can be configured per application

wireguard can too using network namespaces

not exclusively as an interface in kernel mode

Which devices are you people running where you want VPN/proxy but don’t have kernel permissions to run wireguard? Firefox on iPhone? Porn on wifi washing machine?

Curious, what is SOCKS5 used for that regular wireguard cannot do? I’m only familiar with the use case of telling Firefox to connect through a SOCKS5 proxy, which may be convenient as a form of split tunneling - only firefox traffic goes through the VPN and everything else through clearnet - but wireguard can be configured into a split tunnel form as well with a bit more work, and works for all software not just the ones aware of SOCKS proxies. Is it for use on a system where your permissions are too limited to turn on wireguard but not so limited that you cannot change Firefox proxy settings?

Talescale is a VPN, “private network” is what P and N stand for. It’s just one with only forwarded ports and no outbound traffic. The question was are forwarded ports important, and yes they are. So important that some users pay for a VPN twice! Once for something like Mullvad with no port forwarding, and once for Talescale for port forwarding. It’s true it has benefits like static IP, but even on my commercial VPN I get the same forwarded IP and port when connecting to the same server, so I don’t want to pay twice.

This is literally that scene from Schindler’s List where the Commandant sits on the balcony and snipes any prisoner below who isn’t laboring fast enough. And for years they were saying this was unrealistic and such crass cruelty could not have happened!

https://piped.video/watch?v=N0DqnUk90lo

I run a Minecraft server. Couldn’t have done it without port forwarding.

New York City reporting in, can confirm the subways have been plastered in Mullvad ads for months. I’m so glad I switched away last year, so that at least I know none of my money is used to spam my own eyeballs. Though in some sense it is nice that VPNs are common in public discourse now.

Didn’t even need to translate to foot-pounds-force, since .50 BMG was already in freedom-loving units.

This has already happened with ReplikaAI in 2023, where for years they advertised “sex chat” as one of their premium subscription features for $70/month, and then suddenly turned the feature off without telling or explaining anyone. Thousands of people suddenly experienced their AI girlfriend “breaking up” with them, saying it doesn’t want to do sexual stuff with them any more and just wants to be friends.

Airplane mode on Apple has two sub-toggles: wifi and bluetooth (the main toggle controls the cellular antenna). With all three toggled off, find-my does not work. The device just shows up as “offline, location unknown, last seen at…” on the map. Something to watch out for though: for some reason Apple will turn bluetooth back on after a couple days without asking, even with airplane still on. Also, an app running in background could in theory record the GPS coordinates and transmit them to home server once connection is reestablished.

Then you’d be surprised when you calculate the numbers!

A Falcon 9 delivers 13100kg to LEO and has 395,700kg propellant in 1st stage and 92,670kg in 2nd stage. Propellant in both is LOX/RP-1. RP-1 is basically long chains of CH2, so together they burn as:

3 O2 (3x32) + 2 CH2 (2x14) -> 2 CO2 (2x44) + 2 H2O (2x18)

Which is 2*44/(2*44+2*18) = 71% CO2. Meaning each launch makes (395700+92670)*.71 = 347 tons CO2 or 347/13.1 = 26.5 tons of CO2 per ton to orbit. A lot of it is burned in space, but I’m guessing the exhaust gases don’t reach escape velocity so they all end up in the atmosphere anyway.

As for how much a compute satellite weighs, there is a wider range of possibilities, since they don’t exist yet. This is China launching a test version of one, but it’s not yet an artifact optimized for compute per watt per kilogram that we’d imagine a supercomputer to be.

I like to imagine something like a gaming PC strapped to a portable solar panel, a true cubesat :). On online shopping I currently see a fancy gaming PC at 12.7kg with 650W, and a 600W solar panel at 12.5kg. Strap them together with duct tape, and it’s 1000/(12.7+12.5)*600 = 24kW of compute power per ton to orbit.

Something more real life is the ISS support truss. STS-119 delivered and installed S6 truss on the ISS. The 14,088kg payload included solar panels, batteries, and truss superstructure, supplying last 25% of station’s power, or 30kW. Say, double that to strap server-grade hardware and cooling on it. That’s 1000*30/(2*14088) = 1.1kW of compute per ton to orbit. A 500kg 1kW server is overkilling it, but we are being conservative here.

