What do you gain by doing this? I trust both proton and mullvad to not fuck up their encryption so attackers can’t read your traffic even through one VPN. The second one doesn’t offer additional security here.

In your setup, proton will only know you use mullvad but not know which sites you visit in the end. Mullvad knows everything just the same as without proton. So the outer VPN doesnt add privacy either.

If you are suspected of a crime, forcing mullvad to disclose your identity/IP is enough and proton doesn’t help.

If you are worried about traffic correlation analysis, then yes 2 VPNs will help. But honestly for normal usage I don’t see the point of 2 VPNs.

And about the DoS fear. Just do it the other way round? Mullvad on the router, proton on the device? From protons perspective you produce the same amount of traffic, it just comes from a mullvad server. The outer VPN is the one where you have increased traffic due to 2 VPNs. But I am pretty sure neither will be a problem and tunneling a VPN through a VPN is not a TOS violation

I have set it up in a way where all the packets have to go through their VPN and if they don’t, they get dropped before they leave my PC.

That is the function of a firewall and not of the VPN. As I understand portmaster it does both. But that is not normal VPN behavior.

VPNs are not magic. They are a piece of software that encrypt traffic and send it to a special server. They do that by creating a virtual Internet connection (think like pluging in an additional Ethernet cable or connection to an addition WiFi at the same time). Everything that is sent through the virtual connection is encrypted. Your system now has (at least) two valid Internet connections (one real and one virtual). For every packet it sends it needs to decide which connection it should send it from. This is decided by something called the routing table. When you start the VPN it will put two routes into the table.

• traffic going to the VPN server goes through the real connection (so the encrypted VPN traffic is routed correctly)
• everything else goes through the virtual connection (the VPN tunnel where it gets encrypted)

The attack described is a way how a network router can add a new route into your devices routing table to basically override the second route from the VPN. The route is still there, there just is another one that has a higher priority.

A VPN is not the ultimate authority over your network traffic. It is just another program sending and recieving taffic.

There is a famous experiment , where a person gets 100$, and have to offer an arbitrary percentage of that to a stranger. If the stranger declines, both get nothing.

From the strangers perspective, getting offered even 1$ is a win, but the vast majority rejected anything below 30%

By design nothing in the chain can be altered. But of course you could have a block indicating “person X is now person Y”. But you can always read that Y was at some point X (and at what point the change happened). That would not be good, as it would be a public ledger of all trans people. It would also make things like witness protection impossible because inserting a block “today in 2024, person W was born in 1974” is very suspicious

Can’t remember exactly what happened but it involved changing permissions on /bin /sbin and similar. You know for security …

In the end I didn’t have permissions to run chmod, su or sudo

Fortunately there is little that can’t be fixed by booting from a live image.

If you want any system to connect to you, you need to open a port. You don’t need to do that for outgoing connections (the OS and your router will automatically open ports for the return connection). So if everybody connects to one central system, nobody needs to (explicitly) open any ports (except for the central connection point)

Most VPNs use UDP. So set up a wireguard, tailscale or openvpn.

But you still need to “open up the firewall”. UDP still works on ports the same way as TCP. I do agree however, that exposing a VPN port is more secure than exposing a port for a game server, as you don’t know about the security of that server software.

A drive label is just a string that can be set by any privileged process. Seems like this installation of the new distro didn’t do that. Or you skipped a step in the install where you could have chosen the drive label.

If it is a bug in the installer or if you missed it, I can’t tell.

But you can just change it in gparted or something else.

The thing that confused me when first learning about docker was, that everybody compares it to a virtual machine. It’s not. Containers dont virtualize anything. They take a (single) process from the host OS and separate that into its own environment. All system calls, memory access, file writes etc are still handled by the same os (same kernel). However the process is separated both on the file system and process level. It can’t see other processes outside of the container and it also doesn’t see the real filesystem. It sees a filesystem provided by the container. This also means it sees different file and user permissions. When you run a alpine Linux docker container on an Ubuntu system, the container only containes the (few) files for alpine but no Linux kernel no desktop environment. A process inside that container only sees the alpine files and not the Ubuntu files. It also means all containers see a filesystem independent of each other and can use libraries and dependencies of different versions (they are only files after all).

For administration it makes running complex services easy. You define how to setup that service (what base Linux distro to use, what packages to install, what commands to run, and how to start the process). You can then be save to assume the setup of that service did not interfere with the setup of any other service. “Service 1 needs a certain system wide config changed? Service 2 needs that config in the default state? And both need a different version of the same library?” In containers you can have all at the same time because they each see a different version of the same config and library.

And all this is provided by the kernel itself. All docker does is provide an “easy” way to create and manage containers but could could do all of that using chroot, runc and a few other.

As a note, containers usually don’t come with systemd as they don’t need an init system. You would run the service directly inside the container and then use systemd outside the container to make sure the container is started/restarted, or just docker as it can already do that.

I found a great article demystifying containers recently

They sometimes buy keys using stolen credit cards. When the fraud is found out, the banks will request the money from the developer. They in turn often don’t have a way to lock the fraudulent key, so it remains valid.

The costs for the initial bank transfer, plus the time invested in returning the money to the credit card holder are payed by the developer.

The key reseller has a 100% profit margin, the customer has a valid and cheap game key, and the developer actually lost time and money.

You can disable the pin/the popup. I haven’t had to type my pin ever, other than to register a new device.

For the updates: which platform are you using. On android it updates automatically and never bothers me when starting. On Windows it displays a message about a new update, but in 99% of cases I can still use the app without updating.

No experience with the Linux client but I assume if you just regularly update your system, maybe turn on unattended upgrades in your package manager etc. it will also keep signal up to date.

I think it’s about usage rights. People are fine with their post being on their chosen end of the fediverse forever but don’t want corporations and news sites to generate a profit by using the posts. That is independent of federation, federation just makes it easier.

That’s what I wxpect. But with one more layer. In the end it’s going to be system32/elevator.exe which is called by Invoke-Elevation in ps which is aliased to sudo.

It’s supposed to be available in cmd and batch so it must be callable directly

Yes it is unethical and immoral to fool service personal and lead them to believe they receive a tip when they don’t. Everybody hates to receive those fake church bills.

That is a real problem. In a perfect world you would want all of your data to be available to everyone who can use it to improve your live. And only getting advertisement for things you actually want/need (not only think you want/need) is a real improvement of your live.

Sadly “improving lives of consumers” is not the goal of any of the big data collectors and as such any data collected is or will be missused to cause harm to the owner even if it is not directly obvious.