I used to say restic and b2; lately, the b2 part has become more iffy, because of scuttlebutt, but for now it’s still my offsite and will remain so until and unless the situation resolves unfavorably.

Restic is the core. It supports multiple cloud providers, making configuration and use trivial. It encrypts before sending, so the destination never has access to unencrypted blobs. It does incremental backups, and supports FUSE vfs mounting of backups, making accessing historical versions of individual files extremely easy. It’s OSS, and a single binary executable; IMHO it’s at the top of its class, commercial or OSS.

B2 has been very good to me, and is a clear winner for this is case: writes and space are pennies a month, and it only gets more expensive if you’re doing a lot of reads. The UI is straightforward and easy to use, the API is good; if it weren’t for their recent legal and financial drama, I’d still unreservedly recommend them. As it is, you’d have you evaluate it yourself.

Ak-shually… you’re completely right!

But you left out an important option for OP: they can just turn on auto-login and bypass the login screen entirely. If they want any security, they’ll need a display manager, but maybe they don’t care. Also, while this doesn’t apply to them, I discovered accidentally that after I log in to herbstluftwm, it goes directly to screen lock. I don’t know what I did to make that happen, but I’ve realized I can just disable the display manager, have auto-login, and still get security. Probably not as much, and if I ever get around to encrypting home that won’t work anymore, but I’ve been considering doing it because typing my password in twice is a drag.

You can put headers on any TCP packets, and they’re supposed to be preserved by intermediate routers. It affects all TCP packets, not just HTTP; the only way to bypass it is by using UDP, which is used by some protocols, but not most.

A TCP implementation MUST be able to receive a TCP Option in any segment (MUST-5).

RFC9293

You’re absolutely right about not being good for businesses; most of those don’t use Wireguard, though, unless that’s changing. It’s usually some proprietary crap.

The problem with renting a VPS - of which I already have several - is that at some point you have to pay for the data. Either it’s uncapped, but throttled at a certain number of GBs, or you pay a rate per GB. The hell I’m going to pay T-Mobile and have to pay more because they don’t allow VPNs.

But, it’s starting to sound like they don’t block them, so it’s probably all good. Worst case scenario, I suppose I can always go crawling back to Comcast.

Harvesting tracking data is a revenue stream. T-Mobile and Verizon home internet have both been caught attaching tracking headers to TCP packets. A VPN strips those. If enough customers use VPNs, it really can impact their bottom line, as they have data on fewer customers to sell.

That’s the “why they’d bother.”