Thank you!

I’ve found the Seedstudio thing after posting this too and it looks like the thing I’d be looking for!

What’s your experience w.r.t. coverage?
Obviously that highly depends on where exactly you are – you certainly aren’t going to have coverage in the outback – but I’m mostly concerned with places where people actually go and would take my bag/laptop/bicycle to. 'Stralia is going to generally be quite different from Germany too of course but it would be a good reference point from which I could extrapolate.

Well, they have – I think. When you download an edited image, it supposedly downloads an image with edits applied. The original is optionally available too.

If you download the edited image, this is effectively equivalent to the status quo of image editing.

Are there any (ideally waterproof) compact devices with long battery life (months~years)?

On the website I only found a long list of supported devices with brand name search and protocol type. grep showed no LoRaWAN devices though?

My use-case is theft tracking. I only need the device to be able to locate itself after a theft actually occurred and I request it remotely. (Perhaps also periodically with very low frequency.)

SearXNG is not a search engine, it’s a search engine proxy. The actual search engines that are being proxied are still the same old google, bing etc.

Disabling su is stupid because you always need some form of privilege escalation, restricting sudo to apt offers no security benefit whatsoever as apt allows arbitrary file modification, disabling root ssh provides no benefit when the unprivileged user has sudo access – I could go on.

Yikes, lot’s of bad advice in this thread.

My advice: Go develop an actual threat model and find and implement mitigations to the threats you’ve identified.

If you can’t do that, that’s totally okay; it’s a skill that takes a lot of time and effort to learn and is well-compensated in the industry.

You will need to pay for it. Either through an individual assessment by someone who knows what they’re doing, managed hosting services where the hoster is contractually liable and has implemented such measures, by risking becoming part of a botnet or by not hosting in a world-public manner.

My recommendations:

• Pay for proper managed hosting for every part of your system that you are not capable of securing yourself. This is a general rule that even experienced people follow by i.e. renting a VPS rather than exposing their own physical HW. There are multiple grades to this such as SaaS, PaaS and IaaS.
• Research, evalue and implement low-hanging fruit measures that massively reduce the attack surface. One such measure would be to not host in a manner that is accessible to the entire world and instead pay for managed authenticated access that is limited to select people (i.e. VPN such as Tailscale)
• git gud

Wow is that ever a load of snake oil.

I see this kind of guide as actively harmful because it creates a false sense of security.

(but-with 'nix (lots-of 'parenthesis))

And this is why you want atomic updates folks…