There is no downside to nested encryption, except of course the performance overhead. But this only really makes sense if each layer has an independent key and each layer uses an algorithm from a different family. Improper key reuse weakens the scheme.

For symmetric cryptography like AES the benefit is dubious. It is far more likely that the content is decrypted because the key was acquired independently than that AES would be broken.

However, there absolutely is a benefit for asymmetric crypto and key agreement schemes. This is how current Post-Quantum Cryptography schemes work, because:

• commonly used algorithm families like RSA and Elliptic-Cuve will be broken as soon as a sufficiently large quantum computer exist
• proposed PQC algorithms are comparatively immature, and some of them will be broken in the near future

Nesting one algorithm from each family gives us the best of both worlds, at a performance overhead: conventional asymmetric cryptography give us temporary security in the near future, and the second PQC layer gives us a chance at long-term security.

The text does technically give the reason on the first page:

It is not a regular language and hence cannot be parsed by regular expressions.

Here, “regular language” is a technical term, and the statement is correct.

The text goes on to discuss Perl regexes, which I think are able to parse at least all languages in LL(*). I’m fairly sure that is sufficient to recognize XML, but am not quite certain about HTML5. The WHATWG standard doesn’t define HTML5 syntax with a grammar, but with a stateful parsing procedure which defies normal placement in the Chomsky hierarchy.

This, of course, is the real reason: even if such a regex is technically possible with some regex engines, creating it is extremely exhausting and each time you look into the spec to understand an edge case you suffer 1D6 SAN damage.

I found an academic article (Vogel et al 2019) that analyses this phrase. Key points:

• when the German legislator uses geschäftsmäßig, this demonstrates a clear difference in intention from gewerbsmäßig or gewohnheitsmäßig

• the article quotes Franz von Liszt 1881, and this definition seems to be accepted to this day:

  Die Gewerbsmäßigkeit charakteriſiert ſich einerſeits durch die auf öftere Wiederholung gerichtete Abſicht, andrerſeits durch die Abſicht des Thäters, ſich durch dieſe Wiederholung eine, wenn auch nicht regelmäßig oder dauernd fließende Einnahmsquelle zu verſchaffen […].

  Die Geſchäftsmäßigkeit teilt mit der Gewerbsmäßigkeit die auf regelmäßige Wiederholung gerichtete Abſicht, dagegen fehlt die Abſicht, ſich eine ſtändige Einnahmsquelle zu eröffnen. Ob die einzelnen Handlungen honoriert werden oder nicht, iſt gleichgültig.

• the term geschäftsmäßig is significant for §5 TMG, but has also reached wider attention in the discussion around the decriminalization of assisted suicide.

So the key defining aspect is the auf regelmäßige Wiederholung gerichtete Absicht, the intention directed towards regular repetition.

This meaning in legalese German is divorced from everyday language.

§ 5 TMG has the interesting construction of “geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien”. So the TMG does not seem to care whether you have a profit motive, only that other people might provide this kind of service for a profit motive. If other people would provide instances of Discord bots in order to get donations, that might already bring you in scope.

This is not legal advice, but it seems like your options are to either avoid running an instance of the bot, only running it in a private context without access from a wider public, or sucking it up and providing the necessary documentation.

And no, it is probably not possible to use a PO box because you don’t live or work at that address. The general expectation seems to be for the address in an imprint to be ladungsfähig, so that you can be served there. This random lawyer’s website writes:

Unter der Anschrift in diesem Zusammenhang ist die Postleitzahl, der Ort, die Straße und die Hausnummer zu verstehen, nicht ausreichend ist die Angabe eines Postfachs.

That’s not the correct criterion. There are multiple German laws that require imprint-style disclosures.

Some of them are indeed specific to commercial activities.

But the Impressumspflicht typically means §5 TMG which requires an Impressum for

geschäftsmäßige, in der Regel gegen Entgelt angebotene Telemedien

Rough English translation:

Telemedia offered in a business-like manner, typically for remuneration

Critically, “geschäftsmäßig” does not mean “commercial” or “profit-oriented”. In particular, nonprofit organizations also act geschäftsmäßig.

IANAL, but it doesn’t sound like your service wouldn’t be geschäftsmäßig.

All of this is irrelevant anyway because you very likely have to publish a privacy notice per Art 13 or Art 14 GDPR. This must include the identity and contact details of the data controller (i.e., you). The German data protection authorities expect that the identity includes your real name and a ladungsfähige Anschrift (address where you can be served), so pretty much exactly what would be included in an Impressum anyway.

It would be unwise for a bank to publish its exact fraud detection and risk management policies, otherwise they could be easily circumvented. A lot of these policies will be embodied in their internal backend services.

Someone will now inevitably mention “security by obscurity”. But Kerckhoff’s Principle is specifically about cryptosystems which should derive their security solely from the strength of the keys. That way, confidentiality is still ensured even when details about the cryptosystem become known to adversaries.

But non-cryptographic aspects of security benefit from asymmetric knowledge, from grey areas, from increasing risk for adversaries.

Cryptography works. At least until sufficiently powerful quantum computers arrive, TLS reliably ensures confidentiality between your browser and the server. No one else can snoop on the data transmitted via that connection.

But are you connected to the right server? Without some kind of authentication, any adversary in the middle (such as your ISP) could impersonate the real server.

That is where certificates come in. They are issued by neutral certificate authorities (CAs) that check the identity. It works something like this:

• I, the server operator, create a private key on that server. I use that key to create a certificate request which asks the CA to give me a certificate. This request also contains the domain names for which the key shall be used.
• The CA performs identity checks.
• The CA issues me the certificate. I install it on my server. Now, when browsers create a TLS connection I can tell them: here’s my public key you can use to check my identity, and here’s a certificate that shows that this is a valid key for this domain name!
• The browser will validate the certificate and see if the domain name matches one of the names in the certificate.

