And Debian Sid is still stuck on 6.3.6 :(

Hopefully they figure out the qt update thing and get the new version packaged soon?

I know a few more interesting ones but nowhere near what actual vim people know.

• d, y, p - delete, yank, paste as others have said.
• r - replace the character under the cursor with something else
• g - go somewhere (gt is go to next tab which you can open with :tabedit )
• v - visual mode for selecting text to yank with y
• c - change - deletes a thing and goes to insert mode, like d but not. Eg.
  • cc - change the current line
  • cw - change the next word

My favourite is ci - change inside

ci" - changes all the text that’s inside the next set of quotes.

ci( changes the text inside the next set of parentheses. Etc.

I also use :mouse=a which I’m told is sacrilege but sometimes I like to click on a thing!

How about pseudonymous as a compromise? Votes could be publicly federated but tied to some uuid instead of the username. That way you still have the same anti spam ability (can see that a user upvoted these things from this instance at this time) but can’t tie it directly to comments or actual user accounts without some extra osint.

It might be theoretically possible to correlate the uuids with an account’s activity and dox the user in some cases, especially with some instances having a single user, but it would be very difficult or impossible to do on larger instances and would add an extra layer. Single user instances would be kind of impossible to make totally private anyway because they can be identified by instance.

Makes sense.

I’m just glad someone is out there poking salamanders in the butt for science :p

Wait…

• Hydrated salamanders move faster than dehydrated salamanders.
• Dehydrated salamanders find water faster than hydrated ones.
• Dehydrated salamanders and hydrated salamanders don’t find water any differently in terms of the number of locations searched in the labyrinth.

If the hydrated ones move faster and search the same way, wouldn’t they find the water faster?

Basically, dehydrated salamanders don’t run away from a poke in the butt as fast but they do move faster when searching for water. Is that it?

Totally agree on all points!

My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.

Tailscale isn’t an exposed service. Headscale is

Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.

it’s more work and may not always be worth the effort

I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.

I recommended SmallStep+Caddy.

Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.

Are you suggesting that these attack techniques are effective against zero trust tunnels

No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.

I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.

there’s an argument that HTTPS isn’t really required…

Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.

The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.

If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.