His complaint was it was different.

This is the absolute core of everyone’s reluctance… and 99% of (domestic) stuff is browser based…

That says that upgrades won’t enable it… the user can still enable it.

Yes, I feel your pain.

Encryption drives sound like a good idea until the subject of unlocking them comes up… and automatically unlocking the drive for the OS isn’t really helping.

But, for user data, it can be unlocked automatically during login. The Arch wiki covers this.

But backup your data 😉

It depends on your use-case.

Encryption of data at rest (this discussion) is mostly helpful for physical theft, so a device that never leaves the house, there’s little reason for encryption.

Similarly, on a lower powered mobile device, maybe you only want / need user data to be encrypted, and there’s no need to encrypt the OS, which keeps the performance up.

Maybe you want the whole thing encrypted on your high performance laptop.

So, it’s difficult to define a sane default for everyone, thus making it an option for the end user to decide on.

Linux has more choice than Windows - and the encryption algorithm(s) can be verified - so it’s definitely the better choice.

For which OS?

It can be enabled at any time on Windows & Linux. It’s just optional.

It’s dumb and inexcusable IMO

No, it’s a choice, because:

1. History… encryption didn’t exist in the beginning. Upgrades won’t enable it.

2. Recovery… try telling the people that didn’t backup the encryption key - outside of the encrypted vault - that their data’s gone.

3. Performance… not such an issue these days, but it does slow your system down (and then everyone complains)

So, please continue to encrypt your data as you choose and be less judgemental on others, esp. anyone new

No excuses.

Whatever you end up with

• test a restore
• consider how to deal with the source data being corrupted / ransomed / etc, ie multiple versions

I replaced Nextcloud with syncthing (files) & radicale (calendar, contacts & todos)

No-one used the calendar on NC, they just used their phones, Outlook, etc

No-one used the photo gallery on NC - that’s now Immich … again, with syncthing.

During the early days, just doing an update would break things.

For a small home setup, NC is too big, too clunky and just not the right tool.

Or… <using package manager of choice> install immich

Done.

No need to map internal & external ports, wrestle with permissions (or… good grief, run the container as root!), etc, etc.

It’s just… less faff.

Plus I save all that additional disk space, not having to install docker! 😉

Don’t get me wrong; Containers, chroot jails, Type-1 & Type-2 hypervisors all had their place in the history of my systems, I just don’t see it as a necessity.

The additional software required to run it in a container plus its configuration, on top of Immich’s configuration.

Just install & configure Immich, done.

If you’re using Arch, the AUR package works well

I’m fully aware of the joy of containers, but I just don’t want all that extra faff

I setup a media PC with an SSD for boot / OS and spinning rust for the videos, music, etc.

So, I thought LVM would be a good idea… put the whole lot into a logical pool and then carve out large parts for the media which could be adjusted in the future.

No.

Resizing actually just chops up the drives even more (so, partition fragmentation)

Gparted can’t see it, so adjustments are terrible CLI commands

And my favourite system backup tool (clonezilla) cant backup the OS without backing up the entire system.

Depends on your usecase… for a single user laptop, maybe… for a multiuser device or a server… nah.

I prefer partitioning away the user data for all usecases as that will fill up one day, and I don’t want that to down the machine.

Thanks for the links, I’ll take a look as I’ve never actually played with port knocking.

Is this for internal facing servers? Not much more than CIS and the usual Best Practices (no root for SSH, etc)

For a DMZ node, minimal software (ie Arch) and automated defenses like fail2ban, key authentication, etc…

Firewalls with Geo-IP blocking also help, but that’s not technically what you’re asking for.

Would you use that on internal LAN connections or only external internet facing connections? I’m not aware (not checked) if any firewalls support it… not sure why?

Agree.

Years ago, I was troubleshooting something (can’t remember what) on Ubuntu and realised the package had fixed the bug, but it wasn’t in the repos yet… like months behind.

Looked at Arch with it’s up to date repos, moved over and never looked back.

I’ve reported bugs since, watched the package get updated and seen the improvement on my system… now that’s what it should be like.

Critical Synology Vulnerability Let Attackers Remote Execute Arbitrary Code

Just build your own. It’s easy. Move on.

Ah, I see what you’re asking now.

I have a Hauppauge TV dual-tuner card for terrestrial TV.

Dual tuner so we can watch one thing whilst recording something else, or record 2 things at once.

Myth picks up the card and also uses that for the schedule guide, so we can just set up the scheduler with a TV series or some key-words and leave it to it.

We’ve not watched live TV for ages and it’s weird sitting through adverts now when we’re at friends / family

We also have GBs of films and music on the same machine, so it’s our central AV device. The Audio is sync’d off to other devices from here rather than having a 2nd NAS for it.

I had a 2nd MythTv frontend on another box in another room for a while and that worked well too.

Good god, is ActveX still alive?