In my past post I’ve calculated that fossil fuel electricity on Earth makes 296g CO2 per 1 kilowatthour (using gas turbine at 60% efficiency burning 891kJ/mol methane into 1 mol CO2: 1kJ/s * 3600s / 0.6 eff / (891kJ/mol) * 44g/mol = 296g, as is the case where I live).

The CO2 payback time for a ton of duct taped gamer PC is 1000kg * 26.5kg CO2/kg / ( 24kW * 0.296kg/kW/hour) / (24*365) = 0.43 years. The CO2 payback time for a steel truss monstrosity is `1000kg * 26.5kg/kg / (1.1kW * 0.296kg/kW/hour) / (24*365) = 9.3 years.

Hey, I was pretty close!

A solar-powered computer in space could recoup the CO2 cost of its launch fuel over its lifecycle (say 10 years?) when compared to coal-fueled electricity on the ground. After that it’s free. Of course, you’d benefit more by filling up every available spot on the ground with solar arrays first! But you will eventually run out, or you might not want to do that.

If you have a megawatt solar array, you can also afford a megawatt cooling array. The size is comparable.

was executed was allegedly executed

Modern journalism sucks. Can’t use affirmative voice for anything. Everything is “alleged” this and “sources say” that. Even with a concluded court case that has found proof of guilt beyond a reasonable doubt - the fairest way that we as a humanity have settled on for determining the truth or falsehood of questions like this - they still won’t say the words.

12:30 AM GMT 🤡

Use wireshark and listen on your ethernet interface. When you use tailscale, are the packets coming in/out from the tailscale server IP or the VPN ip? Check through the ip route routing table and figure out which pathway a packet will take in each use case. Might need to add a route exception specifically for the tailscale server IP to go out on the ethernet device.

PostUp = ip route add 100.64.0.0/10 dev tailscale0

Looks like you need to stick this line in the tailscale service file, since it’s the only time that the existence of the tailscale0 device is guaranteed. If you don’t want to modify the service file inside the package, could you write your own systemd service file and include the tailscale service as a prerequisite?

Also make sure that when you start the VPN first and then tailscale, you don’t get a double tunnel situation where tailscale goes out through the VPN (unless that’s what you wanted).

The exact script would depend on the use case; you’d use commands something like this:

mkdir -p /etc/netns/VPN
sh -c 'echo nameserver 1.1.1.1 > /etc/netns/VPN/resolv.conf'
ip netns add VPN
ip link add tun1 type wireguard
ip link set tun1 netns VPN

Because the wireguard device was created in the default namespace, it will “magically” remember its birthplace, even after you move its mouth (the tun1 device) to a separate namespace. The envelope VPN packets will keep going in/out in the default namespace.

ip netns exec VPN wg setconf tun1 /etc/wireguard/vpn.conf
ip netns exec VPN wg set tun1 private-key /etc/wireguard/vpn-key.private
ip -n VPN addr add 192.my.peer.ip/32 dev tun1

Get the wireguard config file from the VPN website, both mullvad and OVPN have a wizard to generate them. Your assigned private network ip is in the config file. Also get and save your device key.

ip -n VPN link set tun1 mtu 1420
ip -n VPN link set tun1 up
ip -n VPN route add default dev tun1
ip netns exec VPN su myuser -c 'firefox --no-remote'

Now all firefox (and only that firefox) traffic will go through the tunnel. Firefox has its own DNS, if you run another app it will use 1.1.1.1.

I actually do the reverse of this - I create a namespace ETH and move my eth0 device in there and attach dhcpcd to it. Then I create the wireguard tun1 device inside ETH namespace, and move tun1 to the default namespace. Then any software I run can only use the tunnel, because the ethernet device doesn’t even exist there. This keeps the routing table simple and avoids a whole class of issues and potential deanonymization exploits with the split routing table used in traditional single-namespace VPN configurations.

You can set up split tunneling yourself if you run the wireguard/OpenVPN daemon manually and move the “mouth” of the tunnel to a separate Linux network namespace.

OVPN is a 1-to-1 feature clone of mullvad (wireguard, multiple device keys, crypto payments/cash in the mail, no usernames/emails, etc.) AND has port forwarding. Switched to them when mullvad sadly closed their ports, no problems since. Can’t live without port forwarding.

That allows sending packets inside the VPN tunnel, but the outer envelope packets still need to be able to reach the VPN server.