I'm asking "I" in the sense that I'd personally like an answer to this question, but really this is more about using VPNs in general.

Currently, I just use the server with the lowest latency because that gives me the least friction.

However, thinking about the GDPR in the EU, or California's data privacy protections: should I be strategically choosing a server based on those? Is there any benefit to having my traffic routed through a jurisdiction like that, or does that not really matter?

EDIT: To further clarify: will all the different websites out there log less data or treat my data differently if they believe my traffic is coming from the EU/California?

Hi folks. I'm in way over my head with an AWS problem. Mainly because I don't understand how to use AWS at all, but in 2013 I used a tool called FastGlacier to backup my data (including baby picture and videos) to Amazon Glacier. I also had them on a local drive and a HDD I gave to a friend. Alas, my drive failed a few years ago, and he lost the other in a move.

Anyway, I'm not a coder, and AWS baffles me. I'd like to retrieve these data but don't know where to start. Would anybody well versed in AWS be willing to walk me through the process? The AWS guidance is over my head.

Many thanks in advance.

Just got this email from Framework:

Dear Valued Framework Customer,

We are writing to inform you of a data breach at our business intelligence database provider Metabase that resulted in an attacker accessing customer names, email addresses, phone numbers, and addresses. Your information was in the database that was accessed in this breach. This breach did not include order or payment information.

We have full details on the incident below. We are deeply sorry for this breach of information, and are reviewing and improving our methodology for data storage in external database vendors.

We are also in the process of notifying the regulatory authorities in each region where relevant regulations exist. Note that while regulations in most regions do not require notification for breaches of names, email addresses, phone numbers, and addresses, we are sending this email to you regardless to ensure you have visibility and can take any actions needed.

What happened?

On August 6th, 2026 at 9am Pacific Time, Metabase notified us of a breach of their systems with the following email message:

On Monday, August 3, we discovered that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.

Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:

Rotate the credentials for every database connected to your instance; and

Review the admin accounts on your instance and remove anything you don't recognize.

We also discovered that the attacker was able to gain access to your instance. We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at [removed url].

(If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)

This report is based on our own application logs. We did not query or read the data in your connected databases.

Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.

We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at [removed email address], and we'll get back to you as quickly as we can.

Sameer Al-Sakran

Founder and CEO

Metabase

We immediately investigated the logs Metabase provided to us and confirmed that our database instance was accessed by the attacker. We confirmed that the following information was accessed:

• Full name
• Email address
• Login IPs
• Billing and shipping address information
  • Country
  • Address
  • City
  • State
  • Zip code
  • Phone number
  • Company

For Framework for Business customers, we are investigating whether the following information may additionally have been accessed:

• Company
• Phone
• VAT
• EIN
• Billing Email
• No other personally identifiable information, order information, or payment information was accessed.

Note that Metabase has additionally flagged:

Important: This is a preliminary update based on our current knowledge.

We are working with a third-party forensic investigation firm to understand the full nature and scope of the event.

We are providing you this interim update in advance of completing our investigation to allow you to better understand any potential impact and secure your data.

Our investigation is ongoing and the information shared now is preliminary.

Please look at the application logs as well as the queries executed that are provided as separate files in the zip file for detailed activity and a potential timeline.

We’re providing you notice of the breach in the meantime to ensure you have the earliest possible visibility. In the event Metabase notifies us of additional information that impacts you, we will send a follow-up email.

What was done to resolve the issue?

After we were notified of the breach by Metabase, we rotated credentials on all databases associated with our Metabase instance and confirmed that there were no changes in admin access or access to systems outside of Metabase.

What steps have you taken to ensure this doesn’t happen in the future?

We are evaluating the breadth and depth of data shared with business intelligence platforms, and scoping down their access to only the columns required for analysis.

Nirav Patel and the Framework Team

A few days ago, I posted this and quickly realized that the world of data backups is far richer than just sudo rsync -av --delete --exclude=Videos /home /home_bkup.

So now I'm window shopping the top Linux-supported backup solutions: borg, duplicacy, kopia, restic and--oh look--a core borg dev just dropped his own new-and-improved solution, vykar.

Restic was the first tool I started to research, and I thought I really liked it, got as far as installing, initializing a test repo, creating a couple of snapshots. But restic seems to be, hmm, fussy about the source and destination paths, absolute vs relative paths, etc.

The fact that merely renaming a parent directory (or grandparent, or great-grandparent, etc) causes restic to treat every unchanged byte below that as brand new ... that's a recipe for giant, bloated repos, and it's unacceptable to me ... and hey, lookit that, borg does not do that. So now, restic is out and borg is in.

But what other pros v cons are there, that I haven't even realized need to be considered? What advantages/disadvantages do other apps offer? Which ones can I easily automate with nightly/hourly cron jobs? Which ones have their own even-better automated solutions?

Do I even want encryption? All of my drives/volumes are LUKS encrypted, and anything I would store remotely would also get encrypted before it ever left my LAN ... plus, I'm just a bit nervous about having the backups encrypted, requiring working, functional software to restore/recover data from them....

That may not seem like such a big concern, perhaps, but I am currently working my way thru decrypting a bunch of 10-15 year old TrueCrypt-ed volumes, which requires using an old, outdated version of VeraCrypt and a somewhat "cross-my-fingers" effort to find KeePass repos old enough (also outdated, KeePass 1.0 repos) to still contain the various passwords I used to encrypt those ancient volumes ... but also still use new enough master passwords that I can still get the KeePass repos unlocked.

