zoredache

Lots router have UPNP disabled or blocked, and thing still work. UPNP isn't great.

First The firewalls are stateful. Client inside your network attempts to connect to some system outside. The firewall adds an entry to the state table with client ip, destination ip, protocol, ports, and so on. If an incoming packet is received by the firewall, the state table is checked. If there is an matching entry for the ips, proto, ports, etc, then the packet is forwarded. If there is no match the packet is dropped or rejected depending on your config. So it is easy to permit packets based on the interface it was received or transmitted on.

Ports can be opened for some incoming traffic pretty much the same with as IPv4 using STUN, TURN, and so on.

Past that, you can do manual port forwards the same way you do with IPv4.

Create a DNS name ntp.yourdomain.example.org that points at your internal ntp servers.

Configure your ntp clients to use the name, and maybe add a pool.ntp.org entry or two into your configs.

So what kind of 2FA would be homeless-proof?

Almost certainly is a bad idea. But the first thing that seems like it could work would be an implantable nfc yubikey. Then making more devices support nfc.

I know I would be pretty tempted to get an implantable 2FA device if one was available and seemed like it would have both broad and long term support.

You might be talking about 'Bowl of Heaven', 'Shipstar', and 'Glorious' by Larry Niven and Gregory Benford perhaps?

I would bet you can hire an excellent, technically competent CEO for Mozilla for $250k a year.

But how long would they stay after other companies learn this new person is actually competent and start throwing money at them.

Never heard of regulatory capture?

If the government regulates something, that very often means that the incumbents will donate/bribe officials to pass regulations that favor the mega corps.

Getting government regulations that actually favors the consumers is somewhere between difficult and impossible.