Hello, everybody.
Welcome back to This Week in Privacy.
This is our weekly series where we discuss
the latest updates with what we're working
on in the Privacy Guides community and
this week's top stories in the data
privacy and cybersecurity space.
The stories this week include Moxie
Marlinspike's new AI chatbot,
a new privacy services alliance,
a new advanced Linux malware, and more.
I'm Jonah,
and with me this week is Nate.
How are you doing, Nate?
I'm good.
How are you?
I'm doing great.
Thank you.
For those of you who are just tuning
in for the first time or might not
know,
Privacy Guides is a nonprofit which
researches and shares privacy-related
information,
and we facilitate a community on our forum
and matrix where people can ask questions
and discuss
get advice about staying private online
and preserving your digital rights.
So we always kick off the show with
what we've been working on at Privacy
Guides this week,
and I'll hand it over to Nate to
share a bit about what he's been doing
on the video side of things.
Awesome.
Yeah,
so there's been some exciting
developments.
For those of you who didn't know,
we have a new video now out to
the public.
It's loosely based on Em's written article
that privacy is like broccoli.
So if you haven't checked that out yet,
please go check it out.
Very proud of everyone at the team.
It's obviously, it's not just me,
Jordan edited and everybody helped double
check the writing and everything.
So yeah,
we're continuing to work on our video
courses, the smartphone security guide,
and I believe there's still some work
going on.
Well,
there's definitely some work going on on
the threat modeling course.
And I also,
Just came in.
I yesterday recorded a new video about,
I should know what this was.
I just recorded it when I'm drawing the
blanks.
Private browsing.
That was it.
Yeah.
Yesterday I just recorded a new video
about private browsing and that will be
coming out very soon as well.
we have uh yeah we've got a lot
going on behind the scenes it's hard to
keep track of all of this um i
can share some other updates on our end
um most notably if you missed it last
week um we had some personnel changes um
our wonderful intern kevin is no longer
working with us his internship ended um so
he's moving on to other projects but um
it was a great experience working with him
i'm super glad uh that we got the
chance to do that and i hope to
see kevin um
hopefully stick around on the forum and do
some volunteer,
maybe some one-off projects with us in the
future.
But of course, that's up to him.
We'll see how that goes.
But I just wanted to, again,
thank Kevin for all of his work and
explain a bit about what the show is
going to look like going forward.
Of course,
it's going to be mainly Nate and I
or...
hosting this show.
Jordan may be hosting some episodes as
well, like they used to.
But that'll be kind of the roundup for
this week in privacy going forward.
Besides that,
we published several news articles this
week at privacyguides.org slash news.
There were Instagram password resets in
the news, RCS potentially in the iOS,
which I believe we're going to talk about
later in the show.
Threema,
which is a pretty popular end-to-end
encrypted messaging app,
was recently acquired by another private
capital firm.
There's some vulnerabilities in AI agentic
browsers.
There's news about Windscribe and their
partnership with some other privacy
services,
which is another topic that we're going to
cover in more detail here in the show.
And an article on the WhisperPair
Bluetooth vulnerability.
So definitely a lot of cool stuff coming
out there.
Freya has been working really hard getting
timely news briefs and news updates out on
our site for people who are interested in
that sort of thing.
So if you want to keep up to
date with that,
definitely give the privacyguides.org
slash news site a follow or follow it
on various social media platforms or the
news category on our forum,
which is where all of these articles are
posted.
I also want to highlight an article that
I wrote a year ago.
I know with a lot of political news
going on in the world,
I think it's just always a good time
to maybe give a reminder of this.
We do have an article on smartphone
security and keeping your smartphone safe
if you are attending any events.
In person like protests or activities like
that if you're an activist or you're a
journalist who needs to be sure that your
baseline security for your smartphone is
up to speed definitely give this article
or read, we will.
I'll have a link to this in the
show notes when we send this out later.
But yeah,
just since the article is a bit old,
I wanted to resurface it here.
I think off the top of my head,
that's all of the major updates we've been
working on at Privacy Guides.
It's been a pretty busy few weeks for
me.
We've been working on a lot of things
behind the scenes.
And if you're a regular member on our
forum,
you may have seen some of the notes
from meetings that we've had,
and we have some future stuff that we
have to work out.
still in the works.
But I think that's kind of everything for
now.
Nate,
if you don't have anything else to add
in terms of Privacy Guides updates,
I think I'll hand this over to you
to share some of our news stories,
maybe our first one.
yeah all right so we uh our our
headline story this week is about moxie
marlin spike's new ai chat bot this has
been kind of making waves for those of
you who don't know who moxie marlin spike
is you probably at least know uh his
work which is the signal messenger uh
moxie created signal he passed off the
reins to the current president uh
Well,
I don't know if he picked her necessarily,
but he passed off the reins.
And now who has taken over is Meredith
Whitaker, who, yeah.
Anyways,
she's doing a great job with Signal.
But he moved on, what was that,
about a year?
No, more than a year ago.
My sense of time is all messed up.
But he's been kind of laying low,
actually.
At least I feel like.
I certainly haven't heard his name in
quite a while.
And now it's popped up with this new
chatbot called Conferr.
And I believe the link for that is
confer.to if any of you want to check
it out.
But it's very minimal right now.
And what really sets this one apart is
this might be, to my knowledge,
the first really private AI chatbot on the
user side.
And we're going to dig into that in
a little bit.
But...
You know, things like,
which this article here does unfortunately
incorrectly say at the end,
things like Lumo, things,
as far as I know,
things even like Braves Leo,
I could be wrong about that one,
but they don't really protect the user.
They're basically like a no log VPN for
LLMs.
They promise they won't keep your logs,
but technically they can access them.
Um, if there was a situation like, uh,
you know, famously years ago,
proton was forced by law to monitor a
certain account and record the IP
addresses.
Cause they were trying to figure out who
was behind that account.
Not they proton, the,
the authorities were trying to figure it
out.
And, um, you know,
eventually they were able to do that.
So this, uh,
this is kind of in the,
this is the first time that they're trying
to create something more like signal
where, uh,
That's not even possible.
It's all encrypted from start to finish
for real.
And yeah, it's, I mean, it's, okay.
So if you go to the confer.to website
and you click on the blog,
you can dig in there and there is
some like really
There's some really technical details.
I don't think there's any code or
anything.
I mean, the thing's open source,
so you can go look at the code
if you're that technical.
This Ars Technica article, I think,
does a pretty good job of dumbing it
down.
And basically,
it really relies on what are called
trusted execution environments.
This goes way over my head,
and I'm sure Jonah can probably break it
down a little bit simpler.
But basically, the way they describe it,
they say it prevents even server
administrators from peeking at or
tampering with conversations.
And they talk about how it's designed
where you can access it from different
devices,
and it can synchronize just like Signal.
And I don't know.
It's really cool stuff.
Before I jump into the next part of
this thought, Jonah,
is there anything you want to add?
Yeah, so I don't know.
I'm probably less excited about this
Confer stuff than other people I've seen
in the community.
All of this private AI stuff has been
trending quite a bit lately,
and they especially rely on these trusted
execution environments.
TEE's Confer is now different,
but we've seen
For example,
if anyone wants to look into this later,
we've talked a lot about Maple AI on
the forum,
which uses a similar technology to kind of
validate the security of how these AI
models are being run in theory.
And basically what these trusted execution
environments are,
are
features that are built into the CPUs of
servers that these models are running on,
where they can run a certain set of
code and it can be validated by the
hardware that the code hasn't been changed
or modified in theory.
So if an AI service, for example,
like Confer is releasing an open source
model and they're saying this code is
what's running on here,
the hardware should, in theory,
ensure that they're not swapping out that
code behind the scenes and it might
protect you.
The problem with TEE is that there are
quite a few limitations,
and it wasn't really designed to protect
against the operator of the server from
potentially being a physical attacker
here.
And so we've seen security experts like
Matthew Green, for example,
on
on Twitter caution against the use,
or not against the use,
but against relying too much on TEEs for
the security of AI models because they
can't provide the same type of guarantees
that full end-to-end encryption can
provide.
That's simple math, whereas this is
a bit more policy based.
It's certainly a step better than,
you know,
them just saying they're not going to look
at it,
but not really doing anything about it.
But it's nowhere near the guarantees that
you're going to get from end to end
encryption.
And so it's tricky to say that any
of these are truly private because
While some AI models like Lumo,
for example, or this one or other ones,
they will use end-to-end encryption for
the storage of your chat logs.
They don't necessarily, well,
they don't at all use end-to-end
encryption on the chat as you're chatting
with it.
And they can theoretically read that chat
or log it.
at that time.
And there isn't really any way around this
because these AI servers,
they need access to your data in order
to run the AI query on it.
And so that's why
I think all of these cloud AI models,
they don't probably reach the level of
privacy that a lot of people are going
to want from AI,
especially for some of the things that
people are using this for.
I think we're going to maybe talk about
this in a bit,
but I know there's a ton of stories
about how AI is starting to be used
for health stuff and personal,
very sensitive information.
And these protections, in my opinion,
don't really go anywhere.
too far or far enough to protect that
data, unfortunately.
That's kind of how I would describe the
technical side of things.
I know there's a lot that we want
to talk about that isn't necessarily
technical,
but more just privacy concerns with AI in
general,
beyond the pure security of the system.
But yeah,
I definitely want to create the
distinction between TEEs,
like better being used,
In this case versus end-to-end encryption,
because end-to-end encryption,
it's a whole different ballgame,
and it's much better security,
and AI is not providing that in any
of these cases.
Cool, yeah,
and thank you for clarifying what I meant
when I said that most other, like Lumo,
is more like a no-logs VPN in the
sense that they can read your chats,
they just promise not to store them.
And they do store them in a way
where they can't read them,
but while you're having that chat,
they totally could.
And that's what this is supposed to do
differently.
But yeah, let's,
because I'm excited to get into this,
let's go ahead and talk about,
towards the end there,
you mentioned that this is all fine and
nice from a technical perspective,
potentially,
Um,
but this doesn't solve a lot of the
privacy concerns with AI and, um,
Man, this is really good.
So just to kind of give listeners a
tiny peek behind the curtain,
we have a weekly meeting,
a staff meeting at Privacy Guides.
And part of that discussion is always what
story do we think would make the best
headline story?
And when we talked about this,
our staff member, Em, had an amazing,
a lot to say, really.
She didn't just make a point and she
gave a really good talk.
I guess you could call it that.
