The Kallax OS comeback, the Canvas chaos,
and Google Chrome's sneaky AI downloads.
All of this and more is coming up
on episode of this week in privacy.
So stay tuned.
Welcome back to This Week in Privacy,
our weekly series where we discuss the
latest updates with what we're working on
within the PrivacyGuides community and
this week's top stories in data privacy
and cybersecurity.
I'm Nate, and with me this week,
after several weeks of absence, is Jonah.
How are you doing, Jonah?
You know, I am doing great this week,
and I'm always doing great to be back
on the show here.
It's always fun.
How have you been doing, Nate?
Pretty good.
As you know,
lots going on behind the scenes here.
Lots of videos coming up.
We'll talk about that later.
But yeah,
I've just been keeping really busy working
on everything we got coming up.
Absolutely.
Well, let's get into it then.
All righty.
Yeah.
So let me swap the tiles here.
Oops.
Our first story this week is about Calix
OS.
So full disclosure,
we do not recommend Calix OS here at
Privacy Guides as one of our...
as one of our recommended, uh,
Android distros, but it is still popular.
Nonetheless,
they do have a heavy emphasis on, um,
open source, I would argue.
And, uh,
like that's kind of their whole thing is
a lot of the stock apps they swap
for, uh, open source apps.
And we'll,
we'll talk about that a little later.
But, um,
for those who may not be aware,
Calix OS actually, uh,
went on hiatus in august of last year
which is crazy to think about that it's
been that long um but uh they went
on hiatus uh they assured everybody they
were like hey there's no signs of
compromise or anything but um they had two
major staff members leave they had nick
merrill the founder and uh i don't know
how to pronounce his name cheerio decide
if i remember correctly um
But he was like their,
their lead developer and both of them
parted ways from the outside.
It seems very amicable there.
There was no accusations as far as I'm
aware of from any of the team members
towards anyone else.
But either way,
Calix decided they're like, Hey,
we're going to use this opportunity to
completely revamp our entire
infrastructure.
We're going to rotate signing keys.
I believe they went and bought a hardware
security module.
They really ramped up a lot of the
behind the scenes infrastructure,
but yeah,
that is unfortunately kind of the end of
the facts.
And I,
I'm going to go ahead and say,
I have a little bit of a soft
spot for Calix.
I just want to admit where my bias
is because they were kind of my first
distro when I was getting into,
to flashing custom Android ROMs.
And I,
I tried them out first and I liked
it.
You know,
graphene obviously is way more private and
secure, but it was, it was pretty cool.
It was very empowering to flash an Android
for the first time.
And yeah,
But, yeah, so that they,
they originally said it'd be about four to
six months,
which if I did my math right,
should be somewhere between December and
February.
And here we are in the beginning of
May, early May, early mid May.
And they said that this is their latest
progress report.
I believe it's number four.
And they finally have a test build with
Android.
Hey, Nate,
you're coming across a little robotically
to me.
So I wanted to ask people in the
chat if that's happening to anyone else on
the stream or not really quick.
So leave a comment how the quality is.
I might know what's causing that,
but I'd have to step over to the
other computer for just a second.
Let me see here.
Nope, that's not it.
Well, yeah, let us know.
It's just on my end.
Yeah.
Okay.
We'll wait and see.
Okay.
So, yeah.
So Calix said that they would go ahead
and...
It should have been ready sometime,
like no later than February,
but here we are.
In this new note,
they basically say the Android-XVI build
is ready.
So the version of Kallax that's based on
Android-XVI,
they say is ready for community testing.
So it's not in public yet.
This is in beta.
And, you know, I mean,
there's some interesting stuff here.
Like they say that it's based on
Android-XVI QPR-II,
which I think is the most recent one,
but don't quote me on that.
Um,
it does support pixels four through nine.
So it does not, um,
I don't think the tens out yet.
I'm sorry.
I don't keep up with a lot of
hardware very well.
Uh, supports the Fairphone four and five,
and it supports a handful of Motorola's.
