Coelacanthus

joined 2 months ago
[–] Coelacanthus@infosec.pub 1 points 1 month ago

Actually, Celeste is originally a 8-bit game. It was developed on PICO-8, and then was ported to PC.

[–] Coelacanthus@infosec.pub 6 points 2 months ago

There are some code updates to refactor API call two months ago on Codeberg.

[–] Coelacanthus@infosec.pub 1 points 2 months ago* (last edited 2 months ago)

I think that most of usefulness of swap has passed now that we have systems with noodles of ram.

Please read this article authored by maintainer of Linux kernel memory management subsystem and cgroup subsystem, Chris Down.

https://chrisdown.name/2018/01/02/in-defence-of-swap.html

And there is another article with some additional informations about swap authored by @farseerfc@sn.angry.im who tranlated the article above to Chinese.

https://farseerfc.me/followup-about-swap.html (only Chinese version available)

[–] Coelacanthus@infosec.pub 1 points 2 months ago

Actually it's simple than "NAT", technically. Normally when we said "NAT", it's not just NAT (Network Address Translate), but a NAT plus a stateful firewall (see documents below). The conntrack here is a stateful firewall as in "NAT". And compare to create a map from (paddr, pport) to (iaddr, iport) and match the later, it's more simple to just match suffix of address.

https://datatracker.ietf.org/doc/html/rfc4787

https://tailscale.com/blog/how-nat-traversal-works

[–] Coelacanthus@infosec.pub 1 points 2 months ago

No. It's not random. SLAAC uses EUI-64 by default, it generate fixed /64 suffix from MAC. And with suffix match of nftables you can still do device specific income firewall rules. For random privacy address, it's only used for outcome so just block all other income of IPv6 addresses except EUI-64 is enough.

[–] Coelacanthus@infosec.pub 1 points 2 months ago (1 children)
[–] Coelacanthus@infosec.pub 1 points 2 months ago (2 children)

I don't want each client to have a globally unique address as that just allows insane tracking.

Just for this issue, SLAAC has a privacy extension to generate temporary random IPv6 address for outcome traffic. It's untrackable as well, but in different way to NAT (one device has many addresses instead of many devices have one address).

[–] Coelacanthus@infosec.pub 0 points 2 months ago* (last edited 2 months ago) (2 children)

If I go for SLAAC with privacy extensions and I keep paying for a static IP (v4 & v6) to my ISP then I can't implement any firewall rules for specific devices as devices will change their IP regularly. And its even worse if I don't pay for a static IPv6 prefix.

I don't know which firewall software you used. But if you use nftables, which support suffix match and conntrack for TCP/UDP, you can block all new (identified by conntrack) income (since privacy extension design for outcome) and allow income with specific suffix (for SLAAC with EUI-64, it will stable), needn't care about which prefix was used.

[–] Coelacanthus@infosec.pub 1 points 2 months ago

It "converts" from and to Ethernet frames, of course. There is not actual L2 difference between PON network and normal fiber ethernet network. In simplified description, it just replace active switch with passive optical splitter.

Yes. Like fiber ethernet, differnet speed need different ONT. But noteworthy, there are some different standards for the same speed level, they are incompatible. For example, EPON and GPON, they are both for 1GbE but incompatible.