But anyways,
she pointed out that something that we
never really talk about,
and I'm sure some of you guys have
thought about this,
but I personally have never thought about
this before.
And AI really,
at least in its current form,
can't be made private.
Like maybe it can from the end user,
but that doesn't count the data and how
the data is scraped.
And it's...
I think a lot of us know that
anything you put online you should treat
as,
you know, being public.
At least that's something I've always been
able to say,
or that's something I've always said in
the past is anything you post online,
be prepared for it to be breached or
anything like that.
But even so,
that doesn't make it right for these
companies to go around scraping all this
data without consent.
And I do want to acknowledge there are,
I know there's at least one AI that
they're trying to, or not, well,
I guess you could call it an AI,
a training set they're trying to create
that is drawn from
consenting users but at this time there's
really no mechanism like that i think uh
i think creative commons is currently in
talks to create a flag where basically you
can say oh yes i consent to let
ai train on this data but certainly chat
gpt anthropic uh whatever some of the
other ones are out there i don't think
any of them have ever respected that
because they existed before that was a
thing and we already know that there's so
many stories about like uh
Copyrighted material,
the Harry Potter books,
the New York Times is currently in a
lawsuit where there's so many stories
where we know that this is what's
happening.
They're training on data that is not
licensed for free use,
that is not consented to.
And yeah,
that's a trickier thing that I don't think
can be solved in a technical way.
Any thoughts on that one, Jonah?
Yeah,
there's so many concerns with the privacy,
and I totally agree with what Em had
brought up in our meeting and on Mastodon.
A lot of these things that are being
built right now,
they're being just used in very un-private
ways, and it requires harming privacy,
exactly like you said,
in order to build these things in the
first place.
And so it's very concerning what's going
on with AI here.
Yeah,
I think she summed it up pretty well.
So I'm not sure if I have anything
else to add beyond that off the top
of my head.
Sorry,
I was just looking at the chat here,
seeing if something was coming up.
So I was a bit distracted.
But yeah,
I think that's kind of where I'm at
with that.
Yeah,
we're trying something new on the back end
here, and there's a lot of moving parts.
Yeah, let us know.
Definitely, if you're watching,
leave a comment how the stream is going
in terms of quality.
Or if you're chatting on a different
platform,
let us know and we can see if
that shows up.
Because, yeah,
we have a bit of a different setup
than usual.
But, yeah, going back to AI, I mean,
it's...
I don't know.
I feel like there's not much to add
to that statement,
but it's to what Em said.
But it's such a â to me, again,
I thought it was really enlightening
because I've never thought of that before.
And it feels so â because I've seen
some people say,
particularly in the Mastodon post that Em
sent us where she kind of put all
these thoughts into words.
And someone argued,
like I said at the top, it's like,
well,
you post anything online and you know it's
going to be public.
And I think this kind of falls under
â
A long time ago,
I wrote a blog post where I made
the argument that there's a difference
between an expectation of privacy and an
expectation to be stalked.
And, you know,
I've been in situations where because I
have, you know,
very visible arm tattoos for those who've
never seen my arms before.
And I usually wear short sleeve shirts,
especially in the warmer months.
And I've had many times where, you know,
I've had like there was one time I
went to the store and as I was
leaving the store,
a friend texted me and was like, hey,
I just saw you at the store.
And I'm just like,
How did they know it was me?
And this was like during COVID.
So like everybody had a mask on.
I'm like,
how did they know it was me?
And then I'm like, oh, right.
Duh.
But and, you know,
I'm not mad about that.
Right.
But the difference is that friend didn't
then immediately like get in the car and
follow me around town as I ran errands
or went back home or whatever I did.
And it feels different when, you know,
you post something publicly and sure,
somebody might see it.
Somebody might get upset.
versus that might get scraped up.
That might get added to a data training
set.
I personally have, and many people do,
I have disappearing messages enabled on
Mastodon because I want them to go away.
And if they get caught up in a
data training set,
having a hard time talking tonight,
then they never go away.
They're there forever.
And it's just such an interesting
perspective that I never considered.
Because when we look at these new
technologies,
I think there's two kinds of problems.
There's technical problems and then
there's,
I don't know what I would call them,
but there's all the other problems.
And technical problems to me are things
like the energy usage.
And for the record,
I am not trying to downplay this,
but the energy usage of AI is really
bad for the environment, right?
That's a technical problem.
As we go, I think,
not to sound overly optimistic,
but I think we'll learn how to make
more energy-efficient data centers.
We'll learn how to maybe switch to
renewable energies, maybe someday,
eventually.
And all these things that can reduce the
environmental impact of AI.
But then there's the other things like...
what we were just talking about,
the fact that all this privacy data was
taken,
the fact that this is potentially putting
people out of work, you know,
these are much harder things to solve.
And maybe there is a solution if you
want to be an optimist,
but I think starting this discussion is
certainly part of that, you know,
finding that solution if nobody's talking
about that side of things, for sure,
because
I don't know if I said this,
but we usually think of privacy as the
end user, my prompts and that stuff,
the responses.
But I feel like we don't talk enough
about the training data in the sense of
the privacy invasion from it.
So yeah, it's really interesting stuff.
Absolutely.
And beyond just the training aspect of it,
I think...
like AI has definitely shown that privacy
has never really been more important in
protecting your data online because we
could talk about this other story that we
have.
This was reported by four or four media
talking about Grok's AI sexual abuse
material that it's generating on Twitter
right now or X.
And I think it also shows that like,
You have to be careful with the data
and images that you're posting online,
especially personal stuff,
because now people can basically use these
models.
They're getting better and better at
creating very photorealistic things,
and they can take innocuous images or just
selfies or any images of people and turn
it into stuff that you probably don't want
to see or don't want on the internet.
And certain people are going to be more
affected by this than others.
But I think that...
You know,
AI is creating a very dangerous
environment right now where any data that
you put out can potentially be misused or
blown far out of proportion,
far beyond what you originally intended
when you were maybe making a post.
And I think it's just, I don't know.
AI, I think,
has created a lot of terrible situations
all around in terms of privacy, for sure,
and in terms of safety on the internet.
And I don't really see a way that
it's ever going to be rectified.
There aren't a lot of great solutions
here.
And so it makes me very hesitant to
recommend or use AI in any
capacity because it's just creating it's
really creating a monster that we don't
really know how to how to control and
it's not a good idea I think for
people to become reliant on tools like
this and use it like in their everyday
lives for for all sorts of things because
you know, eventually, you know,
it's either going to create these
dangerous situations or it's going to have
to be reined in by these tech companies.
And then you're in a situation where,
you know,
tech companies are kind of censoring the
stuff that you can create online.
There's always a censorship problem,
I think,
with a lot of these centralized services
and big tech services where outsourcing
all of your control to these centralized
cloud providers instead of trying to do
everything yourself puts you in a very bad
situation.
We see it all the time in other
industries,
and it's something that I think we can
catch right away and try to avoid going
forward.
I don't know what the general vibe for
AI is among the general population right
now.
I don't think AI is a huge thing
for most people outside of the tech
sphere.
And I think most people are rejecting AI
right now, which is probably...
probably a good thing because it it just
seems to be creating a lot more harm
than good right now in so many different
ways yeah that's fair and to be clear
when i when i kind of um
when I kind of take a potentially
optimistic approach,
I'm not necessarily trying to be pro AI.
I'm just, I'm trying to be fair.
I'm trying to point out, cause you know,
one,
and this is definitely not a one-to-one,
this may even be a disingenuous
comparison, but,
One comparison I keep hearing people make
is newspapers.
When newspapers first went to mass print,
we had a huge problem with misinformation
and disinformation and what's now called
yellow journalism,
which is â we still see to an
extent the super sensational just making
things up out of thin air because it's
scandalous and it sells.
I think now we call it clickbait.
But we â
That was eventually something that we were
able to mostly figure out by creating
legislations and having these very strict
slander laws and things like that.
And to be fair, laws are retroactive,
right?
Like laws work after the fact,
after somebody has already been harmed.
So I'm not saying that's a perfect
solution,
but I think we can agree that in
the end,
newspapers ended up being better than they
were.
So that's kind of the lens I'm trying
to look at this through is like,
what are we looking at in terms of
some of these problems are technical
problems that can be solved,
but then others like you're right.
It's, it's,
I think going back to the whole training
data thing.
Okay.
We create,
let's say we created a system where people
have to opt in to have their training
data scraped up by AI and whatever that
looks like, whether it comes with a, like,
what's the word I'm looking for?
Compensation or whatever.
Would that be enough?
Because that's what makes AI so quote
unquote good or effective is that it just
has obnoxious amounts of training data.
And I would be surprised if enough people
opted in to really make AI as effective
as it is now.
And again, to be clear,
I'm not saying like, oh,
people should opt in.
Like, no,
it's your content that you're creating.
Do whatever you want with it.
But it's just,
it's kind of backing up what you were
saying, Jonah,
about if
we may be facing something that there may
be no way to use it privately.
And I think that is,
I agree with you.
I think that's really good that people are
opting not to use this,
but I do worry for people.
We had at least one person in the
forum who said that they're in a field
where it's becoming increasingly difficult
to navigate that field without having AI
on your resume because it's,
I don't even know what businesses are
using it for,
but apparently everybody wants you to be
able to learn AI,
whatever that even means.
I don't know.
And so I guess know how the prompts
work.
I really don't know.
But if you're in a field where you're
like, I don't like to use AI,
even if you just don't like it,
I don't see a use for it.
I don't see a value.
I've tinkered with AI in the early days
and-
There's a few things it does really well,
but overall,
I don't see how it became this trillion
dollar industry that's propping up the
entire US economy.
It's just not that, for me at least,
it doesn't do that much.
So if I were in one of those
fields where they're like, well,
how often do you use AI?
Hardly ever because it just doesn't â I
don't have a use for it.
It doesn't do anything for me.
And anyways, yeah,
my point being what I'm trying to get
to is it's unfortunate that some people
are in a position where they're now stuck
where they have to show that they know
how to use AI.
And I don't know.
It's like â
It's like phones,
like phones are not really private, right?
And it's hard to make them private.
And some people can afford to not have
a phone.
They can work in a field or they
can be self-employed where they don't have
a phone,
but not everybody has that luxury.
And it's really unfortunate people are
being put in that situation.
Yeah,
I think you bring up a really good
point,
especially with the whole like having to
maybe opt in or like consensually sharing
your data with AI.
