Contributors: Claude

Please kindly see Rule 8 of this community and its associated post.

I’ll offer the contrarian answer: FOSS does not guarantee secure software; in-fact, neither does proprietary software, nor government software, nor anonymous software.

As others have mentioned, assurances about software come from audits or by trusting someone reputable who has done the audit. Delivering security guarantees is not what most FOSS projects are meant to do.

So what exactly do FOSS projects do? Why are they any better than proprietary software? The short answer is that FOSS is about continuity. You can and will find FOSS projects from 30 years ago, which have been kept updated so they can run modern machines. The folks doing that didn’t need anyone’s permission to do that; they can just do it.

Meanwhile, if Adobe of MSFT declare that a certain proprietary software suite is going EOL and will not receive any more security updates, then the user base is SOL. FOSS gives a potential route away from this fate, if someone or some group is willing to put the elbow grease into security updates. Even if it’s just one person.

So in the short term, there are no security assurances for either proprietary or FOSS. In the long term, all software cannot escape the unstoppable march of time and vulnerabilities. But at least FOSS has a chance to be corrected, years or decades later.

For handling international traffic under ICAO rules, ATC is indeed supposed to be done in English.

But if we take a look at some of the terminology in aviation, the French words cannot be ignored. Mayday and pan-pan are from the French venez m’aider and panne.

When radio silence is required, a station might command “SEE-LONCE” but this comes from the French word for silence. Though I think this is a rarity in aviation.

And then outside of aviation radio, the French left their mark on aircraft parts names: fuselage, empennage, aileron.

Wine? https://en.wikipedia.org/wiki/Wine_(software)

An intriguing question. I do agree that even the ultra-rich had an eye-opening time during the pandemic, but I don’t agree that their wealth acts as a singular shield, which if pierced would herald their downfall.

When someone has the resources of tens of billions of dollars, the principle of defense in depth is both practical and is most prudent. For each of your points that suggest the ultra-rich were vulnerable, it might actually prove the strength of their fortifications.

they were conceivably vulnerable to the same indiscriminate illness as everyone else.

The thing with disease is that it cannot teleport: the transmission vector must convey person to person, through airborne particles, or some other physical means. What the ultra wealthy can – and do – buy are exotic islands or chalets in faraway places from other humans. Meaning that once there’s notification of a pandemic, they are best positioned to flee to whichever of their overseas fortresses as they may choose. Meanwhile, the masses have to hunker down at home, which is their only refuge, and hope for the best.

the government can and will shut down your business

The ultra-rich leave the daily operations of their businesses to professional managers. It has been a staple of prudent management for decades to have disaster preparedness plans and business continuity plans. You may have seen some form of these through wildfire or earthquake notification systems, so that a company can confirm which of their employees are accounted for. But such systems also serve as a planning exercise, in case a natural or manmade disaster takes out an entire industry.

The businesses of the ultra-rich already plan for things like the loss of most of the world’s hard drive production capacity due to flooding and the closure of EU airspace due to volcanic ash. These aren’t as detailed as those specific situations, but are about the business impacts: what it products can’t get to customers? What if required materials can’t reach the factory? What if war breaks out domestically and the production line is taken over by the government?

Not to minimize the impacts of the pandemic, but the difference is that it activated multiple continuity plans simultaneously, an unprecedented scenario but otherwise not unrecoverable. Fortune favors those who make plans.

Indeed, a part of many business’s plans during a catastrophic situation is to – unsurprisingly – beg the government for aid or a bailout. After all, if they can get the taxpayer to partially implement their plan, they will. And business lobbying for a bailout only requires a telephone and a contact list, so the ultra-rich’s lobbyists were kept busy in the summer of 2020.

What is most telling is that the USA stock markets recovered in the latter half of 2020. The ultra-rich have plenty of resources to survive a few months of disruption, as they have more runway to wait things out than, say, a typical working class household that needs rent relief or faces eviction.

universal income model is not only possible, it is completely affordable and can be quickly implemented.

One of the most under-assessed aspects of the ultra-rich is that they find ways to make money whichever way the wind blows. Even in a UBI scenario, they can still make bank if they are the sole vendors of certain commodities.