That is one reason that Calix has
historically been a little bit more
popular is just because, um,
they do support more devices than graphene
and they do still support locking the
bootloader.
So most apps should work.
Okay.
Not as good as graphene because with
graphene,
you've got the Google play services and
stuff, but, um, definitely, uh,
Yeah, it just, it supports more devices.
And yes,
Jordan informs me that the Pixel X is
out.
So doesn't quite support the Pixel X yet,
but all their current devices.
Supports the Pixel X currently,
but this is their device list from before
they shut down, if I remember correctly,
because I think they supported the nine,
didn't they?
I believe so,
and I'm going to guess that's probably
what their direction was.
It's like,
let's start with our current stable of
devices that we already support,
and then from there, we'll expand.
That's usually kind of how they do things.
So yeah,
they do go on to say here that
they've also updated some of their bundled
apps.
So they moved to FDroid Basic instead of
regular FDroid.
They still have Aurora Store.
They moved up to Breezy Weather.
They used to be on Geometric Weather,
but that one was deprecated quite some
time ago, actually.
They still include Signal.
They still include the Tor browser.
The Tor VPN is, I believe,
a new project from Tor that's designed to
replace Orbot.
So they're going to be including that.
CoMaps will be replacing Organic Maps.
And other than that,
I think most of these are things that
they've already supported before.
So...
And then they say there's some features
that have gone away,
things like the panic button for now.
They say it requires a lot of updates
to make it work.
They say they're shipping Chromium with
less features,
which you can read about below.
So, yeah,
it's definitely a very early update.
beta, I mean, really.
I know our staff member Jordan did attempt
to test it out,
but I believe couldn't get the flashing
process to work.
They kept running into an error.
But I have seen some people just generally
around the internet who have said that it
has worked pretty well for them.
But yeah, so I mean,
that's kind of it as far as the
facts of the story.
This is a I think this is kind
of a bigger story that we wanted to
cover, even though, again,
we don't really we don't formally endorse
Calix OS as like a recommended distro,
but it is very,
very popular in the community.
And this has been an ongoing saga.
And I think this is like the first.
Big milestone in terms of like, oh,
they've actually got something to show for
now, you know what I mean?
So, yeah, really, yeah.
Really interesting stuff.
Do you have any thoughts you want to
start with, Jonah?
Because if not,
I got some questions I can throw your
way.
All right.
Yeah, a couple of things.
It was interesting,
I guess not really about the OS,
but some of the apps that they included.
Calix VPN, rather,
being excluded from the list is
interesting because I think that's been
one of the big services that the Calix
Institute has been providing for some
time.
I didn't even notice that.
And they include Verizon VPN,
which is kind of like... I mean,
they probably don't consider them
competitors because it's all non-profit
and they're all just doing it for fun.
But I mean,
they're pretty much operating the same
service so that they would include that
one and not the other.
It's interesting.
I don't know why the Kallax VPN
infrastructure and capacity is...
not where it was before,
or if they were having issues for some
time.
If anyone used Calix VPN,
you could let us know what the experience
is.
But I just thought that was an interesting
thing to highlight.
I also can't remember if we talked about
Tor VPN in a previous episode or
somewhere.
I was just talking to somebody.
Not since I've been here.
um maybe not then i don't know where
i was talking about it but torby poor
vpn is an interesting one too because it
uses um the new tor implementation so
instead of the one that was written in
c the original tor backend service now
it's written um in rust it's called rt
and that was the main reason that it's
replacing orbot so
It's not just a rebrand.
There's some modernization going on.
So if you're a Orbot user or a
Tor VPN user,
I think that that is going to make,
I mean,
that's going to be a lot nicer for
sure,
and hopefully more reliable and hopefully
more secure.
So I guess that's not really about
Kallaxos either,
but a couple of cool things about the
apps that they're installing.
What are you thinking about this release?
Um, no, that's cool about the VPN.