This is something that really bothers me
about the current AI landscape, actually,
because I think these tech companies have
kind of created this situation where now
that they've created the problem and all
of these problems that AI causes.
now they're trying to sell you on various
solutions to try and take control of it
after the fact and it's like these these
problems wouldn't exist without all of the
ai that's being pushed on consumers from
these tech companies fairly irresponsibly
um i was just looking i mean we
were just taking a look at youtube studio
the other day and looking at um some
of their like likeness detection features
and how that's going to require me to
you know scan my face and send them
my id if i want to
you know,
monitor YouTube for people who are
potentially creating AI generated videos
of me, for example.
And this is not a position that I
think people should be putting in the
first place because it's just yet another
thing in a long string of events where
tech companies create these problems as an
excuse to try and get more and more
of your data.
And now I have to share even more
data with Google that they didn't
necessarily have before because of the AI
problems that they've created.
And I'm sure that this is going to
be commonplace
On other platforms, if it isn't already,
it'll be coming soon.
And I'm sure there's not going to be
a single way to opt out of it
everywhere across the internet because
there's just no coordination like that.
And there isn't really a great way to
do it privately.
And so by just accepting AI and kind
of normalizing all of this,
that's just kind of the society that we're
creating here.
We're just losing the ability to control
who has access to our data and who
benefits from it.
And unfortunately, at this point,
it seems pretty clear that the only people
who are really benefiting from having all
of our data is
these big tech companies.
So I don't know.
It's ridiculous, I think.
Yeah, for sure.
The normalization,
that's a huge problem with privacy, right?
As privacy advocates,
it's so normal to use these tools that
it sometimes can, I don't know, it's...
I'm sure a lot of us have been
in that situation where it's like, oh,
I don't have Facebook.
What do you mean you don't have Facebook?
And they like, I don't know.
Usually when I say that,
people are just like, whoa,
that sounds awesome.
And I'm like, yeah, just delete it.
It's not that hard.
But I also know some people have just
been met with like, you know,
they're isolated now because it's like,
oh, well, you're not on Facebook.
So I didn't send you an event invite
because apparently you don't exist
anymore.
So yeah,
when you use that word normalization,
that really jumped out at me.
That's such a problem with a lot of
these privacy invasive texts is they
become normalized.
I don't have any more thoughts to add
to that one.
Do you have anything to add before we
move on to our next story?
I think that kind of covers all the
stuff I was thinking about with AI.
So we can take a look at our
next post here.
This comes from the Windscribe blog,
actually.
The headline is,
Windscribe partners with Kaji, Notesnook,
Addy.io and ENTI to create a privacy
focused alliance.
And so basically,
what Windscribe has done is they've
partnered with all the services I've just
named to give people kind of exclusive
discounts or deals on all those services
if you're a Windscribe user.
And I know this is I don't remember
if we've talked about this in a previous
episode,
you can remind me but I know ENTI
has done a similar thing with other
services in the past.
And it looks like Windscribe is kind of
joining in
on that initiative.
So I think it's pretty cool what they're
doing.
I guess the question that we would
probably want to talk about is how do
we feel about these privacy alliances?
Do you have any opinions?
I have a couple of things to say
for sure,
but I can let you go first.
I got to be honest,
I think this is the first one I've
seen,
or at least the first one on this
scale, for sure.
I don't really have too much of an
issue with it personally.
I think the thing that disappoints me is
that a lot of these are like Addy.io,
Addy.io,
twenty five percent off the first year.
Same thing with NT,
twenty five percent off for the first
twelve months.
I think.
I don't know.
Maybe it's just me being cheap,
but I'm one of those people that if
I'm going to sign up for a discount,
I would like to continue to have that
discount.
But I mean,
at least they're being upfront about it.
But I don't know.
I think...
I don't have too many issues with it
because I think wind scribes, uh,
their logic makes sense.
You know, if,
if you read the blog posts that they
put out, they said, uh,
like why a privacy focused partnership
instead of just like building a suite in
house.
And their answer is basically
compartmentalization.
You know, if, if you compartmentalize,
then.
If any one of these services goes away
or becomes compromised or what have you,
then it's just that one service.
It's not across the board.
It's not your entire account.
And I think they make a really good
point there.
And also one thing they didn't say,
but one thing I've historically said that
I really believe that is that when you
try to do everything,
usually you end up doing everything kind
of poorly.
So I would definitely prefer like
Windscribe.
We're going to focus on our VPN and
we're going to make a really good VPN
and we're going to let NT handle the,
or NT handle the photo storage.
We're going to let Kagi or Kaji handle
the search and, you know,
which I've heard really good things about
Kaji.
I still haven't used it myself,
but I've used NT.
I'm very happy with it.
So yeah, it's,
it's kind of nice to see that, um,
that specialization there the only thing i
can think that might kind of not be
great is a lot of uh quote-unquote normie
users are really big fans of they want
the ecosystem right they want like that's
one of the amazing things about google
right is you get an email and it
says hey let's have lunch on the and
it automatically asks do you want to add
this to your calendar or it used to
ask i think now it just does it
but i don't use google anymore so i
have no idea um
And it adds it to your calendar.
And then when you send an email and
you add an attachment that's too big,
it's like, oh,
do you want to just one click,
add this to Google Drive and send it
that way?
And they make it so seamless and
everything works together.
And so that is kind of the argument
for things like Proton, for example.
If you don't use them, that's fine.
You don't have to.
But it's a really compelling alternative
for people who want that ecosystem.
And that's kind of the only thing I
could see getting in the way from my
perspective is some people may say like,
well,
why would I sign up for six different
services when I could
just go somewhere else and get it all
at once but yeah i think those are
kind of all my thoughts absolutely i i
totally agree well i'll go through a
couple of your points i think the the
first thing that you mentioned how some of
these discounts aren't lifetime plans i
think is really unfortunate because i do
think that the the the big draw for
for this um for a lot of people
would be to escape an ecosystem like like
proton um i i understand all your points
about the ecosystem and definitely a lot
of people are
into that sort of thing.
And I definitely use a lot of Proton
services myself personally,
but I also know a lot of people
who don't want to put all of their
eggs in one basket and they don't want
to use ProtonMail and ProtonDrive and
ProtonVPN, right?
And they would rather like trust
individually vetted individual services.
And I think there's also something to be
said about companies that really just
specialize on doing one thing and one
thing
really well,
like Haji with Search or NT with Photos,
for example.
I think all of these privacy services and
companies still exist in a pretty niche
market,
and I'm glad that more people are
becoming concerned about the security and
privacy of their data,
and they're switching to these services.
But there's, you know,
there's still a lot of growth to be
had in this sector.
And I think that prevents a lot of
companies from growing super big at the
moment.
Proton, I think,
is a is a good exception.
But I know Proton
people have a lot of complaints about how
Proton is slow to add new features or
they're not integrating all of their
products properly or that sort of thing.
And it's true.
And I think it's just really hard to
build like a full ecosystem right off the
bat.
And if you could have all of these
separate teams that are much more
streamlined,
they don't have to worry about integration
as much.
They can just focus on their own features.
Like Windscribe can just focus on trying
to be the best VPN they can be,
for example,
and they can leave
like cloud storage and search and photo
storage to these other companies.
You know,
I think that's really beneficial and would
help a lot of companies.
But if you're only giving away like trials
or limited time discounts,
it's
It's not going to be very compelling just
from a cost perspective, unfortunately.
I'm not sure if there's a super great
way for a coalition of these companies to
work together on something like that,
or if there's an opportunity for someone
to sell bundles.
Because at the end of the day,
especially with most modern payment
systems right now, you have to...
have like one central company that's in
charge of billing and that's obviously
going to give that company whoever it is
a lot of power over the other companies
in this in this coalition right and so
i'm sure there's probably some
cryptocurrency solution to this where
everything could be decentralized and
split up but not everyone is going to
pay in cryptocurrency um
But I would maybe want to see a
solution that's more integrated than this,
where it's not just like exclusive
discount codes,
but maybe it's a bundle where you could
sign up with any of these services and
get billed through the service of your
choice.
And that might decentralize it a bit,
but then you get access to all of
these other services for the lifetime of
the bundle.
And I think that that would be a
lot more compelling for a lot of people
who are switching from something like
Proton,
that kind of
includes many of the things that are being
sold here.
How that would work exactly, again,
I don't know.
But I think that that would be the
biggest draw for a bundle of privacy
products like this.
And it's kind of a shame that
They're not doing that right now,
but maybe they'll go in that direction.
For now at least,
I guess if you're a Windscribe user,
this is a pretty good opportunity to use
some of the services that we recommend.
We haven't recommended or evaluated all of
the services,
including Windscribe itself on privacy
guides.
I know there's a lot of discussions on
our form if people are interested in
learning about pretty much all of these.
But yeah, I think...
that would be the direction that I would
want to see something like this go in.
And we'll see if that happens.
Yeah.
And just to back up what you were
saying, I totally get the appeal of not,
like the compartmentalization is the
appeal for some people, right?
Like you were saying, like, sure,
there are a lot of people who want
the ecosystem,
but there's also a lot of people who
want whatever the best thing is.
You know,
if you think Mulvad is better than Proton
and you would rather use Mulvad and you
kind of,
mix and match.
I think that's great.
And I do agree with Windscribe that that
is certainly more secure from a
compartmentalization perspective.
But yeah, I'm with you.
I think really,
even if you want these disparate services,
it would be really cool if there was
some kind of... If it was...
I don't know.
This feels to me like...
this feels to me a lot like the
concept of a sister cities,
which I've never really understood.
It's like, Oh, we're gonna like,
I swear to God,
I've lived in places that like the sister
city is in like Russia.
And I'm like, how?
Like I'm in Texas.
How, what, what, what's going on?
And you know, it's,
it's really means nothing.
It's just some kind of like cooperation.
They're like, Oh,
maybe you should check this place out.
We've, you know, shook hands or whatever.
And
And, you know,
I don't mean to downplay this to that
extent,
but it feels very similar that it's kind
of like, well,
we just got together and agreed we all
like each other and we're really cool.
And they are really cool services.
Again, I want to stress that, but.
It would be nice to see something that's
a little bit more cohesive, I guess,
or benefits the user a little more other
than just some kind of like temporary,
which again,
I think some of them are like permanent,
right?
I think at least one of them was,
I'm trying to pull the page back up
here.
Notes Nook was a permanent discount.
As far as I'm seeing.
And I think there was one other one.
