Yeah there's quite a lot of region management going on now. These companies need to meet data residency and other regional laws/requirements, and they do this pretty naively. You can bypass a lot by VPNing in to whatever country most aligns with your values.
Pretty sure it's all just automated; maps pulls in data from "verified providers" for new roads, buildings, etc. They used to do all the work but that doesn't scale and it's hard to discover building renames, etc. So they built the infra to allow verified parties to push changes. I used to work with HERE's map databases (competitor) and also spent some time at Google, but not on the maps team.
Tons of people still don't understand taxes are graduated. So... yeah. You're going to pay more if you have more to pay with. But it never makes your "poorer". It's only a higher fraction on each extra dollar, not the money you already paid taxes on at a lower bracket.
There are a few government sponsored benefits that have a cliff aka welfare trap. In those cases, yes you could be worse off if you step off whatever cliff the program has set. But that's very different from taxes, it's something to fix, and was generally something that was helpful which is antithetical to a thesis of government suppression.
Your really need to define your scope first. Is it just you? Family? Extended family? Strangers?
After understanding that, the best bang for your buck is a private mesh/tunnel VPN. Tailscale, Netbird, Pangolin, or plain wireguard. If you want real public routing, then you need to understand reverse tunnels and your app's lifecycle/quality. After that, all the security guidelines are basically trying to reduce blast radius. And that depends a lot on how you're running the app, what it has access to, etc. DMZ network for isolation goes a long way.
Does that bypass my DNS server when the client is connected to the tailnet?
Yes. A search path is installed so that the OS queries MagicDNS. MagicDNS is a DNS resolver within Headscale and nodes that are on the tailnet will use it to get the tailnet IP of the names being queried under your MagicDNS domain. You MagicDNS path can be a subdomain of your domain (hs or ts.mydomain.com) or anything (.magic). https://photos/ -> check with MagicDNS does it have photos.magic? Return the photos node IP 100.x.x.x.).
It doesn't need to go to your AdGuard DNS server because every node will query the search path that is added to the OS when joining the tailnet. It's the reason why your MagicDNS domain name needs to be unique, and why it doesn't technically need to be a subdomain of your internet routed domain.
Should I still leave it on for local traffic?
Depends on what you want. Is your local traffic expected to go over the tailnet? If every device isn't on the tailnet then you probably still want the local network setup you have.
And if I'm connected to the tailnet from outside, how do I propagate all the addresses?
Every tailnet node has a node name. You can spin up extra nodes so that they resolve a node name to the service it's managing. You can do this pretty easily with containers. The alternative is to configure MagicDNS with extra_records so that multiple A records resolve to the same tailnet IP. Then you either need the services to be on different ports or have a reverse proxy split out based on the connection header (e.g. to route photos to Immich and music to Navidrome).
This is ignoring all "exit node" scenarios. Exit nodes can help bridge your local traffic to the tailnet, or bridge your services to the public.
I'd be fine with this if the people responsible for these guaranteed future outcomes were held to account. Until we have a justice system that reflects fair penalties on poor leadership, we're fucked.
Yeah there's quite a lot of region management going on now. These companies need to meet data residency and other regional laws/requirements, and they do this pretty naively. You can bypass a lot by VPNing in to whatever country most aligns with your values.
Pretty sure it's all just automated; maps pulls in data from "verified providers" for new roads, buildings, etc. They used to do all the work but that doesn't scale and it's hard to discover building renames, etc. So they built the infra to allow verified parties to push changes. I used to work with HERE's map databases (competitor) and also spent some time at Google, but not on the maps team.
Literal entrapment. Everyone should be breaking this shit on first sight.
Tons of people still don't understand taxes are graduated. So... yeah. You're going to pay more if you have more to pay with. But it never makes your "poorer". It's only a higher fraction on each extra dollar, not the money you already paid taxes on at a lower bracket.
There are a few government sponsored benefits that have a cliff aka welfare trap. In those cases, yes you could be worse off if you step off whatever cliff the program has set. But that's very different from taxes, it's something to fix, and was generally something that was helpful which is antithetical to a thesis of government suppression.
A book I can get behind.
Look up cyber security compliance programs companies might need. CMMC for example. Lots of topics to dive into.
Management: "we've been pooling this money to stomp employees for years" ... Yeah fuck you too.
Amazing he said that with a straight face.
And he better not get paid diddly shit.
"I’m not scared of a germ. I used to snort cocaine off of toilet seats." - RFK Jr., 2026
Republicans consulting expertise? Needed a good laugh.
I think the bigger concern is we've also been devolving. Fucking morons keep putting the worst of us in power.
Your really need to define your scope first. Is it just you? Family? Extended family? Strangers?
After understanding that, the best bang for your buck is a private mesh/tunnel VPN. Tailscale, Netbird, Pangolin, or plain wireguard. If you want real public routing, then you need to understand reverse tunnels and your app's lifecycle/quality. After that, all the security guidelines are basically trying to reduce blast radius. And that depends a lot on how you're running the app, what it has access to, etc. DMZ network for isolation goes a long way.
Yes. A search path is installed so that the OS queries MagicDNS. MagicDNS is a DNS resolver within Headscale and nodes that are on the tailnet will use it to get the tailnet IP of the names being queried under your MagicDNS domain. You MagicDNS path can be a subdomain of your domain (hs or ts.mydomain.com) or anything (.magic). https://photos/ -> check with MagicDNS does it have photos.magic? Return the photos node IP 100.x.x.x.).
It doesn't need to go to your AdGuard DNS server because every node will query the search path that is added to the OS when joining the tailnet. It's the reason why your MagicDNS domain name needs to be unique, and why it doesn't technically need to be a subdomain of your internet routed domain.
Depends on what you want. Is your local traffic expected to go over the tailnet? If every device isn't on the tailnet then you probably still want the local network setup you have.
Every tailnet node has a node name. You can spin up extra nodes so that they resolve a node name to the service it's managing. You can do this pretty easily with containers. The alternative is to configure MagicDNS with
extra_recordsso that multiple A records resolve to the same tailnet IP. Then you either need the services to be on different ports or have a reverse proxy split out based on the connection header (e.g. to route photos to Immich and music to Navidrome).This is ignoring all "exit node" scenarios. Exit nodes can help bridge your local traffic to the tailnet, or bridge your services to the public.
I'd be fine with this if the people responsible for these guaranteed future outcomes were held to account. Until we have a justice system that reflects fair penalties on poor leadership, we're fucked.
I reported people dressed as ICE taking someone in a parking lot to my state police and they said it's a federal matter. It's as fascist as it gets.
Aaaauugghh. Auuuuuughhhh!
Who knew being a total dipshit took so much work! I'm sure in 22 more hours he'll spin this into Biden's fault.