mrsssnake

Free personal tier is basically a cheap advertisement for them. You try Tailscale personally and get used to it, then it is very likely you would want to deploy it at your work seeing the benefits scaling even more with more people. And then they make money.

Some regulation yes, throwing information agnostic universal global packet switching network in the trash bin is not the way.

The only way to get rid of domestic abusers in your neighbor is to detonate an atomic bomb at the town center.

Yes but enterprise edition seems to be falsly advertised on the main site as open source. And the community and enterprise editions are mixed in the source code making compilations of community edition complicated.

GrapheneOS has such low count of devices due to strict support for security features reasons.

These projects (Linux on mobile) are even more limited due to very poor support from the manufacturer for anything more than OEM and device specific build of Android, with lack of standards in mobile platforms. Every device support is reverse engineering effort. See https://wiki.postmarketos.org/wiki/Devices for the status of this effort.

> The Enterprise Edition is also open-source under the commercial license which enables free personal/small business use.

Open Source can be pair or commercial. But the license of these software Enterprise Edition, called "Fossorial Commercial License", is not Open Source. You tell who and how can use the software after the share/sell and call it Open Source.

The main site also advertises "Self Host: Enterprise Edition" as being "100% Open Source" which is simply not true and false advertising.

Imagine having to ask manufacturer to fix some tiny component of software with no way to fix it yourself, even if you had the skill and time capabilities.

It does not matter on which layer the restrictions are applied here. Effect on society is the same - ability to pay only for those that give up on basic freedoms (which anonimity of payments and choice of device you carry are).

Not anonymous even for small amounts of money. Without tricks and workarounds Blik apps requires Google/Apple approved smartphone with Google/Apple approved build of the OS logged into Google/Apple account. Participation in the network is tied to private will have Blik association even on small scale.

Seeing bad looking slop generated image -> Expecting badly written slop generated text

No, it does not have any more access than any other app, as it work on unrooted devices too.

That said, it has to be compiled for older Android SDK level because newer levels prevent apps to run executables they downloaded on their own and not bundle with the APK, even isolated. Android may disable compatibility with the older SDK some day but for now it works.

I could talk about things better in Linux whole day. But besides popularity (so being preinstalled, proprietary software availability, being presented from childhood) is there a single reason to use Windows? Backwards compatibility, accessibility? Maybe?

Example of evil maid attack. On laptops prevented automatically by secure boot or manually by encryption and checking fingerprints, not by bricking whole device.

If this would be the reason, downgrading would wipe the device not brick it permanently.

> they have no way to stop an attacker from loading up the broken firmware to exploit your device

You mean the attacker having a physical access to the device plugging in some USB or UART, or the hacker that downgraded the firmware so it can use the exploit in older version to downgrade the firmware to version with the exploit?

Would switch to PostmarketOS tomorrow if there was any fully supported hardware (camera, 4G calling, etc.). All programs/apps I use are FOSS and standardized anyway.

Libre software should be used regardless. And the switching cost with it is still not low but drastically lower.

Carriers dropping legacy IP network and providing only direct connection to few popular CDNs would be natural next step for this security strategy.

> handling mobile devices' changing IP addresses as it hops from one subnet to another

We could create TCP/UDP alternative that would handle mobile IP addresses or even make traffic take multiple of those paths at once (look up MPTCP). But we cannot apply it in real scenarios mostly because of middleboxes (like CGNAT) messing up and limiting the messages that should be taken care of on the endpoint.

How is nearly 50% of modern Internet infrastructure not well tested enough? Also, IPv6 is not an implementation by itself.

> Network routing means there are dozens of TCPIP implementations touching traffic.

One reason why routers should not fiddle with TCP and stay on IP layer.

> And please stop with that 'computers security', we all know here it does not exist (NAT or not), it is a fantasy. Saying otherwise is engaging in bad faith.

So you are willing to message me your credentials then?

Also with IPv6 with NAT you definitely have this security, but with IPv4 without NAT you MIGHT have that security...

Disabling security features makes them disabled. Also security of NAT is a side effect because of that the devices behind it are not connected to the internet just tricks them into thinking they are.

ISP hosting a virtual machine you remote desktop into from internal network as the only way to access the external internet can also work as a "de facto firewall".

But the best de facto firewall is a proper firewall.

France with >85% IPv6 adoption mostly made of grandmothers driving a motorcycles across the town manually delivering packets like in their youth.

Disabled protection does not protect. This is UI/UX thing, not something in Internet-scale protocols. I can "curl https://somethingshady | bash -" but won't blame RFC1738.

With NAT turned on nana's computer is still protected by the same Arris gateway.

Not really, look at a great post on Tailscale blog how such P2P connection can be established: https://tailscale.com/blog/how-nat-traversal-works

With IPv6 you might have to use a hack to make firewall allow incoming packets (like sending a dummy UDP packet to the peer first). The firewall only read, allow or deny these packets. While NAT must mess with the message IP//TCP//UDP headers to work.

Discussions about NAT very often forget that it works by messing up with the transport layer. The fuzz is about hiding IP address and exposing services, but the worst thing about NAT is that technically it should not count as a connection to "the Internet". It exploits TCP/UDP properties to fake endpoints into thinking they have a proper connection.

To visualize this, imagine we somehow are out of available email addresses. Email providers have an idea, they would make one inbox for multiple people and have an SMTP proxy that will read the message content, look at "Dear ..." heading and proxy content as new message to "internal" network. All clients would see the same internal addresses from private space (picture 192.168.1.1), but upon sending the provider proxy replaces it adding "King regards, <shared address>". What if someone format the text differently? What if they use new format unknown to the proxy? It just won't work: https://en.wikipedia.org/wiki/Protocol_ossification Someone would then argue it is good as it hides your real address from spam and theft, but we can clearly see the massive disadvantages in this design.

What's up with those comments? Am I still on HackerNews or did I visit Reddit with some HackerNews theme applied?

Internet engineers pre-2000 had some idealistic, heavly mathematically proven ideas that still seem revolutionary today. Due to human nature, not everything got through, but IPv6 is the best of what we have and creating another standard would be XKCD 927.

Under every IPv6 discussion people all of sudden have the urge to manually assign numbers, need to remember their cousin's phone IP and MAC address, forget firewalls exists, argue that ISP fiddling with TCP+UDP selling it as "Internet" is a good thing or that "sender" field on the envelope is a huge privacy issue.

Should really be called Restricted Boot