eldridgea

Generally the things cameras like that are good for enforcing are handled by local law enforcement. Probably at the city/county level, at most the state. So prior to Flock and their ilk, camera surveillance was used by local people in the community to enforce laws enacted by the community.

Flock enables that but also provides a nation wide, searchable database available to local and federal law enforcement. Recently SCOTUS ruled that broad geo-based warrants (law enforcement would ask Google for all devices in an area for a time frame) are illegal and overbroad.

A nationwide Flock network with facial recognition ends up in the same place of being able not only to enforce laws, but track people in a warrantless way.

Conceptually at least, this feels very similar to government attacks on encryption where a government wants to see and have access to everything without cause just in case, which is definitely at least in sprint opposed to the right of free association. Flock does the same kind of thing but in the physical world.

I also think a general computer security rule of thumb probably applies here, where for the best security/safety, trust should be provable. If trusting a human is required to make a system work correctly, the system is flawed.

All of that to say I don't think the majority of pushback is against enforcing laws by camera specifically, but a Panopticon-ness of it and all the downstream effects that causes.

It's apparently rootable, although I haven't done that personally. It's Google Play certified so anything from the Play store works, and side loading Android apps works too. I use it with the open source KOReader app and in tandem with Calibre Web Automated. I did a writeup[0] with some details if you're interested.

[0] https://blog.eldrid.ge/2025/03/12/self-hosted-ebook-manageme...

It ignores periods so you could also use [email protected] or [email protected] or whatever.

Some sides block plus addressing but that's what I use a lot of the time.

This meant the specialists were on a ladder with often lower pay than a standard SWE, and I couldn't shift the bureaucracy enough to change that. People left for all sorts of reasons but a big part was being able to get 2x-4x the total compensation at other companies.

But I use Portainer and store my files on Github so Portainer can auto-update a deployment if I submit a code change, so kind of rudimentary CI/CD which could be fleshed out more with some GitHub Actions probably.

I use iSCSI mounted storage from my NAS on the host and k8s volumes storing configs there. Actual app data is on the NAS accessed via NFS from the relevant apps.

So a new deployment is usually test locally on my laptop, once it's good commit the code to github and either let the deployment auto update or go to Portainer and do it manually if it's a new deployment. Ingress traffic is done via Cloudflare Tunnels deployed in k8s.

I keep most apps in a single namespace called prod unless they need more than 1-2 pods. If I was doing this again I'd use a namespace per app, I do use a dedicated namespace for anything with a Helm deployment or needs a lot of pods (e.g. Immich)

However with DNS increasingly being encrypted with DoH and DoT, the TLS handshake was one of the only places you could eavesdrop on the destination hostname, until it was removed in 1.3.

Of course network monitoring will still give you the destination IP, but those are increasingly overwhelmingly destined for a major cloud or CDN provider which doesn't provide much context about the actual destination.

If you'll forgive the shameless self-promo, I covered a decent amount of this in my Blackhat talk about encrypted DNS a few years back: https://www.youtube.com/watch?v=XCnE2o2pfxs

0: https://blog.cloudflare.com/encrypted-client-hello/

https://www.theverge.com/2023/12/6/23991183/google-drive-los...

Although I always thought it would be a nice feature for security conscious folks to be able to ennable. Or go ahead and use it on more sensitive sites only, e.g. banks.

Passkeys in Firefox also work for me on mobile but not with Bitwarden, Bitwarden's blog says passkey sync on mobile is "coming soon".

I have a Synology for data accessible via NFS, SMB, and a couple iSCSI mounts.

## Compute:

I have an off the shelf Thinkserve running Ubuntu + Cockpit for VM management via the Web. I I have 3 VMs running on the Thinkserve.

1) A single node microk8s instance. (This is mostly so I can stay familiar with k8s. Most of it could also be in a docker-compose file). This runs most stuff: portainer, Immich (photos), Jellyfin, Plex, Kavita (ebooks), Nextcloud, owntracks (location tracking), paperless-ngx, NodeRED, and Fasten (health tracking).

Most apps are deployed in portainer from a GitHub file, so a git commit is all it takes to update an app.

2) A VM for downloading things from YouTube and other places, categorizing/renaming them, and putting them on the NAS.

3) A VM dedicated to Home Assistant, with a pass-through USB to their SkyConnect device to control ZigBee/Thread home IoT stuff.

Each VM runs a cronjob to regularly put my Github pubkeys in my authorized_keys file for break glass SSH access. I detail my normal access below.

## Network/Security:

I use a Unifi Dream Router (UDR) with VLANs for most devices, one for IoT that's locked down, and one for my personal laptop with certain SMB traffic allowed for backups.

I don't allow incoming traffic (well one exception for Plex). I leverage Cloudflare pretty heavily for DNS, ingress, and access control.

I have 4 cloudflare tunnel pods on the k8s node. And a tunnel agent on each of the VMs, the Synology, the hypervisor, and the UDR. I use Cloudflare's ephemeral certs for SSH in tandem with cloudflared on my clients so I can SSH in a normal terminal (as opposed to the web SSH client).

Ingress traffic comes in via the tunnels which takes care of dynamic DNS. HTTP traffic runs through Cloudflare Access connected to my Google account which requires FIDO2 to log in. Non HTTP traffic (or non-browser traffic) are authorized via Cloudflare WARP + Gateway (mostly applicable to native Android apps).

## Internal DNS:

I have the cloudflared agent running in the UDR to allow incoming traffic for management, but it also creates a local DNS proxy that sends encrypted DNS requests to my Cloudflare Gateway allowing me to collect metrics and do filtering for any DNS on my home network.

## Backups:

I use rclone to backup an encrypted blob to Hetnzner storage.

I write about tech culture/ethics, security and privacy online, and random technical projects I've been working on.

Some favorites are: Myth of the Necessary Jerk https://blog.eldrid.ge/2017/04/11/the-myth-of-the-necessary-...

The Silent AI Overlord is Already Here https://blog.eldrid.ge/2022/07/28/the-silent-ai-overlord-is-...

Online Identity is Complicated https://blog.eldrid.ge/2022/08/12/online-identity-is-complic...

https://www.chainguard.dev/chainguard-images