This is a really interesting cultural one that always kinda surprises me.

Where I am, cooking has always been a very masculine thing. Cutting up meat with sharp knives, setting things on fire, etc. The chef industry here is very male dominated and men cook together as a social thing when hanging out. In most families I encounter, the dad does most of the cooking with the exception of maybe baking? It’s weird to hear that it would ever be thought of as insufficiently masculine.

In fact I think it would be seen as maybe a bit embarrassing/weak if you were a man who couldn’t cook.

They ruined Linux!

Best is very subjective.

.world is a good general purpose instance for just about anything. I think it has the biggest population at the moment, so communities there are likely to get at least some engagement.

For “general discussion” it doesn’t really matter. The instances are federated so you’ll likely get general discussion in comments from lots of people from lots of instances anyway, wherever your community is based.

Some people get almost nationalistic about their chosen instances or have grudges against people from certain other instances. There’s sometimes inter-instance politics with some servers defederating with others or threatening to for various reasons. It’s kinda fun to watch in a popcorn drama kind of way. For the most part, the instance doesn’t matter.

That’s pretty cool!

Although that’s probably what op is actually asking for, I don’t think it’s a modem. It’s a router with an access point.

It does have SFP for a fibre connection and pcie and USB for you to potentially add a modem or whatever else you want.

I’m guessing OP is just looking for a wifi router? Otherwise we’d need to know what kind of modem they’re looking for, like Cellular? VDSL? HFC? Satellite? It depends on the internet connection. Different parts of the world need very different kit.

Totally agree on all points!

My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.

Tailscale isn’t an exposed service. Headscale is

Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.

it’s more work and may not always be worth the effort

I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.

I recommended SmallStep+Caddy.

Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.

Are you suggesting that these attack techniques are effective against zero trust tunnels

No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.

I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.

there’s an argument that HTTPS isn’t really required…

Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.

The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.

If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.

Venom is a type of poison. Poison doesn’t have to be eaten. (Eg. Contact poisons exist).

Venom is just a poison that is delivered through a bite or a sting.