wolrah

> Only today we would have put everything behind something like NAT anyway because your devices would be getting hacked constantly.

So the security "provided by" common 1:many NAT comes from the fact that 1:many NAT inherently requires stateful connection tracking and by its nature traffic coming in from the "1" side without an associated connection or rule has nowhere to go, effectively denying any other traffic by default from the "1" side which is almost universally the untrusted side.

Do you know what else has stateful connection tracking and deny-by-default rules on untrusted interfaces? Every single firewall that's worth using or even was at one point worth using in a year starting with a "2".

So yes, in a world without NAT we'd still have stateful firewalls blocking unsolicited incoming traffic that had not been specifically allowed. Those who wish to host public services will still need to configure rules to allow that traffic in unsolicited but those rules will be simpler than NAT port forwards because there's no address translation involved. Anything else wanting to generate on demand temporary connections between systems will be able to do so simply by having each system perform a basic hole punch, sending traffic at the other at the same time with the same pair of ports, and expect it to work again in ways much simpler than what's necessary for reliably doing the same in a 1:many NAT environment.

1:many NAT makes nothing better, it only makes things worse. It's a bad thing and needs to go away as quickly as possible.

---

1:1 NAT is an entirely different beast, it can be entirely stateless and thus has no has no negative impact on most protocols that don't try to communicate address info in-band but also that statelessness means it doesn't inherently provide a firewall effect.

You ignored the second half of that sentence:

> syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

In no way am I denying that people would like to solve the same problems easily. What I'm saying is that it would have been a much simpler problem requiring much less infrastructure. An application like SyncThing that works without any central infrastructure would have been an order of magnitude easier to implement in a world where every internet connected device had a unique routable address.

> That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

Dropbox gained popularity *BECAUSE IT MADE IT EASY TO DO THIS WHEN YOU'RE STUCK BEHIND NAT TRASH*. By the time it was even a thought in anyone's brain the internet had already been ruined by that garbage.

It would never have existed in a world without NAT because it wouldn't have been needed, syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

Every ISP that has CGNAT v4 without providing full v6 needs to be shut down. They are either incompetent or actively choosing to make their users' service less useful to restrict them and/or encourage "upgrades". Internet service has a public routable IP address, period.

That's not a justification for padding, it's a justification for scalable UI. A lot of those "classic" windows dialogs do not scale well on high DPI screens but they still work great with a mouse even if their scaling is ugly. The padding is just there for touch-friendliness.

It was more of the point that WiFi devices allow that to happen because basically every consumer/smallbiz WiFi network can be assumed to support internet access and most buyers won't care.

The easiest way to avoid that problem is to just skip retail WiFi devices altogether because having WiFi basically always means assuming internet connectivity which is not far from mandatory cloud bullshit.

Matter only sort of solves it because a lot of Matter devices (most in my personal experience) use WiFi and often intentionally neuter their Matter support to "encourage" you to use their app and/or cloud integration with a major voice assistant.

I have a pair of Govee ceiling lights that have a RGB+CCT primary downward facing light and an addressable RGB accent ring. The ARGB ring only exists in their app. As far as both their Matter support and their official API are concerned these units have a single element which is the downward light, the ARGB ring is not controllable from any third-party systems.

If these were using Zigbee, Z-Wave, or Matter over Thread they wouldn't be able to do this but because they use WiFi they can.

I'm going to be opening one up soonish to see how hard it'll be to just replace the controller with one running WLED (or even reprogram the controller already in it).

One of many reasons I prefer home automation hardware that uses ZigBee, Z-Wave, or Thread over using WiFi. If it uses WiFi it almost always wants to connect to or worse requires a cloud, where the dedicated home automation network tech is basically the polar opposite and requires that it work entire directly locally or with a local hub.

Other major reason being that "IoT" devices usually have the shittiest WiFi radios that usually don't even support 5 GHz and almost never support WiFi 6/7 modes where they aren't wasting a ton of airtime on their low-bandwidth communication.

Mouse "works" but it will require that the VM "capture" the mouse pointer and often doesn't move the same way it would on the host because the VM is having to translate the messages it's receiving from the host OS in to emulation of a classic PS/2 mouse.

A VM integration driver allows the host to just pass through to the guest the absolute position of the pointer over the virtualized display and the button/scroll events which allows it to not need to be captured and movement feels natural to the host system.

Newer guest OSes that support USB HID can generally support an absolute input mode which was intended for drawing tablets and it'll work well enough, but it's a bit of a hack and requires updating the USB descriptor any time the display resolution changes to keep them in sync so a VM integration driver is still nice to have.

As Wayne points out later in the thread, it's because those who are paying attention already know the answers but the questions are specifically designed to both confirm that eMudhra actually understands what they've done wrong and are willing to publicly acknowledge it, which is a critical factor in how an incident will affect trust going forward.

Obviously in this case eMudhra has decided they don't want the responsibility anymore which I actually respect to some extent.

> Is the Mozilla bugtracker usually a / the Go to party for these issues? Or just a coincidence in this case?

Yes, because of the project's open nature the Mozilla CA program Bugzilla and their dev-security-policy mailing list have become the de facto public discussion point for TLS-related issues.

The actual thread the post being referenced is in is about Dolby Vision and HDR10 playback on Apple devices, so I can see where a rant might come out I guess...

edit: Yup just saw GP's reply and they clearly have opinions about HDR.

> sometimes due to real constraints

IMO this should always be pushed back against, because it's not a valid excuse. If the hardware is too constrained to support appropriate security then that hardware is not appropriate for the application (or no longer appropriate for the application, as the story often goes).

The element of limited choice between multiple tracks makes me think of the Viewmaster Interactive Vision which implemented a much more limited version of the concept.

There was a whole era of mid '90s Microsoft games where they were still competing with "Exit to DOS to get the best game experience" so they went out of their way to make sure you were aware you were running in Windows while playing their games. Aside from the early Age of Empires games I also recall the "Madness" family of racing games had different takes on the same idea from a variety of different developers. I actually just reinstalled Monster Truck Madness 1 the other day and have been working my way through trying to bodge it in to being an acceptable experience for this exact reason. The game itself runs fine but the UI does a lot of weird things that may have worked on Windows 9x with a low-res CRT but are very annoying on a modern system.

Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.

Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.