It depends on what you care about. The Kino Lorber has good color choices, but far too much contrast: dark areas (including the characters) are pitch black; and you can't see the clouds in the skies.
You're right, now that you mention it. I want a version that combines the Arrow contrast with the Lorber colours. How strange that they still didn't get it right.
In other words, they're so gentle they barely clean lightly-soiled clothes, and that's why they also use much less water; forget about heavy soiling or thicker textiles. For true cleaning, you need a top-loader that submerges them in detergent water and actually forces it through the materials with an agitator.
I think the best answer lies somewhere in compartmentalization and fine-grained permissions. In this case: run it in some kind of secure container which has access to read browser history, and write to its database, but definitely does not have network access.
Unfortunately there's no one-size-fits-all solution for this yet, but there are a lot of groups attacking it from different angles: Qubes, GrapheneOS, Firejail, Bubblewrap, Android/iOS app permissions, Landlock, App Sandbox, etc.
> ...run it in some kind of secure container which has access to read browser history, and write to its database, but definitely does not have network access.
We should be doing this with all software, regardless of provenance, anyway. Least privilege applies to servers just as much as it does to users. Even if the software isn't untrustworthy you can be it has vulnerabilities.
My first go-to is network segmentation because I spend most of my time doing networking work. For every vendor who has shit-talked me to Customers ("Wah, wah! Your networking vendor is making this so much harder because they want us to enumerate our traffic!") I have concrete examples I can cite when attacks were stopped by network segmentation (preventing shellcode from downloading a payload, preventing C2 communication, firing off alerts when unexpected network traffic starts coming out of a host, etc).
Beyond network segmentation, I am very suspicious of software that needs to run as a privileged user. So many attacks get easier when privilege escalation in the host OS is already done for you.
Google/Forrest rushed to embrace AI/Dan, and completely forgot about News/boat, which kept chugging along with no one at the controls until it degraded/crashed.