There's not any, well, Control D,
but that's also run by Windscribe, so.
oh okay okay that's the one i was
thinking of yeah fifty percent off control
d um so yeah it would be yeah
lifetime discount that's dope but yeah so
it would be cool to see something a
little bit more cohesive like that but i
don't know at the same time it's like
that could be a really cool i'm i'm
trying so hard to get a lot of
my family members to try ente because you
know most of them are just in google
photos apple photos whatever phone they're
using and
Yeah.
So maybe, I mean, if nothing else,
maybe this could be a nice like, hey,
here's twenty five percent off.
Give it a shot.
So totally.
I really like your sister cities analogy,
actually,
because that is kind of what what this
is.
I know.
I think all of those sister city things
are like with international cities and
there isn't much like true connection
between them.
And that is sort of what this feels
like at the moment.
Like it's a lot of disparate services
where you can get like, you know,
that there's cross promotional stuff going
on.
There's
limited time discounts,
but there isn't a true partnership or
working together on something extremely
cohesive.
It's just awareness.
Windscribe is probably for the most part
just making people aware of these services
more than providing an actual long-term
value for their users.
But I think awareness of other privacy
companies is certainly a good thing.
So I'm not going to knock it for
that,
but I don't think
in its current iteration,
this is going to create a great
alternative for someone coming from
something like Proton, for example.
But yeah,
if you were going to try out some
or all of these services anyways,
especially because you can pick and
choose,
it's not like some bundles where you have
to register for everything and then you
might not even want to use some of
these things.
You know, it's not that serious.
So yeah,
I think it's a cool opportunity for them.
I always like to see privacy companies
work together on this sort of thing rather
than you know constantly compete with each
other especially in at times when it
doesn't make any sense to be competing
with each other at all um so so
yeah i think it's i think it's cool
yeah for sure um man you said one
last thing i wanted to touch on but
got away from me so all right yeah
I think I would just ask you,
maybe we didn't cover this.
Do you have any thoughts about like any
of these companies in particular?
How many of these have you used?
Because I know not all of these are
even recommended on our site, for example.
But I know they've been talked about a
lot on the forum.
Well, actually, real quick,
my thought just came back to me.
I was going to say,
you said this is kind of Windscribe just
like kind of bringing awareness of these
companies.
To their defense,
that can be used because, you know,
back when I was on Surveillance Reporter,
we took a sponsor and our first sponsor
was JMP Chat, the voiceover IP.
And I thought for sure that I was
like, oh, everybody knows JMP Chat.
And I was floored how many people left
comments like, oh,
I've never heard of this before.
This is really cool.
And I'm like,
Really?
And I don't mean that in a bad
way.
Like, really?
But I was like, really?
That many people have never heard of this.
So I'm sure even Windscribe probably has
tons of people that are like, oh,
I've never heard of Kaji.
I've never heard of Addy.
So...
But in answer to your question,
I use Entei.
I'm kind of in this weird space where
I'm like halfway between Entei and
Nextcloud,
and I'm not sure which one I want
to commit to, to be totally honest.
I like Nextcloud, but I'm debated.
The encryption in Nextcloud is still not
great,
so it's like I could have all my
photos end-to-end encrypted,
but then they don't integrate,
but then how much do I use the
integration?
So anyways...
I've used Addy IO in the past.
I've tinkered with Kaji a little bit.
I haven't really like used it personally.
I've used it to test it out,
but I've never used it in like my
day-to-day use to see how it would
integrate my workflow.
And I've looked into Notesnook.
One of these days,
I actually want to do a video about
privacy respecting alternatives to things
like Notion,
which Notion is already not terrible,
but there's so many open source,
like Obsidian, Notesnook.
There's one called AnyType, I think it is.
So yeah, Notesnook,
I looked into it a little bit as
a potential note alternative,
but I haven't actually used it myself.
How about you?
Do you have any experience with any of
these?
Um, yeah, I, I'm,
I'm also on the boat of maybe switching
to Entei.
Um,
but I haven't really like fully committed
to any of these photo backup platforms
myself yet.
Um,
otherwise I don't really use a lot of
these.
I do need to get better at, um,
note taking and maybe notes look would be
a good solution, but maybe that'll be my,
my new year's resolution this year and
I'll have to report back on what I
ended up doing.
Makes sense.
Yeah.
I've, I've been pretty happy with, um,
Addy, like all the ones I've used.
It's not like I didn't stop using them
for some, like, Oh,
they had this big problem, but, uh,
I don't know how many of them would
qualify to be listed on,
on privacy guides.
I know we have some really strict
standards, but for me, it was just,
I found other things that integrated with
my needs better or, you know,
my workflow or they were a little bit
cheaper or something, but.
Yeah, like I said before,
for better or for worse,
I'm kind of in the Proton ecosystem right
now.
And I'm thinking about changing it,
but I haven't yet.
So that's kind of where I'm at.
Fair enough.
I will admit I'm one of those people
that's constantly like,
I'll have a workflow that works.
Like let's say Nextcloud, right?
Let's say I'm all in on Nextcloud.
And then I'll have that moment where I'm
like,
but it's not really end-to-end encrypted.
So what if I did replace the notes
and then I go back to this system
where everything's like,
I've got my notes here and I've got
my photos here and I've got this here
and this here.
And then I'm like, yeah,
but I really miss next class.
I'm constantly trying different things and
going back and forth and it's awful.
I don't know why I'm like this.
All right.
Okay.
If that's all we have on that topic,
first of all,
I've been asked to let you guys know,
as a reminder,
that you can get this bottle on
shop.privacyguides.org.
Our next story,
we are going to talk about messaging a
little bit.
We're going to talk a little bit about
RCS and iMessage later,
but first we're going to talk about
Threema, which is an encrypted messenger.
It is not recommended by privacy guides.
I think historically,
I think they've added forward secrecy now,
but in the past they were missing it.
And I think there's a few,
maybe a few other shortcomings,
but it's not the worst messenger in my
opinion.
And yeah,
Well, for now,
it's not the worst messenger because they
have just been acquired by a venture
capital firm.
And this is called what is it?
I'm probably going to mispronounce this
comatose capital or comatose.
Maybe I'm not sure,
but I believe they are a German company.
I somebody mentioned in the the group chat
that this is actually not the first time
three months been acquired by a company
like this.
So
I think it was about five years ago.
They were acquired by another private
equity company.
So this is just a second private equity
acquisition,
but it has been kind of the case
for a while that they were owned by
this.
They weren't their own company.
Which on the one hand,
I could see that as an argument for
maybe this won't really affect the quality
of the product at all because they've
already kind of...
Although I don't want to take shots at
Threema because I think anybody who's
trying to make privacy and security...
is doing a good thing,
but I do have to be honest that
they are severely lacking on a lot of
basic features that other messengers
already have.
Um,
So yeah,
it's not the most feature rich platform
and it costs money for those who didn't
know.
It's five dollars one time for the
individual.
Like a lot of companies,
they have like an individual arm and they
have like a business to business arm.
I think the B to B one is
like a subscription.
But if you're just an individual user,
it's five bucks one time.
And that's a hard sell when I could
go download Signal, SimpleX, Session,
pretty much any of them.
So yeah, that's awesome.
It's already a hard sell to get people
to using it.
And like I said,
it is missing a few of the more
advanced securities features that we've
come to expect out of things like Signal,
like perfect forward secrecy.
But yeah, I mean...
I don't know.
Do you want to talk about why?
The price was always the thing that was
holding back Threema, I think,
from gaining widespread recognition or
recommendations in our community and on
our site.
I think even one of our criteria right
now, which are, of course,
always subject to change of people if the
community feels otherwise,
but I think we settled on we only
recommend free messengers because I think
while a lot of people...
in our community are willing to pay for
more private and more secure services with
something like a messenger or social
network or something along those lines it
really there there is a network effect and
the reality is you are going to want
to communicate with people who don't care
about privacy and security and aren't
going to pay for for a messenger like
this and so it was a very niche
um use case where where three would make
sense compared to something like signal
Or especially Simplex,
which doesn't even require a phone number.
But even in Signal's case,
I think most people have phone numbers and
most people expect that's a way to text
people on your phone.
And so slotting in Signal to replace those
messages makes a lot of sense for people.
It was definitely argued to me in the
past that Threema makes sense for people
who don't have phone numbers.
To acquire a phone number to use Signal,
for example,
probably costs more than the five dollars
that Threema costs.
You could argue that Threema is actually
cheaper than Signal from that perspective.
But I think the reality is most people
do have phone numbers and most people are
looking for free messengers.
And especially with the introduction of
completely free ones like SimpleX,
it was just challenging to recommend.
With a messenger specifically,
if we want to improve privacy in the
space overall,
we need to be promoting services that...
Everyone can use,
and you can get your entire network on
because that improves the baseline
security and privacy for everyone.
Whereas with Threema,
if it's only people who are willing to
pay for it,
you're only going to get people who
already care about privacy.
It's a bit like preaching to the choir,
I think.
I've never used Threema for this reason.
I think there's easier ways to reach me.
I think you've mentioned that you use
Threema in the past.
I don't know if you want to share
a bit about your experience with that.
Yeah, I mean,
I don't have much to share because I
haven't used it a lot.
I think I've only run into like one
or two other people who use it.
And honestly, even those people,
like after a couple months of chatting on
and off,
and they're not people I chat with every
day.
It's, you know,
people who are in the privacy community
who are basically like, oh, I have three,
I'll help you test it out.
And, you know, those semi articles like,
couple of times a month or something.
And,
and then after like four to six months,
they're just like, yeah,
I'm just gonna like go all in on
signal because that's where most of the
people I talk to are.
So I'm going to stop using this.
And, um, and like I said,
it's already missing so many things that,
you know, signal.
it has just like emoji reactions.
Like you're very limited to the emoji
reactions you can use on Threema.
I think they do have polls now,
but I think they're very limited polls.
It's just, I don't know.
It's just,
it's not as good of an experience.
And again, I hate to say that.
Cause I think, you know,
anybody who's trying to further privacy
and security, I think that's great,
but it's just,
it hasn't really been the best experience.
And going back to the payment thing,
I agree with you.
Like people are just so, and again,
I see the argument from both sides,
because on the one hand,
we shouldn't be conditioned to expect
things for free, right?
If it's free, you are the product,
which isn't totally true,
but it's a great shorthand.
And when we have so many free services,
nine out of ten times,
they're selling our data or they're doing
something like that,
something shady to monetize.
But on the other hand,
And it's good also that Threema has like
a business model, right?
Like you pay for the product the same
you would as anything else.
