> Yes, the mascot is still a lobster. Some things are sacred.

I've been wondering a lot whether the strong Accelerando parallels are intentional or not, and whether Charlie Stross hates or loves this:

> The lobsters are not the sleek, strongly superhuman intelligences of pre singularity mythology: They're a dim-witted collective of huddling crustaceans.

I find scanning QR codes at the POS hugely inconvenient compared to paying with my watch. The discount has to be substantial for me to ever scan them.

Retailer apps are often surprisingly (expectably?) bad at dealing with spotty/no connectivity, and even if they aren't, getting my phone out of my pocket, unlocking it, opening the right app, getting to the right screen in it (oh, did it just log me out?) etc. takes about 10x as long as arming my smartwatch in a convenient moment and tapping it once the terminal asks for it. It doesn't even require a free hand, since the range of mine is much better than that of passive contactless cards.

I like linking to the Amazon account because apart from the discounts (which are nice), it puts the receipt in my Amazon orders list. Yes, at Gus's there's no such linking feature or discount and I just tap my watch after selecting the appropriate card.

Amazon's app is just like what you describe. It is extraordinarily slow and needs a high-speed data network.

Isn't it a deep vein scanner? Much harder to spoof than still images or even video.

Nope, just a normal camera + a lot of infrared light.

Even modern fingerprint capture can be done with just a phone camera (but that’s also a feature of Amazon One’s enrollment process - you use your own phone to take photos of your palms, then they’re verified on the entry tower and matched up.)

Hard to spoof. Not hard to collect.

You can always call WWV! https://en.wikipedia.org/wiki/WWV_(radio_station)#Telephone_...

That's WWV, also in Fort Collins, but on a very different frequency in the shortwave band.

I really wish microwaves and ovens came with radio-controlled clocks.

While the mains frequency is usually a great (long-term) stable frequency source, the bigger problem is that all microwaves I know lack a backup battery and require re-setting after unplugging them.

Satellite-based time signals also seem easier to spoof, given the inherent power constraints of the transmitters.

That said, newer ones can use authentication, which (together with a reasonably accurate local oscillator) can prevent at least trivial spoofing.

The most common satellite-based time signal today is GPS and global navigation system signals are possible to spoof, but it is harder than "trivial" at least.

IPv6 solves the addressing problem, not the reachability problem. Good luck opening ports in the stateful IPv6 firewalls in the scenarios outlined in TFA:

> And that assumes a single NAT. Many sites have a security firewall behind the ISP modem, or a cellular modem in front of it. Double or triple NAT means configuring port forwarding on two or three devices in series, any of which can be reset or replaced independently.

The article's proposed solution for IPv4 is a combination of VPN+NAT. The solution in IPv6 can be just VPN, sans NAT.

It can be sans NAT, but there's no guarantee it will be, and if a remote site chooses to NAT their IPV6 you still have to support it

I'm not really seeing a reason why it would be impossible to open firewalls in that scenario. More work, sure, but by no means impossible. In any case TFA says right up front that it is trying to solve the problem of overlapping subnets, which IPv6 solves nicely.

Then you've probably never worked in any serious networked embedded systems space. Getting people to open ports on the firewall and making the firewall configuration palatable to the end customer is like a quarter of what I think about when my team makes new features.

Yes! Exactly this.

> I'm not really seeing a reason why it would be impossible to open firewalls in that scenario.

Cheap ass ISP-managed routers. Got to be lucky for these rubbish bins to even somewhat reliably provide IPv6 connectivity to clients at all, or you run into bullshit like new /64's being assigned every 24 hours, or they may provide IPv6 but not provide any firewall control...

> or you run into bullshit like new /64's being assigned every 24 hours

It'd be nice if DNS servers supported this. Save the 64 host bits in the zone and just use whatever 64 prefix bits happen to be issued right now.

Otherwise it makes a strong case for the continued use of "private networks" and the IPv6 ULA mechanism.

> Otherwise it makes a strong case for the continued use of "private networks" and the IPv6 ULA mechanism.

Let's please not. Even without inbound reachability, hole punching is significantly easier given globally routeable addresses.

You can have /both/ a ULA and a Globally Routable address. In practice it works just fine. My internal DNS points to the ULA for internal connectivity and my hosts use their global addresses for external connectivity.

Ah, you mean for cases where you want both stable addresses (even if only internal) and globally reachable ones (even if non-constant)?

