Pi as well? Comparatively it's quite a small surface. I haven't seen issues when I upgrade.

Pi went searching across my entire home directory unprompted... Idk to do that without some kind of sandboxing builtin is rough and chews through tokens on things I don't really want polluting my context.

	▲	ghosty141 2 hours ago \| parent \| next [-]
		A coworker of mine has a pretty neat script that uses bubblewrap to wrap any application. I'm using that one too for pi and it's pretty great since you don't have to trust the harness and can quite easily customize the sandbox to your needs, e.g. disallow reading to certain directories etc. This blogpost describes a similar thing: https://bxt.rs/blog/easy-sandboxing-on-linux-with-bubblewrap...
	▲	mpalmer 2 hours ago \| parent \| prev [-]
		Well yeah, it's YOLO-by-default by design. That's not related to upgrade churn.