But at the same time,
that is such a hard sell to like
try and get, you know,
I always use my family as an example,
but to try and get my sister to
like, hey,
you should switch to Threema when,
you know, you have to pay for it.
It's missing a lot of features.
It's,
not the prettiest UI.
And this is coming from me.
I'm the kind of person that normally
doesn't even care what the UI looks like.
I have cubes right in front of me
right now, which is true.
So it's just a really hard sell,
unfortunately.
I agree with you though.
I think if I were to make the
shots,
I would tell Threema that they should make
their individual facing arm totally free
and they should just focus on monetizing
their business to business side
And that's how you should do their
business model.
You know,
there's like we see Telegram and now we
see Signal kind of venturing into
monetizing certain features of these
platforms where you can provide a very
good base service for free,
but then optional stuff,
especially for power users,
which are probably the core demographic of
what Threema is serving right now with
their five dollar pricing.
I think people will pay for those
features,
but they're not necessary for everyone.
And I think
for any messenger to take off your
experience,
I think really
validates the point I was making.
I think the background behind our criteria
that the messengers that we recommend on
our site have to be free basically comes
down to any of these paid messengers,
I don't really see them taking off as
more than a neat tool for a hobbyist
who's into security to mess around with.
But it's not going to get the kind
of mass appeal that you need from certain
products.
It's fine if
If, you know,
NT charges more than Google Photos,
for example,
because these aren't social platforms.
I can protect all of my data.
If other people aren't protecting their
data,
I think that's unfortunate and that should
be fixed.
So there's that,
but it's not going to affect me, right?
But with a messenger,
like the only thing I'm doing is
communicating with other people and they
might not care about security and privacy
as much as myself.
But I want to...
It benefits me when those types of people
can use these platforms and they simply
won't find pretty much any price worth it
for something that other companies can
provide for free.
So I would agree.
I would just hope for a different
monetization model.
I think there's there's room here.
I don't know if they'll do that.
Threema, like at this point,
they kind of seem a lot like Wire,
which used to be pretty widely recommended
in the privacy community, as you know.
But then they really pivoted after they
were acquired to be very business to
business focused.
And I can imagine Threema kind of
following that same direction where they
just focus on their business product and
kind of drop the consumer side of things.
Which would be a bit unfortunate,
but also I don't know how much three
month is currently adding to the landscape
at the moment,
so it is what it is,
I think there's a couple different
directions that they could go in and we'll
see if they do any of that or
if comment is capital.
is the type of private equity firm that
strips their acquisitions for parts and
completely shuts everything down.
You never know with these private equity
things.
That's usually what they do, yeah.
So yeah, if you're a Threema user,
I would be concerned by this acquisition.
But if you're not a Threema user,
which I would imagine a lot of people
are not,
I don't think there's going to be a
lot of impact in the privacy space from
this news.
Oh, gosh.
They own Petco.
Petco GmbH.
Okay.
Well,
that is not a good sign for Trio.
I would say, yeah.
GmbH, that's Germany, isn't it?
Or is that Switzerland?
I think GmbH is Germany.
I think there's a couple of different
countries in the EU that use that one.
Use that, yeah.
I couldn't tell you off the top of
my head.
Oh, nevermind.
They don't own them anymore.
They sold their majority stake in.
Okay.
Sorry.
I'm just poking around their website now.
Yeah.
Um,
I think I kind of came into the
privacy scene on the tail end of wire,
but I remember that too.
Wire used to be.
it used to be pretty solid.
It was,
it was much more polished than three
months and it was free and it didn't
require any, any private information,
but yeah,
they went all in on business to business.
I think maybe you can still download wire,
but they certainly don't make it easy.
And, um,
Yeah, it's unfortunate.
That was kind of the other big thing
I wanted to mention was, like you said,
venture capital firms â or private equity
firms, sorry.
Their whole â there's a podcast called
Stuff You Should Know that I love,
and late last year they did an episode
about private equity,
and it â
covered all of that.
Like that's usually,
that's their whole job basically is they
buy a company,
they make it run super efficient and by
efficient, we mean we fire everybody,
we triple the workload.
We, you know, it's, it's honestly,
it's like a corporate pump and dump scam.
I don't even know how they get away
with it,
but that's what a lot of them do.
So hopefully Threema can survive this.
Um, but I, I, I will say they've,
they've done a few really interesting
marketing stunts in the past that I think
have, uh,
done good things to raise awareness to
privacy.
Like
I still see sometimes they have a,
you can still access it actually.
They have a website where you can upload
a picture and it'll blur it and then
it'll put a banner on it that says
hashtag normalize privacy or regain
privacy.
That's what it is.
And that was part of an awareness campaign
they did a couple years ago.
And I think they also did something in
Europe where they rented an ice cream
truck.
I could be remembering the details of this
wrong,
but they rented an ice cream truck and
they were giving people free ice cream.
But in return,
you had to hand over personal data.
They would ask people for their phone
number or whatever and their date of
birth.
And it was funny watching people with the
ice cream cone and they're like, why?
No, no, here, have it back.
I don't know.
And they're like, yeah, exactly.
It's insane.
So why are we doing this with other
services?
So yeah, I do agree.
Overall,
they haven't really made a huge dent,
but I really appreciate the innovative
marketing stunts like that they used to
do.
I think those were super fun.
That is funny.
I didn't hear that story,
but I think we don't have to get
too much into this,
but it's really interesting how people
definitely treat the online space
differently than real life.
If people were asked for that on a
website,
no problem entering that information.
Your browser would probably autofill it
for you.
But when you ask this in real life,
people suddenly realize what's happening
here.
I don't know.
why people make that distinction in their
mind.
But that's a really funny way to kind
of realize that.
Yeah, really, really true.
Really quick before we move on to the
next story,
I'll address one comment that we got in
the YouTube chat here.
That was about this story before we move
on.
They asked about Jammy and if we've used
it.
That's not something that we've really
looked into too much on our website.
And I think...
like whenever i've looked into jammy in
the past that's more of like a video
conferencing service i know it has instant
messaging built in but i don't know how
usable it is in my mind it's sort
of like a a free software skype
alternative i think a lot of people um
will probably use something like signal
and either signal video calls or or jitsi
video calls instead of jammy that's
usually what i see recommended but if
Uh, if you have any additional questions,
do you want to share more about like
what you would use jammy for?
And if it makes sense for you,
I would encourage, um,
the user who asked this to, uh,
post on the forum about it and maybe
get some more, more opinions.
Yeah, I agree.
Not to spend too long on it,
but Jemmy is a name that I've seen
pop up from time to time repeatedly.
And I feel like it's hard because it's
not super popular.
I feel like for me as a not
very technical,
like I don't know any code,
I feel like it's really hard for me
to kind of get a good...
What's the word I'm looking for?
Get really good insight into how it
measures up to things like Signal or some
of these other alternatives.
So I would definitely like to know more
about it.
I'd like to know what is going on
under the hood that makes it better or
worse or what use case it's for.
I haven't found a lot of people using
it,
so I've never had a chance to really
test it myself.
But yeah, like I said,
it pops up from time to time.
So I would love to learn more about
it.
I just feel like I have a hard
time finding that information myself.
All right.
I believe...
Is it my turn to take the next
story or is it yours?
I can look at this.
Our next story is encrypted RCS.
Signs of that were spotted in the iOS
twenty six point three beta.
So the article that we have was actually
posted by Freya on our site as a
news brief reporting on a few different
sources.
Basically,
people have discovered in the iOS twenty
six point three beta some settings that
indicate carriers will be able to enable
end to end encryption for RCS messaging
and indicate that in iMessage.
So that's pretty exciting news for people
who have been following RCS support on iOS
for decades.
a while um because of course right now
it is all not encrypted and apple said
that they weren't committing to using the
same sort of encryption standard that
google is using right now in google
messages on android because it was
something that google developed on their
own instead of working with gsma to create
like a standardized encryption protocol
for all these platforms and services to
use but now um there is a new
standard it's called messaging layer
security or mls and that's
what RCS is going to be using in
the future.
And I guess that's what's being added to
iOS.
So the appearance of this stuff in the
iOS beta doesn't indicate that it's coming
in the iOS twenty six point three release
necessarily that could come with this code
still disabled, for example.
So we might not see encrypted RCS right
away,
but it is a sign that it is
actually coming at some point.
They're actively working on support for
it.
And I think that people who
are on iOS right now or who are
on Android and use Google Messages and
chat with people on iOS,
are going to be excited about this because
there's definitely a lot of benefit to
encrypting all of your messages.
RCS definitely is not the ideal messaging
platform for a lot of reasons.
There isn't a lot of production of your
metadata,
like who you're chatting with and that
sort of thing compared to something like
Signal, for example.
So we're still going to recommend a lot
of different,
more secure and more private messengers on
our site that we would recommend
you use.
But especially in the United States,
I don't know how much of how much
this is the case in other places.
I know a lot of other countries just
standardized on various messengers like
WhatsApp or whatever.
But texting is extremely common here.
And it's definitely used around the world.
And
It's easy for a lot of people,
and people just default to it.
And so improving, again,
kind of what I was talking about with
Threema earlier,
I think anything that improves the
baseline security of all of these people
who don't care about privacy and security
and who aren't seeking out private and
secure alternatives like Signal,
it's still a good thing.
It's a step in the right direction,
even though it's not the best you could
be doing.
A lot of people rely on this,
and it's going to benefit a lot of
people.
So hopefully...
This is a sign that this will come
in the final release sooner rather than
later.
But I guess time will tell when this
will actually come out.
So I don't have too much to add
to this, but just to clarify,
and you may or may not know this,
you said, and the article says here too,
that it's a carrier setting.
So does that mean the carriers would have
to choose to opt into this,
like Verizon and T-Mobile?
Most likely.
This is definitely the biggest bummer with
RCS.
RCS...
Right now,
it can be implemented in two ways,
you can kind of do everything yourself as
a carrier and add support for it and
interoperate with other carriers that are
using the universal profile,
but it is much like texting it's a
carrier based platform or.
The other thing you can do with our
CS which a lot of carriers do I
don't remember which ones in the US do
this,
but I think there's a list on Wikipedia
or somewhere that I could find,
but a lot of carriers.
don't run RCS and they purchase a service
from Google that does it for them.
And so the reality behind RCS right now
is that Google is actually running all of
the service behind it for I think the
majority of people,
but if not the majority,
definitely a lot of them.
And so it's basically just a centralized
Google Messenger right now that your
carrier is kind of promoting on your
phones.
