Decryption is not related to root permission.

If the ENCRYPTED drive is mounted to the container, then the container can decrypt it.

If the DECRYPTED drive is mounted to the container, then the container never knows it was encrypted in the first place.

Second case is easier BTW. Just mount the drive on your host, type in the encryption password and you get a new, unencrypted drive. Specify this new drive in your docker compose/docker file.

Generally, Linux Servers are best administered from a command line. At least in the beginning to set everything up. In turn they are faster on lower hardware as they dont even have a graphical desktop at all so need less resources. You could of course install a windows server OS. They can be fully administered through Remote Desktop and a GUI.

There are multiple projects to make self hosting more accessible (like casaOS). They automate many steps of the setup and then offer you a webUI for further steps. Maybe have a look here https://github.com/awesome-selfhosted/awesome-selfhosted?tab=readme-ov-file#self-hosting-solutions

There is a big difference between “not keeping logs” and “dont have a way to check what you are doing right now”.

No logs just means they can’t check what you did last week but they can always check the traffic you are producing in that moment. If they see traffic from a torrent protocol they know you are torrenting.

Edit: they do claim they do “No Monitoring” so yeah by their own words they should not be able to tell you are torrenting.

No Monitoring

We don’t monitor your activity and have no way of seeing what sites you are visiting. We do store when you last used Windscribe as well as the total amount of data used in a 30 day period (to enforce free account limitations and to prevent abuse).

Off topic, but how do you do that on Lemmy? In jerboa there is no option (that I know off) to browse another instance. Do you open your home instance in one browser tab and the one you want to explore in another and once you find a community you like you switch to the other tab and subscribe to it there?

If your messager can’t be used on a computer I feel sorry for you. Signal, Whatsapp, Telegram all have windows or browser clients

Yeah. For me the video stops when I lock the screen (or change apps) but I can then press play again on the lock screen (or in the drop down notifications when changed to another app).

Watching a YouTube video and downloading a YouTube video are the same thing. They are indistinguishable. You can not watch the video without downloading it. Just normally you dont keep the file but each part of the video is discarded a few seconds after you watched it. I dont think YouTube ever went after users who watched pirated content, they only ban the channels that upload it.

Your ISP or law enforcement only see you are watching YouTube. They dont know which video and they dont know if you save it or not.

AMD is no problem. Only nvidea (of the big mainstream hardware manufacturers) does not supply Linux drivers.

In fact AMD will most likely make it easier than Intel if something doesn’t work. Intel pretty mutch only thinks about Winows, so if there are driver problems, there are only windows drivers to download on their website (but there shouldn’t be an problems in the first place anyway)

It becomes a whole different thing when you yourself are a creator of any kind. Sure you can retorrent TBs of movies. But you can’t retake that video from 3 years ago. I have about 2 TB of photos I took. I classify that as media.

Perfect, let’s also bind the certificate to a user session that is derived from a user fingerprint. That way the CA can track users across all sites

So how do you use your phone? Every time you type something you use a keyboard app. It might just be the one that was shipped with android (Samsung keyboard, gboard, etc)

An open pit at an elevation of 1.5km still means the bottom of the pit could be 1km higher than the place the ore is processed at

Depends on the scale of “going down”. Many mines are in the mountains and the material has to be brought down to lower elevations. The mine entry may be lower than the nearest pass but still a lot higher than the destination of the ore.

Yeah he came in with an agenda (block all legislation that could hurt his luxury car daddies). And he achieved all if that. Now his job is done and he gets to retire early.

That is stupid from both of them.

Dont tell your boss you dont expect to be there long.

Dont expect your workers to want to be there long unless you offer good options to advance and educate themselves. Especially for a help desk job… that’s very often an entry job to get a foot into the IT door.

That is the “low tech”; works 100% of the time; will make your live easier in the future solution.

It takes longer than remounting but getting rid of a NTFS drive in a Linux only environment is a good move.

Client isolation doesn’t help. That is just the access point not routing traffic between connected devices. The problem with WiFi is it is a radio signal. Everybody in range can receive 100% of all communication on that network. Just by being in range the attacker can do passive sniffing. No wiretap needed like with cabled networks.

WiFi is encryoed if it uses a password. So any public WiFi without a password can be sniffed by literally every device in range (no need to connect to the WiFi for sniffing). On public WiFi with a password, the radio signal is encrypted but everybody knows the encryption key. So everybody connected to the WiFi can still sniff the traffic of everybody else.

That encryption is only on the WiFi level, so encrypted radio signals, not on the actually traffic level (like TLS/HTTPS etc).

.LAN is not an official top level domain. So I assume this is either your home network or work network? In any case your problem has nothing to do with the .LAN doman.

Maybe you have “https everywhere” activated. If so, Firefox will always default to https unless you specify http in the URL. Again, unrelated to .LAN.

For the certificate: what do you mean “when available”? A self signed cert is a self signed cert. There is no “available” or not. You can import the certificate into the Firefox trust store so Firefox will trust that one specific cert but any other self signed cert will cause an error. That is expected and save behaviour (and unrelated to .LAN).

No, why would it? It will run code in the context of the current user which is absolutely enough to start a new process that will run in the background, download more code from a attacker server and allow remote access. The attacker will only have as much permissions as the user executing the code but that is enough to steal their files, run a keyloggers, steal their sessions for other websites etc.

They can try to escalate to the admin user, but when targeting private victims, all the data that is worth stealing is available to the user and does not require admin privs.