arsome

Great for local stuff but won't help for remote services like banks when they rely on hardware attestation unfortunately.

I've given up on coding personal projects because it feels like I could be doing them faster with AI and I just don't care to bother. Completely killed coding as a hobbyist for me. Still have a senior dev job... for now.

YouTube is really the thing that got me - the thing is it's not bad content, I don't watch slop, I watch quality stuff from interested, passionate individual creators and I could listen to them talk about their interests all day.

It doesn't wreck my day or make me feel anxious or anything, no doom scrolling involved, but it sure can turn into a huge time sink very fast.

Have you considered being less puritanical about these requirements? Surely there would still be strong benefits for many users on other devices which would only be able to run if these were relaxed.

I think it's more about convenience and bypassing filters - developers are already logged in to github, already have access to create repos and publish code, firewalls will allow it. Even fancy HIDS systems will think the git push is rather normal.

If they have a clue, the attacker still will not download that without using a botnet tunnel or Tor at a minimum.

Note though that these credentials aren't even encrypted using some lightweight ECC to prevent others from capturing them, they're posted in cleartext. Embarassment might be part of the point.

This gets even more involved when you consider things like loading libraries, there's also the impact of calls like OpenProcess/WriteProcessMemory/CreateRemoteThread (Windows-land versions, though I'm sure similar exists elsewhere).

The "good" Windows firewalls like Outpost and Zone Alarm used to have features to catch this, they'd detect when a process tried to invoke or open a running process which had internet access. They'd also do things like detect when a process tried to write a startup item. This went by names like "Leak Control" but it was basically providing near-complete HIDS features with local control.

If you're moving those kind of speeds you're probably not doing packet filtering in software.

Headscale also offers a relay server of its own.

Very quickly you'll find this doesn't work. Your DC will just null your IP. You'll switch to a new one and the attackers will too, the DC will null that one. You won't win at this game unless you're a very sizeable organization or are just willing to wait the attackers out, they will get bored eventually.

One of these things is much easier to burn or otherwise tamper with.

This seems absolutely silly, it's not hard to take a photo of a photo and there's both analog (building a lightbox) and digital (modifying the sensor input) means which would make this entirely trivial to spoof.

It's largely equivalent here - you're just exposing something via a tunnel rather than directly via your home IP.

That could have benefits, for example, if you're concerned about a DDoS attack on that service taking your home internet out, you may be able to work around it like this. But it won't mitigate a gaping hole in the underlying service which you're still exposing.

It could also have drawbacks, like limited bandwidth and higher latency, which would make it highly unsuitable for something like a game server.