>the entirety of 10/8 and 172.16/12 and 192.168/16 wasn't large enough for your house?
Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.
In an ideal world I sorta feel like "IPv6" should have been more along the lines of <12 octet prefix>:<IPv4>, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.
@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.
We live in the age of Wireguard (and Nebula and Tailscale etc). Not being home is not an issue for accessing stuff at home in the slightest, no other public service port exposure required either. In the context of someone considering hosting a media server of their own at all in the first place vs just using cloud subscription options, remote access is a pretty minimal lift. Assuming they aren't already doing it actually, if anything I could see a lot of selfhosters doing that first for other reasons before adding video later.
Huh? I find Infuse to be a very solid tvOS/iOS client, and they added built-in support for Jellyfin over 6 years ago [0]. It's right there at the bottom with other media servers they support (Emby & Plex). What's your issue with it?
I'd like to add some extra strong emphasis/support to your post:
>Being ahead of the game is never a bad thing, especially when small towns are so easily exploited due to income and infrastructure. They just can't afford long legal battles.
It's not merely "never a bad thing", for certain tools like zoning it is, at least in the jurisdictions I know of, required to be well ahead and consistently enforced. It's not something towns are allowed to do retroactively, if you have no proper legal town plan/zoning setup in place as well as various ordinances like noise then by default the only controls are the relatively weak state ones. There are many things a government is allowed to do if it's part of an overall plan that applies to all equally, but not if it's "we just don't like those guys specifically", and the best way to demonstrate that is to be making no special moves around a given arrival at all but rather to have it all setup.
Of course, there are as you suggest lots of other good reasons to be ahead too. It's a lot easier to consider things thoroughly and get community agreement when there isn't massive time pressure or lobbying going on and emotions aren't running high. It's easier to get some expert consultation at reasonable prices (in some cases there may even be community members with the skills and willingness to volunteer if it's not a time crush), to enact longer term infrastructure plans, to get any state approval if needed, etc etc. But there are legally serious hard lines as well and if towns are caught napping they may just not be able to use them at all.
>I can't think of any industry that has a market leader that only gets further away from their competition forever.
You're on Hacker News and you can't think of silicon fabrication? What brand new players do you think are about to catch up to TSMC or Samsung? Or what about advanced jet turbine engines, why is China still having such trouble matching the performance of existing leaders after decades of work? Or operating systems, it's been Apple, BSD, Google, Linux, and Microsoft (or derivatives of these) for a long time. Or web browser engined. Or...
Some things are just really hard and involve enormous amounts of specifics, sunk costs and so on. Even if you know it's possible the implementation is everything, the idea that everything is trivially RE'd/cloned seems to have its limits in the real world.
>however using an old PC as a router almost certainly wastes an enormous among of power
I don't think you're quite right on this, or at least you're imagining using something inappropriate when the comparison here involves buying something new right? So it's not "OpenWrt One" vs "whatever you happen to have in your closet" but "OpenWrt One (~$110-130)" vs "whatever can be bought used for $110-130, if you have nothing appropriate". And while they won't go to near-zero like some ARM stuff might, idle power for PCs improved a ton after around the 2013 era. There are lots and lots of small systems available for equivalent prices on Ebay or the like made since then (like Intel NUCs or various other mini PCs) that will idle around 4-10W. Like to take something in the same price range as this OpenWrt One, I regularly see 7th gen era NUCs going for <$140. An i5-7260U will have single threaded performance about the same as the MediaTek in this unit and multi-thread close, but will also generally have 8-16 GB of RAM and often a 250-500GB NVMe drive as well. It'll probably have only one native ethernet, but USB or TB adapters work fine with Linux & FreeBSD at this point.
There's definitely a question of values and exactly what you're trying to focus on, but there are a lot of niceties in having lots of RAM on tap and extremely standard fallbacks to interface with a system, back it up, etc.