Cause I didn't, I've, um,
I I'm subscribed to the tour blogs RSS.
So every once in a while I get
notifications about RT's development,
but I don't really know much about it
other than like, it's a rebuild and rust.
So when you said like, oh,
this is basically a front end for Artie.
I was like, oh, cool.
So that's where they're going with this.
Yeah.
It's finally making it into,
into tour software.
I don't know when it'll be in like
tour browser or anything like that,
but at least we're slowly seeing progress
for sure.
Nice.
Yeah, I mean, overall, like I said,
I admit that I have a soft spot
for Calix.
So I'm really disappointed that this has
been well past schedule.
And I'm really disappointed by a lack of
communication, especially.
I mean,
they've been relatively open in the sense
that they have been publishing blog posts
every...
every other month, maybe, um, they've,
you know,
they went out of their way when they
made the initial post and people started
speculating like, Oh,
is there some kind of compromise?
They were like, no, no, no,
there's no compromise,
but really that's been it.
There hasn't been any explanation for
like,
why are they so much further behind
schedule than they expected?
And like, I, um, I've had in,
in the past, um,
I've worked at other jobs where we have
clients that I have to interface with.
Right.
And I remember one of my, uh,
One of my bosses got really mad at
me one time because I told the client,
I'm like, hey,
we have to contact support from this
company.
And, you know,
it's kind of like slowing things down.
And my boss was like, no, no, no,
never tell them how the sausage is made.
And I really disagreed with him on that
because I'm like,
if I was the client and you just
keep telling me we're working on it,
we're working on it, we're working on it,
we're
That's going to shake my faith in you.
That's going to be, make me think like,
dude, why is this taking so long?
But when you tell me like,
here's exactly what we're doing.
Like we had to get in touch with
support.
Support has to research this.
They're shipping us a new firmware,
like blah, blah, blah, blah, blah,
whatever the case.
That's when I know like, oh,
you're working on it.
And also this is a really complex problem.
That like this is why I'm paying you
is to handle these problems.
So I say that to talk about this
is like I'm really disappointed that Calix
has decided to take the first approach
where they're just like, oh,
we'll just we'll just issue you little
updates here and there.
But we're not going to address the
elephant in the room of why is this
taking so long and why are we behind
schedule?
So that that really does disappoint me
personally.
But I was curious if you could,
cause I know there's some technical
reasons.
If you could just kind of fill in
Jonah,
if you wouldn't mind filling in users on
why we don't really recommend Calix.
Cause I know it gets,
and it gets passed around or not passed
around.
It gets touted and advertised a lot in
the privacy community as like an
alternative to graphene.
And again, despite my bias,
I don't think that's really an accurate
representation.
So like what, what makes a,
I don't necessarily want to turn this into
talking crap about him,
but why don't we recommend...
Why isn't that a really fair comparison in
your opinion?
Yeah, for sure.
Before I get into that,
do you know if MicroG was on that
list?
Are they still using that?
I know they were using it before,
but I just didn't see it in this
post unless you...
yeah it's not in this list but i
have to assume it's going to be there
because otherwise i don't know okay how
it's going to work maybe if jordan's
listening and was able to test it out
um they can let me know in the
chat but um yeah there's there's a couple
different reasons i mean i think the main
thing comes down to the the changes that
calyx os is making
uh mainly come down to getting google
software out of the main operating system
so they replace google play services with
micro g for example and they replace all
of the standard apps um with these open
source alternatives like they don't have
the play store they bundle after a basic
by default um but beyond that they don't
do a lot of modifications they've never
been like super
technical with like how the operating
system works or additional features that
can protect your security or privacy
whereas um on graphene os for example we
see additional hardening features
additional like permissions that you can
you can restrict apps with um additional
sandboxing with google play and all of
that stuff you don't really see with
calxos i think another big criticism with
i would say micro g in general is
that well
it replaces all of the client software on
your device and in theory makes it more
compatible with the open source ethos.
All of these micro G services are
generally still connecting to Google
services at the end of the day.
