I run a language learning app* on a single VPS, for free.
I'm not sure if you can still get it, but Oracle used to offer very generous VPS for free. I have a 4 CPUs, 24 GB memory VPS that I'm using for several things, including running the backend and the marketing site for that app.
I installed Plex but ended up not using it, so I removed it.
Oracle's free tier ARM VM's specs were recently halved so now they only give ARMs with 2 CPUs and 12GB of RAM [0].
Still great value though, have my app's website and associated infra on one of those 4CPU/24GB in "pay-as-you-go" mode and never ever reached the paying threshold.
I recently closed down a VPS I had been running for the last 10 years. Mostly used it for hosting a personal website and some smaller other static sites, as well as git repo backups.
After getting into home assistant and setting up a proper home server I no longer saw a need to keep the VPS running. With cloudflare reverse proxy I can still host personal websites, but from inside my home network. Since getting the home server I'm discovering a lot of neat self hosted options and use it a lot more than I ever did the VPS. If nothing else, hosting your own stuff provides a great place to learn and explore. It doesn't have to be always on/on the internet for that to be true though.
Messaging queues and brokers. RabbitMQ, BullMQ, etc. Simple services, but I've learned to keep them on their own images so they recover fast and don't compete with other resources.
I've seen too many chat services go away, or behind a paywall, so I vibe-coded my own chat and use the VPS to host the hole-punching infrastructure, because I and my friend who I wish to chat with are both behind NAT.
dns and email server. i just make aliases that point to a single imap account that is unique for everything i sign up for. if i start to get spam, turn off the alias. it also lets me see who is selling my info or has been hacked when bestbuy@example.com starts getting emails from russia.
I've built email servers that sent 15 million emails a day into all of the major inbox providers, so you could say I know a thing or two about it. This wasn't spam, it was legit doubple-opt in.
It depends on your use case, and ability to actually administrate it properly.
This is why mailbox providers provide feedback, and let you see how they see your IP and domain reputation. Google Postmaster Tools is free to set up. I also suggest feedback loops, which most major mailbox providers support. There are also a plethora of free lookup tools that will tell you about the history of an IP. If you spin up a VPS and get a crappy IP, just destroy it and create a new one and check it's IP. Lather, rinse, repeat until you get an IP that either doesn't have a negative rep, no reputation, or you get lucky and get the IP from my last VPS that had a stellar IP rep. until I moved to a new VPS provider.
Like I said, this is on an old desktop PC that I shoved some spare SSDs into. I have a few thousand Linux ISOs on there. I have an rclone job running regular encrypted offsite backups as well, so that my Linux ISOs are safe from hardware issues.
Which is only marginally more effecient than the H.264 encoding that many of them are delivered in. And the biggest shiniest Linux ISOs already use H.265 out of the box.
They're compressed in x265, most web browsers can decompress that natively ;) Heck, when you watch something on YouTube you are decompressing the content ont he fly
Since Linux ISOs demand random access for a good user experience most of the relevant compression formats support that and so compressing as a blob wouldnt't really get you much but also not prevent individual access.
I picked up a new hobby of buying Linux ISOs from thrift stores. I usually get them for $1/each. Up to 300 now - all mine. Jellyfin is great to organize them
The two things that torrents are best at are downloading Linux ISOs and pirating content. So using qbittorrent to download Linux ISOs is usually code for piracy, since torrenting Linux ISOs is legal and piracy is not :)
Blu rays aren't bad either. The glory days were back when Netflix was cheap and there was an oversupply (in that era I built up a library of hundreds), but even today you can get most things in 1080p for $10 or less.
If you don't think 2 hours of professionally produced content is worth $10, well that's why AI isn't the only thing destroying art and culture.
I'm back in to collecting physical media as well. I get my wife to use her Facebook account to find stuff on marketplace. Lightly used bundles can get movies down to like a dollar per.
The issue with Blu-rays is they are costly to rip. Basically, the only software that let you do it right now is MakeMKV, and it's proprietary. I believe that the VLC team is working on some open-source solutions, but last time I checked, it was only able to read old Blu-ray (which is understandable, they have to care about potential copyright and drm issue, unlike the people behind makemkv).
