rnhmjoj

I had a lot of fun playing around with antimony (also from Keeter) a few years ago, but unfortunately it has been mostly abandoned. I heard libfive is supposed to be the next generation, but I haven't experimented with it yet.

Do you know how it compares?

> this could invalidate the information contained in that in the man file.

No, it doesn't. The point of modetc is precisely keep both myself and the programs happy: the files are actually stored where I like to keep them, but they can be accessed as if they were stored where the developer intended.

Why would I hide them? They're not really special and since I'm organising them with modetc they're not cluttered. For reference, my home looks something like this

    ~
    ├── bin         binaries and scripts
    ├── etc         configuration files
    ├── var
    │   ├── lib     program data
    │   └── cache   program caches
    ├── src         git repositories
    ├── img         pictures
    ├── mail        email in maildir format
    ├── note        text notes, todo
    ├── doc         documents
    └── down        downloads

Well, it's just the natural extension of the FHS convention to the home directory.

I didn't come up with this idea, though, I think I saw this in a reddit thread and started doing it myself: I like that the directories are visible and follow the usual structure.

Hi, author here: whether it's a valid use case depends on your level of OCD, but the difference compared to symlinks or bind mounts is that you will have a clean home: e.g. `ls -la` won't show any "hidden" files.

Also, completely unrelated to my motivation, someone pointed out that modetc could be used to quickly hotfix packages built with Nix. Say that you need to fix a CVE in openssl, normally that would require to rebuild all dependent packages, which takes a long time. Instead with something like modetc you could build just openssl and rewrite /nix/store/<hash>-openssl-3.6.0/ -> /nix/store/<hash>-openssl-3.6.0-hotfix/.

Another application might be replacing some configuration file with placeholders for secrets, with one file with the secrets substituted in, without having to modify it in place, possibly only for a specific UID. This is something you might find useful on NixOS.

Right, the ULA prefix theoretically has lower preference, so it should only be selected to reach hosts in the LAN and the GUA for everything else, but I don't know how well softwares handle this in practice.

Well, delegated IPv6 prefixes are supposed[1] to be static or somewhat persistent, but some ISPs do this, yes. This is most likely a practice carried over from IPv4 where there is a small pool of addresses. Fortunately in my experience it's not too common: most ISPs that deployed IPv6 did it the right way.

Anyway, to get persistent addresses you can set up a ULA prefix (the equivalent of RFC 1918 addresses) and a simple prefix translation[3]. This is a form of NAT, but unlike the usual IPv4 NAT (actually NAPT) it doesn't deal with ports, so it's slightly less annoying problematic. There also are a few more techniques, like using mDNS and writing firewall rules that match the suffix of the client addresses, but not many CPE allows for this.

[1]: https://www.ripe.net/publications/docs/ripe-690/#53-why-pers...

[2]: https://en.wikipedia.org/wiki/Unique_local_address

[3]: https://openwrt.org/docs/guide-user/network/ipv6/ipv6.nat6

You should have just disabled temporary addresses, they don't make a lot of sense on a server.

Ok, I'll bite: why do you say that IPv6 lacking NAT (which is not true by the way) would be annoying? We can finally get rid of an ugly workaround from 30 years ago that broke one core principle of the Internet (end-to-end connectivity) and a ton of protocols that required even uglier hacks (FTP and SIP ALGs, TURN/STUN, etc.) to barely work. Why would this be annoying?

I interpreted "services with only IPv6 addresses" as IPv6-only servers, in which case some sort of translation is needed, but if these are just processes in a dual stack server, then yes.

Yes, but browsers moan if you connect to a website without https, no matter if it's on localhost or an onion service.

6to4 solves a different problem: it's a way to provide IPv6 internet access to some host with only IPv4 internet access. It's basically a VPN you need to configure on the client.

NAT64 and SIIT (what Jool and af-to are implementing) instead are a way to let (potentially) any IPv4-only client to connect to some IPv6-only machine you control. The client need to be aware its actually talking to an IPv6 machine, because there is a translator (typicall a router between them) that transparently translate the packet so they understand each other.

The point of Jool and similar tools (there is also one called Tayga that runs in userspace, if you want) is to translate network traffic between multiple hosts, where some only have IPv6 and others only IPv4 addresses.

If your machine has both IPv6 and IPv4 addresses you don't need to any translation.

Yes, translating packets between IPv6 and IPv4 is precisely what Jool does.

From what you're describing I think you have to options: if you have enough IPv4 addresses at your disposal to cover your IPv6-only machines, you can use the so called "SIIT-DC" mode [1].

Otherwise, if you have less IPv4 addresses, say just one on your router, and multiple IPv6 machine you can setup a stateful NAT64 [2] with some static BIB entries. NAT64 is basically the familiar NAT, just with IPv6 in the LAN instead of private IPv4 addresses (say 192.168.1.0), and static BIB entries are the equivalent of port forwarding. In this case you would run Jool on your router.

