- qBittorrent for "Linux ISOs"
- Jellyfin so I can watch/read/listen to my "Linux ISOs"
- Tailscale so me, my family and friends can watch/read/listen to my "Linux ISOs" from anywhere in the world
- Self hosting my photo albums. Immich is a handy choice for this. Very useful for personal photos you don't want to trust to strange tech companies.
- Gitea for self-hosting git repos for some personal projects I have not open-sourced.
If you're privacy conscious, please be aware that Tailscale by default is creating behavioral metadata from all of those computers for the Room 641As of the world about everything you do on your supposedly “private” network: https://tailscale.com/docs/features/logging
“This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.”
I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations with bash scripts, but if you have an heterogeneous environment (esp iOS clients), making programmatic configuration changes to WireGuard becomes trickier.
Today I use Tailscale (with Headscale as the control plane) for all users, and WireGuard as a emergency access to key servers.
Needing to do additional things like figure out firewall rules is exactly what I'm talking about. I enjoy tinkering for fun most of the time but I'm generally looking to tinker on something specific, not every step along the way.
One of my pet projects I need to get back to is an SDN to make configuration for mikrotik routers easier (particularly with VLAN's, wireguard or VPNS, or routing configuration between ports).
Winbox is nice in a sense because it tells you the true configuration. But what I really want is something that can start with a network diagram (e.g.) and then get the current state of the router, and then validate that against the network config.
Of course the default behavior that Tailscale forces you to reauthenticate periodically can cause the same problem unless... you turn it off. You know things like that always happen at the worst time.
On some OSes you could probably also use some additional 4->6 tunnel, but that probably doesn't work stacked under Wireguard on iOS and Android.
And a damned good one at that. I can spend five minutes on a (family) nontechnical user's device and set it up to be able to access the parts of my network it needs to get to, and it's easy enough to use that I can walk them through the troubleshooting over the phone if it ever goes awry. Regardless of where they are or I am.
It does not. You need a public endpoint, but presumably the $5 VPS or the "homelab" provides that, or it's of little use for things like email, Web, or game servers.
Headscale turns the $5 VPS into the thing that connects my laptop to my other compute resources while I am out and about.
For example, you can create a token that grants VPN access with inbound SSH as the only allowed traffic. Add that as a secret to GitHub Actions and now you can ad-hoc debug failing CI via `tailscale ssh`.
> no mobile clients
I know of some people however who hacked up their own using the sanctum library (https://github.com/jorisvink/libkyrka)
Definitely a place for both services, IMO.
You can't turn off the centralised element of Tailscale though, i.e. IP tracking etc.
So for the privacy conscious Tailscale remains a poor choice. Especially as they operate under US jurisdiction:
- "Tailscale US Inc., a Delaware corporation with registered address at 447 Sutter St Ste 405 #543, San Francisco, CA 94108, USA"
- "For any dispute not subject to arbitration you and Tailscale agree to submit to the personal and exclusive jurisdiction of and venue in the federal and state courts located in New York, NY".
You may jest "but its only metadata", but you can do a lot with metadata, especially if its all nicely attractively centralised like Tailscale.
What is Tailscale getting that my ISP and google/Facebook via their pixels and tracking scripts aren't?
Tons more. A lot could be written about, but a few "for starters" things to think about:
- The web is decentralised. And a lot of the web trackability can be dealt with in a dozen different ways. But Tailscale is centralised and all the data nicely structured (stable node keys etc.) and "ready to go" for metadata analysis.
- Tailscale have "behind the firewall" visibility at a far greater level, it enables building of a topology map and associated flows.
- Tailscale visibility is perhaps most concerning in relation to metadata surrounding mobile devices. Where is the device ? Is it in use ? Is it near other devices (from the same customer / other customers) ? etc. etc. etc.
But if you think Tailscale is bad for mobile devices because they might be able to tell that you're near another Tailscale user, that is absurd. If you have a need to be physically untrackable, the only solution is to leave your tracking device at home.
Like? What exactly could they plausibly do, that I should care about, if I otherwise have no reason to worry about these institutions?
In case you were not aware, spooks have focused on metadata analysis over "full take" (data) analysis for a very long time because they are far more effective and require less data to analyse. This has been the case at least since the early 2000s with Stellar Wind but arguably even the Stasi worked this way -- they cared a lot more about who you were talking to than what you were talking about. The Snowden revelations in 2013 talked almost entirely about metadata-only systems that were being used to invasively surveil the world.
If your point was more "I have nothing to hide" then you can find plenty of articles online to disabuse you of that notion. There's even a Wikipedia article about it[2].
[1]: https://abcnews.com/blogs/headlines/2014/05/ex-nsa-chief-we-... [2]: https://en.wikipedia.org/wiki/Nothing_to_hide_argument
I don't argue "I have nothing to hide", even uttering this phrase is giving in to privacy paranoia.
In reality, I have plenty to hide. But those who I want to hide it from, don't have access to the metadata you mention - and those who do have access, couldn't give less of a damn about the things I want to hide.
Can I even hide from NSA level adversaries without employing extreme methods? Assuming "no", then for this particular threat model do the tools employed next matter?
But there is a bigger point to be made: in my experience most privacy activists argue that taking an absolutist stance personally is counter-productive -- just because it is almost impossible to completely eliminate risks from your life does not mean you should give up and not try to minimise them. And of course, the goal for most people isn't to protect against targeted attacks (since that means you already need to take fugitive-on-the-run-level precautions), it's to avoid becoming a target in the first place.