In fact, a UBI system which automatically tracks inflation is essentially a license for vendors to also increase their prices with exacting precision, perfectly in-time with inflation. This is why a UBI system should not be implemented on its own, but alongside other social safety nets and regulation on the “demand side” of money. That is to say, business regulation (eg rent controls, anti-monopoly rules, banking reform) are all part-and-parcel of a long-term plan that defeats economic inequality. They are not separate pieces, but the ultra-rich can still take solace that not everyone recognizes this yet.

The war of information would still be on their side even if UBI were voted into effect today.

The luxury services that their money had always effortlessly bought could be quickly ended by decree, scarcity, and the loss of human labor to illness.

I didn’t exactly care to track the happenings of the ultra-rich during the pandemic years, but did they actually suffer such scarcities? Their business empires recovered by the end of 2020, and it’s not like rich people don’t just find other intrigues to spend their time on. Rhetorically, what is a few billion here or there?

Were the ultra-rich terrified? Probably, but only for their paper valuation. They themselves would have been physically fine, and since there was no proletariat uprising during this time, they basically just made money during those years. Essentially, a financial blip but their lives move on. Maybe they’ll build more bunkers for their holiday homes.

In the space of mini PCs/NUCs, this does seem comparable. But bear in mind that the entire space of “home server” is a lot bigger than NUCs. After all, not everyone just wants to host an NVMe drive or two; they might want to fit some cheaper SATA SSDs or even spinning rust, as part of a cascade of stroage, with caching on SSDs and other nice things.

Likewise, the dual LAN ports with 802.3bz support is nice, but the reality is that most networks are only 1 Gbps with some devices supporting 2.5 Gbps. Quite frankly, for server use that actually needs one or both port’s bandwidth, the link would likely be better served with SFP+ slots, because of better compatibility with cheap enterprise switches available online, and because SFP+ transceivers run less hot than their twisted pair counterparts at 10 Gbps. Heck, you could even use a 40 Gbps QSFP+ NIC, which only requires a x8 or X4 PCIe slot (depending on PCIe generation of the NIC). On that note, a single PCIe slot is nice, but it does preclude the use of a double-wide GPU for transcoding use.

I would sum all this up as lacking expandability. Yes, it can be expanded somewhat. But for folks that want the capacity of an ATX-based build, this ain’t it. And for folks with abundant solar power, electricity consumption for older gen chips isn’t as much of a dealbreaker. It certainly checks off a lot of people’s boxes, yours included, but that doesn’t mean that people are “sleeping on” this, because at the end of the day, if it doesn’t serve their purposes, it’s not the right box for them. In terms of price, never underestimate the cost of $0.00 that is an old, unused laptop; they make remarkably decent servers for light loads.

Also, as of this writing, only the 32 GB RAM variant is available on the USA website.

Would cert-manager for Kubernetes be approximately what you’re looking for? In that particular case, it’s a service that runs in a K8s cluster, that can auto-request CSRs and send them to Lets Encrypt using one of the challenge types. It takes care of managing the returned certificates, such as renewing them before expiration and registering the private keys within the K8s key store.

I presume that you’re not already using K8s, so maybe that project will help you find the keywords to describe the sort of certificate manager that you want.

If you’re already using Debian on desktop, then Debian on a VPS makes sense from a maintenance perspective: you only have to track one set of security updates. When there’s suddenly a critical update for some vulnerability, you can update both at once because it’s the same upstream repos. Whereas with Ubuntu on your VPS, you’d have to be mindful to make sure to check back when the same vulnerability is patched there.

Do not underestimate the effort to upkeeping a server, and do try to unify your procedures so you’re spending less time doing the necessary things, and more time building up your self hosting stack.

“more posts create more conversations” has a logical end point, where the sheer volume means more time is spent skipping over uninteresting questions than time spent on answering the interesting ones. At that point, people with answers would rather spend their time elsewhere.

Curation is moderation by another name, and it is hard at scale. The solutions that work for communities with a hundred followers will not work for communities like this one with 49,000 (!) subscribers.

