Solar Bear

But it’s not misinformation to say that’s what you say or that it concerns you if it is actually true.

I’ll contest this. You can misinform people using only the truth. Information can be entirely true and still lead to you being misinformed without necessary context.

I don’t doubt there are people celebrating murder in Arabic. My problem is that I see people celebrating murder in English every time I open Twitter, but nobody writes that article about English-speaking comments. Selective reporting can misinform people by providing a biased and limited set of information that is otherwise completely factual and true.

Everybody sitting here pretending otherwise leads me to believe that the point was to misinform, but this misinformation confirms many people’s biases so they’re fine with it.

I would say there’s solid benefits to breaking out your networking into at least 4 VLANs: IoT, guest, main, and infrastructure. IoT is obvious, these devices are security nightmares, but sometimes you have no alternative so you throw them into a network black hole. Guest for guests that you don’t want touching your stuff but keep asking for wifi. Main is for everybody else, this is your “real” network. Infrastructure for servers and network equipment.

The reason you break infrastructure off into its own VLAN is that modern firewalls are stateful and you can allow the main VLAN to initiate connections to the infrastructure VLAN but not the other way around, so if your server or IoT stuff gets infected it can’t become an attack vector for all your other devices. You allow Main to access Infrastructure, but not vise versa.

I take mine further and add two more VLANs, services and admin access. I split infrastructure (networking, proxmox hosts, etc) and services (proxmox VMs, NAS, etc) and then only allow admin access to the former, which is exclusive to my PC and phone. Some might call this excessive, but it helps me sleep a little better at night.

I feel like NixOS might be the only distro that could realistically handle all these use cases, but I’m a bit scared of the learning curve and the maintenance work it’d take to migrate everything over.

It’s a very steep learning curve, but I personally think it is worth it if what you want is to sync up all your various devices to a single common baseline configuration. I sought a single-distro solution for all of my systems for a long time and always ended up fragmenting them eventually because nothing I tried until NixOS was capable of handling such a diverse set of use cases in a way that would satisfy me.

I am similar to you, in that I regularly use a three server cluster, a gaming desktop, a multi-purpose personal laptop, and a work WSL instance on my work laptop. I still have some purpose-built distros where it makes sense; I use Proxmox for the actual server hosts themselves and then run NixOS VMs on them, along with running VMs for Home Assistant OS and TrueNAS (with the drives passed through, of course). All of these things I could do on raw NixOS (even Home Assistant is packaged in Nix, and there is a project to port Proxmox UI and tooling to NixOS) but I like the stability of the dedicated and battle-tested distros for critical infrastructure, especially for stuff whose configuration is very specific to a given task.

With NixOS, each other device has a consistent shared configuration and package set, they all get updated to the exact same versions thanks to flakes so everything works the same and as expected no matter where I am, and it’s all declaratively configured and documented in one spot. Spinning up a new system or rebuilding an existing system is as easy as pulling the config and changing a few relevant lines, and from there it effectively assembles itself from scratch to the exact state I want it to be in. There’s never any lingering packages or configuration cruft because the system is assembled from scratch every time it updates. Much of my home configuration is also managed, so aliases, environment variables, even vim configs are consistent across the board and set in one location.

The main downside is resource efficiency. Nix is designed to be reproducible and declarative, not fast or lean. It uses much more storage than a typical package manager, and packages are built with wide compatibility in mind so you often are leaving performance on the table from not using newer instruction sets like CachyOS. You can compile your own packages to fix that part, but that obviously takes a lot of spare processing power. I’ve been considering setting up my server cluster to do automatic building for me, but haven’t gotten around to it yet.

It’s really easy to change your positions when there were never any principles behind it either way.

This is what I’m so desperate for people to understand: these are empty people. In terms of politics, they don’t have beliefs in the way you and I do. They have hollowed out that part of themselves. This is why debate or the introduction of new facts never changes their minds, because it never made up their mind in the first place. Such a change requires your positions to be propped up by genuine belief in what you think is the right thing, where that prop can be knocked over.

These people belong to a team, a clan, a cult, however you want to phrase it. The only thing that matters is that their side is in power and uses that power to act against those who aren’t. Any means to that end is valid to them. They’ll happily switch to whichever position is most convenient for them without missing a beat. They’re only justifying it to you to keep you busy and distracted, they never really believed a word they said. They just chose the words they thought would be most effective to win.

My main use case is using it to protect my exposed Home Assistant instance in a way that doesn’t require a VPN that family can screw up. I can just install the cert into the app for them and it Just Works. I also use it for my own Gotify notifications.

As a more general rule, I apply it to anything I want to expose but can’t easily protect using OIDC logins. I used to put more behind it, but I recently opened up my services to friends and family, so I moved to using Authentik as my primary defense for most things. mTLS was great when it was just me, I can easily install the cert into my own browser and all of my Android apps (except Firefox Android…) but friends and family just zone out when I explain why their new phone doesn’t connect, so I had to adjust my systems to compensate.