So if you want to rip recent Blu-ray, you will need to buy makemkv (they do have a 1-month trial tho). But worse, if you want to rip 4k Blu-ray, you will need a specific br-drive that makemkv support (as I understand, they make custom / modified firmware for some drives, allowing to read the protected data). The issue is that there is barely anyone still making br drives and whenever makemkv support one it goes out of stock and/or become extremely expensive on the second hand market.
This is really annoying me because I know this is the end of the physical market for movie. I fully expect Blu-ray to completely die off in a few years. Movie will probably only be available through streaming services, which means it will be harder and harder to get a good quality encoding.
With recent codecs (av1, h265, will see how av2 does), the quality that streaming services is okay, but we are far from what a full Blu-ray dump allows today.
MakeMKV has an effectively perpetual free trial right now. It's not like old shareware were you have to pay after a month but rahter that you have to feed it a new free activation key every month and maybe wait a couple of days for one to be posted.
That can change (and the official communication is that its only free while in beta) but my guess is that the free beta is the main thing holding back alternatives. MakeMKV does solid work but it's not rocket science and a lot of parts (like all the complementary LibreDrive / UHD firmware work) doesn't even have a paid license check at all.
I hate blueray. At least for having physical copies. Too many times I've tried watching something I own only to have it fail due to my player not having current decryption keys. Perhaps it's more of a player issue and less of a disc issue, but it's still a problem with the overall format.
The one time I actually bought a Bluray, I couldn't play it because of fricking Region Coding. Like this is the 2020s and you still have to deal with that BS?!
1080p doesn't really say much when that could be an old DVD-era master with questionable color correction crammed onto a BD25 disc with other features/extras vs a modern archival-quality master professionally encoded to 40+ GB.
Joking aside, a few early commercial Linux distro (Red Hat, Yellow Dog, SuSe, Corel Linux) had really nice packaging and media artworks. I'd love to collect them.
In France many public libraries let you rent them for free (or a ridiculously low annual subscription); you take them home, copy them, return them, and it costs nothing.
Some of ours in the US even have video games. The one I go to even has tools and all sorts of other interesting physical objects. People really need to visit their libraries, they’re already paying for it via taxes.
$1 won't get you Linux ISOs up to modern display standards. Great if that works for you but the high end is more like $20+ (emphasis on the +, taxes and shipping not included) per Linux ISO so its understanding why many might prefer sharing them digitally. And that's before getting into cases where the Linux ISO vendors don't even want to give you the specific version you want.
Did you see the 'thrift store' part of his comment? I do the same thing as him, and depending on the location around town, an ISO on a DVD can be as little as 50 cents, and a modern Linux ISO on bluray, including 4K (though rare I see those) are rarely over maybe $3.
a few months back I opened up a streaming service that I pay for to watch a old TV show. I was _enraged_ to find out that they put ADS WHERE COMMERCIALS USED TO BE. I thought the whole point of paying was to avoid ads!
so now I visit my used Blu-Ray/DVD store about once a month. they always have buy two/get one free, and the prices are ridiculously low.
is it a better solution? I don't know, but I do know that I don't have to watch those ads anymore.
I started picking them up from the library. Goodwill wants like five bucks a disk now. Library has them for .25 to a dollar each. Or free if you just check them out.
Raid is not a backup :( For the really important data (photos, documents, ecc) a small 1GB raspberry pi + USB external HDD works great as a Borg server for daily backup, there is no need for a full NAS when you can store all important data in less the a handful of terabytes
I’m not implying Raid 5 on its own is a complete backup.
Within a storage array though it does provide redundancy at that level, and generally speaking most people don’t access a raid or NAS at a shell level only where they drop rm -fr’s
Separate and offsite backups are non negotiable, however running a raid 5 locally can greatly reduce storage rebuild/restore time, if a single drive fails the rest of the raid continues to work fine until replaced.
I have an encrypted offsite backup. A lot of people I know with home servers work out a deal with a family member to have cross-backups with each other.
Yes, my spouse has access to my password storage, which has all the decryption keys. Whether she remembers how to do it is a different question. :). Maybe I should write it down, or show one of my kids...
I am honestly not sure. I use GG photo because that what i use first and i was too lazy to investigate better deal. Also, i know Google does really well at keeping my data available, which is what you want for backup.
