Here they talk about the issue and its limitations and it seems they missed the workaround mentioned below in the writeup:
https://gitlab.gnome.org/GNOME/yelp/-/issues/221#note_2392999

This attack has some limitations:

• Attacker needs to know the unix username of the victim.
• Browsers ask the user for permission on redirects to custom schemes.

However, the initial current working directory (CWD) of applications started by GNOME (e.g., using Alt+F2 or dock shortcuts) is the user’s home directory. As a result, the CWD of Chrome and Firefox is also set to the user’s home directory. We can abuse this behavior to point to the victim’s Downloads folder and bypass the first condition.

https://gist.github.com/parrot409/e970b155358d45b298d7024edd9b17f2

Thanks for sharing!
Out of curiosity - what kind of glitches?

Seems to exist some other screen sharing alternatives when I search around but I know nothing about them, f.e.
https://github.com/echoshare/echoshare
https://github.com/mira-screen-share

Haven’t tried it myself but there’s Jami
https://jami.net/
https://git.jami.net/savoirfairelinux
https://docs.jami.net/en_US/

edit: doesn’t seem to have audio sharing when screen sharing
https://git.jami.net/savoirfairelinux/jami-client-qt/-/issues/1675

It’s available in uBlock Origin when advanced user mode is enabled in settings. No idea if AdNauseam works the same.
https://github.com/uBlockOrigin/uBlock-issues/wiki/Dynamic-filtering:-quick-guide

As a firefox user I’m not really affected by googles changes so I’m not worried about uBO at all.
I will probably stick with noscript as of now, as I’m so used to it and have already built a large whitelist of domains I trust globally.

Not certain what you mean with sharing my settings of scripts. If you mean my whitelist settings in noscript/ublock origin then I would recommend just starting with a blank slate and build up your own whitelist. We’re probably not using the same sites after all.

It is! I read through the docs and did some testing. It’s very similar to noscript once you get used to the flags.
Do not Disable scripts globally using the settings checkbox, it overrides dynamic filtering and ignores your flags

Left flags are global (In the example I block first party and third party scripts globally) and right flags are local for the site you’re currently on. (Here I allow bbc.com to run scripts, that’s the grey flag)

You can locally allow all scripts from a domain like this (notice the grey flag on bbci.co.uk and the inherited dark grey on the subdomains below):

Or you can allow specific subdomains (here I allow emp.bbci.co.uk and ichef.bbci.co.uk specifically while leaving static.bbci.co.uk blocked)

As I’m allowing scripts with the right side local flags the third party sites will still be default blocked if they’re used by another domain that isn’t bbc.com.

How would the whitelist flow work in ublock origin? Can I allow only some third party domains to run js or is it all or nothing?
I like how it’s just a few clicks in noscript with no need to type - makes usage on my tablet and phone simple.

You will probably want to enable the non-free rpmfusion repository. I can’t remember if that is an option during install, but if not here’s how to do it with the console:
https://docs.fedoraproject.org/en-US/quick-docs/rpmfusion-setup/#_enabling_the_rpm_fusion_repositories_using_command_line_utilities

If you scroll down to Media Codecs and HW Acceleration you’ll have a guide on how to get proper ffmpeg and h264 and h265 driver support:
https://github.com/devangshekhawat/Fedora-42-Post-Install-Guide

Before spending too much time troubleshooting Linux Mint I would try something that’s a bit further along with the kernel updates considering your gpu.
Personally I’ve had good luck with Fedora KDE - https://fedoraproject.org/spins/kde

If you still wanna go for Linux Mint look into how to install the mainline kernel yourself:
https://forums.linuxmint.com/viewtopic.php?t=443810
https://ubuntuhandbook.org/index.php/2020/08/mainline-install-latest-kernel-ubuntu-linux-mint/

I can’t find any proper tests on the matter but here’s someone with the Thinkpad X13 with the same CPU answering the battery question.
https://old.reddit.com/r/thinkpad/comments/x4nevt/perfect_laptop_x13_gen_1_amd_ubuntu_2204/ioibywd/

How easy and expensive would it be to swap this with US English?

On the T14 (not T14s) it is easy. See https://support.lenovo.com/us/en/videos/nvid500443-replacing-your-keyboard-thinkpad-t14-and-p14s-gen-1-and-2-customer-self-service
Seems to be available from ~30USD https://www.amazon.com/Replacement-Keyboard-5N20V44072-5N20V43774-5N20X68864/dp/B0B3RV3LK5
ifixit has genuine parts for ~75USD https://www.ifixit.com/products/5n20v44072-lenovo-laptop-keyboard-genuine

Only thing I dislike about the T14s is that you have to dissassemble everything to replace the keyboard. On the T14 it’s so much easier.

A refurbished Lenovo T14 or T16 should do it.

While I’m morally in the opnsense camp I know pfsense has more third party packages available.
Running docker in an lxc sounds interesting, I’m a bit old school and enjoy the isolation that a true vm gives you.

Router: opnsense/pfsense
Switch: I guess look at something like Open vSwitch After some more reading I would go for a proprietary managed switch here. WiFi/Mesh network: OpenWrt with 802.11r setup - https://openwrt.org/docs/guide-user/network/wifi/roaming
Server: Proxmox or Debian Bookworm with KVM/Qemu
Docker/Kubernetes: Portainer CE version as a VM in Proxmox - https://github.com/portainer/portainer
Collab software: https://github.com/nextcloud/server
Server Backup: Proxmox backup server or Borg backup/Restic
Client backup: Borg backup/Restic

Most of my data are on 2x16TB HDDs running an mdraid1 and then I backup it all to a usb drive with Borg Backup.
The os.qcow2 files live on my m.2 NVMe and are manually backuped to the mdraid1 before running the borg backup.
I should automate the borg backup but currently I just do it manually a few times a month.
Would also like to have two usb drives and keep one offline in another part of the house but that’s another future project.