Yeah, that works, but everything gets much easier if your internal DNS can just support the varying prefix natively, e.g. via integration with the external-facing DHCP or PPPoE or whatever other address configuration protocol you use, since then you can reach everything both locally and globally by name.

> but everything gets much easier

It also gets more fragile. If your ISP can't or doesn't issue you a prefix for whatever reason then your entire IPv6 network stops working even internally. This is even more pertinent if, like me, you're on a 4G LTE connection. Verizon has great IPv6 support, when you can get it, and when you can't I'd still prefer to have a stable internal network.

It's completely impossible if you simply don't have the necessary access. Not everybody can administer all firewalls upstream from them.

Nor can everyone control whether their connection supports v6, unfortunately.

Hole punching actually works most of the time. A lot more often than you might think. But enterprise firewalls usually don't allow it. And some home routers fail when you check all the anti-intrusion options. But it's the same for other VPNs. In the residential and small-business space, it's pretty rare. You might need to point it out to the network guy. If the customer wants the service, they should be open to it.

The problem isn’t that it doesn’t work (and it does often not work – one “symmetric NAT” in the old/deprecated terminology is enough), it’s that it’s orders of magnitude more complex than it needs to be.

I’ve also never seen it work for TCP in practice, and not everybody should have to roll their own UDP wrapper for their TCP-expecting application.

Hole punching is a thing. Ports are not normally completely blocked. They allow replies, which can be exploited to do make a connection. Obviously this requires an out of band signaling mechanism. Tailscale does this, so does WebRTC, iirc.

See: https://tailscale.com/blog/how-nat-traversal-works

Yes, but I don't believe all firewalls support that, especially for TCP, and as you've mentioned, now you also need to maintain a handshaking mechanism.

The complexity makes sense if you need to transport a lot of data peer-to-peer or the lowest possible latency, but if you don't, you might as well use that coordination server (which outbound-only clients are connecting to) for payload communication as well.

Firewalls don't track connections as carefully as you might think. They don't delete the mapping when an RST is received, so you can keep using it and receive a SYN in the other direction and now you have a connection.

Companies with an IT department, maybe. Companies without IT, not much. People, nope.

I can't see my neighbors opening ports on their switch. What's a switch, to start with. And what happens when they change provider and switch next month?

It's much easier to tell them: I install two boxes. One is the camera (or whatever), the other one is necessary to make the camera work properly, keep it online, don't switch it off.

With IPv6 you don’t forward ports at all. The device already has a public address.

That's why I said "open ports", not "forward ports".

Stateful firewalls are very much a thing on v6. Many mobile ISPs don't allow incoming connections by default, for example.

Many CPEs (home routers) also come with a v6 firewall (I'd guess it's probably more common than not?), and not everybody has admin access to theirs.

That's the addressing problem, although I have some bad news on that: NAT is used with IPv6 in some places.

The reachability problem is, even with public addresses, sometimes you have to do the same thing to "configure port forwarding" with stateful IPv6 firewalls as with double or triple NAT IPv4.

You don't have to forward ports with IPv6 but you certainly can, and that means some remote sites you have to interact with will.

For 7 remaining pieces or less, there are actually tablebases of all possible positions showing whether there's a possible win or loss for either side: https://en.wikipedia.org/wiki/Endgame_tablebase

Huh! I don't follow chess closely enough to have known the tables go that deep. Do high-level players memorize (enough of) those that their strategy in a losing position shifts to creating a drawing piece combination? Or do the tables only formalize something was that always done intuitively?

I don't think human players memorize tables in the same way that they memorize opening lines. The number of possible endgame position values is astronomical; "Syzygy" for 7 pieces is a few TB of data, for example.

Heuristics get them very close, but I vaguely remember hearing that sometimes the tables will find an obscure move sequence to turn around a draw to a win 15 or 20 moves in that a human has no chance of spotting.

These tablebases do have something eerie to them, as they represent the phase transition from heuristics to the "solved" part of chess. Lichess will automatically swap to them once it's feasible, and instead of a position evaluation, you'll just instantly see whether it's winning, losing, or drawing. Ken Thompson called it "playing chess with God": https://en.wikipedia.org/wiki/Endgame_tablebase#%22Play_ches...

That said, this can happen with chess engines as well; if a position can be exhaustively analyzed, it'll show you "winning/losing/drawing in n moves" just like the tablebases. The tablebases just guarantee that they'll find that solution in constant time.

The solution in TFA is unidirectional.