I didn't check ToS of proton drive, but in my experience, every cloud storage has requirement about what kind of data is allowed to store(after all, they dont want to accidentally store illegal stuff).
Yeah, I know multiple people who have irreversibly lost their Google or MS account. One day everything you had with them (emails, files, etc.) is just gone forever. Don't use them as a primary storage service (work the "may disappear at any time" risk into your backup/storage strategy)
My exact setup. Main repo on a second internal disk, one replica on an external disk, second replica in backblaze. Replicas are kept in sync with `restic copy`. Backup integrity gets checked automatically with `restic check`. It all works great.
Very common on Slashdot fifteen or twenty years ago. The Pirate Bay trial was a big story back then, for instance, and there was advocacy from the copyright cartels to ban the bittorrent protocol. Another hot story was when Comcast dropped customers for using too much data despite being on “unlimited” plans, justified because only a pirate would download so much. Hence, “You can’t do that, I use bittorrent to download my Linux ISOs!”
It really was common for Linux distros to provide torrent downloads back then. Internet speeds were such that downloading peer‐to‐peer could be significantly faster, and (probably more importantly) it saved the distro mirrors a lot of bandwidth. I think this practice has mostly died out, but Ubuntu for example still provides them under “alternative downloads”: https://ubuntu.com/download/alternative-downloads
If you're privacy conscious, please be aware that Tailscale by default is leaking behavioral metadata from all of those computers to the Room 641As of the world about everything you do on your supposedly “private” network: https://tailscale.com/docs/features/logging
“This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”
What's the advantage of Tailscale anyway? I guess ease of use compared to say setting up IPSEC? I haven't played with it yet but from what I read it's just wireguard with a bit of proprietary "one click and sell your soul" magic around it?
Tailscale automates wireguard key distribution and then layers routing, DNS, network ACLs, and other niceties on top.
For example, you can create a token that grants VPN access with inbound SSH as the only allowed traffic. Add that as a secret to GitHub Actions and now you can ad-hoc debug failing CI via `tailscale ssh`.
You can ask an LLM to set up a wireguard network for you with an idempotent bash script to deploy everything. You'll need a $5 VPS to bounce everything through. Works an absolute treat.
I saw all the Netbird recs here so looked into it briefly. Depends I guess on what you use Tailscale for. Tailscale Funnel is easy and stable. Self-hosted on Netbird is ... a bit more involved.
> connection data for troubleshooting you can turn off. No privacy issue there.
You can't turn off the centralised element of Tailscale though, i.e. IP tracking etc.
So for the privacy conscious Tailscale remains a poor choice. Especially as they operate under US jurisdiction:
- "Tailscale US Inc., a Delaware corporation with registered address at 447 Sutter St Ste 405 #543, San Francisco, CA 94108, USA"
- "For any dispute not subject to arbitration you and Tailscale agree to submit to the personal and exclusive jurisdiction of and venue in the federal and state courts located in New York, NY".
So CLOUD, PATRIOT and friends very much apply to Tailscale.
You may jest "but its only metadata", but you can do a lot with metadata, especially if its all nicely attractively centralised like Tailscale.
> What is Tailscale getting that my ISP and google/Facebook via their pixels and tracking scripts aren't?
Tons more. A lot could be written about, but a few "for starters" things to think about:
- The web is decentralised. And a lot of the web trackability can be dealt with in a dozen different ways. But Tailscale is centralised and all the data nicely structured (stable node keys etc.) and "ready to go" for metadata analysis.
- Tailscale have "behind the firewall" visibility at a far greater level, it enables building of a topology map and associated flows.
- Tailscale visibility is perhaps most concerning in relation to metadata surrounding mobile devices. Where is the device ? Is it in use ? Is it near other devices (from the same customer / other customers) ? etc. etc. etc.
Yes, `--no-logs-no-support` exists for the Tailscale client — but that's per-device, per-platform inconsistent (as the docs show), forfeits support, and doesn't change the fact that coordination traffic, the DERP relays, and the control plane still run through Tailscale. You can't opt out of the centralized control plane at all.
I think you are overestimating how decentralized the web is. Tailscale (could) collect a different kind of data than e.g. Google, and I believe it's far less harmful for the average user. If you are a journalist or persecuted by a government then sure, Tailscale is bad news.
