Don’t let a little assassination of your spouse get into the way of a good grift.

With what?

Similarly here. Have an Odroid with that platform, it wasn’t cheap but it came with several advantages:

• 4 SATA ports on addition to the M2 slot
• Intel QSV
• 2 x 2.5 Gbit Ethernet (I only have gigabit at home though)

Very powerful machine for the power usage, I ran a really old Athlon before though (from 2010 or so that I retrofitted with 16GB RAM) that did most stuff just fine. But I wanted some transcoding and also possibly a smaller case.

I run everything bare metal though.

Luckily, it’s not the entire Internet, just the unfun part.

Don’t think I could watch through beans being thrown at him

A patriot who really wants to trigger those stupid libtards /s

I don’t see any issues with these subvolumes for NixOS (though I haven’t used NixOS on btrfs, just assuming it works) – Create the partition and its subvolumes manually and then perform the steps at https://wiki.nixos.org/wiki/Btrfs. It shouldn’t be an issue

under the grass?

Possibly next to the mother of his children? He would never allow to be buried there

It should have been no email. Nothing about this was necessary.

I’d feel so fucking stupid as a general being lectured by this dropout and a draft dodging president about how they won no war “because of woke”. Absolute disgrace but to be expected for that admin.

Saving this in case my employer wants to send me to the US

My wake-up call probably should have been when a member of my own family insisted that Christians are the most prosecuted people in the USA (this was circa 2024).

They’re actually the third-most prosecuted group, after white hetero cis males, and gamers

Jesus, how far do you have to be down the panic hole to believe this stuff?

Well, technically, there’s a second time

The best mini stroke they’ve ever seen.

I might have to agree.

Lol that one subreddit also equated the two. Smallface will be forgotten within a year, he had no memorable message that people would rally behind. Anyone can spew his kind of hate, just needs a bit of training to beat some highschoolers in shitty debates. “Owning the libs” and using dog whistles is nothing that will make you more than some footnote.

MLK was a leader. Kirk was an arsonist.

A twitch chatter used the same term in Atrioc’s stream where this was presented, saw it on YouTube and had to laugh

Client data absolutely is encrypted in TLS. You might be thinking of a few fields sent in the clear, like SNI, but generally, it’s all encrypted.

I never said it isn’t, but it’s done using symmetric crypto, not public key (asymmetric) crypto.

Asymmetric crypto is used to encrypt a symmetric key, which is used for encrypting everything else (for the performance reasons you mentioned).

Not anymore, this was only true for RSA key exchange, which was deprecated in TLS 1.2 (“Clients MUST NOT offer and servers MUST NOT select RSA cipher suites”). All current suites use ephemeral Diffie-Hellman over elliptic curves for key agreement (also called key exchange, but I find the term somewhat misleading).

As long as that key was transferred securely and uses a good mode like CBC, an attacker ain’t messing with what’s in there.

First, CBC isn’t a good mode for multiple reasons, one being performance on the encrypting side, but the other one being the exact reason you’re taking about: it is in fact malleable and as such insecure without authentication (though you can use a CMAC, as long as you use a different key). See https://pdf-insecurity.org/encryption/cbc-malleability.html for one example where this exact property is exploited (“Any document format using CBC for encryption is potentially vulnerable to CBC gadgets if a known plaintext is a given, and no integrity protection is applied to the ciphertext.”)

As I wrote in my comment, I was a bit pedantic, because what was stated was that encryption protects the authenticity, and I explained that, while TLS protects all aspects of data security, it’s encryption doesn’t cover the authenticity.

Anyhow, the point is rather moot because I’m pretty sure they won’t get a certificate for the IP anyways.

Public key crypto, properly implemented, does prevent MITM attacks.

It does, but modern public key crypto doesn’t encrypt any client data (RSA key exchange was the only one to my knowledge). It also only verifies the certificates, and the topic was about payload data (i.e. the site you want to view), which asymmetric crypto doesn’t deal with for performance reasons.

My post was not about “does TLS prevent undetected data manipulation” (it does), but rather if it’s the encryption that is responsible for it (it’s not unless you put AES-GCM into that umbrella term).

Right, and for the challenge, you need to have access to a privileged port (which usually implies ownership), which you won’t get assigned.

Let’s Encrypt are rolling out IP-based certs, you may wanna follow its development. I’m not sure if it could be used for your forwarded VPN port, but it’d be nice anyhow

It shouldn’t be because you’re not actually the owner of the IP address. If any user could get a cert, they could impersonate any other.

I believe encryption helps prevent tampering the data between the server and user too. It should prevent for example, someone MITM the connection and injecting malicious content that tells the user to download malware

No, encryption only protects the confidentiality of data. You need message authentication codes or authenticated encryption to make sure the message hasn’t been transported tampered with. Especially stream ciphers like ChaCha (but also AES in counter mode) are susceptible to malleability attacks, which are super simple yet very dangerous.

Edit: this post is a bit pedantic because any scheme that is relevant for LE certificates covers authenticity protection. But it’s not the encryption part of those schemes that is responsible.

Very cool