Anybody have any ideas for replacing the loss of Reddit's RSS feeds? I've probably been using the front page RSS feed for over a decade to get reddit posts. On my phone I like to check specific subreddits, but on my desktop I like to just have an unfiltered firehose of everything hitting /r/all. (http://www.reddit.com/.rss)

Is it possible to replicate that? I briefly did some looking. There's an open-source project called redlib - the main project seems nearly dead and while there are forks, nothing seems to be consistently functional these days.

I don’t care about discord servers. This is not for the public. I just want to use something that has good screen sharing (like discord’s), call support, and a chat.

Calling and chat options are the easy ones to find. I’ve been having trouble finding something for responsive screen sharing. Especially ones that works for group calls.

I will only be using this with people I know. As much as I hate discord I haven’t found a suitable replacement yet.

In summary, key criteria I want are:
- calling
- text messaging
- responsive screen sharing
- group calls

What have people been using for this?

If you have anything with SSH exposed that comes from Docker, alpine, or even generally you should double check you aren't vulnerable:

https://sshhole.com/

Disclosure first: I'm the founder of a technical due diligence tool that reads git histories, which is how this list came about. You don't need it for anything here, and there's no link to it.

Across the 1,577 public projects it has read, it flagged apps that report home by default. These 14 were each checked against the project's own code, and all were still on by default in the latest code on 5 November.

Three that look as if they belong here and don't:

• Syncthing asks before it sends usage reports. Crash reports are on by default (crashReportingEnabled).
• Notifuse's setup wizard shows the telemetry box, ticked, so you see the choice.
• ownCloud's sample config has telemetry.enabled true, but it says community servers without a licence key never send.

This isn't a complaint. Several describe what they send as anonymous, and I haven't judged what each one sends, only that it's on until you say otherwise. The list is what's in my library, not every app. If I've got one wrong, tell me and I'll fix it.

If you'd like analysis and might want to use my tool, DM me.

Heads up if you run Ubuntu or Debian servers. A new APT flaw was published on Nov 4, and how you install the fix matters.

CVE-2026-109518 is in APT's HTTP backend, so it affects apt, apt-get and aptitude. Ubuntu rates it High (CVSS 4.0 score 7.7). An attacker who can tamper with your HTTP traffic, or a malicious mirror, can get APT to install a package that failed signature verification. Package scripts run as root, so that means root on the box. It needs a retried download to work. Neither Ubuntu nor Debian says it is being exploited.

Ubuntu's recommended update turns retries off while you patch:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

If a full upgrade isn't possible right now:

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

To check your version:

apt list --installed '?source-package(^apt$)'

Fixed versions:

- Ubuntu 22.04: 2.4.15ubuntu0.1

- Ubuntu 24.04: 2.8.4ubuntu0.1

- Ubuntu 26.04: 3.2.1ubuntu0.1

- Debian trixie: 3.0.4 (the advisory only names trixie, so check the Debian tracker for other releases)

Other things Ubuntu notes: HTTPS protects against the on-path case, but some community and country mirrors don't support it. Unattended-upgrades applies the patch within 24 hours if you have it enabled.

Question for people running apt-cacher-ng or a local mirror: is the traffic between your clients and the cache plain HTTP, and are you changing anything because of this? Neither advisory covers that setup.

Sources:

- Ubuntu: https://ubuntu.com/blog/apt-vulnerability-fixes-available

- Debian DSA 6607-1: https://lists.debian.org/debian-security-announce/2026/msg00526.html

- Debian tracker: https://security-tracker.debian.org/tracker/apt

(Drafted with AI help. The facts are from the pages linked above.)

Immich Machine Learning (ghcr.io/immich-app/immich-machine-learning:v3) uses a library called ONNX Runtime, from Microsoft.

This library has telemetry enabled by default, and the Docker build of Immich Machine Learning does not disable it.

I found out about this because my DNS logs were showing thousands and thousands of blocked queries to resolve mobile.events.data.microsoft.com.

I don't think this is acceptable for something that is going to process all my photos, especially since it goes to Microsoft, even if it's anonymised or whatever. The whole point of self hosting is avoiding shit like this.

Mitigations:

Add the environment variable ORT_DISABLE_TELEMETRY=1 to the immich-machine-learning container.

Aditionally, it is good practice to isolate all containers that do not need internet access from the internet. For example, with Docker compose, you can create an isolated network for Immich:

networks: immich-iso: internal: true driver: bridge 

Then, on all immich containers:

networks: - immich-iso 

Be sure to add your reverse proxy to this network so that it can access the Immich server.

This was reported to the Immich issue tracker in August and they have not addressed it yet.

Found an old Asus prebuilt in a closet and wondering if it makes sense to use as a starter box or not.

Specs:

• CPU: Intel i5-3340S (4c/4t, 3rd gen, 65W TDP)
• RAM: 4GB DDR3
• GPU: GT 620 2GB
• Storage: 500GB HDD
• PSU: 300W OEM

Is this worth tinkering with, or is 3rd gen Intel idle power so bad that I’d spend more on electricity than just buying a cheap N100 mini PC? Scrap it or keep it?

Hey everyone,

I've been doing some research as to what it takes to move off iCloud as I want to gain some autonomy moving between different desktop and mobile devices. Consequently, this means I'll have to take my family with me for most things.

Some of the candidates I've identified:

1. Passwords -> Vaultwarden
   
2. Photos -> Immich
   
3. Drive -> Seafile
   
4. Calendar -> Davis
   
5. Notes -> Memos
   
6. Notes/groceries -> KitchenOwl
   
7. Hide My Email -> Addy/Proton

I really wanted Immich to be the first as it would cut my iCloud storage bill, but we rely heavily on some of the shared libraries features. I looked into the Noodle Gallery fork, but I'm not quite ready to take that risk yet. So I started with Vaultwarden instead. I documented it in a YouTube video and a written guide with all the commands.