What kind of checks are done depends on the CA. I’ve obtained certificates by appearing in person at a counter, showing my government ID, and filling out a form. Nowadays more common is the ACME protocol which enables automated certificate issuance. With ACME, the CA connects to the server from multiple network locations (making interception unlikely) and checks if the server provides a certain authentication token.

To know which certificates are valid, browsers must know which CAs are trusted. Browser makers and CAs have come together to create an evolving standard of minimum requirements that CAs must fulfill to be eligible for inclusion in the browser’s default trust store. If a CA violates this (for example by creating certificates that can be used for government traffic interception, or by creating a certificate without announcing it in a public transparency list), then future browser versions will remove them, making all their certificates worthless.

eIDAS 2 has the effect of circumventing all of this. There is to be a government-controlled CA (already high-risk) that has its own verification rules set by legislation (does not meet industry standard rules). And browsers would be legally forced to include the eIDAS CAs as “trusted”.

This puts browsers in a tough spot because they’ve resisted these kinds of requests from authoritarian regimes in the past. But now the world’s largest trade bloc is asking. Browsers can comply or leave the EU market, or maybe provide a less secure EU edition? Awakens uncomfortable memories around the failed US attempts at cryptography export control (cryptography is considered a munition, like hand grenades or ballistic missiles).

It is plausible that the EU is doing this with good intentions: having a digital identity scheme is useful, it makes sense for identity to be government-controlled (like passports), and such a scheme will only see success if it sees industry adoption. The EU has also seen that hoping for voluntary industry adoption doesn’t generally work, e.g. see the USB-C mandate.

Synology’s DSM has built-in MFA support, though it also has some features for external identity management. I don’t think Keycloak and so on would be compatible though.

Exos ist Seagate’s Enterprise-Segment. Generell sehr gut (und möglicherweise bessere Total Cost of Ownership), aber:

• Die Specs von genauen Modellen vergleichen, nicht von Modellreihen. Es gibt viele Exos-Modelle mit Unterschieden bei Leistungsaufnahme, Garantien, Lautstärke, … letzteres ist für einen Rack-Server im Enterprise-Bereich übrigens egal, für ein NAS im Wohnzimmer jedoch wichtig.

• Nicht versehentlich die Modelle mit SAS statt SATA kaufen.

• Bei Exos gibt’s keinen inklusiven Datenrettungs-Service, falls das ein Verkaufsargument ist.

• Manche Platten werden ohne volle Garantie verkauft.

Für mich ist leider Lautstärke relevant sodass ich keine Exos verbaue. Ansonsten würde ich das bedenkenlos tun.

HGST Ultrastar sind legendär, aber ich bin nicht up to date was deren Qualität seit der Übernahme durch WD angeht.

Gewicht ist in der Ebene egal. Luftwiderstand nicht.

• Bei 20km/h und Windstille ist der Luftwiderstand ähnlich groß wie der Rollwiderstand.
• Hier hattest du aber Gegenwind, verlierst also sehr viel Energie um durch die Luft voranzukommen.
• Die sportlichere Haltung auf einem Rennrad hat geringeren Luftwiderstand als die aufrechte Haltung bei einem Stadtrad.
• Seitliche Gepäcktaschen haben einen hohen Luftwiderstand.

Im Vergleich zum Luftwiderstand sind andere Faktoren wie Schaltung, Kette, Dynamo klein, solche Unterschiede können sich aber auch summieren. Gewicht ist eher für das Beschleunigen (wie nach einer Ampel) oder bei Steigungen interessant.

Kondition kommt dazu. Insbesondere wenn du kurze Stadt-Strecken von 15 min gewohnt bist, ist eine 70km-Tour ein ganzes Stück. Da reicht es nicht einfach nur zu fahren, sondern Essen, Trinken, und Pausen sind auch wichtig. Eine Durchschnittsgeschwindigkeit von 20km/h wäre keinesfalls schlecht (im Kontext Trekking/Reise). Ich persönlich rechne mit einer effektiven Reisegeschwindigkeit von 15km/h (inkl Pausen, Navigation, Ermüdung, leichten Steigungen, etwas Gepäck) für längere Strecken über 40km, auch wenn ich kurze Strecken deutlich sportlicher fahren kann.

Bei NAS-Festplatten ist wichtig dass die Firmware für NAS ausgelegt ist (also nicht eine günstigere normale Festplatte nutzen), und dass kein Shingled Magnetic Recording (SMR) verwendet wird. SMR spart dem Hersteller Kosten, solche Platten werden aber bei hoher Schreiblast von RAID-Controllern als fehlerhaft erkannt und deaktiviert. Zum Beispiel genau dann wenn du eine Platte in einem RAID ersetzen willst.

WD benutzt SMR inzwischen bei deren “WD Red” Reihe welches für Einstiegs-NAS vermarktet wird… Bestimmte ältere WD Red Modelle sind aber OK.

Pratkisch hast du damit die Auswahl zwischen 2 Modellreihen:

• WD Red Pro
• Seagate Ironwolf / Ironwolf Pro

Ich persönlich nutze inzwischen ausschließlich Ironwolf. Haben zwar etwas schlechtere Ausfallstatistiken als die Alternativen, für ein kleines NAS fällt das aber für die Total Cost of Ownership nicht ins Gewicht.

Und immer daran denken: RAID ist gut für Verfügbarkeit, aber RAID ist kein Backup.