For personal stuff, i use an external email, and borgbase for backups (highly recommend them if using Borg or restic).

I got a fairphone 5 earlier this year and am very happy with it. There is a version with /e/os installed but it was out of stock so I bought the android and it was really easy to install /e/os myself with no technical knowledge needed. I use f-droid for as many apps as possible. It has a version of play store (app lounge) for other apps, most of which have worked. For the odd one that didn’t, I’ve just added a shortcut to the mobile website for quick access. Theres no google pay but I can use the curve app fine with NFC so can even buy stuff, something I didn’t expect to be able to do.

To be honest, you would get frequent notifications for updates that are probably more often than just to remind you. If you’re like me, you’ll just end up ignoring them anyway! There are a lot of small updates to a lot of software, most often not from a security point of view but just as people develop their projects. I update every week if I can but can be a couple of weeks, in which I start to feel “guilty” so when it builds up I know I have to do it

Sorry this doesn’t answer your question really but I’ve had issues when I used to auto update containers so stopped doing that. Some things have breaking changes, others just had issues in that release that caused me issues accessing stuff when not at home. I update every so often when I have ten minutes to do updates, check release notes and deal with any issues if they arise or roll back to that version. I spin up what’s up docker to see what’s changed then when finished, stop the container so it doesn’t keep on polling docker hub using my free allowance.

In short, it could be an option to spin it up, let it run, then stop the container so theres less risk it could be used for an attack.

About 120 miles, which in the UK is like a weekend trip at least

I bought a new domain for my business and there was no trace of any old business name when researching connected to that domain. After about 6 months I received some data from an old client of theirs. It had a company name so I was able to let someone from that company know, as well the sender and I deleted the data before reading it. I guess you have to think what did you use it for, who might send data that identifies you etc. You never know who might buy it.

I remember reading an article but can’t find it now. A researcher bought tons old domains from government and local departments that had shut down or changed names, and managed to get some interesting information!

I bought a set over a year ago for my son, then the school library also seems to have them (they pick a book a week)