rjmalagon

Thanks for this, almost forgot it. Works great on Fedora Workstation 39.

Wayland forwarding over SSH: done

I am a long happy user of authenticated TOR hidden services for my secure admin access to ssh servers and some self-hosting services, and it is my last hope when even tailnets, meshnets fail to reach. I2PD c++ IP2 nodes are very helpful as backup authenticated hidden services for some of my servers, as in general TOR is more stable but sometimes I2P can work around when TOR fails.

Tor is simpler, better audited, and I don't mind too much the little centralization of the authority TOR nodes, plus the pluggable transports.

I2P is more complete (UDP, protocol libraries, nice hidden service client and server port handling, etc) its somewhat chaotic decentralization is a mixed bless, but that's the point. I like the tradeoff of mixing my bandwidth with others bandwidth (pay with some bandwidth now to save my rear-end later when needed).

I2PD c++ node is pleasant for me because it is compact and clean for my needs (authenticated hidden service SSH access and self-hosted web services) and I can manage it almost like the TOR node. The original IP2 Java node is good for end users, handy with integrated IRC, email, and file sharing services.

Minor inconvenience vs Mexico electronic invoice hell. Our VAT is 16%, for everyone except a select group of small business, of a now discontinued tax regimen. We must issue a dual cryptographic signed XML invoice (by the emitter and the tax authority) with individualized items with ID codes from a tax authority catalog of recognized products and services, that includes tampons (53131615) to warships (25111708) to radical ecological organizations (94131701). Every invoice needs to be sent to the tax authority servers to get the second signature, without it the invoice is not valid. Without it is not possible to deduct to VAT payments, or (monthly) tax filling in general. No internet, no invoice software, no computers, equals no invoice and no invoice is almost tax fraud. A fiscal invoice is only emitted when a customer asks for it, but businesses are obliged to emit a "general public invoice" with all the sales where customers don't ask for a fiscal invoice.

In México, we have SPEI. Allows free instant transfers between bank accounts (with some exceptions). We employ an 18-digit code (CLABE), and debit card numbers are also permitted. You can add a phone number to your bank account to receive money transfers with it. SPEI supports push and pull, the latter being less common. SPEI can be utilized to remit payment for certain credit cards and specialized services. CLABE 18-digit codifies the bank, account location, account number and a verify digit. SPEI is managed by a subsidiary of the Mexican central bank. For a country where many things work slow a clunky, SPEI woks surprisingly well and fast. We really missed it when we tried to send money outside of Mexico.

Apparently, just fine. On paper, do a quick check and clean on mount. There are mount options for full check, degraded and recovery modes. About the paper https://bcachefs.org/bcachefs-principles-of-operation.pdf

Maybe you already know it: you can filter ads by DNS on phones (manually configured or with pseudo VPN apps), and if you don't mind using other mobile browsers, on Android Firefox supports ad blockers and Brave (Android and IOS) has an integrated one.

I see ad blockers as good filters for them. Someone that feels annoyed by ads to the extent of making the effort to install ad blockers is not a good target for ads too. Less tech-savvy and caring users are perfect targets for ads.

I am a very happy Silverblue user. There is a learning curve to adapt workflow to containers, Toolbox and serious Flatpak tuning, but got a solid and clean workstation experience. The clutter-free that prevents the gradual rot of the system pay by itself.

I like it so much that 2 years ago I jumped to the Fedora Core/IOT thing for my servers. A somewhat deeper learning curve (ignition files...) but very pleased to used lightweight Fedora rpm-ostree based immutable OS on metal and virtual. Cleanest rock solid server experience on Linux servers (that actually updates worry free) of my career.

Yup, Ubuntu is ongoing in this. Debian is in a better shape.

It is a fixed bug. Your target needs to be an outdated Linux distro.

In a current one or patched one, is more likely to have a non-vulnerable LUKS2 volume that you can not downgrade to a vulnerable one, or a kernel and userspace tools non-vulnerable to the metadata manipulation even for a LUKS1 volume.