Some of my learnings:

- Switching was really easy: On the iPhone, "Export Data to Another App" moved passwords, passkeys and 2FA codes into the Bitwarden app effortlessly. The awesome CXP protocol makes this all possible.

- Family support isn't that hard either: I turned off sign-ups, created a Family organization, and moved shared logins into the shared collection. An email relay/server is not necessary as they can register with the invited address directly.

- Backups: I made sure I had a proper backup system in place first. I use Proxmox Backup Server.

- Updates: I used the Alpine version of the PVE helper script with automatic updates that run weekly.

- Remote access: By far the most intensive thing to set up. Technically not required, but this allows updates to your vault outside of the house. I initially set it up to use Tailscale with split-horizon DNS. The trade-off is that you need to have Tailscale active on your phone. There are tons of alternatives for this and I'll be tweaking this going forward. Maybe a move to Netbird or open access with better firewall rules.

If you're in the process of moving off iCloud or Google: I'd love to hear about your experiences and which services were the hardest to get the family on board with.

Hi all,

I am currently working through a rebuild of my homelab and am re-evaluating how I access my stuff remotely. Local access is controlled via Caddy+Authelia, and I would like to keep Authelia for authentication at the very least. I had been using a mix of Cloudflare tunnels and twingate for remote access, but I would like to get that more centralized. Also, no port forwarding as I am behind CGNAT with no way to get a public IP (parent's internet at home and dorms at college). I do have a PAYG Oracle VM, 2c+12gb for hosting the coordination services.

Why even bother with a reverse proxy you may ask? Well, I would like to access some services on my iPhone, which already has a 24/7 VPN needed for another app. I would like to access services like Obsidian-Livesync, Cal/CardDAV (unless ios or gmail calendar uses something else), and potentially some other small web services. I will not be exposing any management tools, rest assured.

• Pangolin is from what I have heard the self-hosted replacement for Cloudflare tunnels, giving you a reverse proxy with solid access controls and object-based permissions. It also has a VPN now, which is really neat!
  • How are the speeds on this?
  • For the VPN client, would it be possible to make a small TUI script for the Linux CLI? My mother would be using the VPN and I want to make it simple for her to connect (yes, she will be using Mint).
  • I like the simplicity of the central server that everything goes through, I have also heard that the rules are easier to understand here?
• Netbird is effectively a WireGuard overlay network AFIAK, really nice for P2P connections. Network and device based rules, wireguard is fast and reliable, plus native GUI clients for all operating systems. Some people say that they are moving faster than Pangolin?
  • Mesh based VPN, having used this a little I can say that the access rules seem really complex to me, but maybe I just need to spend more time with them? Due to the mesh I will have to manage inter-device relations, Pangolin not so much.

Some other architectural questions:

• Do I point the reverse proxy endpoints directly at my Caddy instance, or should they point at the service itself? This would make two paths for authentication, Caddy for internal/local only, and Netbird/Pangolin for public/remote.
  • If I do split them, is there a good way to manage the permissions for both using IaC like ansible?

Looking for advice and feedback!

Hey everyone,

We’re a team of four currently developing an app and we’re looking into hosting options.

Since we’re still at an early stage, we don’t really know how many users we’ll have. Maybe 10–20 initially, then hopefully 100, 1,000 or more over time.

We’re looking for something affordable to start with that allows us to scale resources as the number of users and the workload increase. We understand that hosting costs will grow as well, and that’s completely fine.

Our current stack:

• Backend: Node.js, NestJS, TypeScript
• Database: MongoDB
• Redis + BullMQ
• Socket.IO
• SeaweedFS for file storage
• ClamAV
• Frontend: Flutter (Web and Mobile)
• Docker Compose

We’ve looked at providers like Hetzner and Netcup, but we’re still unsure what would make the most sense for our setup.

Would you start with everything on a single VPS or separate certain services from the beginning? Which hosting providers would you recommend, and how easy is it to scale later?

We’re comfortable with Linux and Docker, so managing a server ourselves wouldn’t be an issue.

I’d be interested to hear what server specs you’d recommend for the beginning and how hosting costs typically develop as usage grows.

Been self-hosting for a while and I keep seeing the same recommendations. I’m specifically looking for things that aren’t piracy-related or *arr-adjacent. No DRM removal needed. The reason I skip Audiobookshelf since used mostly with Libation or piracy. I’m not trying to fill the usual media automation niche

Here’s what I’m already running so you can skip the obvious ones:

• Homarr (dashboard)
• Open WebUI
• SearXNG (mostly wired up for AI search; I still prefer Brave for normal browsing)
• Dawarich (location history, big fan of this)
• Immich (photos)
• Nextcloud
• Uptime Kuma
• Hister (personal search index of pages and files)
• Speedtest Tracker
• Invidious
• qBittorrent (not for piracy, I just seed about 7 TB of AI models and I’m currently #5 on the pirateface.co leaderboard)
• Frigate
• WUD
• Grafana
• MeTube
• A custom Signal bot
• Forgejo (and workers or whatever it is called)
• Scrutiny
• A couple of fully custom things (I had Claude build and just put behind a zero-trust policy)

I bought a a lot of storage when I first got into this and still don’t really know what to put on most of it. 16TB HDD & 1 TB SSD & 4TB SSD.

Looking for the non-obvious stuff people find useful not monitoring tools.