u/QWERTYroch

Case 3 only works if the forwarding resolver guarantees that it only reaches Cloudflare when the Pi-hole is down. That would be a custom solution as it is not the way normal DNS resolvers work. Even if you configure it to ask Pi-hole first, when the Pi-hole returns NXDOMAIN for a blocked site, a normal resolver will try the next upstream server in its list, effectively bypassing the Pi-hole. There is no distinction in DNS for "blocked" vs "non-existent" vs "may exist but I don't know about it". Thus, when one upstream says the domain doesn't exist, client will try all known upstream servers in case that one just didn't get the memo.

The method I mentioned in my previous comment is more of a high-availability solution than a forwarding resolver solution. You would set up one Pi-hole and one external server. The external server would run something like keepalived to point a virtual IP address at the Pi-hole as long as it is online and repoint that IP to itself when the Pi-hole goes down. The external server would also run a forwarding resolver so any DNS requests it's receives directly are forwarded to Cloudflare.

The much easier and less error prone is to simply have two Pi-hole instances and use a script like gravity-sync et al to keep them in sync. In this case, the router would advertise both piholes as the first and second DNS servers, so no matter which path a client takes or which one is down, the blocking continues to work.

I don't think there's a separate published pdf, but the native help menu pulls up an HTML document with explanations and examples.

DNS doesn't have a notion of primary/backup, so there's no telling what percentage of load the second instance would carry. A high-availability setup could be used to load balance to the primary unless it is down, but Pi-hole is so lightweight I don't think any hardware that can run a modern (ie secure) OS is really going to have any problem.

Secondary DNS is not intended to be a backup. The order in which primary and secondary servers are queried is undefined and may change from platform to platform or device to device. Often, both are queried simultaneously and the first to respond is used. Sometimes that one is then preferred over the other, but not always.

The only safe way to do it (ie without letting blocked domains through) is to do as you suggested and have a forwarding resolver that strictly tries pihole first and only goes to Cloudflare if it is down (but that is also a single point of failure), or to stand up a second pihole instance with the same blocklists.

HomePod Mini is also a supported hub. I saw a sale yesterday for $60, which is half the base AppleTV.

This is true, but not all matter devices will support wifi. So if you want a particular brand/device, say Eve, you will need something that supports Thread (but that could also be a HomePod Mini or eventually a third party Matter-compatible Thread border router).

Thread is not required for Matter. It is one of two transport protocols, the other being WiFi. Matter is really just a language the devices speak to each other, like HTTP for websites, which can be transmitted via WiFi or Ethernet but doesn't care which.

I had the same thing, though not trying to catch a bus or anything. I would routinely have dreams where all of a sudden I just couldn't move, or it was like walking through syrup. I hadn't thought about timing before, but now that you mention it I think it did start during the pandemic and ended months ago (maybe about a year now?).

I had them frequently enough that I actually started to recognize I was dreaming from within the dream. Unfortunately it was usually more of a "this is weird and exactly like that dream I keep having" more so than "I'm currently dreaming, let's see what I can change". I have never had a controllable lucid dream.

I agree. Although I feel AirTags are a net positive (nicer item tracker + public awareness of easy stalking devices), it's also worth noting the downsides.

Just as Apple made people aware stalkers can use AirTags and other GPS/Bluetooth trackers, so too did they make casual/opportunistic stalkers aware that there is a cheap and easy way for them to stalk their victim. I'd wager there is a nontrivial number of people who wanted to keep tabs on someone, nefariously or not, without their consent who simply had not bothered looking into ways to do it who now have a popular brand presenting an (apparently) easy way to achieve their goal.

Don't get me wrong, I think the AirTags are a good product and Apple is in now way wrong for launching them. The built in protections, and the fact Apple was fairly quick to revise and improve those protections, are good - certainly above the "launch/don't launch" threshold.

As with anything that can be abused, we'll hear about it for a while when it's new, and because it's a big brand name, but eventually the hype will die and we'll hopefully see less sensationalized headlines about it.

Absolutely. The only requirements are that you have the ability to send DNS traffic to the remote device (TCP port 53) and that your Pi-hole is not accessible from the public internet.