>or an OpenWrt One which will possibly also have newer, faster WiFi standards (WiFi 6)
If you want an AIO style device that's definitely a consideration, though again USB WiFi dongles are a thing too. But regardless of router choice, for someone considering going beyond what their ISP offers at all I think it's usually well worth spending the $50-80 to get a dedicated wireless access point. It'll make a major difference in real world performance in most spaces I've seen to just physically have a unit in an ideal spot (on a ceiling or high up on a wall, away from metal). Aesthetically the clean disks or rectangles those tend to have also blend well and mean that various boxes can be tucked away. And of course you get to upgrade networking bits separately from your router.
Anyway, definitely good there are multiple approaches, this is an area of life where people can have very different needs driven by very different physical environments and "stakeholders" (like significant others). But I think OPNsense (or other bog-standard-PC FOSS alternatives like VyOS) can be competitive even in TCO, depending on how much value you place on pushing your networking stack and what else you have going on (like solar power).
>Any service or product delivered at a loss seems pretty plainly anti-competitive.
You have to get into the weeds though on what exactly counts as a "product delivered". Like, Apple doesn't charge for new versions of macOS. But are "Macs" separate stacks together or are they the fusion of hardware and software, and if so on what levels? There are all sorts of products surrounding us that are running software that we still treat as unified objects after all, right down to smart light bulbs or a "plain" lithium battery pack which still requires controllers to manage charging and USB negotiation etc. Chips and software are in tons and tons of "basic" hardware stuff yet we just buy the object as a singular entity.
I'm not saying that dumping can't be a thing but the lines aren't always clear cut either. You also have to get into bog standard business scaling issues and profit vs investment. If you take on debt to invest in capital that you believe will lower per unit costs if you build enough volume and then turn a profit, you're "selling at a loss" but that's how tons of business works, that's why there is risk right? Doesn't seem good to discourage that.
It seems more fruitful to approach things from the perspective of monopolies, competition, corporate governance etc in general, granted not that a lot of governments have been great about that either in recent history.
>Starlink satellites are just routers to ground stations.
You are very out of date on your knowledge here. When it first launched yes, Starlink sats purely acted as "bent pipes" so you needed a ground station within 300-400 miles or so. But inter-sat optical laser links went online quite awhile ago so now data can go from a terminal through the orbital network to ground across the planet. That of course was required for them to offer air/maritime global service (as well as extremely remote areas like polar), can't put a ground station in the middle of the ocean.
Incidentally that should allow them to beat the latency of standard fiber by quite a bit over a long enough distance, there was speculation it might become quite popular for HFT for example, but I haven't tried it.
Edit: So I went ahead and checked, and interestingly at least via a v1 land based terminal on a basic plan they don't make use of it. So must be a higher end option or something? Picking a random top 50 site in Japan tbs.co.jp (163.45.254.1), a streaming TV site iirc, I got around 186ms ping on a fiber connection in rural New England, and 192ms via Starlink, almost exactly the difference one would expect for adding purely a LEO leg up to the nearest ground station. Maybe they want to charge for that, or maybe they're still fleshing out bandwidth on the intersat network. If anyone has a maritime or portable terminal or something it'd be interesting to see some comparisons. In principle on a great circle the distance for me should be something like 10600km, so maybe 12000ish including sats, 24k rtt, which at the speed of light should be more like 80ms. Even with some routing lag that's a big enough difference seems like it'd be noticeable if it was going via orbital mesh instead of ground and kind of fun to test.
I also just tried this as well, sending an email from a Migadu-based account to one at both Gmail and MXRoute using Mail.app under macOS 15.7.7. Neither included any private IP address info I could find in either headers or raw source. That would be a good leak to know about and as sibling comment said saagarjha definitely knows their stuff, so any tips to replicate would be appreciated.
>I’m in the “we should protect kids online” camp, but I am not sure there’s a real way to do it without compromising privacy for everyone.