Graphene OS certainly would also have this
problem in a lot of cases,
especially if you use Sandbox Google Play.
But if you don't do that,
Graphene OS by default,
removes, I believe,
all connections to Google services,
and they are really good about proxying
any services that are required with
Google, like connectivity checks,
for example.
They proxy through Graphene OS servers by
default,
so you're not hitting Google servers
directly,
and you can typically turn all of that
stuff off.
off completely if you choose to so those
are some of the benefits in graphing os
that we just don't see uh added in
calyx os calyx os is more of a
stock android experience with some bundled
apps that are nicer than the alternatives
but it's not really changing the android
paradigm in in any way and i don't
know in previous episodes and on other
shows i've talked a lot about how
Android is just not my favorite operating
system in general because it's very tied
to everything that Google is doing.
I think Chromium kind of has the same
issue,
but Android especially and Graphene OS
just goes a lot further in making that
less of the case.
I think it's unfortunate that even on
Graphene OS,
most people have to rely on Sandbox Google
Play to get a decent experience on
Android.
But what can you do?
At least with the Sandbox Google Play and
Graphene OS,
you can install all of those as
user-installed apps, basically.
Whereas even on Kallax OS,
if you use Micro G,
all of the Micro G apps have to
be installed as system apps, which...
will, I mean,
which is a greater security risk than apps
that have normal user install permissions.
I think the other main thing that we
would see with Graphene OS is just a
much stronger commitment to updates,
security updates,
but also just updates in general.
We saw, as you noted,
the Pixel X is not even supported with
Kallax OS yet.
i don't know i don't know too much
else about the current like version of
android that this is using i know all
of this calyxos is still in beta they're
just getting up and running but
historically they have been a bit behind
normal android releases and a bit behind
graphene os whereas graphene os very often
releases updates
very, very close,
if not at the same time as major
Android updates.
And even now,
Graphene OS has a partnership with an OEM
that has access to these security updates
that aren't publicly released yet.
So they can issue those security releases
before they're open source.
Of course, if you don't want
proprietary code on your device,
you can you can disable those and wait
for them to be publicly released.
But that is a security option that I
don't think Kallax OS would even be able
to offer as far as I know,
because Google restricts some of those
security updates to certain approved
parties, which is a shame.
So, yeah, kind of a lot,
but that's typically all of the reasons.
Kallax OS didn't really make sense to me,
probably still doesn't,
but I guess we'll see how this is
going,
because it seems like they'll be taking
a... well,
at least a different approach than they
were before.
Yeah.
Yeah, I agree with all of that.
I agree that it's...
I think they do a couple small things
to try and make it a little more
privacy-respecting.
I think the advertising ID is removed by
default or something.
But it's really nothing compared to
Graphene.
It's definitely not even in the same
ballpark.
I think really the only selling point,
in my opinion, is that it would be...
I would argue it's an easier setup because
then with graphene,
you need to go in and you need
to install the play services.
I mean, if you want to use those,
which like you said,
some people could definitely get away
without those, but for the average person,
you're going to need those for
notifications and stuff.
So with graphene,
you additionally have to go in and install
that kind of stuff and get everything set
up.
But yeah, at the end of the day,
it's...
That is another downside of graphene OS.
You are stuck with the official play
services clients.
If you are the kind of person who...
prefers the micro-G approach,
at least you have that option with Calix,
whereas despite them being sandbox on
Graphene OS, which is great,
especially because you can restrict them
to certain profiles,
you're still running that proprietary
Google code directly on your device,
and some people just aren't going to like
that.
So that is something to consider for sure.
Yeah, I agree.
I think I had...
One other.
Yeah.
So in your opinion on that note,
do you think there's any like redeeming
qualities about this update?
Like me personally,
I'm glad to see them finally move to
breezy weather because again,
geometric has been abandoned for God,
I think years at this point,
like a good couple of years.
So it's nice to see them finally move.
I like to see them get rid of
scrambled eggs.
