If a worker co-op based society erased it’s competition and formed a monopoly co-op run for the benefit of workers, is that not just a communist managed economy at that point with the monopoly playing the role of the state before erasing itself?

Oh shit, there goes the planet.

Yeah, it’s true, a lot of things suck. They can and do get better though. I have a partner with BPD. They’ve been through a LOT of rough times, but they’re now very loved and they enjoy their current job and have plenty of friends who care about and support them.

Therapy helps and sometimes, the world isn’t always an absolute dick to everyone forever. Life changes and the world revolves and people find each other.

I hope you find your people too and a place where you can feel a little less shitty. :)

Edit: if you’re feeling THAT shitty maybe consider reaching out to your local suicide hotline? People like that can help.

https://youtu.be/V5u9JSnAAU4 Relevant Tom Scott

How about pseudonymous as a compromise? Votes could be publicly federated but tied to some uuid instead of the username. That way you still have the same anti spam ability (can see that a user upvoted these things from this instance at this time) but can’t tie it directly to comments or actual user accounts without some extra osint.

It might be theoretically possible to correlate the uuids with an account’s activity and dox the user in some cases, especially with some instances having a single user, but it would be very difficult or impossible to do on larger instances and would add an extra layer. Single user instances would be kind of impossible to make totally private anyway because they can be identified by instance.

It does sound very strange. What kind of anti-China content would ever help a student’s application process? Most of the application documents are about things like English language competency, visa requirements and prior qualifications, not political opinions.

The most popular brand of matches in Denmark is called Tordenskjold. In the late 1800s, Sweden had a large export production of matches, so a Danish manufacturer put Tordenskiold’s portrait on his matchbox in 1882, in the hope he could once more strike at the Swedish (Danish: give de svenske stryg).[13] The Tordenskjold brand was bought by a Swedish company in 1972.[14]

Ouch.

Haha, the internet did not fit on a 1.44mb floppy in 1998. Curious to know what was on this‽

1998 was well into the CD-ROM era and the internet was full of .mp3s and .isos by then.

Best is very subjective.

.world is a good general purpose instance for just about anything. I think it has the biggest population at the moment, so communities there are likely to get at least some engagement.

For “general discussion” it doesn’t really matter. The instances are federated so you’ll likely get general discussion in comments from lots of people from lots of instances anyway, wherever your community is based.

Some people get almost nationalistic about their chosen instances or have grudges against people from certain other instances. There’s sometimes inter-instance politics with some servers defederating with others or threatening to for various reasons. It’s kinda fun to watch in a popcorn drama kind of way. For the most part, the instance doesn’t matter.

I guess eternal life through some profane kind of undead cyborg magic… Bad maybe?

They’re not files, it’s just leaking other people’s conversations through a history bug. Accidentally putting person A’s “can you help me write my research paper/IT ticket/script” conversation into person B’s chat history.

Super shitty but not an uncommon kind of bug. Often either a nasty caching issue or screwing up identities for people sharing IPs or similar.

It’s bad but it’s “some programmer makes understandable mistake” bad not “evil company steals private information without consent and sends it to others for profit” kind of bad.

Totally agree on all points!

My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.

Tailscale isn’t an exposed service. Headscale is

Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.

it’s more work and may not always be worth the effort

I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.

I recommended SmallStep+Caddy.

Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.

Are you suggesting that these attack techniques are effective against zero trust tunnels

No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.

I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.

there’s an argument that HTTPS isn’t really required…

Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.

The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.

If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.

“Toad in the Hood” is the gritty HBO sequel to “The Wind in the Willows” that takes place after Toad breaks out of prison.

Interesting. I remember there being fewer ads but the ones that did exist were worse. Bright colours, flashing, blink tags, 3-frame epilepsy inducing animated gifs… “You are the 10000th visitor!” Some in the mid to late 90s would pop-up new windows or even start autoplaying sound…