Of course there is, it's easy! You take a white list approach instead of an auth one. The default is that the general Internet is exclusively for adults. Anonymous = adult. Then use the DNS system to make a set of .kids ccTLDs, with government controlled registries. Then legal standards can be set for who gets a .kids.cc domain and what content is allowed, what meta-data is required, what services can be provided (which could be blanket stops, like no ads or social media under age 7, or granular, like "age 7-11 can only talk to registered educators or other children within given domains"), and so on. Then everything is in place to have router manufacturers give parents a super easy interface (and technical ones can do their own easily) to add their kids, have a password for each kid, and either automatically filter by general age, or let parents drill in and select specific categories or the like. And it'll all Just Work. Yeah it'll be a lot less stuff then on the main internet, but with government money to fund things and parent-based payment all abstracted from what kids see there will be as much as there was on PBS or the like back in the day.
So specific ID/passwords/parental control is exclusive to those who haven't reached majority. Once they do they an just dispense with it and access everything like we do right now. The entire approach being taken everywhere is 100% backwards, because it's not about the kids at all it's about control over adults.
...yes, really? Gun fire is indeed stupendously, dangerously loud, which is why we have suppressors and heavy hearing protection for them. And there are indeed significant public/legal fights around outdoor gun ranges that end up near habitation (even if it's not the range's fault at all but rather because construction moved towards it).
So I'm not really seeing how that's an argument that people not wearing earpro would be fine with regular 108 dB booms over where they live/work. People aren't happy even about small engine noise and rightfully so, and it's one of a few core reasons for switching to electric.
>Apple is a digital services company that happens to sell hardware. Their big money maker is their app store, and no Linux user is ever going to buy apps from the app store.
You do realize that Apple is a public company and one can just go look at their financials like their latest 10-Q [0] right? For the most recent 6 month half (ending March 28 2026) I'm seeing $194 billion for product sales and $61 billion for service sales. The gross margins are certainly higher on services, at 77%, but 40% product margins are nothing to sneeze at either, and the disparity in absolute sales means the absolute dollar gross margins are $77 billion for products vs $46 billion for services.
So I don't see how you can assert that their "big money maker is their app store" from those numbers. Hardware matters a lot, and furthermore Apple sells services (like AppleCare+) that are specific to hardware and thus even a Linux user might still be interested in.
And without their hardware, their services would evaporate. There is a much tighter link there than with many companies. So they're on the hook for continued R&D and capex on that no matter what, you can't really separate that out, and in turn it's always going to be useful to have more volume to amortize it with.
I think primarily it comes down to corporate DNA, which is powerful. There are plenty of Mac hardware, software and service markets in pro/business/enterprise Apple has neglected or abandoned over the years, including ones making oodles of money, not out of any 4D chess but just because it doesn't fit them as an organization.
A perfect theoretical filesystem can still have subjective user configurable choices though right? Like case sensitivity, UTF normalization, checksum hash function, extra copies of data/metadata to store for redundancy/healing, etc (as well as compression/encryption). I think ZFS is a pretty strong real world example of a CoW FS, but you can still set a lot of different properties between sub-fs and then need to copy when you go between them to get the structural changes.
Disk images are supposed to function as if they're attached storage I think, and have different properties from what FS you're running on boot or your home folder (which themselves can be different, I run my home folder on my main Mac off a NAS via iSCSI). I'm not sure any underlying FS would avoid a copy operation there in general?
OK, setting aside the possibility this is some sort of joke/sarcasm I can't quite get, and the absolute wtf of this "scenario" which doesn't exist and all the ways it cannot exist with nothing to with privacy, and taking it sorta seriously, your argument completely falls down here amongst other places:
>Lets say military intelligence has multiple NATO hospitals compromised, and have assets in these hospitals which are being used for various black operations (including non-medical neurosurgery on literal children). In this scenario, maybe total societal surveillance, including radical transparency, would have been a nice thing to have in regards to bolstering national security?
