• 3 Posts
  • 1.12K Comments
Joined 4 years ago
cake
Cake day: January 17th, 2022

help-circle

  • IMHO the key aspect isn’t where you host things but rather understanding how hosting itself works.

    To me the most challenging aspects are how to :

    • route traffic
    • start a service
    • backup your data

    and also ideally

    • have more than 1 service on a single machine
    • restore your data
    • restore your entire setup

    For that very first step I would say having a machine directly exposed to the Internet makes it easier. I don’t know what ISP you use but at least in Belgium where I’m currently located all ports are closed and IP are dynamic. That means if you want to show your freshly started Apache Web server to your mother in law it will challenging.

    Meanwhile if you do manage to get to the last step, namely restore your entire setup, then restoring to a cloud service or a RPi is the same, you transfer your data, start your services and voila, you are back either LAN only or on the entire Internet via a cloud provider.

    So autonomy isn’t as much as to where things are physically hosted and by whom as in the actual capacity to able to host there or elsewhere.

    Finally if you are using a commercial ISP, as opposed to having your own AS, are you really self-hosting?


  • That’s actually my recommendation yes.

    If somehow after a month you feel like you do want this “lifestyle”, are comfortable with setting up a VPN (if you need external access) THEN spend more and get your a SBI like a RPi and have it at home. If that’s still not enough then go up to a proper server you host, use a non commercial ISP, etc … but IMHO don’t start with a server at home if you are not familiar with all this, it’s counter intuitively harder and definitely more expensive.

    Also FWIW you should still have an offsite backup regardless of how you do it.




  • Honestly I don’t mind that, at all. What I mind is if it’s mandatory and only through proprietary applications.

    WiFi, BT, Zigbee, Z-wave etc are not per se a problem. The question instead is who practically owns the device. If the behavior is force on you as a customer, then it’s easy, it’s not YOUR device. Consider then buying OSHW or whatever alternative you need, including potentially non connected devices that you yourself connect on your terms.

    Edit: check which devices are compatible with GadgetBridge and/or HomeAssistant then reviews from actual customers. That should help you find out which devices can match your requirements.






  • No.

    Not because it’s not technically feasible but rather I would psychologically not manage to make money knowing my portfolio, either directly or via EFTs, makes me money by profiteering of BigTech or surveillance capitalism.

    Full disclosure : I did have Apple and NVIDIA stocks and I did sell them not because they were not making money (there sure were) but because I felt disgusted by HOW they made money.

    PS: KYC and related laws in a lot of countries demand you use your real information and declare your earnings, so again it’s not a technical problem, it’s at least ALSO a legal problem, and arguably a moral one if you believe KYC kind of laws help to curb money laundering.


  • I think that’s an important distinction here :

    • there can be NO genuinely open devices

    versus

    • open devices can’t be popular

    So when you say “what’s frustrating is that we can’t really vote with our wallets, and any right-to-repair or consumer-is-in-charge movement is going to be limited by intelligence agencies, corporations like John Deere, Apple, and the entire entertainment industry” I disagree.

    We CAN really vote with our wallets precisely by purchasing things like Precursor, MNT, NitroKey, etc while at the same time expecting, sadly, that it won’t become the most popular devices in the market. I believe allowing creators and maintainers of such system, and even distributors like CrowdSupply, to exist even though they are and might always remain niche, is already empowering. So I’d argue both of us already voted with our wallets on this topic and our acquaintances too.

    I’d also be cautious about preemptive pessimism. Sure it’s important to be mindful of worrisome examples like the FlipperZero (which AFAICT is only banned for purchase in Brazil due to lack of Anatel’s certification for wireless, I believe it’s possible to legally bring and use a FlipperZero in the country but I’m not a lawyer) or DRM for streaming (which I thought was a huge deal until I disabled DRM support in my browser and basically nothing changed in my browsing habits) precisely to learn from them. Also FWIW I did gather some ideas on the topic at https://fabien.benetou.fr/Content/SwappingPartsOfTheRestrictionStack so I’d be curious about your opinion on the topic, suggestions welcomed.


  • TPM. It’s what protects your phone and servers from attackers. Desktop would also benefit from it a lot.

    Hard disagree here, TPM is only 1 more protection, it’s not what alone does protect your data. Also desktop vs phone and servers are very different use cases. You can easily get your phone stolen in a public space. Your server if it hosted in a data center you don’t own might get compromised … but your desktop, it means breaking in or inviting in guests you do not trust. The situations are very different. Encrypting disks on a small device holding sensitive data, e.g. banking, that can easily be taken from you in public makes sense for most people. Doing so on a heavy bulky device that sits in your locked house where is quite another thing.




  • A good rule of thumb is : does any of the participant maintain the backend?

    If not then you are dependent on at least a 3rd party. If that 3rd party is not entirely open, meaning at least

    • standards for the protocol,
    • open source for the backend and frontend,
    • alternative clients,
    • alternative backends,
    • both can be actually used (not just in theory because the protocol has been published)

    then basically you should consider that this 3rd party owns your group, there is no expectation of privacy in it, it can be closed in an instant, messages can be modified without you knowing it, etc.

    TL;DR: bad.






  • Historical context : it’s a 1yo post.

    TPM itself isn’t the problem. TPM itself technically might be a good solution, what the FSF precisely put forward is “out of the user’s control”. They even mention how it’s not about theoretical ideas but how it’s actually used. If Microsoft gets to decide HOW your computers works DESPITE you wanting NOT to behave that way AND it makes Microsoft itself, or its partners, even more entrenched then it’s a serious problem, it means “your” computer is their computer.

    What we have all witnessed is that bit by bit OSes like Windows, but also MacOS and Android, are not simply providing stores or tightly controllers channel (with fees for themselves) but ALSO removing entirely, or making it radically harder, to install software the user actually wants to install (not malware).

    It’s not about TPM, it’s as usual about who control your computer.