But if you think Tailscale is bad for mobile devices because they might be able to tell that you're near another Tailscale user, that is absurd. If you have a need to be physically untrackable, the only solution is to leave your tracking device at home.
"We kill people based on metadata." - NSA Chief Gen. Michael Hayden, 2014[1]
In case you were not aware, spooks have focused on metadata analysis over "full take" (data) analysis for a very long time because they are far more effective and require less data to analyse. This has been the case at least since the 90s with Stellar Wind but arguably even the Stasi worked this way -- they cared a lot more about who you were talking to than what you were talking about. The Snowden revelations in 2013 talked almost entirely about metadata-only systems that were being used to invasively surveil the world.
Can you be on the internet and avoid the collection of metadata that can eventually be accessible for the NSA or other TLA? You have an ISP which logs everything, same for your destination endpoint, and those logs are already being correlated.
Can I even hide from NSA level adversaries without employing extreme methods? Assuming "no", then for this particular threat model do the tools employed next matter?
Most privacy activists are already taking an absolutist stance.
Reality is, for normal people there's no point where worrying about spooks and taking actions to protect themselves is reasonable. As you say, there's nothing one can do against a targeted attack. But same is true for broad, untargeted sweeps - if they really care, they will find you anyway, and attempting to reduce your data exposure just flags you as an anomaly, making you more interesting, not less.
The whole "privacy vs spooks" threat analysis is not relevant to regular people.
What I mean to ask was related to the mention made above, that Tailscale shouldn't be used by privacy conscious people.
> If you're privacy conscious, please be aware that Tailscale by default is creating behavioral metadata from all of those computers for the Room 641As of the world about everything you do on your supposedly “private” network
Is Tailscale creating additional metadata that doesn't already exist in "concentrated" form with my ISP? As a regular person trying to live a normal "internet enabled" life (self hosting a few things, sharing things with family or friends....) are there alternatives to Tailscale that leave substantially fewer traces for "Room 641s" and other similar entities, and doesn't just move the metadata collection to the hosting provider or the ISP?
And finally, does disabling logging in Tailscale mitigate those concerns? After all Tailscale will always be a target for data collection whether they cooperate or not by virtue of where they placed themselves. Similar to Cloudflare probably.
> Is Tailscale creating additional metadata that doesn't already exist in "concentrated" form with my ISP?
Yes, for connections between any pairs of machines that were previously entirely behind your NAT, unless you use bare LAN IP addresses for everything. Tailscale takes over DNS resolution very aggressively, so any use of short hostnames will have them resolve to Tailscale's CGNAT range instead even if they're on the same network.
My point is I don't care. It's not a thing worth caring about.
I don't argue "I have nothing to hide", even uttering this phrase is giving in to privacy paranoia.
In reality, I have plenty to hide. But those who I want to hide it from, don't have access to the metadata you mention - and those who do have access, couldn't give less of a damn about the things I want to hide.
Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what.
I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations with bash scripts, but if you have an heterogeneous environment (esp iOS clients), making programmatic configuration changes to WireGuard becomes trickier.
Today I use Tailscale (with Headscale as the control plane) for all users, and WireGuard as a emergency access to key servers.
Does headscale fully replace the corporate tailscale network? I've been looking at replacing my home wireguard if I can self-host tailscale but haven't had the free time to really figure out how much privacy I can retain by using headscale.
It definitely can. By default it ships with the normal Tailscale DERP map but it also ships with a default-off DERP server. You can turn that on and set your DERP map to only include that one server (or you can fan out a couple if you want). At that point you're not using Tailscale assets at all.
> Reliable NAT traversal on top of wireguard is their moat
And a damned good one at that. I can spend five minutes on a (family) nontechnical user's device and set it up to be able to access the parts of my network it needs to get to, and it's easy enough to use that I can walk them through the troubleshooting over the phone if it ever goes awry. Regardless of where they are or I am.
> How does wireguard helps you with NAT traversal?
It does not. You need a public endpoint, but presumably the $5 VPS or the "homelab" provides that, or it's of little use for things like email, Web, or game servers.