Why the heck would you think that the first job of a hostile military intelligence wouldn't be TO COMPROMISE THE TOTAL SOCIETAL SURVEILLANCE NETWORK!?!? There is a sort of really fundamental common failure to this kind of conspiracy thinking, wherein simultaneously your opponent is this incredibly powerful and skilled entity, one that in this case can compromise lots of secured aspects of society and insert actual agents into a hospital for illegal child surgery and escape notice. Yet simultaneously they're complete idiots who don't do the obvious, obvious job #1, job #2, and job #3 of an intelligence agency which is seek to compromise your enemy's intelligence agencies! Duh. It always has been. Counter intelligence and trying to get inside the other agency's decision loops has rich history probably for as long as spying has been done.
Why do you think you can secure this incredibly invasive theoretical network, all evidence from our entire history to the contrary, yet not medical service providers? You've literally built something here that your enemy would desperately love to have! You've done their entire job for them, better than they could! Rather then having to try to compromise endless distributed independently secured private and public organizations, now they just have to compromise a single one and they get the keys to the kingdom.
>Instead, we got HIPAA, and other medical privacy laws/standards, which are aiding literal mass atrocity to continue to proliferate.
This is such schizobabble that makes no sense (HIPAA has nothing to with law enforcement or medical ethics boards or a million other checks on the health system, just for starters) that I don't know what else to do beyond urging you to seek some alternatives to wherever you got this from.
>privacy does not matter when there are rampant black operations being conducted which violates human dignity in every sense of the term.
You have this completely backwards. The threat and existence of such operations is one of the fundamental reasons privacy does matter so much. Privacy is to be protected heavily not just for the now but for what could happen in the future, and it's self-reinforcing. A more privacy preserving society is a harder one to oppress.
At the time I write this parent comment is grey and I don't think it deserves to be. Some people may be down voting around the blanket statement about "US elites" despite a lot of elites clearly not being ok with the horrendous actions taken this last year, but regardless of that the concerns around dependencies and abuse of power right now are very real and quite justified particularly internationally. There are hard business considerations here as well, the executive unfortunately really does have a lot of power under existing law, particularly with a supine GOP in Congress, to unilaterally disrupt trade and export relationships with other countries, allied or not. It is part of the new business climate.
>How is it possible for a US startup with honest leadership to shine through all this bullshit?
Absolutely zero inside knowledge of course, but I think Oxide's approach has intermingled pros and cons. The only real con I can see, but it is a real one, is that one basic argument against unreliability at higher levels is standardization/commoditization. If some big player sells you a standard rack and setup, then gets blocked from further support or otherwise dies, you can just swap in whatever else. Vertical integration and customization offers real benefits but also more dependency, even if things are open unless the niche becomes big enough that other players get interested.
On the other hand, the Oxide approach is also positive thanks to that seem openness and integration. They can offer safe software and firmware up and down the stack in a way others cannot. They can offer assurance not just about one piece but around much or all of the stack. I think there's quite a few layers of insecure mystery meat in the standardized stuff most of us run when you start digging down into it. And of course there is no cloud dependency at all, a European organization can buy their kit have full on-premise control no matter what. While the answer for new "3rd party in another jurisdiction can be pressured to screw with you even if you aren't" worries will probably most often be "go to a cloud provider exclusively under your own jurisdiction instead" Oxide seems like they could have a window there as well. If they're honest and give their own customers the power that more and more of the industry has been trying to take away, while also keeping down the IT cost load as a cloud would, that seems like an argument for some?