With rsync, I can literally just go into any backup, find the specific version of the specific file(s) I want to recover, and manually copy it back to my workspace. Is anything like that option available in any of these deduplicated/encrypted solutions, even if they're not encrypted? If (eg) a borg repo is created w/o encryption, the data is still all just borg-specific blobs, right? Or can I navigate into the repo and just manually grab files?

Oh yeah ... for reference, the past 10-ish years, my backup routine has been to create a new, dated, destination folder, starting with a full backup of my /home folder (excluding things like Videos, Music, VMs, other bulky stuff that gets backed up separately/differently), and then running nightly diff backups into the same folder, while also maintaining a "one-day-older" second backup of the whole thing on a 2nd HDD ... then, every 3-6 months, zipping up the current backup folder and starting a new one.

At any rate, there you go; that's the kind of stuff I'm thinking about now, as I overhaul my 20-year-old, 20TB (but could be 2TB) backup system.

Any and all feedback, recommendations, tips are welcome. Danke.

With all of the identity verification laws in the pipeline, data breaches, and government overreach (mandated monitoring in new cars in the US), what steps can the average person take to secure their anonymity and data and device privacy?

I’m a tech-savvy person but nowhere near the level of a great many. It seems like in the face of overwhelming odds, making small changes is only a drop in the bucket. I have all the data encryption settings enabled on my phone, but I use services like Dropbox and rely on it heavily. I’ve always thought that if the product is free, you’re the product…but I pay for Dropbox, so they shouldn’t use my data for training AI (but they likely are). Setting up a personal cloud seems like a daunting task, as is getting involved in any of the small projects that people have going (decentralized networks, mesh…things, P2P, etc). I’ve focused more on securing my home networks recently so my Ubiquiti devices are restricted in what they can access, but I haven’t actually pen-tested my network yet. I have PopOS! installed on my home desktop because I got tired of Windows’ invasive…everything, but ultimately I don’t know what I’m doing.

There’s probably a great many people out there that feel like it’s hopeless to try to do anything because it won’t matter as there’s such a heavy push to invade, restrict, and monetize our digital lives. What can the average person do to take control of our devices and data?

Increasingly I'm looking at my backup solution and I'm not totally happy. My "threat model" I guess is if the house burns down and we only make it out with the shirts on our backs. Alternatively if I get hit by a bus I'd like a backup of passwords and maybe some instructions for my wife.

TL;DR What are decent medium term cold storage options for < 1gb that I can be really sure will be good for several years (maybe 10 or 20 years at the extreme end) and is fairly cheap. I was thinking optical media but I'm kind of lost as to what specifically to get and how to not get conned by buying fake media (m discs). I (somewhat randomly) have an m disc drive in my computer but I don't know if thats overkill or not? My important stuff may even fit on a CD actually...

I figure the title is good enough, but, I just want to upload/make a spreadsheet in an .ods format so others can view it. Not edit it, not have to sign in to view, but still has sorting options or whatnot. And in the .ods format.

I'm seeing a few options online, but it seems more that they offer viewing but not sorting (which is a huge aspect of spreadsheets), or no importing, or doesn't support .ods.

So I can keep searching and I'm sure something is out there, but does anyone already use a site for these requests?

If you have a flash drive, SSD drive (including NVMe drives), (micro)SD card, or some other popular flash memory media die on you, you might be able to get a free replacement, depending on the manufacturer and the product.

I recently RMA'd a SanDisk microsd card that died unexpectedly. When I looked up their warranty, SanDisk has a lifetime warranty on most of their flash memory products. They even provided a return shipping label. Since they no longer make the card that died, they're sending an upgraded, currently available model.

I've also RMA'd two Kingston NVMe drives. Both of them were getting a bit old, but the RMA was accepted, and in these instances I also received the newer version of the product. I did have to pay for return shipping myself, but it was well worth it.

So if you're about to toss that broken flash media in the trash, double check to see if a warranty applies. It's worth the time and potential shipping cost/hassles in many cases.

TLDR/Warning: this might be a tedious read. But I'm curious if I could have gone about rating my albums better.

I tend to simply either favourite an album or not. The idea of giving albums and tracks marks out of five stars seems tedious, difficult to match to how I feel and just doesn't match how my head works. But my collection has grown over the decades and I've been bed bound a lot lately, so I'm trying to organise/categorise based on my feelings towards the albums rather than genre. I'm also hoping to rejuvenate my old interest in music (playing in a band and recording for a living took the shine off of casual listening for me). I thought it would be an interesting experiment to try out, so I rated songs from over 50 albums.

I came up with a rigid and hopefully balanced definition for each rating:

• 1 star - Dislike. I hope I never hear this song again (but I'll keep it purely because it's part of the album)
• 2 stars - Neutral. It doesn't annoy me, but it's too generic to be interesting
• 3 stars - Sometimes this song hits the spot.
• 4 stars - This song usually hits the spot.
• 5 stars - This song always hits the spot.

Then I rate the album out of five stars based on the average of the song ratings. The result is that no albums got 5 stars, a seven got 4 stars, the vast majority of albums are rated at 3 or 2 stars. Even among the 3-star albums, some I like much more than others depending on whether they contain mostly consistent 3-star songs or half 4-star songs and half 2-star songs.

I wonder if the lack of 5-star albums is because of the definitions I gave each of the 1-5-star possibilities. For example, I don't know if any song "always hits the spot". Or maybe it's just that I'm not as into my music as I used to be.

Anyway, I thought maybe people interested in music and data might have thoughts on going about this differently. It's worth asking before I do the next 1,000 albums :) Maybe you'd define each of the 5 stars differently. Any takers?

Edit: thanks to everyone for reading all this and commenting their thoughts. I have a system I'm happy with now, but always happy to continue to chat with fellow (and reluctant) pedants about this.