Hiker, software engineer (primarily C++, Java, and Python), Minecraft modder, hunter (of the Hunt Showdown variety), biker, adoptive Akronite, and general doer of assorted things.

  • 2 Posts
  • 229 Comments
Joined 11 months ago
cake
Cake day: August 10th, 2023

help-circle









  • Yes, WireGuard was designed to fix a lot of these issues. It does change the equation quite a bit. I agree with you on that (I kind of hinted at it but didn’t spell that out I suppose).

    That said, WireGuard AFAIK still only works well with static IPs/becomes a PITA once dynamic IPs are in play. I think some of that is mitigated if the device being connected to has a static IP (even if the device being connected from doesn’t). However, that doesn’t cover a lot of self hosting use cases.

    Tailscale/ZeroTier/Nebula etc do transfer some control (Nebula can actually be used with fully internal control and ZeroTier can also be used that way as well though you’re going to have to put more work in with ZeroTier … I don’t know about TailScale’s offering here).

    Though doing things yourself also (in most cases) means transferring some level of control to a cloud/traditional server hosting provider anyways (e.g, AWS, DigitalOcean, NFO, etc).

    Using something like ZeroTier can cutout a cloud provider/VPS entirely in favor of a professionally managed SAS for a lot of folks.

    A lot of this just depends on who you trust – yourself or the team running the service(s) you’re relying on – more and how much time you have to practically devote to maintenance. There’s not a “one size fits all answer” but … I think most people are better off doing SAS to form an internal mesh network and running whatever services they’re interested in running inside of that network. It’s a nice tradeoff.

    You can still setup device firewalls, SSH key-only authorization, fail2ban, and things of that ilk as a precaution in case their networks do get compromised. These are all things you should do if you’re self hosting … but hobbyist/novices will probably stumble through them/get it wrong, which IMO is more okay in the SAS case because you’ve got a professional security team keeping an eye on things.


  • The company Tailscale is a giant target and has a much higher risk in getting compromised than my VPN or even accessible services.

    One must be careful about this mindset. A bunch of smart lightbulbs that are individually operated aren’t a particularly appealing target either. However, in aggregate… If someone can write a script that abuses security flaws in them or their default configuration … even though you’re not part of a big centralized target, you are part of a class that can be targeted automatically at scale.

    Self hosting only yields better security when you are willing to take steps to adequately secure your self hosted services and implement a disaster recovery strategy.


  • The thing about something like TailScale or ZeroTier or Nebula is that it’s dynamic. These all behave similar to a multiplayer game … a use case every residential firewall should “just get.”

    The ports that are “opened” can change regularly, they’re not some standard port that can just be checked to see if it’s open (typically).

    Compare that to the average novice opening port 51822 for wireguard or 22 for SSH and you start to see the difference. With those ports, you’ve got a pretty good idea what’s on the other side and it might even be willing to talk to you and give you error messages or TCP ACK packets to confirm it’s there (e.g. SSH).

    This advice is as you can probably imagine more relevant to things like OpenVPN that are notoriously hard to correctly configure or application protocols like SSH or HTTP.

    With these mesh VPNs you also don’t have to worry about your home dynamic IP changing and breaking your connection at inopportune times… And that’s a huge benefit (IMO). It’s also very easy to tie in new devices to the network.

    A lot of it is about outsourcing labor to programs that know how to set up a VPN and make management of it easy. That ties into security because … a LOT of security issues boil down to misconfiguration.





  • The reason the US and Canadian governments are doing this is to stop that $10k car from destroying the auto motive industry in North America resulting in layoffs that make the recent tech layoffs look like peanuts.

    I agree we need cheaper EVs in North America, I want one too… There’s an Ars Technica article where Ford basically goes “we thought everyone wanted expensive trucks … we made those electric … we realize we missed the mark, we’re going to work on smaller, cheaper, EVs.” So, they are coming hopefully within the next couple of years.

    I’m not sure how important manufacturing still is to the Canadian economy, but for the US economy … trying to protect domestic production is important (and we should’ve done it years ago instead of letting cheap Chinese imports destroy a large amount of the factories in North America).




  • Hm… I agree that Instagram is not a neutral source. I also agree that there are going to be some biases imposed by the user base.

    I don’t believe the US government plays a major role in Meta’s content moderation behavior. Meta if anything has shown a reluctance towards any political or news content in recent years. That’s not to say the US government doesn’t have influence but their influence is (from what I’ve seen) oriented around fighting disinformation and threats of violence … not cherry-picking the discussion of subject matter. I think there would’ve been a pretty significant leak out of Meta by now if there really was a strong political bias or government influence in content moderation.

    I don’t think any of these lines particularly fall along political lines within the US either. There are people on the left and right taking different sides on virtually all of the topics with statistical divergence; many of them are unusually bipartisan within the US.


  • This comment is the worst misrepresentation of penguins I’ve ever seen. It sounds like a red herring. It makes me want to vomit. People get away with this because nobody actually knows what penguins are. They just take what the media writes and accepts it as truth.

    On a serious note, plenty of people here surely know what net neutrality is. Net neutrality is the guarantee that your ISP doesn’t (de-)prioritize traffic or outright block traffic, all packets are treated equally. In other words it means you don’t have to pay $5 extra for high speed access to Lemmy because Reddit and your ISP (say Comcast) would prefer Lemmy not exist.