I never understood why they don't support the subsonic protocol.
I mean... you might as well ask why the DLNA plugin has been broken for years. Or why they don't add a custom HTTP header to the client app so people can lock access in their reverse proxy.
As usual it's a mix of not enough developer manpower and "I don't use that so it's not a priority" i.e. the whimsies of FOSS.
I mean, US is the country that classified encryption as munition in the '50s and tried to ban its export in the '50s and then limit it again in the '90s and then on and off since then. 🤷
I think the confusion is that this isn't a CalDAV concern. A CalDAV server only hosts event/task definitions. It doesn't do anything with them, only offers an API for managing them.
It's the client apps that use those definitions to work out occurances, do notifications, send emails etc.
So what you want is a capable calendar app with CalDAV support and email support, that can send email invites using different email addresses for different calendars.
Yes, and also by trying common subdomains under the main domain (like jellyfin., home. etc.) (They also scan the entire IPv4 address space, all TCP ports, over and over, but that's a different discussion.)
If you're using DDNS you have to also be careful where you put the A and AAAA records. Some people put them on the main domain and then do a wildcard CNAME pointing to it for all the subdomains, or individual subdomain CNAMEs. But since the main domain is known from TLS cert logs it's trivial for bots to also check to see if there's A/AAAA records on it.
It's better to put the A/AAAA on a dedicated subdomain, obfuscate the name beyond trivial guesses (eg. maybe don't use ip.), and make an individual CNAME for each services that points to the IP subdomain, and obfuscate those service subdomains similarly.
For those who aren't familiar with DNS, the information in it is publicly available to anybody who can name a [sub]domain and record type explicitly, but they refuse to do "list all the records for all the subdomains of this domain". So bots are limited to asking for the most commonly used record types on the main domain but can't get to records on subdomain names unless they can name the subdomain. (For completion, asking for a list of all records is possible, but nowadays due to abuse that function is restricted on all the public servers to just the known IPs of their fellow redundant servers.)
A similar limitation applies to reverse proxies, bots can't get to a service behind it unless they can correctly name the FQDN that the proxy uses for that service. (But please note that a reverse proxy works independently of DNS. If the proxy has foo.example.com defined to reach a service, it will work even if that domain isn't in DNS or doesn't exist.)
Even after taking these measures you have to keep in mind that this is not security, it's obscurity. It cuts down on bot scans which is great but don't assume it means nobody knows your service domains. Your ISP probably knows them, there are DNS servers out there that know them, your mobile carrier can see them, and if you ever connect to WiFi when away from home the owners of those WiFi can see them (think hotels, airports, coffee shops etc.) It's not out of the question for a coffee shop WiFi to have been compromised and to collect URLs and attempt attacks against them. Use VPN or a SSH tunnel to connect to services whenever possible, rather than exposing them publicly, and if you must expose them publicly then use mTLS or at the very least a custom header key.
I think the product that speaks the most about the camera was the Snapchat Spectacles. Snapchat did everything they could to position it strictly as a fun, party-oriented camera that didn't try to hide what it was but leaned into the fun ways to use it.
And they still died out after the initial hype. Which I think is most telling because, like, here's this product with the most positive take you could possibly have on "glasses with cameras" and people still didn't want it. So wth makes Google think the creepy no-fun version will catch on?
In the Yggdrasil network any node can act as relay for other nodes. So you can get to unreachable nodes via reachable nodes, as long as there's a possible path through the network graph.
The community also maintains a few nodes with static public addresses, specifically so they can be used as entry points into the network.
Each node has two addresses, one used for communications inside the network and one used for peering. The inner address is IPv6 allocated randomly from the reserved 0200::/7 range and never changes (unless you wipe and re-configure the node). The peering address needs to be public and static, yes, but can be either IPv4 or IPv6 fwiw.
You only need to peer with one such public and static address to be able to reach other nodes, as long as there's a path to them among all the peers in the graph. If you're taking advantage of the larger Yggdrasil network that is taken care of by the public community nodes. If you want to set up your own separate network then you need to set up at least one node with a public static address. But you can also use a domain name and do DDNS for example.
If you're using ipv6 supposedly you don't need to forward ports.
You don't need to forward ports but you still need to maintain network rules for each port so you can get through the firewall. And those rules need to know IPs. And if your public IPv6 prefix changes you need to update the rules.
So, really, there's no advantage over forwarding, on the contrary, since forwarding uses private IPs which you can make static so they never change.
Some router software like OpenWRT attempts to work around this issue by using a special "minus netmask" shorthand syntax for the network rules, for example ::2/-64 means you want to reach [whatever the dynamic prefix is right now]::2. Which assumes you've set things up so that a certain machine always gets static suffix ::2, which means that machine does not do MAC anonymization and can use DHCPv6, which excludes all Android and iOS devices. So it can be used with Linux servers for example but with a lot of caveats.