For much the same reason most people choose Windows or Mac over Gentoo. Most people set up something like Tailscale to accomplish something rather than create a project and ongoing maintenance burden for themselves, and setting up Wireguard is not terribly friendly to the uninitiated.
WireGuard is one of the easiest things to set up. The total amount of reading you'd need to do to set up WireGuard amounts to half of a page. I spent more time figuring out what firewall rules are needed for WireGuard traffic than actually setting up WireGuard, it's so simple.
I'm going to disagree with you there. It's been a while since I set up anything with WireGuard but "easy" is not a word I would apply to it. A simple tunnel or VPN configuration was close to that but a network comparable to a Tailnet got pretty involved to do properly. By contrast Tailscale was effortless.
Needing to do additional things like figure out firewall rules is exactly what I'm talking about. I enjoy tinkering for fun most of the time but I'm generally looking to tinker on something specific, not every step along the way.
It's also removed the difficulty of configuring a mikrotik router as well. Mikrotik has a cloud router instance which is much easier to deal with I think than linux. Mostly because there's a UI interface for Mikrotik that makes it a little easier to inspect what's going on.
This. Wireguard is a single short text file with keys. It's simple and robust, and setting it up on a client like a laptop or a phone is equally easy. Tailscale or Headscale (the self-hosted version) are massively overengineered for something as basic as accessing your Linux ISOs from your phone.
I'll argue though that the convenience and autonomic management make a big difference in that case because if your Wireguard configuration is busted you might need a working Wireguard to log into your homelab and fix it.
That's true, but the $5 VPS should have a public IP, either v4 or v6. Other devices can route their traffic through it, and then every device can reach other devices, regardless of NAT.
Yes, but only if the VPS becomes a bottleneck. Otherwise self-hosting Headscale does not seem worth it. My guess is that the threshold is at dozens of devices in simultaneous use.
It better have v4 if you ever want to use it while traveling. v6 is still not widely enough available on public Wi-Fi networks and even many mobile operators.
On some OSes you could probably also use some additional 4->6 tunnel, but that probably doesn't work stacked under Wireguard on iOS and Android.
That's a really uncharitable take. Yes there's client logging by default, but those who are privacy conscious probably also continued to read the very next few sentences in the same section of the docs you quoted, showing precisely how to opt out.
You lost me with the quotes. Why are Linux ISOs needing such broad distribution that mirrors won't handle? Those mirrors might be on full self driving cars taking people to the movies or a concert, right?
Out of curiosity: why use Gitea for personal projects when you can put up raw git repos and run the git-daemon that comes with git? Super lightweight, really functional. Add _cgit_ if you need to be able to view the repos online. Simple and does not require upkeep like gitea (which seems to break with every update and is really heavy).
Here are a few things I do:
Host static content behind nginx
Run filestash as a partial GoogleDrive replacement (I use it for sharing files with other people, like deliverables), files place on an S3 compatible object store.
Run vaultwarder for myself and some family members.
Run a container registry service backed by an s3 compatible object store.
Run a django web application I wrote for my own use. However, it stores to postgresql running in a different VPS.
Run caddy for ssl termination and reverse proxying the other services running here.
Redis (I forget if that was for filestash or the container registry, but can be configured to be very light weight).
All of those are in different containers running through podman.
I keep moose os instance on a vps, for immich, cap (recordings), cal for meetings and one app for notes.
Small productivity apps that I just like to have access to everywhere.
Proxmox VE with various guests (PeaNUT, Gitea, Ntfy, n8n, AI inference, agents) running across 3 servers (total >300GB RAM, 6TB SSD storage), with a separate Proxmox Backup server.
* Mirror my Github repos (in case GH goes down or closes my account)
* Serve my small website (just HTML files using Nginx)
* Monitor other applications (and hits a URL when they fail)
* Occasionally use it as a WeTransfer alternative (just uploading files into the WWW directory with an obscure name)
I repurposed my old macbook pro from 2013 as dedicated Proxmox machine. I run all short of application on it - mostly pulled from https://community-scripts.org/. Along this, I use free tier of Oracle VM to funnel traffic to my box and use that as reverse proxy appliance. Thee isn't a real need to pay $5-$10 for a VPS if you have old machine lying around and use AI to help you configure it. I gave my setup using whichever LLM model I want to use at that day full access via SSH keys.