I concede the plausible scenario of replacing the kernel to a vulnerable one, if you ha access to the drive (by external OS boot or get the hardware) and replacing the kernel on the usually unencrypted boot partition along modifying the LUKS2 metadata of the encrypted volume. Not a quick local or remote feat to do. Not doable on an encrypted boot volume or signed boot files (secure boot thingy). Sincerely, if you have that kind of access, it is easier to modify the initramfs file to grab the LUKS key.

Your second guess is the correct one. This is a bug in the LUKS2 header metadata that can trick the kernel to "recover and resume" an unsolicited decryption/reencryption process. Very hard to do because you need access to the drive and later someone to unlock the modified drive.

It as fixed bug, and a plausible scenario is if someone wants to decrypt a LUKS2 (in and old linux kernel system) which is auto unlocked by a TPM like device.

Actually, I have a LLVM build kernel in a Debian server, with ThinLTO enabled config.

"Linux version 5.13.0+ (x@x) (Debian clang version 13.0.0-++20210418105309+a0898f0cecc7-1~exp1, LLD 13.0.0) #6 SMP Thu Jul 1 10:22:40 CDT 2021"

Nope, is more like a "Vitual public network" maker. Peer links are encrypted, each peer has its own key, but DHT and routing is not obfuscated. It exposes virtual network interfaces with an IPV6 address per node. You can use common software on it.

"Magic VPN" or "Magic E2EE LAN" kinda IPSEC for commoners, depends on how you config it.

Very different. WireGuard is explicit basic, only cares how to make an encrypted link between two devices, and do it very well. Key exchange, IP assignation and routing are manual work. There are solution build on top of WireGuard (Tailscale is one of them) that puts some "automagic".

YG puts more "magic" on protocol (autorouting, mesh making, etc), but is not that clean on design (crypto not formally tested, latency prone TCP links, not good enough NAT punching, etc).

Wireguard and YG are different tools on the SDN network toolbox, and can be mixed for special porpoises.

At low level is not related to WireGuard in any way. The wintun project only exposes a virtual network interface to Windows systems, a clean and proper signed windows driver. That side project to Wireguard was created because the native windows virtual interface is too basic for "advanced vpns" and the former windows TUN driver (OpenVPN side project TUN driver for windows) used by everyone was clunky and old.

YG uses it own crypto and routing, wintun is used here only to expose the virtual network interface on Windows.

Quite different. ZT is centralized config, direct peer to peer, automatic key exchange, virtual switch.

YG is decentralized, direct peer to peer and multi hop routing, manual key exchange for direct peering, virtual internet (each node is a router to another nodes)

ZT (and Tailscale) requires a central node coordinator for automatic config and peer key exchanges, peers directly to each node to create a flat virtual network, not multi hop routing, between two peers you need a reachable IP or port mapping (supports UPNP) by one of them (fixed in config there are private TCP relays when carrier NAT/double NAT/ restrictive firewalls are in place, very slow), Uses UDP for the links, mimics a virtual switch and support custom IPV4 / IPV6, good for virtual private networks.

YG (and CJDNS) is kinda an overlay public network, is fully decentralized, it supports automatic routing between nodes to mimic a virtual Internet, each node is a router too, needs to register each key for every direct peer node connection (config needs peer key, reachable ip and port, but supports automatic key exchange for local networks), YG uses TCP for the links, support self-healing routing, every peer has an IPV6 address derived by its public key.

ZT (and Tailscale) can mimic a mesh network and node routing because supports bridge nodes between networks (routing between virtual switches), but is not self-healing and somewhat heavy work to config. ZT is fully open source, can be config with your own node coordinator and discovery helpers (Controllers and Moons in ZT), not easy. Only Taislcale client is open source, can't be config with your own node coordinators for free.

You can mix ZT and YG, weird side effects warranted but works. (Edited post - some grammar fixes)

CAESAR AEAD crypto competition final portafolio.

After 8 years since the initial announcement and 5 years of the initial papers submission, the CAESAR committee selects the most robust AEAD crypto implementations that offer better security and performance than AES-GCM. The portfolio groups in three categories: lightweight application, high performance and nonce misuse resistance.

Surprise me. I think that both diabetes types are very complex illness.