Anyone got a source on GrapheneOS recommending Brave?

My user is, yes. But there has to be an exploit in sudo for the program to elevate itself using it without the user knowing, no? It's possible for sure but I'm seeing this type of a precaution on a torrent client for the first time.

How is NAT travelsal handled if you want to connect two devices via WG? That's what Tailscale primarily does.

Do you not need DDNS for that?

You shouldn't need to do that if portals are properly installed on your system which typically is just one or two package.

Isn't that the globbing operator?

Hm, Discord didn't have anything registered there. After some digging, I found about:debugging#workers which does list Discord stuff under "Other Workers". It's unsettling to see there's no way to force confirmation and/or disable these stuff. I use Discord when I have to every once in a while. I don't want their code running all the time in my browser..

edit: you can disable service workers with dom.serviceWorkers.enabled = false but this has no effect on Other Workers.

edit2: uBlock can disable Other Workers by setting the filter ||$csp=worker-src 'none' in My Filters and enabling Suspend network activity until all filter lists are loaded in Filter lists. It funny how this "trick" is written for Chromium-based browsers with the note that Firefox allows global disabling of service workers when the sites can just register a different type of worker with no way of disabling them. I am sure the api is less powerful than service workers bla bla bla, let me decide what runs on my browser without needing third party tools, please.

I have notifications turned off globally. The notifications I'm getting are in-app notifications.

I'm asking global override vs application manifest (not application override). So the app asks for access to home/some-dir but I have a global override that blocks access to home entirely.

It is. Just put your card in your phone case if you really want to tap your phone to pay. Accepted in more places too :)

And it is safe to host HTTP services this way, say something like Immich or NextCloud?