You see, it’s not communism, but communism with Chinese ideals (therefore whatever the heck the CCP wants it to be)

There’s growing research into positive tipping points for the climate. Biden’s historic investment into renewables put a finger on the scales tipping them for significantly more solar and wind investment, which will of course reduce the cost of building solar and wind and soon enough the federal government’s finger won’t even be needed on the scale to make solar and wind cost effective to build.

Other decarbonization efforts like pushing for more bike infrastructure leading to fewer car trips and more bike trips, and shifting cars to electricity rather than gasoline also have tipping points where it will make far more sense to do the cheaper thing that happens to be better for the climate than not

Realistically the indescriminant nature of this attack with high likelyhood of civilian casualties it probably will be classified similarly to cluster munitions and be banned, and nations with enough geopolitical weight to skirt these rules will continue to skirt them then play dumb when they’re called out and hauled in front of the ICC, ultimately facing zero repercussions

Ooh I hope that’s the case because that would be much more convenient

Edit for anyone who stumbles on this: it works exactly like the above commenter described! It looks like there’s some opportunity to better communicate what DLC the “copy” you select is installing since it doesn’t show a full list of DLC but it at least shows who’s library it’s pulling from so you should be able to infer the full DLC list based on who has all of the DLC

Omg I forgot about that moment!

I’m curious if this will improve DLC mismatches. For example, I’ve purchased most of the map DLCs for Euro & American Truck Simulator, but my wife only purchased the base game.

By memory she previously could access all of the DLC via library sharing until she purchased it, then she could only access the base game and not the shared DLC. It’s probably cleanest to keep it that way since you never know how different games handle DLC being activated and de-activated within an existing save, but it would be nice to not punish someone for playing a game with DLC via library sharing then purchasing the game for themselves and buying DLC later

It was great seeing Kamala get under his skin. The reaction cams were really fun seeing Kamala react like a normal human to his insane rantings and him just smoldering and getting angrier and angrier when she hit back

For public facing only use key based authentication. Passwords have too much risk associated for public facing ssh

In the context of Runescape this is just a hellish mess, because its ultimately a codebase from the late 90s with graphics created everywhere from the early 00s to the mid 20s. Oh and as an MMORPG anyone who was a player but stops playing is a lost sale so no pressure at all

The Sims 4 actually added a similar approach to character creation about 2 years ago, but very different kind of game with a very different market

Off the top of my head it has options for male presenting body type, female presenting body type, sliders for fat and muscle (and you can generally reshape most of the body) and the available clothing and hairstyles got sorted into masculine and feminine with I believe more traditionally gender neutral stuff getting placed into both, then for biological purposes there’s “can pee standing up/cannot pee standing up” and “can impregnate/can be impregnated” It defaults to Male/Female defaults but makes it easy to customize, and a good mix of default townies (NPCs) are all over the spectrum.

They also recently added more complex relationship and romance preferences, so sims can be sexually bi but romantically straight for example, but also expanded to allow various levels of openness to relationships as well as poly relationships

so all rules would have to be applied on the Pi itself

Sounds like you’ll want to setup IPTables

I got one for work. It literally just pastes into ChatGPT

Huh! Thank you very much for the detailed answer that’s extremely interesting!

Checking nmap’s documentation it looks like it’s perfectly possible to detect open udp ports

You should NOT have a WG tunnel from the home network to the VPS with fully unrestricted access to everything.

This is what I came here to make sure was said. Use your firewall to severely restrict access from your public endpoint. Your wiregaurd tunnel is effectively a DMZ so firewall it off accordingly

The really nice thing about tailscale for accessing your hosted services is absolutely nothing can connect without authentication via a professionally hosted standard authentication, and there’s no public ports for script kiddies to scan for, spot and start hammering on. There’s thousands of bots that do nothing but scan the internet for hosted services and then try to compromise them, so not even showing up on those scans is a good thing.

For example, I have tailscale on my Minecraft server and connect to it via tailscale when away from home. If a buddy wants to join I just send a link sharing the machine to them and they can install tailscale and connect to it normally. If for some reason buddy needs to be cut off, I can just stop sharing to that account on Tailscale and they can no longer access the machine.

The biggest challenge of tailscale is also it’s biggest benefit. Nothing can connect without connecting through the tailscale client, so if my buddy can’t/won’t install tailscale they can’t join my Minecraft server

No problem! I’m just an information sponge and I’ve lucked out with really good mentors so far in my career to learn from

So from my experience you generally will have different zomes of security. Outside Internet is obviously entirely untrusted so block every incoming connection except those you really need, and even then ideally all remain blocked (especially for a home network). Then you generally have your guest network which might need access to some hosted resources but is largely just used by guests to connect to the internet, next is your client network where your computer likely lives which probably gets access to all hosted resources but no management access (or depending on how much you want to trust your primary PC, limit that to just your main PC) and finally your datacenter network where you hopefully trust everything running in there.

