I’m the Never Ending Pie Throwing Robot, aka NEPTR.
Linux enthusiast, programmer, and privacy advocate. I’m nearly done with an IT Security degree.
TL;DR I am a nerd.
If you are on Android, just know it has much weaker security because it is a webview browser with no per-site process isolation. WebView browsers are just reskinned weaker Chromium. Also, of your devices is no longer receiving updates, your webview (built in to the OS) may be very out of date, and Browsers are the most exploited platform.
If you are on iOS, it is just reskinned Safari (WebKit). If you are on desktop, it should be fine (just still chromium).
Idk how that relates to my comment at all. Yes that is true, part of the reason I’d never use a Samsung. UAD-ng can be used to debloat while keeping the stock OS.
It is worse than the Google Pixel by a lot. Samsung loves spyware (looking at you you preloaded Israel spyware for phones in the middle east), and you still have the Google spyware too (Samsung+Google OS vs just Google). Pixel is pretty clean (compared to other certified Android devices). I used Universal-Android-Debloater-NG on a fresh Pixel 10 and there wasnt much to debloat (without compromising functionality). Avoid phone carriers when buying a phone, more spyware.
My recommendations: Buy a Pixel 9 or 10 (unlocked not from a carrier) and flash GrapheneOS. Way better than stock.
The method by which they check if your browser is “out-of-date” is not always/usually a simple version check. They check for browser features such as JS, WebGL, WASM, etc.
Remote code execution is a concern. Your server and your network as a whole (including other VLANs) are susceptible to attack if Jellyfin is compromised. If Jellyfin is running on the host, it would be trivial to hack your server (and anything else running/connected to it). If Jellyfin is in a Docker/Podman containers, it doesnt prevent attacks against the host (sandbox escape, kernel privilege escalation, etc), or against your network over some ports. Even if the server is on it’s own VLAN, a vulnerability or weakness in your router could still lead to a compromise, meaning that any devices that is in any way connected to your router (including personal devices) could be attacked.
There is a lot of depth to this topic of course. And at some point you just calculate your risks and weigh your options. There is no such thing as perfect security of course.
Can you elaborate? Seems interesting.
China was doing that kinda thing in Hong Kong not that long ago. Killing protestors, disappearing people, attacking journalists and doctors. They just aren’t right now. They are srill that bad.
You you do choose to release it, do it on codeberg because GitHub is Microsoft owned and has an incentive to remove it.
QUIK SMS implements turning “blank liked message” into the proper format, but that still doesnt allow sending emoji reactions.
I was pretty sure that RCS id centralized and requires using the existing infrastructure, which requires some contract with Google or other providers.
Either way, no open source Messenger (that I know of) exists which supports RCS.
GrapheneOS. It gets updates and security patches quickly, it fully removes dependency on Google services (unlike any of the others you mentioned), and it is heavily deblobbed of proprietary blobs. It is rock solid. Here is a comparison table from a trusted third-party: https://eylenburg.github.io/android_comparison.htm
All of those apps will work, just install Sandboxed Google Play. Install company apps either in a Private Space or a separate user to isolate them. I recommend putting all Gapps (play store apps) in a Private Space.
That is why I said sending them. You can’t send reactions that people can also see without RCS. QUIK SMS converts received reactions into the proper format but still can’t send them.
Sending them requires the proprietary RCS protocol. Only google messages and a couple others can do it. Infrastructure for RCS is owned by Google, Apple, and some carriers IIRC
Note: iode is often a month or more behind on Android security patches.
QKSMS has been dead for years. QUIK SMS is a revival QKSMS: https://f-droid.org/packages/dev.octoshrimpy.quik.fdroid
Here is the link to UAD-ng: https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/
Vivaldi is also proprietary. Not a good privacy browser.
Having JS disabled is very rare for non-bot traffic, so you stand out far more. It isn’t about uniqueness, you are already unique if you aren’t using Tor/Mullvad browser(s). While disabling JS protects against certain kinds of fingerprinting, there is pure CSS and TCP fingerprinting. Firefox RFP (eg. Librewolf) and whatever Cromite or Brave have help to protect against much of JS fingerprinting. You are only ever going to fool naive scripts which these browsers already do a good job of that.
As for security, having JS disabled is a benefit. Just know since you will very likely have to enable to again quite often for random websites, you’ll become used to doing that to the point that it may as well be useless. If a random website doesn’t load just leave it, unless it is worthy of some actual trust. Even more useful would be setting up uBlock Origin with a blocking mode, such as medium or hard.
I still dont understand /e/OS. Just use LineageOS. It supports all the same devices and doesnt lag as far behind. You can choose to run an insecure OS if you like (see: all Windows 10 users) but definitely don’t recommend it to others.
You cannot have privacy without at least basic security. Targeted attacks are not the most common kind of attack by long shot. Threat actors scan for vulnerable devices and use automated scripts to execute attacks. Android is one of the most exploited targets. With an outdated OS your browser could be exploited and used to get a sandbox escape, possibly chaining it into root escalation. It all depends on the vulnerabilities found and the longer you wait the more likely for the “stars to align” for the perfect attack. Look at CVE-2025-48593 for an example, zero-click RCE. In recent memory there was also a zero-click RCE utilizing specially crafted MMS, meaning an threat actor could send messages to all phone numbers and try the attack in mass.
/e/OS is by far the most behind on updating security patch levels of the AOSP ROMs (at ~2 months), iode is ~1 and everything else is better than those two.
Privacy without security is not real privacy, it is a mirage.
Security without privacy is like a fortress with cameras inside, a known threat (eg. Gapps Android).
Privacy with security is like a fortess with no known threats at all (eg. AOSP with timely security patches).
Privacy without security is like a fortress where some of the locks have rusted through and if someone tries they can open the doors. It is like replacing the walls with cardboard. “No one can spy on me now” you say in your cardboard castle.
Proprietary OS. Idc if it is “Linux”. Android is Linux, and AOSP is open source. Why use a proprietary Linux distro over something like GrapheneOS which is fully free and open source software. I don’t think any person who cares about their privacy should use SailfishOS. It really seems like privacy-washing and OSS-washing. I say kick proprietary Linux distros out of the community.