The simplest way to achieve this is to set up a split-tunnel VPN (check out WireGuard if your not familiar) that sends traffic for your Pi-hole instance over the vpn and all other traffic through your default gateway. Make sure your cloud server is set up to only accept dns requests from the vpn interface.

You do not have to send all of your internet traffic through the remote server, unless you really want to hide from your ISP. The DNS redirect will be enough to hide your personal IP as any upstream requests would come from the Linode address. If you're concerned about your ISP snooping on your traffic after DNS resolution, run a full tunnel VPN to your Linode.

Keep in mind that tunneling all of your traffic will add noticeable overhead when browsing as all traffic must be encrypted, sent to your Linode in a datacenter, decrypted, then sent to the original destination. WireGuard is generally pretty fast, but it does still impact performance. And if you are not physically located very close to the Linode datacenter you choose, the path your traffic takes may become much much longer.

If they used a unique domain purely for the purpose of detection then yes, it would be easily circumvented. But in all likelihood the same domain they check will either also serve the ads or be part of larger tracking that you probably don't want to whitelist.

Interesting! So even for fixed rate loans you do not sign a 20-30 year agreement, it's all short term rates that have to be renewed? I guess the mortgage itself is probably binding for the full term and just the rate agreement must be renewed?

Also very interesting about keeping the payment the same when rates change, as that could easily push the payoff date beyond the initial timeframe. Is there a fixed cutoff where you must pay the remainder or if rates keep going up could your payoff date keep getting pushed out further and further?

How frequently does the bank adjust your interest rate? Like it is continuously being adjusted or do they recalculate it every month/year? It seems like it would be hard to budget if it was changing too frequently.

Not sure how other countries call them, but here fixed rate means one rate for the entire term of the loan (say 15/20/30 years) while variable rate or adjustable rate (I've seen these interchangeably) have an initial period and then periodic adjustments. So you might get 5 years at the initial rate and then it changes every year. That initial 5 year rate is often lower than the fixed rate, but the jump in year 6 can be brutal.

My printer has been borked for years after a failed repair and I've never had the time or energy to fix it. I'd love to get back into printing though!

I voted

I just happened to see a little notification at the bottom of the screen that said "Found Food!", but it was mostly occluded by the home bar. It seems like the spacing is just messed up for that one because the "gurgle" text shows above the bar (and is very disheartening when you don't have food to give!).

Apple is projecting their values via their editorial power. Just as a newspaper can choose not to publish an op-ed from someone they dislike, Apple can choose to not use their editorial space to promote an artist they don't want to. It's an implicit endorsement by association.

They’re not directly endorsing him

They effectively were though. What they removed was a curated playlist, which means someone at Apple said "hey, look at this artist and these songs, they're great!" By removing the playlist, they are removing their endorsement even if they are not explicitly condemning him.

Yeah, but the battery is shown in wireless mode regardless. I'm saying it would be nice if the battery was shown in wired mode so I don't have to think about it, just look at the top left of the screen and get time, signal, and battery regardless of how it's connected.

Consistency in the UI would be nice. That little bit of screen is not being used for anything else, I would at least like to see the battery icon with the charging ⚡️ on it to confirm it's charging correctly (seeing the current charge level might be nice but isn't a must have).

To be really pedantic, that sentence isn't technically wrong. It was the first time it was broken "over the high desert of California", even if not the first time on Earth.

Obviously the context implies that it was the first ever, but in a vacuum each of their claims could be rationalized.

I'm pretty sure these settlements are typically paid out of escrow so Apple is not cutting individual checks to developers. And the court documents identified all eligible developers, so they wouldn't even need to give the names of the claimants to Apple to determine the amount, the settlement trustee could do it all. I'd be surprised if Apple knew precisely who got paid from this and how much, unless they post it themselves.

That's cool! Does it have the ability to add arbitrary information to the stored items, like value, description, when it was purchased, etc?

My grandparents recently passed away and we're looking for a simple asset management system to catalog all their stuff. The professional systems are way too complex and expensive, but an excel spreadsheet is a bit too primitive. This looks like it would be perfect if it can track that per-item information. The QR scanning is exactly what we want too!

Little Snitch is great. I've got it set up with the same rules as my Pi-hole and there's no difference when I'm home or away, or on a vpn with fixed DNS. It's $45 for a perpetual (single version) license, and IMO worth every penny.