Generally agreed, I would actually try using as many services with their progressive web apps.

The main reason I think they may need google services is the banking app. Mine will refuse to launch without google services installed.

You sound like the ideal candidate for a refurbished Pixel 7 / 8 from amazon.

Test its hardware thoroughly on the stock os in case you need to return it.

Install GrapheneOS using the Web installer.

Install Droid-ify into your main profile from the f-droid web page. It looks much better than the official f-droid client and actually has a working auto-update

Create a work profile. I use an app called Shelter as the work profile admin app. This allows you to auto freeze your big-tech apps to help with battery life / privacy. Install google services from the built-in GrapheneOS app store.

Enjoy.

I’ve been using Linode (now owned by Akamai) for a couple years now and have enjoyed their pricing / service.

You are correct, a VPN connection does not bridge to another profile. You can install a VPN in said work profile. The always-on VPN settings in grapheneos have the work icon to indicate what VPN is in your work profile.

Try Organic Maps.

It’s not as fully featured as OSMAnd but my goodness is it faster.

That’s most likely the problem. In my experience, nearly all tor exit nodes are flagged as such and captchas are nearly impossible to “pass” when using such an exit node. I would try using a free VPN to test. Try protonvpn without an account and see if you can get past the captcha.

Are you using a VPN? It might be that changing your exit IP might help. I’ve noticed captchas get harder to pass if your on a VPN that has a lot of traffic trying to pass captchas. Probably DDoS protection.

IKR?? I feel personally targeted by this… And I’m OK with it.

Thanks! Flatpak-KCM is perfect as I’m thinking I’ll move to fedora KDE in a couple days when f40 drops. I’m hoping that the Wayland experience on NVIDIA GPUs will be smoother there than on GNOME.

To add on to this, if you are using flatpak apps and want granular permission control, check out flatseal. Fedora (IMO) has one of the best flatpak integrations out of the box. Other “sandboxing” or containerized app deployments are snaps (made by Canonical), and appimage (I’m not entirely sure this qualifies as an app container).

From my experience, flatpaks is currently leading in adoption when compared to the other two.

I’m not entirely sure tbh. Like I said, mixed results depending on the app, but my working throey is that the session installer can automatically install apps that have the same signature and don’t require any changes in permissions. I’ve seen some apps do in-place upgrades with no user touch but some don’t.

I’ve had better success with auto-update using Driod-ify. At the very least the client downloads the updates automatically so it’s just a matter of tapping install.

^^ Source: trust me bro

Probably 50? 100? At some point you cant keep track. Still so much mapping to be done…

I stand corrected, its been quite a few years since I needed to use the ADB backup so I guess back then it was more complete.

Found a good detailed explanation here.

Shame that it seems to be getting phased out for cloud backup solutions. Makes sense that google would want to control more of your data and make you pay for it.

As installing a custom ROM typically involves using ADB anyways, I would suggest that you back up your device normally (copy files over to a folder on your computer), and then use the built-in backup function in ADB to make a secondary complete backup.

Also, depending on your threat model, you might not want to move any files from your old installation to your new one. Its possible that the old files, applications, and linked accounts could compromise your new installation privacy / security. I also generally enjoy starting with a clean slate after a new OS install.

@tymon@lemm.ee is the audio supposed to be mixed in Stereo or Mono? I see that there is a Stereo track but both tracks are identical (no Stereo separation). Thanks for making this! This fixes the one main complaint that I had with the series!

CGNAT = Carrier Grade Network Address Translation. It makes it practically impossible to open ports to the public internet and in some extreme instances make zerotier very unstable. Typically you only have CGNAT if your internet connection is 4G or fixed wireless.

OpenVPN is just a VPN protocol. Roughly comparable to wireguard. It has been the gold standard for VPN technology for the past decade or so. Wireguard by comparison is much newer, and lighter to run. This typically results in faster throughput from a computational standpoint and devices where power is limited (cell phones), uses much less power by leveraging modern CPU encryption methods.

If you have the option to port forward on your home internet connection, its possible to setup a VPN connecting in a straight shot from your home to your roaming device. If you can’t port forward, you will need a main in the middle (the VPS) to establish and route the connections through.

Zerotier works off of a PTP style network and the free plan allows up to 50 devices when last I checked. I’m not sure on the availability of zerotier or wireguard on truenas as the last time I used TrueNAS was Scale 22.

My recommendation would be some kind of VPN. If your looking for something plug and play and free, look into zerotier.

If your home internet connection sits behind CGNAT, like me, just buy a cheap vps and set up your own wireguard network.

Both solutions avoid exposing your services directly to the public internet which reduces attack vectors and adds an extra layer of encryption.

If my understanding of how “force SSL” works for most proxies, it just simply issues a HTTP 300 redirect message for all http traffic coming in on port 80. It then sends everything to port 443 https.

Do you get a 502 when you try to connect with the force SSL turned off? It might me less of an issue with SSL and more that your proxy is not pointing to the right host / port of your nextcloud server.