TechLich

Makes sense.

I'm just glad someone is out there poking salamanders in the butt for science :p

It's really not... A domain name is what.. $5-10 per year? Web server software is free (nginx, apache, lighttptd, pick your poison). You could run a website on your phone. It doesn't need much hardware or network requirements unless you start hitting thousands of users.

A static IP helps but dynamic DNS is a thing. If you need more juice or you're located somewhere that NATs IPs, a public web host is like $5-10 a month if you're getting ripped off.

It costs more to get a streaming service subscription.

Hosting a popular webapp with tens or hundreds of thousands of concurrent users interacting with complex backend code and a database (see Lemmy) gets more expensive but it always was and it's now cheaper than ever.

Edit: I should point out that I'm pretty anti-corporate and I'm not defending the current state of social media or search results. I'm just also agreeing with the guy who pointed out that the web is still open and you can host a website on a potato.

I feel like that's not a fair comparison. You can't ride a horse on a freeway but you absolutely can host a website that anyone in the world can access instantly.

Back when the web was "open" and "free" and not dominated by social media, the 99% of people, the millions and billions of users, weren't using it. It's not like your Geocities page in 1999 had a billion visitors (despite what your "one billionth visitor" blink tags proclaimed). Even after it got added to that popular web ring for like-minded netizens.

I feel like people have forgotten what the old web was really like and that most communities only had a handful of active people. You can still do that and in fact there are thousands of such small independent websites and communities in forums and platforms like this. Hell, a bunch of the old forums and IRC channels etc. from back then are still running and some actually have more users than ever just because of more overall internet adoption.

It's a bit sad that Google SEO favours large platforms and garbage medium blogs over smaller personal websites but search was mostly shit back then too (metacrawler ftw).

Wait...

• Hydrated salamanders move faster than dehydrated salamanders.
• Dehydrated salamanders find water faster than hydrated ones.
• Dehydrated salamanders and hydrated salamanders don't find water any differently in terms of the number of locations searched in the labyrinth.

If the hydrated ones move faster and search the same way, wouldn't they find the water faster?

Basically, dehydrated salamanders don't run away from a poke in the butt as fast but they do move faster when searching for water. Is that it?

They're not files, it's just leaking other people's conversations through a history bug. Accidentally putting person A's "can you help me write my research paper/IT ticket/script" conversation into person B's chat history.

Super shitty but not an uncommon kind of bug. Often either a nasty caching issue or screwing up identities for people sharing IPs or similar.

It's bad but it's "some programmer makes understandable mistake" bad not "evil company steals private information without consent and sends it to others for profit" kind of bad.

I think the idea is that he thought she was confused by what he had said.

"What are they called?" meaning "what are the words for them?" Not "what are their names?" Like he was quizzing her on her English or something.

He was a about to correct her like "no no, I meant what are their names?"

Totally agree on all points!

My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.

Tailscale isn't an exposed service. Headscale is

Absolutely! And it's a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I'm not suggesting that it's in any way vulnerable to that kind of thing now, or that it even affected most users we don't know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.

it's more work and may not always be worth the effort

I don't really buy this. Certs have been free and easy to deploy for a long time now. It's not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you're running. Especially when stuff like caddy exists.

I recommended SmallStep+Caddy.

Yes! Do this if you don't want to get your certs signed for some reason. I'm only advocating against not using certs at all.

Are you suggesting that these attack techniques are effective against zero trust tunnels

No I'm talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don't assume that something is perfectly safe just because it's airgapped, let alone available via tunnel.

I feel like it's a bit like leaving all your doors unlocked because there's a big padlock on the fence. If someone has a way to jump the fence or break the lock you don't want them to have free reign after that point.

there's an argument that HTTPS isn't really required...

Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it's potentially susceptible to vulnerabilities and exploits so don't fall into the trap of thinking that anything in your private network is safe because it's only available through the VPN. "Defence in depth" is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.

The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it's not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.

If you're going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.

"Toad in the Hood" is the gritty HBO sequel to "The Wind in the Willows" that takes place after Toad breaks out of prison.

No, that's "Monk"

A manc is a place where you can go to deposit your money and get home loans and stuff.

Do you get that kind of delay when you talk to the assistant on your phone or through a browser? It might be whisper taking a while to process it?

What is your home assistant running on?

Also, what's the range/mic/audio quality like on those atom echos? I'm thinking of looking into something like that now that a decent voice assistant is a possibility.