Melmi

Just put everything that doesn’t have OIDC behind forward auth. OIDC is overrated for selfhosting.

I occasionally use middle mouse paste, but I switched my partner over from Windows recently and they were used to scrolling by holding MMB and dragging which seems to be the default on Windows…

I expected there to be a toggle to turn off middle mouse paste but there just wasn’t. I had to go into multiple different places to disable it and enable autoscroll for all their apps. I ended up installing a hacky tool that would just clear the clipboard whenever MMB was pressed.

If anything can make this process easier, I’m all for it.

You’re arguing two different points here. “A VPN can act as a proxy” and “A VPN that only acts as a proxy is no longer a VPN”. I agree with the former and disagree with the latter.

A “real” host-to-network VPN could be used as a proxy by just setting your default route through it, just like a simple host-to-host VPN could be NOT a proxy by only allowing internal IPs over the link. Would the latter example stop being a VPN if you add a default route going from one host to the other?

Fundamentally, a host-to-host VPN is still a VPN. It creates an encapsulated L2/L3 link between two points over another network. The number of hosts on either end doesn’t change that. Each end still has its own own interface address, subnet, etcetera. You could use the exact same VPN config for both a host-to-host and host-to-site VPN simply by making one of the hosts a router.

I see your point about advocating for other methods where appropriate (although personally I prefer VPNs) but I think that gatekeeping the word “VPN” is silly.

“It has effectively the same function as a proxy” isn’t the same thing as “it’s not actually a VPN”.

One could argue you’re not really using the tech to its fullest advantage, but the underlying tech is still a VPN. It’s just a VPN that’s being used as a proxy. You’re still using the same VPN protocols that could be used in production for conventional site-to-site or host-to-network VPN configurations.

Regardless, you’re the one who brought up commercial VPNs; when using OpenVPN to create a tunnel between a VPS and home server(s), it seems like it’s being used exactly to “create private communication between multiple clients”. Even by your definition that should be a VPN, right?

VPN and proxy server refer to different things. There’s lots of marketing BS around VPNs but that doesn’t make the term itself BS, they’re different and it’s relevant when you’re talking about networking.

If you want to share software like that, just use AppImage. It’s perfect for sneakernet software sharing: no internet access required, and it requires less technical knowledge from end users than telling them to use a package manager. Just copy the file and run it.

Wine literally stands for “WINE Is Not an Emulator”.

That said, Proton is pretty transparent, you can just install any game off Steam right now and it’ll work 9 times out of 10 without you noticing that you’re using wine. I often can’t tell if I’m using proton or not and get surprised when I go into the game files for one reason or another expecting proton and am surprised to find a native Linux build. There has even been at least one time I’ve switched from a native Linux build to Proton because it ran better, and it was just one toggle.

Why the resistance to wine? Did you have an issue while using it, or is it the principle of using a compatibility layer?

If you don’t like the functional syntax you can usually use for each loops to the same effect.

for element in array.iter() {
    println!("{element}");
}

If there’s a port you want accessible from the host/other containers but not beyond the host, consider using the expose directive instead of ports. As an added bonus, you don’t need to come up with arbitrary ports to assign on the host for every container with a shared port.

IMO it’s more intuitive to connect to a service via container_name:443 instead of localhost:8443

The UX just isn’t there for MPV. Jellyfin isn’t always ideal but it gives an interface roughly on par with a streaming service. Why should I replace that with a tool like MPV? I don’t need keyboard controls, I watch from my couch. It seems like all downsides to me.

CGNAT is for IPv4, the IPv6 network is separate. But if you have IPv6 connectivity on both ends setting up WG is the same as with IPv4.

Only giving a /64 breaks stuff, but some ISPs do it anyway. With only a /64 you can’t subnet your network at all.

I really doubt it. We could give everyone on Earth their own /48 with less than 1% of the IPv6 address space.

Giving a /48 is spec, but a lot of ISPs are too stingy :/

Going to other planets would require a total re-architecting of our communications infrastructure anyway. There’s such distance too it’s not really viable to have a shared internet. Even Mars would have up to 22 minute latency at peak. So I don’t think it makes sense to plan our current internet around potential future space colonization.

Even so, IPv6 is truly massive. We could give a /64 to every square centimeter of the Earth’s surface and still have IPs to spare. Frankly, I think the protocol itself will be obsolete before we run out.

All of your temporary privacy addresses will be coming out of the same subnet, so it’s clear they all belong to the same people.

Ultimately the privacy extensions are just bringing IPv6’s privacy back in line with IPv4, because without the privacy extensions every single device has a separate IPv6 address based on its MAC address whereas in IPv4 most consumer networks have every device sharing a single IP.

Being able to sell FOSS is one of the freedoms “free software” refers to.

Honestly though I think the thing that struck me the most and I found kind of scummy was their “value statement” where they were advertising the OS by comparing it to the prices of the proprietary software is includes alternatives to. You misreading the website wasn’t an accident, they designed it in a deceptive way IMO.

If they were more honest about it, I wouldn’t have any problem with them charging for the convenience of having everything pre-bundled. Of course you could set everything up yourself, but Linux is notoriously finnicky. People want a complete experience, they want support. They want the slick branding.

As far as I know Zorin is FOSS, for what it’s worth. It’s mostly just bundled FOSS software with some slick themes and accessibility features, plus a few in-house system apps which they do seem to provide sources for.

They mention that it’s open source on their website but they don’t mention FOSS probably because the libre/gratis distinction is confusing for people.

Editing the systemd services seems a neat solution here. Rather than editing the package-provided service files directly, you can create overrides using systemctl edit.

Another more hacky option would be to use the PostUp directive but account for the case there’s no tailscale0 device yet. Write a simple shell script or something.