paperless is set up on a remote server that you rent from a server- provider and you access it like a website. As long as you stick to "just plugged into my router", an attacker needs to be within range of your wifi and to crack the wifi password to get access to the web interface of Paperless. And then, they still need to hack into it. ---------------------------------------------------------------------- gramoun-kal · 2023-10-04 06:05 About the machine learning bit: The neural network is local. Paperless doesn't send your documents to some "Paperless server" that guesses what the document is. It never leaves your Raspberry Pi. ---------------------------------------------------------------------- kataflokc · 2023-10-04 07:01 Every one of us had to start somewhere and either learn by asking or by fucking it up He’s doing it the right way ---------------------------------------------------------------------- IceOleg · 2023-10-04 10:38 If you are running it in a container, you can create a network specifically for the Paperless containers which doesn't have access to the outside world. I did it with Podman and it was pretty simple to set up. I imagine Docker will work exactly the same way. ---------------------------------------------------------------------- niceman1212 · 2023-10-04 10:43 Not a stupid question. Most likely you’re behind a firewall of some sorts already (ISP Modem/Router). So if you did not do any port forwarding nothing has been exposed. (uPnP excluded but that’s another can of worms) If you’re not sure check your routers admin panel for port forwards open. In any case I don’t recommend opening up something like paperless to the public internet. If you want to do it properly secure the only open port needs to be to a VPN server allowing access to internal resources ---------------------------------------------------------------------- BraianP · 2023-10-04 14:44 It uses a model to computer OCR (optical character recognition) to get text out of images ---------------------------------------------------------------------- katrinatransfem · 2023-10-04 14:52 I think the question is whether it phones home and sends your data to some third party rather than whether people can get access to the server from outside. ---------------------------------------------------------------------- [deleted] · 2023-10-04 16:26 [deleted] ---------------------------------------------------------------------- miteshps · 2023-10-04 16:26 This comment isn’t helpful at all ---------------------------------------------------------------------- Vast_Round8059 · 2023-10-04 16:28 I have my whole setup locally only. I was unable to setup authelia in proxy so i decided to just use wireguard. Theres no easier way to take your network with you on the go. ---------------------------------------------------------------------- AttackCircus · 2023-10-04 16:36 It's actually both. But while you have to do something actively in order to expose the RasPi and the server to the internet, it's still valid to ask if the software sends the data out , maybe on purpose, and maybe in the default setup (e.g. ML) ---------------------------------------------------------------------- chaplin2 · 2023-10-04 17:15 Not that I didn’t say OP should not self host. I said OP has be (extra) careful, which is very very sensible advice I believe.