[1]: https://www.jool.mx/en/siit-dc.html

[2]: https://www.jool.mx/en/run-nat64.html

[3]: https://www.jool.mx/en/usr-flags-bib.html

I didn't know BSD had an IPv4/IPv6 translation mechanism built-in. On Linux the state of the art seems to be Jool[1], which is unfortunately an out-of-tree kernel module. IIUC, they currently share the limitation of not being able to translate locally-originated packets, which can be annoying unless you have a machine to dedicate to the translation.

[1]: https://nicmx.github.io/Jool/en/intro-jool.html

As much as Americans like to think everything is about America, I doubt this is somehow connected. These goverment-appointed officials, like the Secretary General of the Privacy Watchdog, tend to be incompetent and corrupt buffoons.

Just two months ago, the previous Secretary General was forced to resign[1] after he tried to spy on his own employees in a botched attempt to find a whistle-blower that had exposed his corruption. He couldn't get away with it only because the head of IT (who he ordered to carry out the actual spying) happened to be the son-in-law of the President of the Republic, which is practically the last remaining institution with some integrity in the political landscape.

To understand the magnitude of the incompetence of that fool, just know that he had asked IT to retrieve employees access logs and all emails for the past 25 years (hundreds of TB of data) and put them on a DVD so he could check them out [2].

[1]: https://www.ansa.it/sito/notizie/politica/2025/11/20/scosson...

[2]: https://www.key4biz.it/garante-privacy-capo-it-a-segretario-...

Yggdrasil uses exclusively IPv6 for routing on its own overlay network, but not on the Internet. See https://yggdrasil-network.github.io/faq.html#does-yggdrasil-...

No, because x/y is just an arbitrary operation between x and y. Here you're assuming that 1/x is the inverse of x under *, but it's not.

This is the PoW scheme that Monero currently uses:

> RandomX utilizes a virtual machine that executes programs in a special instruction set that consists of integer math, floating point math and branches. > These programs can be translated into the CPU's native machine code on the fly (example: program.asm). > At the end, the outputs of the executed programs are consolidated into a 256-bit result using a cryptographic hashing function (Blake2b).

I doubt that you anyone managed to create an ASIC that does this more efficiently and cost effective than a basic CPU. So, no, probably no one is mining Monero using an ASIC.

> It's also amusing that people here claim Wayland is a security theater too while posting about flatpak being bad because it's vulnerable to x11 issues.

They both create an illusion of safety. We all know that X.org had no security model and it sucks. Wayland put restrictions that would make sense if the rest of the desktop ecosystem was made with security in mind, but it wasn't. I've heard way too many claims like "Wayland makes keyloggers impossible" that are technically true but irrelevant in the real world, because a desktop environment is not just Wayland.

Flatpack is also misleading and its sanboxing is just not great, regardless of the problem with X11.

> No security boundary can prevent bad permissions just like in android.

Good bringing this up: in Android the applications ask the user for permissions, in flatpak permissions are granted based on what the developed asked. That's just bad.

Sandboxing on the Linux desktop is far from common and the flatpak security is kind of a joke [1] [2], unless something changed recently. For starters, it's the application that has to ask to be sandboxed, so if I were to make a malicious flatpak I will just ask for full file system access or d-bus.

[1]: https://flatkill.org/ [2]: https://hanako.codeberg.page/

There are no excuses, this protocol is just terrible: it could have been made much much more secure without any kind of virtualisation or sandboxing.

For example, the kernel could be used[1] to store the secrets in memory and only authorize the userspace process that created it to read it; other processes could request access to a secret and only be given if you accept.

[1]: https://docs.kernel.org/security/keys/core.html

Yes, it's 100% a security theatre. Programs aren't even allowd to set their own icon because it's not considered secure, I'm not joking. The reasoning goes something like: what if a malicious program set its name to "firefox" and uses the firefox icon and then prompts you for the gmail password, eh?

At the same time a malware can just get all of your passwords without even asking using d-bus or read all of your files since it's running as your uid.

> It is striking that we don't see that

It probably just means they are asking the providers to hand over the data, no need to perform active attacks.

Nah, it's huge, you just have to remember the best result so far: the JET DTE-3 record that produced the energy to boil 60 tea kettles in a whopping 5 seconds pulse.

This would be very optimistic, essentially the project meeting its main goal, I'm not sure why you're calling it dark comedy. A 20 minutes pulse alone would mean the fuel injection, aux heating, plasma control systems and the divertor are working as designed. Net positive energy also means we got the physics of a burning plasma right.

The most recent timeline I know (from 2024) in fact puts the start of the DT operation at 2035, so I doubt ITER would achieve such a huge result within less than an year.

There's a more cursed one here: https://rgbcu.be/blog/htmnix. It hijacks the Nix search paths syntax (e.g. import <path> {}) to create html tags.

> It feels more like the "pull in a 500MB framework instead of writing the function yourself" kind of simplicity.

Essentially yes, but it's a function that has been continuously optimised by engineers for 200 years.

We are still trying to solve the problem that we can't keep the plasma hot long enough to create fusion energy, so working on exotic conversion schemes is one step too far.

Consider also how complex these reactors already are, it makes sense to use the simplest method that we know works well.

In physics it is common to work explicitily with the components in a base (see tensors in relativity or representation theory), but it's also very important to understand how your quantities transform between different basis. It's a trade-off.