If like that is also abandoned where I
think,
or at very least like not updated very
often.
I wish they would just roll that into
the camera app like graphene does,
but yeah,
Yeah, I don't know.
Do you think there's any redeeming
qualities about this or anything that you
think is a step forward maybe?
You know...
To be honest,
I'm not the biggest expert on Android
apps, so it's kind of hard to say.
Some of these apps certainly make sense to
pre-install.
I'm glad they're pre-installing Signal,
for example.
Some of them,
like the ones that you mentioned,
don't make a lot of sense.
I can't remember.
I saw DAB X five.
I think that's the newer.
I think I'm thinking of a different app
that was discontinued.
That's probably the newer one,
so never mind.
But yeah,
certainly having privacy respecting
defaults is good.
Like comaps or organic maps they had
before.
It looks like they're switching to comaps
now.
I mean, it's greater visibility.
And I would say that this...
list of apps is probably useful to people.
I mean,
even if you end up using Graphene OS,
this would be a good list of apps
to maybe look at.
And maybe you want to use some of
these.
You can install FDroid on Graphene OS too,
certainly.
And we have a lot of Android app
recommendations on our site as well.
But yeah,
any visibility to all of these third-party
apps that are providing good services is a
good thing, I would say.
Yeah, a user here says,
nice to have you, Jonah.
They said, breezy weather is goaded.
And that's an example.
I agree.
I use breezy weather.
It's pretty rad.
I like it a lot.
Before we move on to the next story,
assuming there's nothing to add to that,
sawed this all here, said,
you love the PG polos.
So I just wanted to,
I would be remiss if I didn't take
a moment to point out that we do
have a merch store,
shop.privacyguides.org.
We have this awesome,
I know you probably can't read it from
there, but this coffee cup,
because I'm insane and I'm drinking coffee
at five PM,
has article twelve of the UN's Declaration
of Human Rights, which is about privacy.
I actually have some stickers here because
I was going to ask Jonah a question
about those later.
poster in the back,
all kinds of cool stuff.
So yeah,
and certainly not all of our merch is
like these polos with just the with
privacy gets loaded.
A lot of that is for the team
members who want stuff for this video.
But we also have a lot of merch
like with that poster design in the
background of Nate's video right there.
And a lot of other cool stuff.
So if you are interested in those privacy
designs, I would check it out.
And we hope to add more stuff there
soon.
Another thing before we start talking
about this canvas story,
I wanted to answer TG in nineteen ninety
seven's question really quickly here.
We always have around five to twenty
viewers.
A couple of reasons were very generously
supported by many of our members.
We also get a lot of views on
this show after the fact of especially
various podcast apps we get
A lot of downloads there.
But it's mainly the support of our members
and people who want extra perks across our
site and our forum,
which certainly has an active membership.
The other reason for this discrepancy in
views is that we...
uh stream on a lot of different platforms
so like right now on streamyard i can
see a hundred forty nine people are
watching and on youtube that's quite a bit
less um so yeah as somebody else just
pointed we we live stream on youtube we
live stream on x we also live stream
on twitter and we live stream on
streamyard.com which is the
which is the streaming service that we are
using to stream in the first place,
so it's kind of a native approach.
We share the StreamYard stuff on our form,
so a lot of different options for people
to choose from, not just YouTube.
But yeah,
we would love to get more viewership.
So definitely subscribe if you like these
shows and share the show with a friend
or two if you think it's interesting.
Because we would love for more people to
hear about all of this stuff.
Of course, that's why we're doing it.
Not to dig into it too much,
but nice to have Jonah says why you
only see six people.
Because we're in the studio,
we can see the full list.
It says here that we've got over a
hundred and twenty people on Twitter.
What's that?
It just combines them all into one number.
That's what I was looking at.
But if we hover over it,
it gives us a breakdown.
So, yeah,
there's six people on StreamYard right
now, twenty two on YouTube.
We got one on Twitch.