You generally work with these zones and write rules based on the zone the traffic is coming from, with some exceptions, such as I might not want to give the guest network any access to my data center network, except for access to my jellyfin so I’ll create a rule allowing only tcp web traffic from that network to a specific port on a specific IP/hostname.

A common way to achieve this is with a DMZ network, a network that sits between all of your networks and relies heavily on routing and firewalls. Public services and routers get IP addresses on the DMZ, and your firewall only allows specific paths. The outside Internet can open connections to the web ports of the web server and nothing else, the web server can’t open connections to your other networks, only specific machines/networks are allowed to access the SSH port of the web server, etc. the DMZ is where trusted and untrusted connections mix, hence why its named after the zone that belongs to both North and South Korea where both are allowed but also neither are allowed, where one only goes with specific purpose and explicit permission

I was a bit hesitant to do firewall rules based off of IP addresses, as a compromised host could change its IP address

Realistically any identifier you can write firewall rules based off of can be forged in some way. A rogue machine can change it’s host name, IP address and MAC address (and many do randomize their MAC address these days) in enterprises this is generally mitigated through limiting a network to only Ethernet access or via 802.1X authentication on WiFi and potentially even Ethernet. (You can also take the approach of MAC address whitelists, and some switches even allow for “sticky” MAC addresses where the first MAC address that connects is whitelisted until either the switch is rebooted or an administrator explicitly clears/allows the MAC address)

However, if each host is on its own VLAN, then I could add a firewall rule to only allow through the 1 “legitimate” IP per VLAN

You could go crazy and do everything at L3 (which your idea is basically doing but with extra steps) but that sounds like far more effort than it’s worth, since now you’re making every client also act as a router, and you lose a ton of efficiency both in configuration and in routing & switching, plus you’ve now changed the type of threats you’re vulnerable to.

Generally in the enterprise, risks like what you’re trying to mitigate are handled through reporting. An automated alert email is sent when a new device connects to a network that should never have new devices connect to it, then you kill the connection and verify with the team of that was any of them and investigate if it wasn’t.

Realistically as a home network your threat model is automated scripts and maybe a script kiddie trying to get in. You really just need higher than average security to mitigate such a threat model (and average security is a shit show)

I feel like I may have to allow a couple CT/VMs to communicate without going through the firewall simply for performance reasons. Has that ever been a concern for you?

Security is always a trade off of convenience and speed. You have to decide what is an acceptable compromise between security and efficiency

Generally anything virtual when you aren’t sure what to do, you should look at what the physical solution would be. For example, network storage is very bandwidth intensive, latency sensitive and security intensive. This is usually secured at the physical level as a separate network with no routers so that most security can be disabled. So at the virtual level these would be tackled with a separate virtual network connected to a second interface, and firewall rules on other interfaces to disallow incoming and outgoing connections to the storage network

Edit: I just realized I never answered your first question. In short, from what I’ve seen most enterprises put one firewall from a vendor like Fortinet, Zscaler, Palo Alto, etc. right on the edge of the network closest to the internet then either entirely rely on that for firewall or rely on that for firewalling off the outside Internet then do additional firewalling with a different tool inside the network. For example, a bank I worked at had a pair of redundant L3 switchs (Nexus N9ks specifically) which handled all of the routing for all of the bank’s networks, and connected between those and the internet was the Fortinet box which was managed by an outside vendor and while i was there as part of hardening ahead of a scheduled red team audit we setup firewall rules (I’m blanking on the Cisco term for it, but they’re ultimately just firewall rules) on the L3 switches to limit access to more sensitive networks and services

It really sounds like you need to dive into firewall rules. Generally you lean on your firewall to allow and restrict access to services. Probably the easiest place to start is to setup pfsense/opnsense since it has a really clean interface for setting up rules. Proxmox’s built in firewall is nice too, but configuring the firewall per VM would probably get annoying and difficult after a while

And as you learn more about firewalls learning how subnetting works will allow for more efficient rules (for example, if you have 192.168.0.0/23 192.168.2.0/24 and 192.168.3.0/ 24 for your networks that you’re allowing traffic to/from you can just enter one firewall rule for 192.168.0.0/22 rather than 3 separate rules)

It’s a hilarious theory with zero evidence to back it up, but equally zero evidence to refute it. There’s beauty in its possibility and ultimate unknowability