> If you're privacy conscious, please be aware that Tailscale by default is creating behavioral metadata from all of those computers for the Room 641As of the world about everything you do on your supposedly “private” network
Is Tailscale creating additional metadata that doesn't already exist in "concentrated" form with my ISP? As a regular person trying to live a normal "internet enabled" life (self hosting a few things, sharing things with family or friends....) are there alternatives to Tailscale that leave substantially fewer traces for "Room 641s" and other similar entities, and doesn't just move the metadata collection to the hosting provider or the ISP?
And finally, does disabling logging in Tailscale mitigate those concerns? After all Tailscale will always be a target for data collection whether they cooperate or not by virtue of where they placed themselves. Similar to Cloudflare probably.
Reality is, for normal people there's no point where worrying about spooks and taking actions to protect themselves is reasonable. As you say, there's nothing one can do against a targeted attack. But same is true for broad, untargeted sweeps - if they really care, they will find you anyway, and attempting to reduce your data exposure just flags you as an anomaly, making you more interesting, not less.
The whole "privacy vs spooks" threat analysis is not relevant to regular people.
If you don't think 2 hours of professionally produced content is worth $10, well that's why AI isn't the only thing destroying art and culture.
So if you want to rip recent Blu-ray, you will need to buy makemkv (they do have a 1-month trial tho). But worse, if you want to rip 4k Blu-ray, you will need a specific br-drive that makemkv support (as I understand, they make custom / modified firmware for some drives, allowing to read the protected data). The issue is that there is barely anyone still making br drives and whenever makemkv support one it goes out of stock and/or become extremely expensive on the second hand market.
This is really annoying me because I know this is the end of the physical market for movie. I fully expect Blu-ray to completely die off in a few years. Movie will probably only be available through streaming services, which means it will be harder and harder to get a good quality encoding. With recent codecs (av1, h265, will see how av2 does), the quality that streaming services is okay, but we are far from what a full Blu-ray dump allows today.
That can change (and the official communication is that its only free while in beta) but my guess is that the free beta is the main thing holding back alternatives. MakeMKV does solid work but it's not rocket science and a lot of parts (like all the complementary LibreDrive / UHD firmware work) doesn't even have a paid license check at all.
> I fully expect Blu-ray to completely die off in a few years.
I don't. It might continue to shrink and thereby get more expensive but the distributor market is still very healthy and has more active competition than movie production itself. The biggest danger is disc production but I don't think its impossible to shift that over to a BD-on-USBFlash or whatever else is convenient if needed.
It's rare that the latter goes for < $10.
at least with the library DVDs I can be reasonably certain the weird artifact is not embedded malware, just scratches
a few months back I opened up a streaming service that I pay for to watch a old TV show. I was _enraged_ to find out that they put ADS WHERE COMMERCIALS USED TO BE. I thought the whole point of paying was to avoid ads!
so now I visit my used Blu-Ray/DVD store about once a month. they always have buy two/get one free, and the prices are ridiculously low.
is it a better solution? I don't know, but I do know that I don't have to watch those ads anymore.
I go to a local game exchange place, they have all kinds of DVDs and Blu-Rays for dirt cheap.
the really good stuff eventually goes, but there is often a lot of pretty dang good media there too.
check for scratches, tho
> Linux ISO: A codeword for copyrighted material shared without permission, usually over P2P networks.
Ask yourself what other types of media can be had on popular torrent sites.
It is generous of you to share your "Linux ISOs" with your family and friends.
It really was common in the early 2000s for Linux distros to provide torrent downloads. Internet speeds were such that downloading peer‐to‐peer could be significantly faster, and (probably more importantly) it saved the distro mirrors a lot of bandwidth. I think this practice has mostly died out among newer distros, but distros from the era such as Ubuntu or Arch still provide them.
I used to do this, until I learned the value of offsite backups.
Learn from my mistake (if you aren't already :) ).
This.
My photos are on: Captured devices(phones, camera). Immich on my homelab, and google photo(which is lossy, but better than nothing).
Granted, an average person most likely will never mess up, but in google-land the surface area where to make that mistake is quite large.
I didn't check ToS of proton drive, but in my experience, every cloud storage has requirement about what kind of data is allowed to store(after all, they dont want to accidentally store illegal stuff).
I then tested restore vis kopia desktop onto my desktop to validate restore works.
13 eur for 5tb is more than enough for immich backups for my personal use.
Inherently to inner copy it provides some redundancy.
Backups need more than one copy.
Constructing a RAID5 with 4 drives provides failover and recovery if one of the drives dies.
A real backup protects both against hardware faults and accidental deletion.
Within a storage array though it does provide redundancy at that level, and generally speaking most people don’t access a raid or NAS at a shell level only where they drop rm -fr’s
Separate and offsite backups are non negotiable, however running a raid 5 locally can greatly reduce storage rebuild/restore time, if a single drive fails the rest of the raid continues to work fine until replaced.
With qBittorrent.
> Do you prune the ISOs you've already installed somewhere, or are they kept around to be re-installed?
I keep them all. Compression algorithms are pretty good these days, as is storage density.
But yes, Jellyfin can also natively transcode formats on the fly if you stick a GPU in there: https://jellyfin.org/docs/general/post-install/transcoding/
This doesn't sound safe, since this is not anonymous and there are a lot of "Linux haters". Consider switching to and thus support torrents in I2P.
~10W is what my socket reports for regular use on the M2 Pro.
They are not cheap anymore, unfortunately, but at least you get much more performance out of them than you would from some $5 VPS.