So obviously, from a metadata perspective,
that gives Google a lot of data,
but also it is, yeah,
there's a lot of middlemen involved here.
It's not just like an over-the-top service
that these tech companies are working on
together.
It's integrating with the traditional
carrier platform.
And whether you're going to Google servers
or whether you're going to the carrier
servers,
that is something that the carrier has to
set up on their end, which is...
Yeah, I agree with your reaction.
A bummer.
Yeah.
Cause I,
I feel like it's going to be a
challenge to get carriers to go ahead and
roll this out.
Like,
I feel like if Apple did it or
even Google,
if they did it at the phone level,
it would just, they would do it,
but I feel like carriers have very little
incentive and.
Kind of going back to what you said
earlier at the beginning when you were
covering this,
I agree with you that we look at
something like iMessage and people who do
not care about privacy or security,
who use the I have nothing to hide
argument liberally,
these are the same people who are using
iMessage.
And they're getting end-to-end encryption
just talking to each other without even
knowing what it is or knowing that it's
enabled.
And so, yeah,
it would be really cool if RCS could
roll out
to the general public and be available for
everyone cross-platform.
But I guess the only thing I could
see maybe as incentive for the carriers is
I know that RCS also comes with a
lot of those quality of life features that
iMessage is known for,
like bigger attachments and reacting to
messages and stuff.
So maybe we'll get lucky and maybe
carriers will roll it out because of the
features and the privacy and the security
will just be an added bonus.
But
yeah um yeah at the moment i do
think there's a lot of pressure and i
think apple adding rcs better rcs support
is going to add even more pressure for
these carriers to support it because like
it i'm in one group chat with some
family members on rcs right now and it's
very nice to be able to see like
read receipts and and like
typing indicators and all the normal group
stuff that you don't get on SMS because
SMS is a terrible platform.
And so there have been some improvements
there.
And I think people will realize that,
especially if they're in chats with RCS
users,
and they will eventually demand carriers
do it,
especially in the US where like texting is
so common.
I don't know how it'll be
in places where people don't use SMS in
the first place.
Maybe there's less incentive to use RCS,
but I think at least for a good
amount of people,
there is pressure to support it,
which is all right.
Like I said, it's not my favorite,
but it increases the baseline,
especially if this gets included.
So I'm hopeful that we'll see wide
adoption.
Yeah, same here.
Um, I think actually I'm going to,
I'm going to keep on the Google and
Apple thing and I'm going to go to,
we have a story here about Google Gemini
is going to power Apple's AI features such
as Siri.
And yeah, so, oh man,
this is kind of a confusing story for
me because,
so Apple's been trying to roll out their
Apple Intelligence,
clever little bit of marketing there,
which is just on-device AI.
And-
Man,
I know we've talked about AI so much
already tonight, but again,
on the user end,
from what I've been understanding,
it seems relatively private.
A lot of it is going to be
done on device.
And I think Apple actually has a very
similar architecture to confer.
Jonah can definitely correct me if I'm
wrong,
but I think they have a very similar
architecture where they try to run
everything in these trusted modules and
they try really hard to make it as
private as possible.
And Apple has been running into a lot
of delays rolling out their Apple
intelligence thing.
And,
One of the few things I don't like
about TechCrunch is they're very sparse on
technical details here.
But basically,
they say that Apple and Google have signed
a deal where Google's Gemini is going to
power at least some of the AI features.
And the headline specifically says,
like Siri, for example.
This is not an exclusive deal,
according to this article.
So Apple may...
Um,
potentially this is me speculating Apple
might tap, uh, you know,
like Claude for something else or,
you know, whatever chat GP,
I think originally they did contract with
chat GPT.
So yeah, it's again,
it's very sparse on technical details as
far as privacy stuff goes.
It just says here in the article that,
uh,
Apple has focused on privacy with its AI
rollout with much of the process happening
on processing happening on device or
through tightly controlled infrastructure.
Apple says it will maintain these privacy
standards through its partnership with
Google.
That's kind of all they said.
So, yeah.
I don't know.
What do you think about this?
There's a lot going on here.
Okay.
So, yeah,
I know Apple says that they are going
to maintain their privacy standards.
which to their credit the things that
apple have has been working on lately to
my knowledge they were kind of the first
to go in this private compute direction
that um confer the ai company we just
talked about earlier in the show and that
maple ai and that other people are doing
i think google was i mean i think
apple was kind of the first to create
this and they kind of have a
big advantage compared to their
competitors in the sense that they can
build their own hardware and CPUs to make
the security more robust rather than just
relying on these off the shelf solutions
from Intel and AMD or Nvidia, for example.
Something I want more clarity about when
it comes to how this will work is
like what exactly Google's involvement is.
I saw a lot of rumors that this
would happen leading up to this
announcement where people were basically
saying that Apple and Google came to
an agreement where like Apple would get
access to Gemini's models basically and
they could create their own models based
on that or add additional training data or
whatever and they could run everything
themselves on these private compute
servers that they have.
So it isn't like the current
implementation that Apple has right now
with ChatGPT where Siri will sometimes
offload your request to ChatGPT and just
send it over.
In theory,
if Apple is running all of this and
keeping it on their cloud and they're just
using these models that Google has created
and that's what their partnership is,
Keeping everything in one ecosystem and
not giving more data to Google, I think,
is an improvement for sure.
But all of this private AI stuff,
no matter how it's implemented,
has all of the problems that we talked
about earlier on in the show and the
problems with AI in general.
And I don't think that Apple's private
compute is going to be at a level
of privacy...
and security that I would be comfortable
with using for anything serious if I was
going to use AI at all.
And that's unfortunate because I think
that Apple is kind of doing the best
you really technically can do from the
security perspective if you want to get
back into the technical specifics of how
AI works.
But the best that's possible right now
with our current technology isn't
good enough in my opinion for people who
are serious about their privacy and
security and, um, any of this cloud stuff,
like I think it sets a very dangerous,
um,
path that we are going on with technology.
Because it seems like all of these tech
companies like Apple and especially like
ChatGPT or Google,
what they're trying to do is offload as
much as possible to the cloud.
And in doing so,
they're making normal hardware for people
more expensive.
We talked about this a few episodes ago,
and I know there was a news brief
about the RAM pricing,
which is
crazy right now because all of these data
centers are buying it up.
And what's really happening is people are
being priced out of the market where you
can own your local compute.
And that's a trend.
I was sharing this, I think,
in one of the group chats we have,
but it's a trend that we really see
in society at large for many years.
People were
priced out of the housing market.
I know that's a hot topic,
especially all around the world right now.
People are being priced out of even the
car market.
So many more people are leasing before or
people are just relying on things like
Uber or Lyft.
I know Tesla really wants to do this
with their robo taxis where people won't
own cars generally.
They will just rely on other people who
own cars to taxi them around.
I think that that is the direction that
tech companies want
everything to go in because they can
control all of it and they can create
this subscription model that you have to
pay for and local compute is kind of
going away and I think that's very scary
and dangerous because we're really they're
really forcing everyone in this position
where everyone's going to be locked in as
rent seekers on all of these platforms and
won't have any agency over
Over anything anything that's doing
computers all of these computers are just
going to be thin clients for the cloud,
which is extremely unfortunate it's not a
direction that I think people should
should tolerate.
And I guess i'm having a camera issue,
but whatever hopefully you can see me but
yeah that's my.
Concern with with all of this.
Yeah, no, I, I agree with you.
Cause even it's, it's this whole,
like everything on the cloud is even from
a practical perspective,
like I swear I'd have to go find
it,
but I swear I read a story several
years ago about somebody who rented a car
and they were in like Arizona.
And they couldn't start the car because
the car couldn't get cell signal to call
home and do whatever stupid checks it had
to do to like verify that they could
start the car.
And just things like that are just so
it's, it's a practical perspective.
You know,
what happens when the power goes out?
You know,
that's a very common scenario we've all
been in what happens i mean i guess
when the power's out you're not really
using computers but you know what i mean
or even your phone yeah what happens when
the power goes out and now the grid
is overloaded with everybody texting and
everybody checking twitter to be like oh
what's happening does anybody know why the
power is out and you can't do anything
because you have like you can't make that
connection to the the server for whatever
license you're supposed to have and it's
just it seems like such a
like I get it on the one hand,
right?
Like I love the cloud in the sense
of like, I, you know,
if my computer crashes,
I have a copy of my data or,
you know,
to not have to destroy my own CPU
doing this.
God,
I wish I could render videos in the
cloud and not have to destroy my GPU
to do it.
But, you know,
it comes with practical drawbacks of just
that, that,
resilience, you know,
what happens when AWS knocks out a third
of the internet traffic or cloud flare,
whoever.
And it's just, yeah.
I mean,
I feel like I've seen that multiple times
just in the last several months of like
some major outage and all my friends in
discord are just like, well,
I guess I'm just gonna like, you know,
take an extended lunch today or something.
Cause I can't do anything.
Cause the cloud's out.
My whole job is on the cloud and
Yeah,
it seems so very short-sighted in the name
of profits,
which I know is so hard to believe
that tech companies would do that.
But yeah, I don't like it either.
It's horrible.
I don't have much else to add to
that one.
Yeah, I think...
That's kind of all I have to say.
We did have one more discussion question
for that topic about did Google win kind
of this AI thing despite being ruled
against making anti-competitive deals in
court?
It's a really interesting case, I think,
this one.
And again,
I want to see more about this because
you know,
if Google is actually like controlling all
of the stuff that Apple is doing behind
the scenes, that would be very concerning,
especially from an antitrust standpoint.
But if it is a deal where Apple
just kind of building on their work,
but they're doing it themselves,
that's pretty typical of Apple across
their software and their hardware.
I mean,
most of like Apple's advances in hardware
come from like Samsung making better
screens and that sort of thing.
And if it's a situation like that with
Google,
It's probably not a huge anti-competitive
concern,
but if Gemini branding is going to be
prominently featured and stuff,
and Gemini is kind of buying their way
into being the AI company that people
think about, yeah,
it is a weird situation for Google to
be in.
So definitely something I hope antitrust
people keep an eye on,
but I don't think they have much teeth
at the moment against these big tech
companies.
Sadly true.
Just to add on to that,
I don't know much about a Google AI
antitrust lawsuit,
but it says here in the TechCrunch article
that Google and Apple specifically have
faced lawsuits.
In August,
a federal judge ruled that Google acted
illegally to maintain monopoly in online
search by paying companies like Apple to
present its search engine as the default.
