Doubling down on a winning strategy I see.

I think you might need to adjust expectations a little. If your website is simple enough that a competent person could reasonably do it for <$1,000, you’re honestly probably better off just using Squarespace or similar.

Building a website for a few hundred dollars just isn’t worth anyone’s time. Just getting enough information out of a client to build a site they’d be happy with is usually hours of meetings regardless of how simple the site is. Usually the process is going to require multiple design drafts and a bunch of back and forth. That adds up to lots of hours of skilled work.

If you’re an independent web designer you need happy customers and good reviews if you want to get future customers, and trying to do things on the cheap end just isn’t really a workable business model.

You can use git over ssh with no other infrastructure. It’s less work, and you’ll learn more from doing it.

Tailscale is a sort of VPN. So, yeah, treat it the same.

I’m mostly responding to add a little context to the security concerns. Probably the biggest inside-the-VPN concern is that someone on your VPN gets some malware. So, if this is your family network, and say, your kid’s phone or laptop gets some malware, now any non-encrypted traffic is potentially compromised. Basically, the VPN is only as secure as the weakest link. That’s the thing you’re protecting against with https for individual services.

If I were hosting vaultwarden, and had my bank login in there, I absolutely wouldn’t consider a VPN + http sufficient protection. With LLMs, if we don’t have malware that knows how to hunt around for valuable credentials in the wild already, it’ll be here soon. I personally run my Jellyfin server over https because I’ve gone to the trouble to set up a good system to use letsencrypt with nginx as a proxy for any service. But I wouldn’t be too worried about running Jellyfin over http.

If you’re not using https, then anyone who can see the traffic in your VPN can see everything you do.

Whether that’s a problem depends. In principle, as long as access to your VPN is restricted to people you trust, then http inside it is fine. In practice, if your security isn’t perfect, and someone gets access to your VPN, then https provides a meaningful second line of defense.

My recommendation would be to never use http for anything where a breach would be really painful. It’s good that vaultwarden is on https. Beyond that, https is absolutely the best practice, but if someone getting access to your service is only a mild inconvenience, then leaving it on http is fine as long as it’s only accessible inside your VPN - the risk is relatively low, and the consequences aren’t bad.

The skills you need to guide LLMs though comes from practical application/experience writing code in the industry though, so my concern is how people are going to get those skills now. You don’t get them from college.

Yeah… it’s going to be really rough for new engineers for a while until we figure out a new way to train people. I think there will be people who are self taught and AI native who will do really well, but they will be the minority.

I don’t feel comfortable telling anyone to go into software engineering right now. I think the future is really uncertain. That said, I’m also not convinced this is a bad time.

The need for software engineering isn’t going away. LLMs are actually not very good at thinking and solving problems at a high level, so we still need people for that. LLMs are more of a performance multiplier than a replacement for human software engineers.

That does mean that fewer engineers will be needed to do the same work. But also, I think there’s a chance it’s a Jevons Paradox situation, and maybe if the cost of software drops we’ll see even more demand for it - like how we found tons of new uses for electricity when prices dropped. Maybe we’re entering a golden age of bespoke software. Unclear.

This is pretty off-base for what OP is asking about.

React and C# are open source.

WebM, WebP, and AV1 are open standards that have mature and well developed open source implementations.

Literally every item OP asked about is already OSS. OP just doesn’t like that they originated at Meta, Microsoft, and Google.

Not everything made by big tech is bad.

React is great. It’s open source. The governance is reasonable. Why should we replace it?

WebP, WebM and AV1 are great open technical formats. We should use them.

If a standard is truly open, then you should judge it on its technical merits, not some weird purity test about where it came from.

castle-nathan.gif

I don’t know why, but I always assumed that image was from Firefly. It’s the same color shirt and everything!

I’m not saying it’s great.

I just don’t see this ending without a bunch of people having their lives ruined, so whatever we can do to pull the bandaid off faster is the best we can hope for.

You know, this might not be for the worst.

People really need to get used to the idea that everything you see online, and especially on Facebook is fake. Maybe it’s for the best if they don’t moderate things well enough to let people pretend otherwise.

I don’t have any personal experience with self hosted webmail. I know there are a bunch out there and definitely both options that can sit in front of a maildir and options that can sit in front of a POP/IMAP server like Dovecot.

I did a little googling, and if I wanted to set this up, the first thing I’d check out is something like imapsync -> dovecot -> Roundcube.

Dovecot provides a really reliable maildir -> IMAP/POP conversion layer, and once you’ve got that, most things should work.

You can use imapsync to keep a local synced copy your email in maildir format. That, along with a domain you own, solves the “I own my own email sycned to my server” problem pretty much completely. Switching email providers is just syncing to the new server (which imapsync supports) and updating your MX records on your domain.

Some email clients (like aerc) can just operate on the maildir directly. That’s what I do, but there are lots of ways to do this.

One option is to just keep using your email client the way you are now talking directly to your mailserver, and just rely on the imapsync side to be your owned backup/migration path.

Alternatively you can run your own local IMAP or POP server like Dovecot backed by the local maildir. So that’s imapsync -> dovecot -> thunderbird (or similar). It’s a little more software to set up, but once it’s set up it should be very reliable and gives you total control over what email client you use and full ownership of your data.

What I’m trying to say is that you should choose the programming language that will make your learning and early projects easiest.

Learning a new language later is not hard. Trying to use the wrong tool for the task when you’re just learning is hard, and will teach you the wrong lessons.

Learning more programming languages isn’t the hard part of becoming a decent programmer. You’re optimizing for the wrong thing here.

You should choose a language that works well for the specific projects you think you’re going to do in the near term. Depending on exactly what sort of projects you want to do, Python, Typescript, C++, and Rust are all languages I might recommend. I wouldn’t recommend raw Javascript for anything other than doing some tutorials before learning Typescript.

Without more information, I’d recommend Python.

The moment you start allowing limitations on who can or can’t be president you open the door to politicians shifting the requirements to fit their political needs. The legislature would immediate start the game of updating the requirements in a way that seems benign but is primarily calculated to hurt their opponents. Within 2-3 election cycles you’d have bills up specifically targeted to exclude their most popular opponents.

Is France… ok?

I’ve always treated my home server with public facing services as presumptively compromised. I don’t put any data on there I wouldn’t want to see become public, and any data I actually care about losing is backed up to the cloud with an append-only key. The NixOS config lives in a git repo not on the server. If something bad happens, I can wipe the machine clean, redeploy the image, restore my backups, and we’re back to the status quo.

So, my threat model hasn’t changed much!

They really want people scared, ehh?