Keep in mind they can only "traverse NAT" if you have a publicly reachable node available, otherwise peering can't complete. The Yggdrasil network maintains a handful of public nodes for this purpose, or you can set one up yourself on a VPS etc. But you still need to deal with this.
It's a mesh VPN using exclusively IPv6 addresses in the reserved 0200::/7 range.
By default a new node connects to nothing. You add other nodes explicitly, typically they'd be your own devices, but the network also maintains a few public nodes that are used to facilitate communications across the entire Yggdrasil network.
When a node is connected it raises a tunnel network interface and routes 0200::/7 through it. With the usual caveats (it will pick up any service that binds to all interfaces etc.)
Each node can act as relay to reach nodes that aren't directly connected – the network will compute the shortest path in that case – and this can be used to reach nodes behind CGNAT as long as there's a path that contains at least one publicly reachable node.
All connections are end-to-end encrypted with the keys of the two end-nodes involved in it, so the relay nodes cannot eavesdrop.
That's about it. Anything else (DNS, routing, firewalls) is the responsibility of each node.
While I also started with Nginx Proxy Manager, I would urge anybody to look into Caddy eventually. Especially someone who happens to be comfortable editing their own compose files. Very flexible and simple configuration.
Also, to create the reverse proxy, the most simple setup is to install Caddy and write something like this to its config file (Caddyfile):
a.myfakedomain.com {
reverse_proxy 10.0.0.1:1000
}
b.myfakedomain.com {
reverse_proxy 10.0.0.2:2000
}
Whatever they need. Alphabet Inc. is made up of a dozen companies with thousands of products. There's always something that can benefit from such insight.
The location data that Google collects through Android phones, alone, is mind-blowing. Just from your daily movement they can figure out where you live, where you work, shop, eat, drink, vacation. Indirectly they can figure out who your friends and relatives are, your partners, extra interests and hobbies etc. They sell all that to advertisers, there's a reason why so much of Alphabet revenue comes from ads. Then there's more complex patterns like traffic for example that they can sell to city planners and so on. And that's just location data.
It works but it's subject to the same limits – it can only find your most recent comments via the Reddit API. But you can upload files from your data request to help it find all your comments.
All DNS servers have "fast record changes". They publish the records instantly on their own servers (if they don't they're a crappy service). But they can't force other DNS server to update, each server does that at its own pace. In theory they have to obey the TTL for each record but in practice many cache the information and update much slower than the TTL.
You need to have "address or nationality in one of European Union states or Island, Liechtenstein or Norway" to buy an .eu domain.
There are other EU ccTLDs that are fairly cheap and have no restrictions of purchase, like .nl, or .ro.
Yes. If a TLD has the so called "premium domains" feature then it can unilaterally decide that certain domains are worth more, based on their popularity. Then they'll ask you to pay tens, hundreds or even thousands at renewal time, and if you can't pay they will auction it away.
This isn't something that registrars do, this is something that the entity that manages the TLD itself is doing.
For TLD's without "premium domains" the TLD sets a single base price for all their domains. Registrars can demand more but there's competition so someone will always sell it for closer to the base price, and if they change their price at renewal you can transfer to a different registrar.
You can't do this with a premium TLD once they're targeted your domain because the TLD forces all registrars to raise the price for your specific domain.
Bottom line, never buy from a TLD with premium domains.
I've heard a conspiracy theory that says that the apps and services that Google dumps were experiments in data gathering and correlation. So basically they make a music platform like GPM, they use it to get a great music prediction algorithm, then kill the platform because what they wanted was the algorithm. They have money to burn so they don't care about one more tiny revenue stream or about making a great music platform.
Can you even do that anymore? AFAIK Reddit now caps the amount of comment history they show you so how do you find your comments to change them?
I guess if you're EU you can request a dump of all your data as a GDPR request and find the permalinks for all your comments in there.
Oh this is nothing. They're currently testing identity verification. As in, "send a pic of your government-issue ID to Persona so they can check who you really are" (and cross-reference you with other sites that use Persona, like LinkedIn etc.)
I'm also surprised they're still allowing old accounts that don't have an email. Or that they're not mandating everybody to add and verify their phone number "for security and 2FA" – another excellent way of cross-referencing people against all kinds of databases. Just imagine what they can get if they work out a deal to share your phone number with Google, or Amazon.
Or sync to a local directory and slap Dovecot+Roundcube on top, and you have your own private searchable email archive you can use indefinitely/securely/remotely. Just update imapsync to pull from the new provider when you switch.