Is that the nuke one?

Edit: lokked it up, yes, it is.

aansprakelijkheidsverzekering in Dutch

You have to be kidding, right?

Super fair, ich habe erst die letzten Jahre angefangen mich mehr mit Containern auseinander zu setzen und da war diese Gefahr in vielen Tutorials recht präsent. ist wahrscheinlich ein shift der da in der Wahrnehung zwischenzeitlich passiert ist.

I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)

Also, this is documented:

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.

https://docs.docker.com/engine/security/#docker-daemon-attack-surface

You wouldn’t download a plagarism machine!

The way I read it, it is fine if you do not allow password authentication in general?

Just out of curiosit, what do you gain from unmounting the fs? Depending on your reasoning, it might he an option to use a zfs filesystem, set it up so automatic jobs rarely run and then set a somewhat agressive disk spin down policy. That way fs info would be handled by the arc, not the disks and they would only spin up when an actual file is accessed.

At least I assume it would work this way. Look-Ahead reads or your explorer generating previews, etc. might well make thta option fail.

I had an issue setting up immich for my parents, whre the fs would stall too long for it to successfully get files. Missing media was just getting displayed as a grey box with a “missing media” text on them.

Could not find a less jpg version :/

Just mentioning the words “fertility monitor” in the post (or these comments) would probably have helped. I (and I assume those who downvoted) have never heared of the brand names in the article and do not even know what broad category of devices you were talking about.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don’t notice (i.e. don’t need the service) than having open vulnerabilities when a fix exists.

german company employing outside of germany, the employees get all benefits from german employment and all work laws

That is just false.

For my threat model I’m not really concerned with people gaining physical access to my phone, it’s more the surveillance capitalism I’ve got a problem with. So I’d like to be able to keep showing notification contents to myself without showing them to Google.

If properly implemented google should not see your notification “only” metadata (origin, app, timestamp).

I do not use play services on my main profile in Graphene. Here is what works for me:

Email: currently use the Proton app. I’m open to switching to a separate client, but the feature to mark read directly from the notification […]

I use FairEmail and get reliable push notifications for all my e-mail accounts. I do not have proton however, as far as I know you need the subscription to access mail via IMAP.

Calendar: also Proton, also open to other clients. Reliability here is important for obvious reasons.

I think other clients will be difficult here. Proton does not support CalDav (the open standard to sync calendars between devices using numerous applications). Proton also does not support unified push. Getting notifications here will be difficult. However, I would suggest you should try to use the protonmail app in a user profile without play services and see if you get reliable notifications. Some apps have theri own push service implemented when Googles service is unavailable (it will be more battery intensive though). If that does not work, my suggestion would be to use a diffeerent calendar service supporting CalDav (like a small selfhosted Nextcloud instance) and sync that via the android app DavX5.

Messaging: Facebook Messenger

I (have to) use Whatsapp which works okayish with notifications when battery optimization is disabled. I suspect Facebook messenger could work the same, so I would, again, suggest to just try it.

Molly is the go-to? That talks to regular Signal, correct?

Yes, Molly is a compatible fork of the official Signal client. They support Unified push but that requires running a small server to receive your Signal messages. I do however also get reliable notifications without that (more battery intensive).

Emergency/weather alerts:

I guess it depends on the country you are in. But emergency alerts via CellBroadcast are supported in Graphene and do not require Goole Play.

Microsoft Authenticator:

Have you checked if that works at all? The last time I have tried to set it up on a profile without GooglePlayServices it refused to work at all. My suggestion would be to have it on a separate profile with play services (it is healthier to separate work and private life anyways).

Smart home degoogling is Coming Soon™, if there’s anything I need to keep in mind there. Can home assistant consolidate everything or does it work through vendor apps? (Schlage deadbolts, ecobee thermostat, WiZ lightbulbs, Kasa switches if it matters.)

If a device is supported in homeassistant it should be consolidated. I would suggest looking up the ecosystem and homesssistant for details.

I’m guessing call, SMS, and MMS are a dedicated channel with the cell service and are not push notifications, but please correct me if I’m wrong.

Yes, afaik those are separate. They have worked reliably for me without any intervention or Google.

It seems like scheduled notifications e.g. alarms and timers are also not push notifications. I tried a test timer and it worked.

Yes, Googles service is only required for stuff that happens remotely and whose timing you device cannot know about in advance.

What country are you in? In my experience transit apps are somewhat localized.

This might be a jumpoff point to get Linux booting on the A18 and other apple mobile chips as well, no? On devices like the Macbook Neo or some iPads, having Linux as an option makes sense in my opinion.

Why is it just exposed like that. That seems needlessly dangerous.

I have an HDD at my parents place and manually bring over snapshots when I visit. Off site does not necessarily mean cloud.

It seems like the choice was not made out of mallice, but legal obligations (reply stolen from reddit):

2026-09-21 - Update by Qobuz support: Hello, thank you for your message.

Following the recent changes made to the QBZ repository, we’d like to provide some clarifications regarding this decision.

QBZ was an independent application developed by a third party and was not developed, maintained or distributed by Qobuz. We know that QBZ was a really convenient solution for our Linux users.

However, we have strict legal and contractual obligations toward rights holders to ensure fair artist compensation. Unfortunately, the app placed Qobuz in a non-compliant position, which left us no choice but to ask the developer to stop its distribution.

The use of the unoffical app unfortunately leads to streams not being counted with us and thus the artists end up empty-handed.

We completely understand that this situation is frustrating for the Linux community. This was a difficult decision, but it’s necessary to protect both artists and our platform.

We are actively working on releasing an official Linux application as soon as possible. Thank you for your patience and understanding in the meantime.

Kind regards,

Marina

Qobuz

I agree with the comments here, that this could have been handled better, providing an open API that ensures streams are counted, taking over or building on qbz to release their own client, etc. But I think this is not an issue with Qobuz, but moreso with the music industry.

Anyhow, I guess I’ll get a seedbox subscription instead now :/.

If you are using aptitude (apt) it is quite simple: https://ubuntu.com/server/docs/how-to/software/automatic-updates/

If you just want security updates and are fine with the default configs:

# apt install unattended-upgrades

You can test that on this site:

https://no-sct.badssl.com/