How could a hijacked DNS entry harm you?
You can leverage the trust in DNSSEC to distribute TLS and SSH fingerprints too, look up DANE.
Oh, now I see. I guess then the DNS64 server needs to do the dnssec verification on behalf of the user, then drop the RRSIG records for the v4->v6 translated names.
Oh, and now I realize I confused the direction. DNS64 makes v4 into v6.
I'm fortunate to get native IPv6, so I'm not very familiar, tho I think I have basic understanding.
Did you mean you need to pick just one of {authoritative DNS server, DNS64} to listen on port 53? No, because the authoritative DNS only needs to be accessible from the outside. Run it on another machine or nonstandard port, then expose via port forwarding. Machines in LAN don't need direct access to the authoritative DNS server, they can just as well resolve via the regular system.
I just self-host my own DNS server. Works like a charm. Setting up DNSSEC was a tad fiddly tho.
Long story short:
dig can use a specific server)Sounds like a bug in the applet, frankly.
Try this in Bash:
$ echo $((`cat /sys/class/power_supply/BAT0/energy_now` * 100 / `cat /sys/class/power_supply/BAT0/energy_full`))
You'll have to try :) I'd be wary of having multiple daemons managing your battery, though - it sounds like a recipe for conflicts, infinite loops and such.
No idea about TLP, I'm not using that.
I created a systemd service for setting the charging threshold on boot, works for me.
This is NixOS syntax, but you get the idea:
systemd.services.battery-charge-control = {
description = "Set battery charging behavior";
script = "echo 70 > /sys/class/power_supply/BAT0/charge_start_threshold; echo 81 > /sys/class/power_supply/BAT0/charge_stop_threshold";
wantedBy = [ "multi-user.target" ];
};
My rye sourdough ferments for 24h. That takes some planning.
I'm not sure if I agree.
Unless you own a CA, or are a powerful country able to coerce a CA, or mandate installing one into users' PCs.
As for SSH - you missed the "TOFU" bit, Trust On First Use. Do you verify your SSH host keys every time before connecting to a new server? The docs for GitHub doesn't even mention it.
I partially agree - encryption appears to be a solved problem today. Key distribution, however is not, it's layers upon layers of half-solutions of wishful thinking, glued together with hope.
Depends on your threat model and priorities, right :) HPKP is helpful and does not require DNSSEC. DANE and CAA are helpful but require DNSSEC.