I’ve copied a portion of an older comment I wrote, answering part of the question:

One thing which isn’t immediately apparent, even to Americans themselves, is that the large American political parties are less equivalent to individual political parties elsewhere, and are closer to “uneasy coalitions”, like those found in Europe involving multiple parties trying (and maybe failing) to form a government. That makes it harder to draw broad conclusions like “USA Democrats would be right-of-center” because progressives and “DINOs” (Democrats in name only) within the party would be left-wing or right-wing, respectively. Logically, the same applies to the Republican party, although ranging from right-wing RINOs (Republicans in name only) and “moderate Republicans”, to the far-right factions of the party, like neo-Nazis and MAGA.

That’s what I wrote then, and what I’ll add today is that because of the enormous variety in different parts of the USA, two members of the same national political party from different parts of the country might sit down for dinner and find they have very little common group. What appeals to them about their party might be highly local.

For example, a registered Democrat in California might be fully onboard with regards to the rule of law, as applied to immigration and unlawful detention, but might be a bit apprehensive about tax reform that would eliminate middle-class subsidies (eg SALT exclusion) because that hits very hard in a HCOL state.

Meanwhile, a registered Democrat-Farmer-Labor (the state’s Democratic party) in Minnesota may be fully convinced that environmental protection is important to preserve both the planet and the nation’s public lands, but wouldn’t necessarily support the wholesale ban of hunting because of the rich cultural value instilled from an early age.

With the exception of vanguard political parties, I’m not aware of any political parties that strictly adhere to and enforce the party platform. That is to say, membership that mandates exsct alignment to the values of the party, and failure to do so requires expulsion or resignation. This is a rarity in American politics, because parties generally want the barrier to entry to be low. The downside is that there’s no party discipline whatsoever for members that aren’t in government.

Is the couch in reference to just parking one’s investment into a simple index fund and then laying on the couch passively? I saw the URL first and was concerned it might be about the USA vice president.

Also, out of curiosity, was an LLM used to generate this game?

I’ll offer a comparison not yet mentioned in the context of hosting software, but which should sound familiar in the social media context: moderation is hard at scale.

By every metric of scale, Codeberg is a competitor to the behemoth that is GitHub. And that means they have to contend with tough choices, such as who and what to host on their servers, no different than BlueSky, Facebook, and the individual instances of the Fediverse. And to be clear, Codeberg has always been limited to FOSS projects anyway, so nobody can genuinely argue that limits weren’t in the cards.

The distinction is that less alike Meta, and more alike with the Fediverse, Codeberg takes no hostages: people with obvious AI repos (or even marginal repos, given the possible ambiguity) are free to take their code and leave. Yes, they have to rebuild their CI pipelines, but that’s always required for any platform, including self hosting.

The fact is that Codeberg is a centralized entity that needs to (try to) make consistent policy. In this case, they have a concern about copyright and nothing anyone says can magically dematerialize that risk. If their new policy is not agreeable, then decentralized self hosting is probably the only way forward. But that was always an option with ForgeJo and federation.

And indeed, folks moving from GitHub or elsewhere are not exactly without fair warning that they might have to migrate again; we’ve not reached a utopia yet.

Is this correct though, in terms of a confidentiality or non-repudiation guarantee? For a ledger system – blockchain or not – every unit can be traced back through the history, to one or more sources. Yes, multiple transactions can serve to obfuscate the sources, but the real source is within that subset of all possible sources. So unless obfuscation takes place by involving all possible addresses, there’s still going to be some amount of knowledge revealed about the relationship of some source and some destination address.

But I think non-repudiation could be more damaging in a cryptocurrency context. Imagine a corrupt politician that takes a cash bribe. Unless the briber recorded the serial numbers, the politician can plausible repudiate any connection with the briber, because the cash could have come from anywhere else.

Whereas with cryptocurrency, if the briber’s wallet address is ever revealed (eg. by hack, by change of heart, by blackmail, or by cryptographic collapse), then there’s a line which can connect the briber to the politician. They cannot deny that it’s possible to have received the bribe, which is a scandal unto itself. Probably not good enough to convict of a crime, but enough to do political damage.

Ultimately, I’m of the opinion that a ledger system still isn’t as strong on confidentiality as cash, because cash records nothing at all, so there’s nothing to accidentally reveal. To be clear, bribery is a stand-in for any sort of payment that would cause adverse effects if revealed. Other examples include secret child support, for a secret pregnancy, for a secret abortion, or anything else that people don’t want to reveal to the world. The whole point of privacy, I maintain, is to have a choice on what other people get to know.

