Mmm yeeees. Very distinguished.

Wow small world. Have you played Spitzer?

You don’t need to. But it’s probably a good idea for the same reason as with BitTorrent.

Reading through the docs about it here, it sounds like it’s only an indexer, not a tracker.

Well fuck me. I mean I don’t think that’s an immediate issue for me but that does suck.

EDIT: Although if we’re being honest, has PIA been found doing anything shady in the 7 years since they were acquired?

Do people not recommend PIA anymore? I’ve used it for a long time and never had issues. Supports port forwarding. Audits have shown they don’t store activity logs, and they even run RAM-only servers.

EDIT: Just looked at AirVPN. It’s nice they don’t request any identifying info on signup.

I agree the transport layer is good and having anonymity in a different layer works. I think my main gripes with it today are:

1. Anonymity is paid for and trust-based. It’d be awesome if something like I2P started working well enough that anyone could have anonymity for free without needing to trust a company or worry about poor performance.
2. Private trackers. While I understand the logic behind this form of community (incentivize seeding and make bans meaningful), I think it’s possible to solve those problems with a public tracker. I have ideas on how this could work if anyone is interested.

I haven’t tried SoulSeek. What does it do better than Bittorrent?

EDIT: After playing around with SoulSeek, it seems pretty cool, although the amount of time it takes to scan your files on startup is laughably bad.

Public trackers never seem to have as good of releases or swarm health, except for the most popular content.

Secrets

• Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
• Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

• Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
• No SSH from the WAN. sshd on the router is not exposed to the internet at all.
• WireGuard for remote access.
• Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
• Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
• TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

• SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
• Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

Thanks for sharing. I’m trying it out as a Google Keep replacement.

Zeus

You should file an issue.

Doesn’t Matrix do everything you just listed?

Copyparty. Or any other web file server.

Is that Alien?

They do but I don’t know if there is a significant conversion from tourism to immigration. I think most tourists are taking advantage of the weak yen, not trying to live there long term.

I don’t doubt some of this stuff happened, but I also wouldn’t be surprised if some of it is nationalist fear mongering. Just like the whole “tourists are kicking the deer” rumor where no evidence ever surfaced. Some nationalist Japanese really like to stoke the anti-foreigner flames.

But Japan truly does have an over-tourism problem so this could absolutely be justified.

Unfortunately I don’t see any mention of Dolby Vision Profile 8 support. My KODI box has an intel GPU.

I don’t think that’s the case. Whatever device is running the jellyfin client needs to support DV. So in my case, a Linux box running KODI cannot decode DV (because Linux has no DV support AFAIK), even though it’s connected to a TV that supports DV.