ddh

Even the author says Flatpak is a sandbox.

The most simple but also least effective sandbox type is the container or wrapper sandbox that builds an isolated process environment and then executes the target application inside.

Flatpak provides an isolated runtime environment using a container type sandbox to execute the target application inside.

… there are two issues that prevent flatpak from providing a real sandbox environment…

Just that it’s no true scotsman, I mean sandbox.

He has angered the penguins

In fact, a good pihole will speed things up.

So don’t change the defaults?

As far as I know, yes. You tell me the alternative if you’ve got it.

People who like having fine-grained security controls over their apps?

Yeah, for Windows vs Linux on servers the battle is already won. For desktops it’s more Windows vs GNOME, Windows vs KDE, Windows vs XFCE, etc.

The best posture is the next posture.

Use the second option of a static MAC to IP map and add the relevant records to each pihole’s local DNS.

I wouldn’t use Copilot for this, as it may be using some older info on you that it already has. There are lots of “whatismyip” type sites that can try to guess your location. Failing that, see what region Google serves you ads from—any YouTube ads I get are always from my VPN endpoint country/region.

Also, just try plain old Tor Browser to compare with your setup.

Router may not have a function you want.

You can just run two DHCP servers. Give them non-overlapping ranges or give them the same MAC to IP mapping.

Supported by GOG

You can also create a single LXC for Docker and run multiple Docker containers on it. The VM argument is for security as it’s harder to escalate to the host from a VM than from an LXC.

If you do that, Docker is stuck on that host. If it’s in an LXC it can move to another host. Plus, backing up and snapshotting are easier IMO.

I’ve used Gnucash for investment accounting and market valuation. It’s got plenty of features for tracking personal investments.

GnuCash will do the sort of security trade accounting you’re talking about. I don’t know how GnuCash compares to the other offerings, but it can be fully offline and has a lot of features.

It’s extra protection, especially if you use non-browser apps on your devices it can limit tracking.

Be careful upgrading Docker versions, it has breaking changes.

https://registry.hub.docker.com/r/pihole/pihole/

find . -name “.DS_Store” -type d -exec rm -rf {} + -print