I developed tarvis.io which is being used by friends and family to self host notion alternative and run hermes agents. This let's them run self hosted apps as actual apps without having to worry about the server or setups.
One friend was running a gitlab runner on a laptop but moved to tarvis given how easy it is. Tarvis has a catalog of 750 apps already so I am sure you can find a few things from there to run 24/7.
IMO being able to see all the apps in a catalog and being able to easily add that app and experiment helped me figure out which apps I should be running.
682 comments
[ 0.25 ms ] story [ 191 ms ] threadIf you don't have a use maybe you do not have a use?
Pretty low maintenance overall - I can go months without even thinking about it.
I installed Plex but ended up not using it, so I removed it.
* https://www.langturbo.com
Still great value though, have my app's website and associated infra on one of those 4CPU/24GB in "pay-as-you-go" mode and never ever reached the paying threshold.
[0] https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...
2. Rendezvous server ("supernode")
supernode is 214.7k static binary
Own version of www, tailored to own needs, free domainnames, no ads/tracking/telemetry, using CurveDNS and CurveCP in homelab
After getting into home assistant and setting up a proper home server I no longer saw a need to keep the VPS running. With cloudflare reverse proxy I can still host personal websites, but from inside my home network. Since getting the home server I'm discovering a lot of neat self hosted options and use it a lot more than I ever did the VPS. If nothing else, hosting your own stuff provides a great place to learn and explore. It doesn't have to be always on/on the internet for that to be true though.
The price was low enough that I left it running.
It depends on your use case, and ability to actually administrate it properly.
I do think about it sometimes when databases leak, though.
I do the same. One of the many joys of owning your email.
- qBittorrent for "Linux ISOs"
- Jellyfin so I can watch/read/listen to my "Linux ISOs"
- Tailscale so me, my family and friends can watch/read/listen to my "Linux ISOs" from anywhere in the world
- Self hosting my photo albums. Immich is a handy choice for this. Very useful for personal photos you don't want to trust to strange tech companies.
- Gitea for self-hosting git repos for some personal projects I have not open-sourced.
With qBittorrent.
> Do you prune the ISOs you've already installed somewhere, or are they kept around to be re-installed?
I keep them all. Compression algorithms are pretty good these days, as is storage density.
But yes, Jellyfin can also natively transcode formats on the fly if you stick a GPU in there: https://jellyfin.org/docs/general/post-install/transcoding/
Ask yourself what other types of media can be had on popular torrent sites.
> Linux ISO: A codeword for copyrighted material shared without permission, usually over P2P networks.
[1] http://linux-iso.urbanup.com/2782626
the really good stuff eventually goes, but there is often a lot of pretty dang good media there too.
check for scratches, tho
I go to a local game exchange place, they have all kinds of DVDs and Blu-Rays for dirt cheap.
If you don't think 2 hours of professionally produced content is worth $10, well that's why AI isn't the only thing destroying art and culture.
So if you want to rip recent Blu-ray, you will need to buy makemkv (they do have a 1-month trial tho). But worse, if you want to rip 4k Blu-ray, you will need a specific br-drive that makemkv support (as I understand, they make custom / modified firmware for some drives, allowing to read the protected data). The issue is that there is barely anyone still making br drives and whenever makemkv support one it goes out of stock and/or become extremely expensive on the second hand market.
This is really annoying me because I know this is the end of the physical market for movie. I fully expect Blu-ray to completely die off in a few years. Movie will probably only be available through streaming services, which means it will be harder and harder to get a good quality encoding. With recent codecs (av1, h265, will see how av2 does), the quality that streaming services is okay, but we are far from what a full Blu-ray dump allows today.
That can change (and the official communication is that its only free while in beta) but my guess is that the free beta is the main thing holding back alternatives. MakeMKV does solid work but it's not rocket science and a lot of parts (like all the complementary LibreDrive / UHD firmware work) doesn't even have a paid license check at all.
It's rare that the latter goes for < $10.
