Something like https://graphite.com/ to create stacked PRs that are reviewable probably would have helped. Can be replicated with local LLMs or remote AI providers with locally configured agentic workflows. Never used graphite personally, but I’ve seen some open source maintainers use it to split up large PRs.
Firefox Nightly + arkenfox userjs + uBlock Origin + Bitwarden as my daily driver.
Been a couple years since I checked up on arkenfox still being good. I get flagged as a bot all the time and constantly get popups about WebGL (GPU fingerprinting) so I assume its working as intended for my threat model.
Tails when I really care.
Mullvad VPN as my regular VPN with ProtonVPN for torrents.
GrapheneOS / NixOS as my OS.
Proton Visionary for most cloud services except passwords and I don’t really use Proton Drive. I do use ProtonPass for unique emails to every provider.
Kagi for searches / AI.
Etesync for contacts because Proton didn’t sync with the OS last I checked.
Backblaze B2 for cloud storage with my own encryption via rclone (Round Sync on GrapheneOS)
Keypass for a few things like my XMR wallets and master passwords I don’t even trust in Bitwarden.
https://jmp.chat/ for my mobile provider.
Pihole with encrypted DNS to Quad9.
https://onlykey.io/ for the second half of my sensitive passwords (Bitwarden, LUKS, Keypass, OS login). First half memorized.
Its a lot. I burned myself out a couple years ago keeping up with optimizing privacy and this setup has served me well for 2 years without really changing anything. The cloud services are grey areas in terms of privacy but the few ads that leak through uBlock have zero relevance to anything about me.
NixOS. Started with Yellow Dog Linux in 1998.
I don’t do everything through nix’s derivation system.
Many of my configs are just an outOfStoreSymlink to my configs in the same dotfiles repos. I don’t need every change wrapped in a derivation. Neovim is probably the largest. A few node projects for automations I’m fine using pnpm to manage. Nix still places everything but I can tweek those configs and commit in the same repo without a full blown activation.