I’m relying a lot on the background of Sweden from this video: https://www.youtube.com/watch?v=7CsSs0eQKKA

In essence, the USA does not have the same pressures that led Sweden to their current strategy. For that reason alone, duplicating the same strategy in the USA would be a failure to meet the country’s actual threats, use up more cultural and military capital, while also throwing away some of the USA’s natural strengths (eg stable geopolitics in North America, service exports economy, vastly distributed population).

As a reminder, only until fairly recently, the USA military branches met most of their recruitment goals through voluntary enlistment, an approach that succeeded against the backdrop of 1975, when the country was deeply against the draft. What fuels the enlistment pipeline is, rather unfortunately, the poorer class, because military service is a route to a better life. In some ways, the voluntary enlistment benefits are a perverse form of state support.

So the need for a draft is, IMO, wholly inappropriate if voluntary enlistment is still viable. The next question would be whether the USA would find itself overwhelmed by crisis or disaster that it would need the civilian population to help defend the national interest.

And still, I don’t see as being plausibly, because it really shouldn’t ever get to this point: the USA still has (we think) credible nuclear deterrence and power projection. This can, and does, make up for the lack of civil cohesion and, quite frankly, civil apathy for anything beyond putting food on the table. That is to say, a threat would have to seriously infringe on the average American’s daily life before they will do something about it.

If this were seriously part of the national defense, then we’d have already lost the game.

There are a few things that need to be clarified, because they’re all fairly distinct even though they might seem to be doing similar things:

• Copyright: protects the reproducibility of some work. Objective: a time-limited monopoly for the owner to control copies

• Trademark: protects the authenticity of a vendor. Objective: elimination of marketplace confusion; vendors are judged on their merits

• Patent: promotes disclosure of innovations and protects the use or application of an invention. Objective: a time-limited monopoly for the owner to control uses, but must disclose the secrets for how to build it

• Defamation: (USA specific) protects against provably false statements published about someone. Objective: elimination of lies from the marketplace of ideas, but does not affect opinions or public mores

• Right of publicity: protects personal marketability and opportunities. Objective: elimination of labor marketplace confusion; person will be judged on their merits

There are two things which can cut against almost all of these: fair use and parody. Fair use arises commonly in copyright but the logic is the same: in order to discuss something, the thing must be identified. The marketplace of ideas cannot exist if nobody was allowed to screengrab a TERF’s wizard movie or mention why they don’t like a certain cola company. The key is to be minimize the incursion to what is absolutely needed. For example, someone organizing a boycott can indeed use a brand’s logo to refer to that brand.

As for parody, it goes a bit further and will (for comedy or sarcastic intention) assert that the statement is true or the work is authentic. This too is allowed, because – at least in the USA – poking fun at things is a valid (and human) way of discussing things that would otherwise be difficult to say. How it relates to defamation, trademarks, and right of publicity is that a reasonable viewer of the parody must be able to determine that yes, it’s a joke and it’s not actually making that particular point but rather a different one. This is akin to someone nodding their head to say yes but verbally saying “no”: there are enough mixed signals that nobody would take the assertions seriously.

So would someone’s face be “locked out of the arts”? No, not by copyright. But under right of publicity, they could have a claim if the depiction could potentially be confusing. Fortunately, this generally can be cleared up by explicitly identifying who the depicted face belongs to. And also to never try to sell or distribute artwork that rides on that person’s coat-tails.

Since this would be the phone number that you’d rely upon to have continued access to those government services, I wouldn’t skimp on the expense: consider the monthly charge for a domestic phone plan as a cost of citizenship or residency.

Supposing you find and set up an eSIM with a domestic carrier in that country, then one which supports WiFi calling would allow you to receive SMS/MMS from anywhere, provided that your phone also supports WiFi connectivity.

As an aside, WiFi connectivity was greatly useful when I was traveling in Japan, since I’d be back at the hotel with WiFi in the evening, which conveniently overlapped with USA West Coast time, so calls were perfectly natural.

I’m going to try answering the titular question, despite the factual situation being wholly divorced from sanity, through no fault of the OP directly. Unless some new convention on the laws of the sea has been enacted vis-a-vis international waters – which the Strait is – a nation which provides some sort of service over that area is not entitled to remuneration. It would be gratis.