The "questionable" piece is ripping the DVD to a home media library to play via Jellyfin. Which might be fair use in some countries.
at least with the library DVDs I can be reasonably certain the weird artifact is not embedded malware, just scratches
a few months back I opened up a streaming service that I pay for to watch a old TV show. I was _enraged_ to find out that they put ADS WHERE COMMERCIALS USED TO BE. I thought the whole point of paying was to avoid ads!
so now I visit my used Blu-Ray/DVD store about once a month. they always have buy two/get one free, and the prices are ridiculously low.
is it a better solution? I don't know, but I do know that I don't have to watch those ads anymore.
I used to do this, until I learned the value of offsite backups.
Learn from my mistake (if you aren't already :) ).
Inherently to inner copy it provides some redundancy.
Backups need more than one copy.
Constructing a RAID5 with 4 drives provides failover and recovery if one of the drives dies.
A real backup protects both against hardware faults and accidental deletion.
Within a storage array though it does provide redundancy at that level, and generally speaking most people don’t access a raid or NAS at a shell level only where they drop rm -fr’s
Separate and offsite backups are non negotiable, however running a raid 5 locally can greatly reduce storage rebuild/restore time, if a single drive fails the rest of the raid continues to work fine until replaced.
My photos are on: Captured devices(phones, camera). Immich on my homelab, and google photo(which is lossy, but better than nothing).
Granted, an average person most likely will never mess up, but in google-land the surface area where to make that mistake is quite large.
I didn't check ToS of proton drive, but in my experience, every cloud storage has requirement about what kind of data is allowed to store(after all, they dont want to accidentally store illegal stuff).
I then tested restore vis kopia desktop onto my desktop to validate restore works.
13 eur for 5tb is more than enough for immich backups for my personal use.
It is generous of you to share your "Linux ISOs" with your family and friends.
It really was common for Linux distros to provide torrent downloads back then. Internet speeds were such that downloading peer‐to‐peer could be significantly faster, and (probably more importantly) it saved the distro mirrors a lot of bandwidth. I think this practice has mostly died out, but Ubuntu for example still provides them under “alternative downloads”: https://ubuntu.com/download/alternative-downloads
If you're privacy conscious, please be aware that Tailscale by default is leaking behavioral metadata from all of those computers to the Room 641As of the world about everything you do on your supposedly “private” network: https://tailscale.com/docs/features/logging
“This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”
Headscale turns the $5 VPS into the thing that connects my laptop to my other compute resources while I am out and about.
For example, you can create a token that grants VPN access with inbound SSH as the only allowed traffic. Add that as a secret to GitHub Actions and now you can ad-hoc debug failing CI via `tailscale ssh`.
https://www.wireguard.com/quickstart/
Definitely a place for both services, IMO.
https://sanctorum.se
> no mobile clients
I know of some people however who hacked up their own using the sanctum library (https://github.com/jorisvink/libkyrka)
You can't turn off the centralised element of Tailscale though, i.e. IP tracking etc.
So for the privacy conscious Tailscale remains a poor choice. Especially as they operate under US jurisdiction:
So CLOUD, PATRIOT and friends very much apply to Tailscale.You may jest "but its only metadata", but you can do a lot with metadata, especially if its all nicely attractively centralised like Tailscale.
What is Tailscale getting that my ISP and google/Facebook via their pixels and tracking scripts aren't?
Tons more. A lot could be written about, but a few "for starters" things to think about:
Yes, `--no-logs-no-support` exists for the Tailscale client — but that's per-device, per-platform inconsistent (as the docs show), forfeits support, and doesn't change the fact that coordination traffic, the DERP relays, and the control plane still run through Tailscale. You can't opt out of the centralized control plane at all.But if you think Tailscale is bad for mobile devices because they might be able to tell that you're near another Tailscale user, that is absurd. If you have a need to be physically untrackable, the only solution is to leave your tracking device at home.
Like? What exactly could they plausibly do, that I should care about, if I otherwise have no reason to worry about these institutions?
In case you were not aware, spooks have focused on metadata analysis over "full take" (data) analysis for a very long time because they are far more effective and require less data to analyse. This has been the case at least since the 90s with Stellar Wind but arguably even the Stasi worked this way -- they cared a lot more about who you were talking to than what you were talking about. The Snowden revelations in 2013 talked almost entirely about metadata-only systems that were being used to invasively surveil the world.
[1]: https://abcnews.com/blogs/headlines/2014/05/ex-nsa-chief-we-...