So I don't know.
Yeah, this could...
Hmm.
I don't know.
Yeah.
I guess now that I think about it,
I could see a scenario like Europe saying,
Hey,
you have to offer other models or
something.
But like you said,
that may only be the case if Google
is maintaining everything.
If like you said, if Google's just like,
okay, here's a copy of our model,
go host it on your server and do
whatever, then I don't know.
I mean,
I would still argue that's Apple being
monopoly,
but governments seem to be a little bit
easier on that.
Yeah.
I mean, and it still has, um,
troubling implications, I think,
for the AI industry.
Because whoever trains these models,
they have a lot of control over what
the AI does.
And so they can definitely shift things to
show up in certain ways or prioritize
certain responses.
I don't know what these AI companies could
do,
but it does give Google a lot of
power either way.
Agreed.
All right.
Let's see.
I think this is our...
We have another news story before we move
on to forum updates here.
But this is from Ars Technica.
Never before seen Linux malware is far
more advanced than typical.
Void link includes an unusually broad and
advanced array of capabilities.
So basically this article from Ars
Tactica,
it kind of dives into this new Linux
malware that can infect Linux machines and
it has a lot of advanced capabilities that
attackers can use to perform various
things on your computer.
I feel like we've talked a bit about
malware on Linux in the past.
I think this is a trend that's only
going to continue,
especially as more people adopt Linux.
The reality is all of these malware
targets or malware developers are going to
target the platforms that most people use.
And so if we see more people adopt
something like the Steam Deck or more
people adopt Linux on desktop because
gaming is getting better or because they
want to escape...
all of the copilot nonsense in Microsoft
Windows or for whatever reason,
we will see Linux become more and more
of a target
just inherently, I think.
And so we're going to probably see more
articles like this.
But it does demonstrate what I think a
lot of people in the privacy and
especially the security community have
been saying about Linux and desktop Linux,
especially for a while,
which is that I think Linux does have
a good ways to go as far as
defending itself against
malware like this i think linux has for
a very long time greatly benefited from
not having a very big market share on
desktop people will always say you know
linux has very high usage on the server
and so therefore there should be more
malware for it based on that but that
isn't true because the desktop ecosystem
is just a very different um
threat landscape,
you're running so many different
applications,
you're running like web browsers,
especially that's downloading arbitrary
code from the internet,
anything that you're just doing, random,
whatever desktop things on is going to
have a much
larger attack service than something like
a Linux server.
If I set up a Linux server,
it's only going to do whatever I install.
And so the attack surface is very small,
and that's why you haven't seen a lot
of malware targeting these Linux servers.
But yeah, this is...
I think that's basically my only point.
I think this is a trend that we'll
continue to see.
So I hope that Linux distro developers and
the Linux kernel product take security a
bit more seriously because there are
security features that we see on
mainstream big tech platforms like Mac OS
and Windows that Linux still could benefit
from.
And it hasn't seen much of a focus
yet, unfortunately.
Did you have any takeaways from this
article when you read through it that I
didn't cover, Nate?
Well, kind of to add to that,
because I think your takeaway is spot on,
like Linux needs better security.
I don't think there's a lot of people
that would argue that,
that know what they're talking about.
But no, it's interestingly,
this kind of plays into what we were
talking about right before we transitioned
to this story, because it says that...
This particular malware is actually aimed
at servers.
It's specifically aimed at virtual
machines and stuff,
and it can detect popular hosting
providers like AWS, Azure, Tencent,
and they say that there's indications the
developers are gonna add detection for
Huawei, DigitalOcean,
And it's very modular.
So that's kind of been one of Linux's
saving graces, I guess you could say,
is because, you know,
when you buy a Mac,
you're buying the entire device, right?
And like when you're buying Windows,
you're generally buying,
it's a little bit mix and match,
but generally there's, you know,
a handful of people make the chips and
a handful of people make, you know,
the RAM and all that, even less now.
But it's, you know,
Linux machines are so varied in their
hardware and their capabilities and what
they're designed for,
like you were saying.
And
So this one is very modular,
and it can do all kinds of different
things depending on what type of machine
it's on and what,
if I'm reading this right,
and what the attacker needs it to do,
which is really interesting.
And kind of just to back up what
you were saying about we're going to see
more of this, the article says, like,
similar things have targeted Windows
servers for years,
but they're less common on Linux.
And, you know, like I said,
this goes back to everything.
This goes back to Linux needs better
security.
This goes back to...
Was I saying resilience?
Because if the VM that's hosting my app
goes down, can I use the app?
Oh, man.
This was a good story to end on,
I think,
because so many things come together.
And yeah,
is it going to take down AI data
centers now?
How are people going to live without their
AI chatbot telling them what kind of
coffee they want?
So yeah, I think they'll survive.
Oh, I don't know, man.
But, but I, I can't pick between the,
the, the hot coffee and the cold brew.
I don't know.
I got nothing, but yeah, it's,
it's really, and I agree.
I agree with you a hundred percent on
your takeaway that we do.
I,
I always hate telling developers what to
do because I'm not a code person and
I would love to know code.
I'm trying to learn code for the record.
That's one of my goals this year is
to learn at least Python.
I feel like that's a good foundation to
start with.
And I feel bad saying like, oh,
you should go do this thing when I
can't really contribute to that.
But it's, you know,
privacy and security are, you know,
Kerry Parker from Firewall's Don't Stop
Dragons,
he likes to say that privacy is a
team sport.
And like you were saying with the
messengers,
and when we do things that raise the
default level of privacy and security,
it, it raises everyone with it.
What's the phrase?
Like a rising tide lifts all boats.
And so it's,
it's not me trying to sound entitled and
be like, well,
these developers need to do what I want.
It's like, no,
like if we put more emphasis into
security, everyone benefits by default.
And,
Yeah,
clearly the article backs up what you were
saying about we're just going to see more
of this,
whether it's on the server side or the
desktop side.
Yeah,
my wife now has two Linux devices because
she now has a Steam Deck and a
Pop!
OS machine, which, quick side note,
when she got the Steam Deck,
I took great joy in telling her,
now you can tell people I use Arch,
by the way.
So I had to make the joke.
Yay!
I feel accomplished tonight.
Yeah, that's all I got.
Just kind of backing up what you were
saying.
Let's move on to some form threads that
have been popular this week.
I think one that has gotten a lot
of discussion over the past few days was
about Mailbox,
which is recommended on our site as an
email provider.
There's this thread on the Mailbox form,
basically,
that was also linked on our form for
further discussion,
talking about
um some issues that people are having with
guard and mailbox if if you're unfamiliar
or haven't checked their website in a
while mailbox recently um
went through a whole refresh.
It seems like they redesigned their whole
website.
They refreshed all of their apps.
And it seems like they might have changed
development.
And so unfortunately,
this isn't something I would say that
we've gotten a great chance to take a
longer look at.
but um i would ask anyone who like
uses mailbox right now if you have any
experiences with things changing or um
potential problems with this new version
definitely let us know in this forum
thread because um it's something that we
want to keep an eye on i know
we have a couple team members um who
do use mailbox i don't personally but um
we
we're gonna have them look into some of
these things and hopefully find out more
about what's going on but yeah it's
according to these the users on these
forums um there's potential security
issues it seems like with um with guard
which is their um tool that basically
encrypts all of your messages pgp so it's
important um and i guess it's uh
leaving behind traces,
even after you log out on a machine,
that seems to be the main gist of
the issue.
So again,
that's something that we'll want to
validate,
but it's something you might want to be
aware of if you are a mailbox user.
And hopefully we'll have more information
to share on that soon.
I think that kind of covers it.
Did you see any comments in this thread
that you wanted to cover?
No,
I just wanted to back up what you
said about if anybody is a Mailbox user
who can kind of shed some light.
Because it very quickly devolved.
I don't want to say devolved.
That's not the right word.
It very quickly turned into people
discussing Proton and Tudor and some of
the features they offer.
Because a lot of people were like, oh,
I use Mailbox because it has this feature.
And people were like, well,
Proton offers that.
And they say, oh,
but I don't like that it doesn't do
this.
And they say, well, Tudor does that.
You know, which is fine.
It's totally fine.
But it kind of...
As an outsider coming in who's never used
Mailbox,
I'm kind of looking at this and I'm
like, so what is the issue?
Like,
I actually asked Jonah that before we
started recording.
I was like, what is Guard?
What is going on?
But yeah, and it's also interesting.
It's not necessarily related,
but we did kind of note that Mailbox.org
appears to have really facelifted their
website.
So...
Which it looks great, for the record.
Looks super modern, super slick,
very awesome.
But it does seem that they've done a
lot of things,
both on the user end and behind the
scenes.
And yeah,
I think we're just trying to get a
better idea of exactly what's going on
here.
And if there is anything to be concerned
about,
we definitely want to make sure mailbox
users know.
We want to make sure that we know,
so we can see if there's any concerns
that affect our recommendations,
all that kind of stuff.
Yeah,
all of those mailbox changes are
relatively recent,
so it sounds like they're more extensive
than I had thought when they first
announced that.
For sure.
All right.
Did we have any other forum threads you
wanted to discuss,
or should we turn it over to questions?
I don't think so.
I think we can look through the chat
and see if anyone had any questions for
us this week and the forum thread as
well.
Let me get it pulled up.
But if you have any,
you want to highlight right off the bat,
definitely get started.
Let's see.
I'm looking through the forum thread right
now.
You,
I don't know if we do have any
answers to this.
One of our members bits on a,
Bits on Data Dev says,
referring to the headline story,
the confer AI, he says,
where do the trusted execution
environments run?
They'd be more trusted if I knew where
these were and how they're insulated from
the surrounding environment.
For now,
I can't seem to find much info on
it.
It's Marlin Spike,
so I feel pretty sure I can play
with this for fun,
but I'm not about to have a therapy
session with it anytime soon,
though that should never be the use case
for AI in an ideal world.
Thank you for getting one step ahead of
me there.
Yeah, I don't.
Unfortunately, correct me if I'm wrong,
but I think a lot of what we
know either comes from like that article.
I don't know if Moxie's done any direct
interviews yet,
but there's reputable sources like Ars
Technica, for example.
But there's also,
I think I mentioned it at the top,
but I may have accidentally stumbled over
myself and rushed through it.
If you go to confer.to,
which is their website,
and I think right at the beginning,
it prompts you to log in.
There is no like free tier for this
thing.
But it says on that login page,
it's like, oh, click here to learn more.
And he has three blog posts.
