samcat116

Notarization has been enforced for all apps on the Mac for years. Would the DMA have an issue with requiring signed drivers? Seems a similar baseline. Personally I’m totally ok with that. I haven’t seen a single instance of them not notarizing something or revoking it for something that wasn’t actually malicious.

Why do you say that? It seems like they would be more important in the context of supply chain attacks.

> sure I’m using an iPhone 7 Get a new battery at the very least

Can I ask what you use all that storage for on your NAS?

Latency is quite poor, I wouldn't recommend running high performance database loads there.

> My password manager autofilling will always be faster than any other option

Passkeys will be faster.

there are other methods for 2fa recovery. The main one involves an SSH key you've previously added to your account.

Layer 3*

I don’t think people realize that a lot of Cloudflare’s free/cheap services are squarely focused on HTTP. Multi protocol stuff is on the enterprise plans where they make their money.

Docker changed to this system long ago AFAIK

I really can't take pedantic takes like this seriously. Just setup MFA.

> And one thing is certain; talking to people is never as difficult as the feeling of loneliness when you want to say something and there is no one to listen

Man did this hit hard.

Famously those default selection screens for browsers failed horrendously.

Typically that CGNAT IP would just sit on the WAN port of your router. So in theory none of your LAN devices would hit that IP anyway (the router would be NATing everything). Your clients having a route to 100.64/10 pointing to the tailscale VPN interface shouldn't have an issue (unless you install Tailscale on your actual router, that would take some special setup).

> It's standards compatible What standard is Tailscale breaking? I agree your solution is more elegant and simple with less running components, but the trade off is more setup.

> Now mobile providers and some ISP play gatekeeper … don’t allow you to keep any IPv6 devices (rotate assignments) so we end up with little benefit to the end consumer.

I see this as a feature not a bug. Use dynamic DNS if you need a stable endpoint here.

> The idea that a home user ca setup a desktop and share anything I want via IPV6 another person without the need for a middle man “cloud” provider just didn’t happen.

You can, you likely just need to change the default firewall settings on a typical ISP provided router.

> Corporate greed / government control have severely limited any usefulness of IPv6 at least here in the US

I don't see how either of those have to do with this.

I remember when I used to do laptop repairs in college (we were a certified Apple repair center), Apple had a great training on all the different types of internal connectors, how you should handle them, etc. Some of them are really, really fragile.

I don't think they're saying they're comparable, its just that a lot of people were waiting for the cheaper standalone firewall, which is what the gateway lite is. also its $129 not $172.

Wireguard has been there for more than a year at this point?

Knowing the region here would help as a lot of them are region specific, but I've had great experiences with Tierpoint (https://www.tierpoint.com).

This applies to just about any CI/CD program, so I guess they just don't like them in general.

AzureAD licenses near the feature equivalent of Okta are much more expensive than base office licenses that only give you access to the office apps and cloud storage.

If you have AzureAD you don’t typically also have Okta. Also the features you listed are like 20% of Okta’s functionality here.

One thing I'd say on the client side would be an integration with MDM vendors somehow. All the platforms have native hooks to install certs into their trusts that the MDMs use, and corporate IT is already using MDMs. I think that would actually be a lot easier than telling everyone "go download this CLI", especially if a non engineer needs to access these internal services.

Does this help at all with the issue of deploying the root CA cert on every device that will interact with services with these certs deployed? That seems to me to be the hardest part about running an internal CA. You've got to put it on everyones laptops as well as all your servers.

I've done this several times with a TB3 cable. Has to be the right port for DFU.

The vast majority of people only need to deploy VMs.

This is a one time cost, AWS is a rent only model

NextDNS with either their app to set an DoH profile on devices or DHCP giving out their specific IPs for my config.

I actually think if a bunch of companies started hosting their own SSO, we'd hear of a lot more hacks. I'm not sure orgs would put in enough resources to do things properly other than "hey we got keycloak working"