It’s mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.

This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.

You’re right that it doesn’t increase security on case of a compromised container. It’s just about outside connections.

Some I haven’t yet found in this thread:

• rootless podman
• container port mapping to localhost (e.g. 127.0.0.1:8080:8080)
• systemd services with many of its sandboxing features (PrivateTmp, …)

I do the same, but with Wireguard instead of OpenVPN. The performance is much better in my experience and it sucks less battery life.

Trying to actually restore is the best way to ensure the backup works. But it’s annoying so I never do it.

I usually trust restic to do it’s job. Validating that files are there and are readable can be done with restic mount, and you’ve mentioned restic check.

The best way to ensure your data is safe is to do a second backup with another tool. And keep your keys safe and accessible. A remote backup has no use of the keys burned down.

Yes. I like to leave the original link in the post body for that reason.

Sadly it’s not possible to provide links using Firefox Translate. People would have to translate it themselves (i.e. opening in a browser and clicking translate). Depending on the device they likely wouldn’t bother.

Agreed. In general people seem to like centralised platforms. They don’t want to sign up on another site for a specific purpose. They stick to what they know unless there’s good reason to change (mostly peer/ad/social media pressure I feel like).

In a way Lemmy is similar in that it’s a single platform to access all types of content. Given most people don’t care about the technical “how”, I can see why they like Discord and Reddit.

I use Findroid for its great UI but also its ability to download and watch offline. It’s a better experience and I was surprised Jellyfin Android didn’t support it.

I wonder how much money Plex still makes through their lifetime purchases. Is it that they were struggling and then made bad business decisions with the aim on increasing revenue (ad supported video on demand)? Or was it the other way around?

In the 80s new systems usually came with new OSs, which required porting software it. Thus a lifetime license was practically limited.

I wouldn’t be as opposed to a subscription model if it was cheaper and they focused on their actual core product, not all the other fluff around. 5€/m is a bit much given they don’t pay for my bandwidth. And if they didn’t store my media info, history etc…

To me there’s a major difference depending on the cost of the provided service. I don’t know what features crowdsec provides, but if it’s mostly providing lists and all the blocking etc happens locally, I don’t see how they lose much money on this free service. Gathering the lists is something they’d have to do anyway to service their paying customers.

If Cloudflare stopped making Cloudflare Tunnels free to use, I’d be more understanding since bandwidth costs them relevant amounts of money.

If your anything like me you’ll forget what PPAs you’ve added in a few months. Or rather, forget that you’ve even added things like PPAs. That’s why I stick to flatpak if its not in my distro’s repos.

Like others mentioned, request Google Takeout which gives you all your photos. I recommend keeping the original zip/tar.gz for future reference (e.g. you need specific metadata not included in the photos directly).

Also, make sure to keep backups. E.g. upload it preferably encrypted, and store the password in a password manager. Make a copy on a USB SSD, and not just the Steam Deck (you might wipe it, lose it, …).

These tools are also useful for finding large files in your home directory. E.g. I’ve found a large amount of Linux ISOs I didn’t need anymore.

Do you delete all your files on a reinstall? Documents, photos, videos, games?

Fclones is a great tool, but it’s for finding duplicate files and replacing them with sym-/hard-/reflinks.

I recommend using the --cache option to make subsequent runs extremely quick.