Universal Blue and Wayblue offer most of the desktop environments available for Linux.

Yes, most DEs use X11. I dont think that is a good thing. XFCE will take a bit to implement Wayland (approx 2 years according to their update schedule).

Better for newbies because it is harder to break.

deleted by creator

XFCE will within the next 2 years.

Nah, I personally dont like its look, Ubuntu base, and slow update schedule. I think Bluefin or Aurora would be better starting distros.

Uses the heavily deprecated XOrg display manager. XOrg has no isolation of windows from each other, meaning any app can record your screen without notice. All XOrg apps can also log keyboard presses arbitrarily. Since all apps share the same display server, they can easy correlate keypresses (text) with what app it is entered in, kinda like Windows Recall. Cinnamon, Mate, and XFCE all use XOrg. Cinnamon still doesnt default to Wayland.

Notesnook has a desktop app. Does it not work with self hosted implementation?

Hmm, you have typed words that I do not vibe with.

You can shove anything in /tmp, it is (by default) read/writeable by all users/groups. Plenty of user apps create files/folders in tmp

Why?

WebCord supports it.

Self hosting has the advantage of keeping your encrypted vault local and under your control.

Self-boting is against ToS. You have to be careful when interacting with the Discord API. Maybe there is a way to run the discord website to fetch text messages.

Generally, I think it is better to use a general server OS like Debian or Fedora instead of something specialized like Proxmox or Unraid. That way you can always choose the way you want to use your server instead of being channeled into running it a specific way (especially if you ever change your mind).

That is not how security works. You must protect against known and unknown attack vectors. I am only pointing out weaknesses of Docker and other linux containers that share the kernel with the host or/and run with Root. I’m not saying anything original or crazy, just read up on the security of these technologies and their limits. I am not a malware designer, I am a security researcher.

Look into gVisor and Kata Containers for info on how to improve the security of containers.

Here are some readings for you:

https://redlib.tux.pizza/r/docker/comments/eakd50/help_can_i_safely_run_malware_inside_a_container/
https://www.csoonline.com/article/1303004/vulnerabilities-in-docker-other-container-engines-enable-host-os-access.html
https://www.panoptica.app/research/7-ways-to-escape-a-container
https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
https://www.securityweek.com/leaky-vessels-container-escape-vulnerabilities-impact-docker-others/
https://www.cybereason.com/blog/container-escape-all-you-need-is-cap-capabilities

It is not speculation, it is reducing attack surface. Security is preemptive. Docker/Podman are not strong isolation solutions. Rare does not mean we shouldn’t protect against the chance of kernel vulnerabilities. The linux kernel around 30 million lines of code long and written in a memory unsafe language. Code isn’t safe just because we dont know the vulnerabilities, this is basic cybersec reasoning.

Docker/Podman and LXC linux containers share the same kernel with the host machine. Root in the container is root period (in the case of rootfull containers). Even without root, much of the data on your machine is readable from any user. With a exploit to escape the container (which are common) the malicious program has root on the machine. This is a known attack vector against linux containers. VMs are much better for isolating untrusted software from the host OS.

Idk how to decide what is safe or not, but as a warning, Docker containers can escape trivially and have access to the kernel.

And install it as a PWA (it might just be a shortcut idk) on Android