That said, in the very different context of aeronautical navigation, there is indeed precedence for providing a service to an international zone, but this is agreed to by multilateral treaty, not imposed. For this, we look to the massive area of the north Pacific Ocean, for which there is essentially no radar service available. And yet, to enable civil aircraft to fly without colliding with each other at speed, somebody needs to coordinate the flight routes and provide weather information. Through ICAO, the USA is the contracting state that provides such service over the Oakland Oceanic Flight Information Region. This means most of the Pacific Ocean is not USA airspace, but does follow the American procedures for organizing traffic (which follows from ICAO rules but possibly with small tweaks). This is the distinction between “USA airspace” and “USA controlled airspace”. ICAO chose the USA because no other country can realistically perform this service, nor has anyone else put in an offer to ICAO.

To pay for this service, the USA FAA charges overflight fees. Since the FAA is a civil agency, it does not have authority to order a shoot-down of an airline’s jets due to non-payment. Rather, the FAA can collect the owed fees through the American courts, just like anyone else would through a lawsuit for money damages. The FAA could also take adverse regulatory action, such as providing less or no service, subject to minimum obligations required by ICAO. The agency can also choose to cancel or disapprove of flights headed to/from USA airspace. If an airliner flies into the territorial airspace of any country without permission, then the air force would respond, not the civil air regulator.

So what does this have to do with international waters and maritime navigation? The air example shows how an equivalent fee for water passage would have to be implemented, when it concerns international waters. Everyone has to agree to the terms, the fee has to be economically reasonable, the contracting state must have some relationship to the area in question, and an international organization must actually contract with a qualified state to provide said service.

The present action in the Strait meets none of this criteria. So yeah, a ship could try their luck and pass through the Strait without making payment. Maritime and international law would not support the USA’s claims for remuneration, even if adjudicated in an American court.

What is the absolute simplest way to accomplish this?

< gets on soap box>

The absolute simplest way is to use IPv6: on your Debian machine, assign multiple IPv6 addresses, one for each service you want to expose to your LAN. There’s no penalty with having a dozen v6 addresses.

Although you have those addresses, your machine generally uses just a single one for its own outbound and inbound traffic. For each service, you would edit their config so that they bind to a specific IPv6 address. Finally, you would configure an AAAA entry in DNS so that your chosen subdomain will point to the IPv6 address in question.

As an example, suppose you had three different web servers running Nginx, currently on port 80, 8081, and 42069. What you would change is the server config for each server instance, adidng the IPv6 address as part of the “listen” directive. Since each instance is now bound to a different IP address, nginx can now listen to the conventional port 80 and n’ary will the three collide. In other software, the configuration option you’re looking for is the “bind address”. By binding each app to its own IP, it will only respond if you send a request to that IP (or DNS name, which translates to an IP); this conveniently makes debugging really easy.

For a home network, you might have a single /64 IPv6 subnet. But that still means you literally have billions upon billions of addresses to use before you ever run out. And as you’ve recognized, using DNS names to identify services is a lot easier and intuitive than using port numbers. It also neatly avoids the need to memorize IPv6 addresses, because that’s never been necessary: we have DNS.

If your ISP won’t give you IPv6, you can still use locally-assigned private ranges, known as ULA, and this works because your services are contained to your LAN. Best practice is to randomly generate a subnet then use it.

< gets off soap box>

Without knowing which medication, there can only be speculation as to why it requires a specific quantity of water. And even then, the best source of authority would be to ask the doctor for the reason.

Is that something you’re looking for? As a practical matter, the effort to maintain multiple release branches and backports – compared to the norm of just maintaining a single main branch – is an outsized effort, available to only well-funded FOSS projects, usually by having an industry sponsor that makes it a priority.

I posit that the grand majority of selfhosted FOSS software, by project count, do not have back ported branches. And so production environments will want to set up an offline validation setup to evaluate update, prior to making the switch. Not convenient, sure, but not exactly insurmountable either.

At some point, some amount of responsibility for use of FOSS software must fall upon the users, or else the project is less about creating value by building up the commons for software, and more on the exploitation/abuse of the volunteers.