Can I even hide from NSA level adversaries without employing extreme methods? Assuming "no", then for this particular threat model do the tools employed next matter?
Reality is, for normal people there's no point where worrying about spooks and taking actions to protect themselves is reasonable. As you say, there's nothing one can do against a targeted attack. But same is true for broad, untargeted sweeps - if they really care, they will find you anyway, and attempting to reduce your data exposure just flags you as an anomaly, making you more interesting, not less.
The whole "privacy vs spooks" threat analysis is not relevant to regular people.
> If you're privacy conscious, please be aware that Tailscale by default is creating behavioral metadata from all of those computers for the Room 641As of the world about everything you do on your supposedly “private” network
Is Tailscale creating additional metadata that doesn't already exist in "concentrated" form with my ISP? As a regular person trying to live a normal "internet enabled" life (self hosting a few things, sharing things with family or friends....) are there alternatives to Tailscale that leave substantially fewer traces for "Room 641s" and other similar entities, and doesn't just move the metadata collection to the hosting provider or the ISP?
And finally, does disabling logging in Tailscale mitigate those concerns? After all Tailscale will always be a target for data collection whether they cooperate or not by virtue of where they placed themselves. Similar to Cloudflare probably.
Yes, for connections between any pairs of machines that were previously entirely behind your NAT, unless you use bare LAN IP addresses for everything. Tailscale takes over DNS resolution very aggressively, so any use of short hostnames will have them resolve to Tailscale's CGNAT range instead even if they're on the same network.
I don't argue "I have nothing to hide", even uttering this phrase is giving in to privacy paranoia.
In reality, I have plenty to hide. But those who I want to hide it from, don't have access to the metadata you mention - and those who do have access, couldn't give less of a damn about the things I want to hide.
I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations with bash scripts, but if you have an heterogeneous environment (esp iOS clients), making programmatic configuration changes to WireGuard becomes trickier.
Today I use Tailscale (with Headscale as the control plane) for all users, and WireGuard as a emergency access to key servers.
And a damned good one at that. I can spend five minutes on a (family) nontechnical user's device and set it up to be able to access the parts of my network it needs to get to, and it's easy enough to use that I can walk them through the troubleshooting over the phone if it ever goes awry. Regardless of where they are or I am.
It does not. You need a public endpoint, but presumably the $5 VPS or the "homelab" provides that, or it's of little use for things like email, Web, or game servers.
Needing to do additional things like figure out firewall rules is exactly what I'm talking about. I enjoy tinkering for fun most of the time but I'm generally looking to tinker on something specific, not every step along the way.
On some OSes you could probably also use some additional 4->6 tunnel, but that probably doesn't work stacked under Wireguard on iOS and Android.
For example, "our (paying) customers want everything to "just work""
Or, "we only use the behavioural data to improve the service"
Therefore non-paying users must want this, too. Hmm...
Maybe the data collection is way to extract some value from those non-paying users
There will be always be some "but you can opt-out" HN replies
As if defaults don't matter
~10W is what my socket reports for regular use on the M2 Pro.
They are not cheap anymore, unfortunately, but at least you get much more performance out of them than you would from some $5 VPS.
[0] https://www.githubstatus.com/
This doesn't sound safe, since this is not anonymous and there are a lot of "Linux haters". Consider switching to and thus support torrents in I2P.
Handy to have a non commercial VPN solution you can deploy in any region.
All of those are in different containers running through podman.
Proxmox VE with various guests (PeaNUT, Gitea, Ntfy, n8n, AI inference, agents) running across 3 servers (total >300GB RAM, 6TB SSD storage), with a separate Proxmox Backup server.
One friend was running a gitlab runner on a laptop but moved to tarvis given how easy it is. Tarvis has a catalog of 750 apps already so I am sure you can find a few things from there to run 24/7.
IMO being able to see all the apps in a catalog and being able to easily add that app and experiment helped me figure out which apps I should be running.
( my post-factum inspiration: https://stevehanov.ca/blog/how-i-run-multiple-10k-mrr-compan... )
- Jellyfin
- Audiobook shelf
- Immich
- ChangeDetection (for monitoring when something is back in stock)
- Minecraft server for my kids
- Several apps I have for my own use
- HomeAssistant
- Hermes