Presuming BASH:
https://www.gnu.org/software/bash/manual/bash.html#Quoting
Single quotes are much safer/predictable because:
Enclosing characters in single quotes (‘
'’) preserves the literal value of each character within the quotes. A single quote may not occur between single quotes, even when preceded by a backslash.
Not to say they are always tye right coice though.
I think the desktops need to better protect users’ secrets by accepting rogue user processes are part of the threat model now. There are lots of mechanism to lock known future user processes into a protected area (containers, chroot, etc), but none to lock existing and future unknown user processes out of a protected area.
Your idea of a yubikey access protected file area makes a lot of sense and I don’t think it exists yet. Then a user could throw their existing ssh keys in there and immediately get physical protection on them.
It would need to be carefully controlled. Something like gocryptfs on FUSE as you suggest but with a stronger threat model layered on top as theirs is short: https://nuetzlich.net/gocryptfs/threat_model/
Thanks to these attacks I think creds got to all move to physical security keys so there’s nothing to (digitally) steal any more.This tool is a good idea for the short term.
I’m not familiar with Pikapods but Monica v4 has trouble with notifications. First you need to ensure it’s been configured right to even send a test email, this can be triggered with a command if you have access:
php artisan monica:test-email
Various Monica environment variables must be set to configure this, it should be in the docs somewhere if not I can fish my config out for you.
Even once that’s working you’ll need Monica to run its regular jobs for sending notifications, there’s config for that too. Finally the code has bugs and will often miss reminders in my experience. There are some open bugs still on this and I guess the devs have moved onto their rewritten version (chandler):
We’re also making it possible to add alt text for profile pictures and headers now, making your profile more accessible for blind and visually impaired users.
That’s good!
According to the research team, this unique formation directly influences the movement of Antarctica’s massive sheet of ice. The network of hidden geological features determines where the glaciers overlaying it will flow, which makes studying it crucial for predicting how climate change will change the southern ice cap.
Interesting
F-droid themselves gave an update in April:
https://f-droid.org/en/2026/04/03/twif.html
If you’ve been holding off updating Syncthing-Fork we have two pieces of news for you. First, the original dev continues to collaborate still, we know this was a pain point back then. Second, we’ve just added BasicSync, A simple app for running Syncthing, which just controls Syncthing’s running behaviour as hands off as possible, while the original service hums in the background.
So it seems since the handover things have settled but there is also a new fork which takes a more bare-bones approach.
The new/alternative secret provider is interesting:
https://github.com/bilelmoussaoui/oo7?tab=readme-ov-file
I would like to be asked when processes access my secrets, or maybe it will be possible to set perms on the portal in future.
Looks like this long-standing issue affecting all flatpaks run under MATE/marco:
https://github.com/mate-desktop/marco/issues/301
Applications launched under Firejail and Flatpak include “(as superuser)” in their window’s title even though they’re not actually being ran as root.
This is new:
https://github.com/dkorecko/PatchPanda
Self-hostable Docker Compose stack update manager.
And
when you choose to update, PatchPanda edits compose/.env files and runs
docker compose pullanddocker compose up -dfor the target stack. You can also view live log.
Discovered in the latest Self Host Weekly:
https://selfh.st/weekly/2025-11-28/
I have not tried it myself tho.
You’ve made a great start. How much further you go depends on your needs and threat model.
Rsync is ok as a start but there are dedicated backup tools that will give you access to your files at any point in time. This is important if you delete a file and later need it back after an rsync has already run and deleted it remotely too.
Rsync will not encrypt your backups. If a burglar takes your Pi will they have easy access to all your files too?
With rsync+ssh you are also vulnerable to either yourself (more likely) or a rogue process on your own machine deleting the files over ssh (e.g. ransomware attack).
The answer to that is append-only backups. A backup tool like restic has a backend you can host that does exactly this:
https://github.com/restic/rest-server
Take a look at restic to see what else you gain from switching to a dedicated tool versus rsync:
https://github.com/restic/restic#design-principles
There are others too such as borg.