I do remember now, I did say this,
where he digs in a little bit more
to the details.
I don't know if he gives you that
level of detail that you're looking for,
but if you have any more technical
questions, I would start there for sure,
because that blog post gets very
technical.
Yeah,
that's probably a good place to look.
I haven't seen where Confer is hosted
specifically,
if you're talking about the hosting
provider side of things.
Typically...
Like I know with Maple AI, for example,
they run on Amazon Web Services and Amazon
is selling a service right now to people
who run this sort of product where you
can rent access on these trusted execution
environments that are hardware validated.
And I know Intel and AMD have this
Intel...
Notably,
Signal has been using Trusted Execution
Environments for things like contact
discovery and other features if you've
seen any of their integrations with
Intel's platform on their blog.
So that's the sort of thing that this
is like.
The trusted executed environments, yeah,
they're running on various providers,
and it's mainly relying on the hardware to
isolate that environment from the rest of
the stack.
However,
and I know that we talked about this,
because I remember talking about this in a
previous episode.
Maybe we can find that and link it
after, but I...
problem with all of these things is that
like they aren't fully validated yet and
protecting against physical access like i
said earlier is not something that they
were designed to protect against in the
first place now they're kind of being used
for that purpose maybe we'll see
improvements
to that end i don't know but like
at the end of the day vulnerabilities um
in these platforms have been found before
one was found very recently because we
talked about it on this show and other
ones have been found in the past and
very often um but not always but very
often
They do rely on some sort of physical
access,
but it just kind of shows that like
these aren't the best protections against
people who have physical access to the
machines.
You can't fully rely on them for that.
And the only thing that they can really
do is kind of isolate the code that's
running and also
in theory,
validate the code that's being run.
But the code that's being run could be
anything.
It could be code that's spying on you,
for example.
And if that's running in the TEE and
you don't know it,
what protection is it really giving you?
None at all.
And so I think in this case,
like with Confer,
I believe everything should be open source
so people can audit this.
But are people auditing the code that's
being run in these trusted execution
environments across the board?
I don't really know if that's the case.
I don't know.
What Confer has done about that,
but I don't think that's happening with a
lot of these other companies who are doing
similar things to Confer.
Totally agree.
But a quick note,
I don't know if you remember in the
or if you saw in the original article
about Confer,
the Ars Technica one we spoke about at
the top.
Towards the bottom,
it talks about how he's actually offering
remote attestation.
or I don't know how to pronounce that
word,
but how you can remotely verify that the
code is running on the server,
that it has not been tampered with and
that there is no additional code.
Um, I,
I don't know to my non-technical brain,
that sounds like a big claim.
So I don't know anything about that,
but I'm just saying they did say that's
a thing at least with confer.
Yeah.
And, and we see this with other, um,
Similar platforms as well.
I just keep bringing up Maple because it's
the only one that we've...
talked about on the forum a bit,
but they have cryptographic proofs that
they publish on their website as well,
where you can ensure that you're talking
with their secure servers.
But what does that tell you about the
code that's actually being run on it
itself?
That is unclear.
And that's the main thing that I would
caution people against.
Just because you know that you're
interacting with a trusted piece of code
doesn't mean that the code is trustworthy.
It really depends.
like, they don't even have to be like,
confer doesn't have to be malicious to
have bugs in their code.
There's buggy code all the time.
And so it's not a guarantee by any
means that there's no way to get your
data out of this.
And yeah,
that's the kind of thing that I would
be very concerned about.
I don't really know how what you're
describing would, um,
work in like a web-based client like
Confer because then we get into another
issue where we talk about this on our
website with end-to-end encrypted web
applications like Proton where Proton
could in theory send you a totally
different version of the website that like
runs JavaScript that decrypts your data,
for example,
and they could do it surreptitiously where
it would be very difficult to detect that
they're doing it.
I mean,
unless you're like going through the
inspect element source code and you're
looking at all the JavaScript and you're
seeing if it's different and then you just
have to assume
they're targeting you and they didn't just
push out an update.
Like that's the kind of thing that's very
hard to detect.
And I don't think Confer can really do
anything about that without a native
client.
I think going back to Apple's AI
implementation,
if we want to talk about the security,
their private compute,
be a bit better against this because they
can run code on in your operating system
like on ios that validates the servers
that they can't i mean if they implement
this properly apple everything is
proprietary so who knows what they're
doing you can't you can't really trust
these platforms either but i'm just saying
in theory running a native client there
could be some validation involved but with
something like a web app like confer
If they change the server,
they want to redirect you to a malicious
server,
they can just give you a different version
of the website that connects to this
malicious server and says, yep,
the server's verified.
It's all good.
And how would you know otherwise?
I don't think that would be very easy
for most people to detect.
So yeah, all of this private AI stuff,
if it's running in the cloud...
and not locally,
I wouldn't really trust it.
And that is the main reason that on
our website,
we do have some AI recommendations.
But if you're going to use AI at
all,
we only recommend local AI models at this
time because it's really the only way to
ensure that your data that you're
inputting into it isn't going to be
monitored or logged by other parties.
That's just the reality of the situation
at the moment.
Fair enough.
Here's another question about Confer from
the forum.
Do you think Confer's way of doing AI
is something other AI products will follow
suit,
and how difficult would it be for existing
AI products to migrate that?
I would say...
I think that it's likely that other AI
products will do this.
It does seem like NVIDIA is putting more
resources into this trusted execution
environment from what I've seen in their
GPUs for AI data centers to use.
Again,
like I said a few times on this
show already,
what Conferred is doing isn't super new.
We've seen it from other companies like
Maple and like Apple.
I think confer could be doing a better
job.
They probably have more security minded
people behind it.
I don't know.
I haven't looked too much into it,
but like it's, it's,
it's something that has been done before.
It's something that I think we'll probably
continue to see happening.
Um, and as far as I know,
there isn't much stopping AI companies
from, from implementing this in hardware,
especially as the hardware supports this
and gets better.
Um,
So I don't know why most companies like
ChatGPT or OpenAI would be incentivized to
do this.
It seems like they're perfectly happy to
just have all of your data.
So I don't know if it will happen,
but it definitely could happen for sure.
Yeah, I agree.
It's the incentive thing for me.
I'm sure, as you noted,
there's already other companies trying to
do this and trying to create those private
alternatives,
but
As far as the ones that are around,
the OpenAI, Anthropic,
I don't see what their incentive would be
to do it.
We did have one more quick thing in
the forum.
It's actually a shout out from,
we have a pretty active member who goes
by Nombre Falso.
And he said,
there's an age verification bill making
its way through Florida.
SB four, eight,
two would require you to verify your
identity to use an AI chat bot.
But he makes a pretty good point that
with AI getting so integrated into things
like Gemini, for example,
where Google's rolling it out to every
part of their product system,
does that mean that eventually they can
make the argument that you have to verify
your identity to use Gmail?
So pretty concerning stuff.
And if you're,
In Florida,
definitely go check out that link in the
forum and learn more about it.
I only have access to the YouTube chat.
I'm not sure if we've missed anything in
some of the other chats,
because I know we're live streaming to a
few different platforms right now.
I don't believe we have.
So I guess we can do kind of
a last call for any questions if people
are still wondering about anything.
Otherwise...
It looks like we've gotten through
everything on the forum.
Yeah.
I'm not seeing anything in the YouTube
chat that we haven't already addressed.
There's the question about Jami.
We did have a new member sign up
tonight.
What is that?
Oh, man.
I don't know if I can pronounce this
because I think this is a Greek name.
Ionis Karopoulos.
But they became a member on YouTube
tonight,
I think at the beginning of the stream.
And I think we missed that.
So thank you so much for signing up
and supporting Privacy Guides and our
mission.
Really appreciate it.
We got another question in the chat from
unredacted.
Any update on the bad internet bills that
we had talked about?
As far as I know,
it's been pretty slow over the holidays.
I haven't seen any new news,
but they are continuing to advance.
I haven't seen any good news in that
direction either.
And I don't think...
No news is good news in this case.
I think no news means that they're working
on things behind the scenes to continue
pushing it through.
So yeah,
when we see more updates on that,
we'll definitely be sharing on our social
media and keeping people up to date.
But I don't know.
It's hard to keep track of all of
the many vacations that Congress feels
welcome to take away from their jobs.
And so I don't know if they're actually
doing anything right now over in
Washington or if they're just kind of
lounging around for the winter.
So that could have something to do with
it.
Yeah.
But yeah, if there's updates,
I'll let you know.
Yeah,
it looks like Congress reconvened on
January fifth, if I'm reading this right,
the subcommittee markup of six bills.
It says that's the Committee on Energy and
Commerce,
which I think is what a lot of
these bills fell under,
if I remember correctly.
Yeah, they met up yesterday, actually.
And next meeting was scheduled today at
three.
So three p.m.
So, I mean, theoretically,
if anything happened,
hopefully we should hear about it any day
now.
It could be ongoing right now.
Maybe that's the update.
You know, that's true.
For all the hate that politicians
rightfully get,
they usually do work pretty late when they
have these meetings.
So, yeah,
they might be talking about it as we
speak.
Everybody, uh, focus real,
real hard and we're going to send them
a message to tell them to stop being
stupid.
Please.
Yeah.
Jokes aside.
Um, yeah.
Underdacted said, thanks.
Hard to keep track these days.
Yeah.
Trust me.
You're telling me there's so much to keep
track of and, uh, but all righty.
Well,
I think that kind of wraps everything up
then Nate,
do you want to take the outro here?
Sure.
I can do that.
So all the updates from this week will
be shared on the blog.
So if you are not signed up yet
for the newsletter, go ahead and do that.
Or you can of course,
subscribe with your favorite RSS reader.
For people who prefer audio,
we also offer a podcast available on all
platforms and RSS,
and this video will also be synced to
PeerTube.
Privacy Guides is an impartial nonprofit
organization that is focused on building a
strong privacy advocacy community and
delivering the best digital privacy and
consumer technology rights advice on the
internet.
If you wanna support our mission,
then you can make a donation on our
website, privacyguides.org.
make a donation click the red heart icon
located in the top right corner of the
page you can contribute using standard
fiat currency via debit or credit card or
you can donate anonymously using monero or
your favorite cryptocurrency becoming a
paid member unlocks exclusive perks like
early access to video content priority
during the live stream q a you'll also
get a cool badge on your profile in
the privacy guides forum and the warm
fuzzy feeling of supporting independent
media so thank you guys so much for
watching and we'll see you next week
thanks everyone