No it doesn't. Seriously, where does this meme even come from? It should be pretty obvious just from a solar insolation map that AC is just noise vs the sun. The energy usage is tiny vs vehicles or non-heat pump heating and only electric. What changes temperature overall is the balance of thermal retention by the atmosphere vs radiation into space, hence why net increases in GHG are so dangerous. And at the ground level similarly how heat is dumped to atmosphere. Greenery, whites, shade etc is good, asphalt, mass standard glass is bad (hence many cities being heat islands). Old, leaky units sure, we absolutely should work to reduce that. But it's astonishing how people claim AC makes the outdoors hotter so consistently.
Yes, at least in theory changing this is straight forward. Though:
>You have to do it once per file type but it's once and done.
I will note I have one Mac with one old user account where it will not remember this anymore across reboots (across macOS 15, plan to skip 26 and hope 27 is acceptable). I haven't had time to try to get into why, but it's occasionally irritating.
>Goes to show that a year of anybody with any sort of clout complaining about the thousand little cuts of Liquid Glass on macOS will get a company to respond.
Worth remembering too that this isn't merely about "complaints", Apple has significant metrics on the rates at which users are upgrading to a new OS, or not. You can opt-out of sharing that data, but a lot of people (even technical people) may choose to check the box to share with Apple. Anecdotally, I myself and a LOT of other people have stuck with macOS 15 or earlier, but Apple should have a lot of hard data on it and adoption curves vs the past.
A real reaction does certainly suggest that this wasn't just a tempest in a teacup, but that they really weren't seeing the adoption on Macs they expected.
Just making a note here for anyone else with the same thought: I went to ping the domains listed ITT, and nothing went through. I'm running OPNsense and amongst other things using some of the hagezi DNS block lists [0]. It looks like brdtnet.com, bright-sdk.com and various subdomains were already in there, which is a nice sanity check.
That said, also worth noting that an Unbound or other resolver based DNS block list can prevent resolution but doesn't preventing connecting to the underlying IP, it's not the same thing as actually invoking your firewall itself. For that I think you need to stick the lists into something that will resolve them regularly and then actually Firewall that off. So for OPNsense you can setup an alias using the URL Table (plain text) or URL Table in JSON depending on format, or manage it externally directly if desired via external. Then the source will be updated and aliases will all be resolved on operator defined schedules, and can in turn be fed into regular firewall rules. Don't forget these can turn into massive lists, so make sure your internal resource limits (so for OPNsense that'd be Firewall Maximum Table Entries) are set sufficiently high and the hardware can handle it.
Other systems may handle it differently, just it's important to double check what is actually happening including if something malicious tries to be sneakier. And ultimately for these sorts of untrustable embedded devices that lack owner control, it's probably a lot better and more sustainable, if more effort upfront, to isolate them into their own vlan/subnet and then whitelist instead of blacklist. So they can only access what you decide they need to and nothing else, vs access everything except what is disallowed. Still, blacklisting bad actors as a final layer for everything may still be useful.
Just to chime in agreeing with sibling comments, the issue is when it's not about just your house and you're deep into self-hosted stuff with a lot of different properties and businesses other people's houses all sharing resources. Without a lot of coordination and consideration, which in practice doesn't really happen easily given the adhoc nature such things tend to organically develop out of, and all the random stuff that wants specific addresses at least for setup, it actually gets pretty easy to run into collisions. Allocations typically are definitely inefficient in many respects but also made sense in the context they were first done and of course can be a certain amount of effort to change.
In an ideal world I sorta feel like "IPv6" should have been more along the lines of <12 octet prefix>:<IPv4>, everyone gets a prefix or set of prefixes that they actually own and are consistent worldwide, or at least only change when geographic location changes, and then can just have the entire 32-bit IPv4 space for LAN however they want. Then you only have to care about prefix between LANs and it could all be extremely automated, internally you only need to use something that looks like IPv4 with the network hardware transparently able to handle prefixes for WAN. Backwards compatibility story would be a lot more straight forward too. Oh well.
@kotaKat: that's a great idea and I don't know why I forgot I played with that like 15 years ago. Really handy as a backup space that almost certainly won't collide with any commercial hardware at least.