> Given a choice, would most people prefer a Lenovo/PC or an Apple product?

I certainly would, because I demand Linux on all my computers. I can't stand the idea of being forced to sacrifice x% of my disk for things like "Apple Intelligence" or other bloatware that Apple decided I can't remove because it is a "system component." That, plus all the privacy and user control issues posed by an operating system effectively remotely controlled by a third party.

But everyone loves Bono?

> So the NAS runs Kubuntu 24.04 with ZFS

My experience is similar. I no longer use dedicated NAS, firewall, or other exotic distributions. I run plain Debian, and add what I need through standard repo packages. My "NAS" is simply a Samba daemon. The same box runs countless other services including hostapd (WiFi), DNS (Unbound), an email stack (Postfix/Dovecot), multiple game servers, and Podman.

> everything else in Docker Compose

I would suggest Podman instead. It is far more secure by design (rootless) and is unable to silently alter the firewall's configuration.

> is unable to silently alter the firewall's configuration

I'd like more informations about this as I'm not too familiar with firewall setup but every time I tried to setup iptables / nft it was indeed bypassed by docker. Recently I found out in the docs that docker adds a DOCKER-USER table, isn't it enough to put your rules in it to prevent the outside world to reach containers ?

These days you can buy 4 bay USB-C hard drive enclosures which let you make a nas out of any mini pc. I 3D printed a 10 inch rack to put the mini pc, hard drive enclosure and switch in which keeps it all neat and looks kinda cool.

USB is unreliable.

I used btrfs raid0 on USB drives for more than a year. Every month or so, a drive would disconnect from the bus and immediately redetected as another device (sde->sdf). Btrfs does not auto-recover from this. The choices are 1) reboot and scrub, which recovers the missing drive without doing a full resync, but it needs a reboot (any hosted site is offline for 3 minutes) and scrub takes a long time reading in the background, or 2) run btrfs replace which doesn't need a reboot, but the full resync takes even longer than a scrub and increases wear if it's a ssd because it wipes everything and writes all data again.

I agree that USB is unreliable.

I will point out that if you use ZFS instead of btrfs, you can specify drives to be detected via their serial number names rather than their attachment points, so a reconnect will not require a reboot.

Still, don't depend on USB for anything meant to be permanently connected.

USB is unreliable but it's working for me. I've had zero disconnects in a couple of years of using a Terramaster USB-C DAS. I've heard of the problems enough I've even searched logs for it.

I've wondered if my experience is different because I'm using single disks (but still ZFS) instead of any RAID. There is rarely transfer happening across all of the disks.

I have not had this issue myself. Drives connected for around 6 months in raid without issue. But also, you should mount your drives using partition UUID rather than whatever linux decides to name them which is not stable as you'd noticed.

Why not an old school case with an HDD cage that can hold anywhere between a few and a dozen drives? It would be cheaper and more flexible.

Or even go nuts and do something like this: https://grabcad.com/library/10-bay-hard-disk-drive-cage-for-...

I do a similar thing. It really is functionally exactly the same, just a bit more piecemeal.

Interesting, I never tried Podman. Thanks for the suggestion!

I find Proxmox to be a great host. It's Debian with a bunch of helper scripts/GUI to run containers and VMs. I manage ZFS outside the Proxmox bubble and run a privileged SMB server container to access it.

Though I really don't use the server anymore and it's probably worth several thousand dollars with the RAM in it. Been thinking of using a spare laptop with external HD bays to do the same job.

Don't know what it is with Proxmox, but I always somehow managed to break it in such a way that I can't remove the container/VM or start it...

My DNS server (which uses Hagezi's excellent blacklists) returns NXDOMAIN for bzr.openai.com. Serves OpenAI right.

I keep meaning to set this up but haven't. What's the simplest best setup for my own DNS blocker?

For simplicity I highly recommend https://nextdns.io. Supports most devices, and probably most, if not all, well known blacklists.

Also recommend NextDNS

Forget if they have Hagezi though. Also it would be really nice if there was a way to export and import custom URL lists and rules....

The easiest off-the-shelf option would be a router running OpenWrt. IIRC, it natively uses dnsmasq, and the relevant blacklists can be obtained from here:

https://github.com/hagezi/dns-blocklists

My own setup is DIY: a Debian box running Unbound (recursive DNS) with the RPZ blacklists from above. This gets rid of the upstream DNS service such as the ISP's completely, and prevents tampering or censorship.

For a home network network pihole or unbound also supports blocklists (bundled with opnsense for example if you also want a firewall). For Android, I use Rethink with Hagezi blocklists, so they block also when I am on mobile data (it is vpn based).

Hmmm Pihole I guess. Runs on a pi zero (1 or 2 but 2 is better ofc)

An would always be wrong here, in the U.S. at least.

This is governed by the following word. "Thee" can also be used for emphasis anywhere.

And this is why you should always carry while hiking. That being said, the primary reason is two-legged predators.

There is no such thing as extreme privacy; it isn't something any phone can provide, especially if you are going to rely on third party software and services like email and instant messengers where the likes of Google and Facebook are dominant players. Even behind a VPN, Vanadium is fingerprintable by commercial trackers like fingerprint.com. Short of disabling Javascript, browsers leak enough information to basically follow anyone around the internet.

How much do you know about Graphene? It literally disables JavaScript JIT for security.

> How much do you know about Graphene?

Enough to know that it is as fingerprintable as any other phone. Disabling Javascript JIT will not change that.

This. Also, use OSM for maps and run your own SMTP server, if you can. Nobody should need Google.

Sadly, the to me most important parts of Maps are live navigation and live traffic status. I'm assuming you can't get those with osm (yet).

The actual maps are much better in osm than in Google.

OsmAnd does have live navigation as far as I understand it (turn-by-turn directions), but no live traffic status, because for that you a lot of drivers willing to surrender their location/sensor data. Anything "live" cannot be privacy respecting. I never found live traffic information particularly worthwhile to be honest.

Maybe it's time to give up privacy absolutism and add strictly opt in live data features.

That reminds me, place reviews using ATProto. Kinda surprised that no map client jumped on that when it's the exact thing you need to replace a centralized service. A lot of people use Google Maps to find businesses more than directions.

Pixel a-series with GrapheneOS is already the "minimal phone" for hackers: cheap, reasonably small, hardened OS without Google spyware and bloatware. Compatibility with Android is fully retained so you can run things like Wireguard, Termux, Home Assistant and a myriad of other excellent FOSS (or non-FOSS) apps with complete sovereignty over your data.

Same thing here, I use Graphene for the sake of user control. All the security features and hardening of the Pixel phones and of the OS are good to have, but they not the main reason.

What if GrapheneOS believe that privacy/security is what gives users real abuse-resistant agency and control over what happens on their device with their data?