So just browse piracy sites with Tor. Bittorrent clients might struggle to access blocked trackers, but the DHT can’t really be censored IIUC.

EDIT: It might even be possible to configure Bittorrent clients to use Tor specifically for communication with trackers (but not for the bulk P2P chunk transfers).

EDIT2: Not sure why I’m getting downvoted. Maybe the next person to downvote could reply and explain why.

They could also force ISPs to ban VPN IPs that don’t comply with their piracy blocking rules, regardless of whether they’re in the US.

I do appreciate some of the philosophy of Hey, like cherishing the human-to-human section of your inbox. But it’s simply not worth the price tag. Also now that DHH has proudly proclaimed he does not read any of the code, I don’t think it’s even worth it for free, if I’m gambling with my data. I just self-host Stalwart and Bulwark.

Secrets

• Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
• Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

• Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
• No SSH from the WAN. sshd on the router is not exposed to the internet at all.
• WireGuard for remote access.
• Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
• Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
• TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

• SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
• Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

Thanks for sharing. I’m trying it out as a Google Keep replacement.

It’s in the name. Capitalism rewards capital.

Probably best we just let them think they got one over on us.

It’s not middling, it’s an early-advanced rating. For perspective, an Elo differential of 400 implies 10:1 win:loss odds.

New shortest path meta dropped

https://arxiv.org/pdf/2504.17033

What good role models do we have for today’s youth? I feel like they’re all on YouTube watching braindead slop or chauvinistic rich douchebags.

What about nftables?

“Fraud” might be a bit strong, but Theo just generally seems to have myopic takes on programming. I always cringe when I watch his videos.

Such a good book. I still have no idea what it was about.