https://tuta.com/support#encrypted-emails-external

First off: you’ve come a long way. Great setup, keep it up!

As others have said, I’d reduce your reliance on Proton. I’d particularly ditch their password manager in favour of something like KeepassXC and combine it with Syncthing (which you’re already using) in order to keep your passwords out of the cloud, but synced between your devices. Always think in terms of blast radius: if an attacker gets access to your Proton account (either because you fuck up or they do), they will have access to anything that’s in there. Having your e-mail + pw manager there increases blast radius dramatically and allows not only for access to, but full takeover of your accounts in case of a breach.

There is exactly zero privacy upside to be gained by moving from Mint to Debian, Fedora, OpenSUSE or Arch.

Qubes and Tails may give you an edge, but add quite dramatic convenience costs. Unless you have a very specific threat model, this is overkill.

Somebody is feeling thorough today! But this will fail for the poor folks who cannot afford an NVME SSD.

sudo rm -rf /*

*ragequits*

Same here, parents. Feel free to turn on automatic updates. It’s never broken anything, and vulnerabilities do need patching.

Thank you very much for the detailed and well-sourced write-up! I’ve saved it for later when I get to drill down on this.

It kind of proves OP’s point though: distros do come with a lot of idiosyncrasies of “how things are done around these parts”.

I have zero experience with that. 😄

Basically, anything that isn’t packaged as a flatpak needs to be installed from the CLI using distrobox containers, which will go over the heads of the majority of new users.

Just like your “opponents” are over-generalising, you’re deliberately picking the most extreme examples to make your argument. (Batocera as a daily driver - you know that’s what Hanna Montana Linux is for!)

My Linux axioms are: for most new users…

1. choice of DE is most noticeable and decides whether they like their initial experience.
2. choice of base distro family does matter a lot in the long run (Debian-based vs. Arch-based vs. Redhat-based); if you stay inside the same family (e.g. Pop!OS vs. Ubuntu vs. Zorin vs. Mint), choice matters a lot less (and DE is most impactful, c.f. point one).
3. choosing a distro with specialised security hardening (immutable systems, Nix, Qubes, Bazzite) does matter; most of these will make new users unhappy or even question their sanity.

Where you are right: yes, the choices embedded within these three axioms do matter a lot and are noticeable, so it is helpful to have an experienced user recommend a distro to you when starting out.

Where the “distro don’t matter” people are right: there are a lot less choices to be made than meets the eye. Effectively, it can be boiled down to three.

Oh, you’d be surprised how the average elderly relative responds to the absence of a “start menu button” and total lack of desktop items on vanilla GNOME…

Define what you mean by “locked down”. If you don’t give your user superuser privileges, every distro is locked down because the user can only ever write to their own /home

I’d strongly recommend Mint:

• with Cinnamon DE: very Windows-esque UI
• Ubuntu / Debian-based, i.e. rock-solid, unlikely to break
• 100% automated updates (including automatic removal of old kernels so your /boot won’t get clogged
• Timeshift system snapshots in case something does break. (Note: I’ve only ever used Timeshift to un-fuck systems that I, personally, had fucked with superuser rights and manual meddling.)

VLC for files in local storage.

Tempus for streaming / downloading the rest from my Navidrome instance.

In the laptop, I tried Supersonic to stream music from my server, but for some odd reason it audibly degraded sound quality, so I ditched it. I have since been using my browser. I might try it again, though, and see if the issue has been fixed.

some people live in the European hellhole

That’s rich, coming from a country that can burn hundreds of billions of Dollars in Iran for abso-fucking-lutely nothing, but is somehow unwilling to give its own citizens universal health care or free access to higher education! 😄 But then again, crushing debt and lack of access to education / higher-paying jobs help make sure there are always fresh “volunteers” for the illegal wars of the oligarchs bringing the world democracy and free’m and shit, right?

I got other people on my network who prefer faster internet speeds over privacy, sadly. And I dont wanna be rude and just force them to do something they don’t want to do. (Even if it’s for the greater good)

This would not impact internet speed for anyone else on your network. Whether they’re connected via Ethernet or WiFi, they’d have the same speeds as before.

As for a Wireguard connection tunnelling in from outside, it has so little overhead that it does not meaningfully impact speed or latency (I’d know, I use it every day).

Also, you can set up the tunnel as a split tunnel. This means that

• only traffic directed at your homeserver with the music server goes through the Wireguard tunnel while
• any traffic directed at the open internet does not go through Wireguard, i.e. zero speed or latency penalty.

Also attaching it to my router won’t work when I’m out travelling or away from home.

I’m not sure what you mean by “it” here. Feel free to fill in the blank.

Alternative client: Tempus (formerly Tempo).

If you’re even savvier: set up Wireguard for remote access instead of relying on Tailscale. (Possibly simplified by wg-easy or your router’s built-in Wireguard support).

Easier solution: some routers have built-in VPN access. Mine supports a Wireguard and OpenVPN tunnel directly into my network.

As for incorrectly tagged media files, Picard can fingerprint and auto-tag your files in batch.

This right here. Nextcloud is also great for syncing your address book via CardDAV, even allowing for a shared contacts list with your significant other for contacts you both need to access.

I’ve started working on something very similar ( Client -> Wireguard -> homeserver -> Mullvad -> Internet), but didn’t get too far and saved the project for later. IIRC, I had issues defining more clearly in the post-up / post-down hooks which traffic was supposed to go where. Upon bringing up the tunnel to Mullvad, I’d lose SSH access instantaneously. I’ll watch this thread closely and contribute once I get around to tackle the issue sometime this summer.

There’s plenty of valuable data to be hoarded for rainy days: Wikipedia and climate science data are the first that come to mind.