I didn't even know Blue Sky did live
streaming.
We can look into that,
but it's really about what StreamYard.
Yeah, Blue Sky doesn't do live streaming.
if you want to share um whoever said
blue sky um what you're referring to i
know you can um post a link to
the live stream manually on blue sky and
it will show up like around your profile
picture um we have to do that basically
every time we stream manually and we can't
even link to
youtube streams i think or stream yard we
have to link to like twitch or something
so it's just annoying to do on on
blue sky but maybe we'll use that feature
in the future i don't know what blue
sky features really have for live streams
yeah we could look into it oh here
we go somebody said the the new calyx
os builds run great on the pixel six
six a and six pro so there we
go we have some uh boots on the
ground from somebody who's tried it
awesome
Good to know.
All right.
Well,
let's take a look at our next story
here.
This was reported by Bleeping Computer.
Headline is,
Canvas login portals hacked in mass Shiny
Hunters extortion campaign.
The Shiny Hunters extortion gang has
breached education technology giant
Instructure again,
this time exploiting a vulnerability to
deface Canvas login portals for hundreds
of colleges and universities.
The defacements,
which were visible for roughly thirty
minutes before being taken offline,
displayed a message from shiny hunters
claiming responsibility for the earlier
Instructure breach and threatening to leak
stolen data if a ransom is not paid.
The message warrants that Instructure and
schools have until May twelfth to contact
them to negotiate a ransom or students
data will be leaked.
Moving down in this story here.
I'm not seeing it in here,
but I read in a different article that
this vulnerability was related to a
service that Instructure has with Canvas
that allows teachers from any school to
sign up and create courses,
even if your school doesn't have a
partnership with them.
So I know that they've disabled that
feature, basically.
But what the vulnerability is exactly,
or I think what data has been leaked,
as far as I know,
is not necessarily clear yet.
But the hackers in question have claimed
to have stolen two hundred eighty million
student and staff records tied to eight
thousand eight hundred nine schools,
universities and education platforms using
the Canvas learning management system,
according to this source.
article.
So it is quite a cyber attack and
it seems to be very widespread.
I know,
I think it says it in this article
too somewhere,
but I just know Canvas is one of
the,
if not the largest learning management
systems used by schools.
So this is pretty extensive for sure.
And I think what we're going to see
out of this is
I mean, especially if this data is leaked,
but also, I mean,
even if it's not leaked,
these people could just keep the data
anyways,
or it could be leaked in the future,
or they could just leak it anyways.
I think there's really no way to guarantee
for sure whether this data is going to
make it out there or not,
regardless of whether that ransom is paid.
So I think this I mean,
this will certainly be a big problem for
students, also staff,
and maybe not even immediately.
All of this data could be used in
the future for various attacks.
I can imagine phishing attacks and other
and other sorts of attacks against all of
these students and and teachers to be very
I think they'll be very prevalent if all
of this data gets out.
So yeah, that's pretty much the story.
It's not great.
As Jordan W. says,
shaking my head with the centralization of
everything on a single platform for
learning.
Yeah, I mean,
this is definitely the big problem with
decentralization.
It's certainly a double-edged sword,
and it's the kind of thing that we
see in the school systems.
With this,
with a lot of different tech services,
I know all of them have switched to
Google Workspace, for example,
and none of these centralized services are
immune.
um i know before the days of decentralized
services schools would typically use
various platforms or open source platforms
like moodle um and there are downsides to
that as well because then you're relying
on the school or the district's i.t team
to secure all of that which can have
varying levels of quality and knowledge
depending on what kind of people they can
hire so
That's certainly a problem as well,
but certainly all of the centralization of
data into a single database is also a
huge concern.
So yeah, you kind of lose
Either way you go, really.
But obviously,
this sort of attack has a much larger
impact because this is going to affect
schools all around the US and maybe around
the world.
I don't know where Canvas is used.
I know it's huge in the US here,
but I would imagine they sell to other
countries as well.
Yeah, I agree.
And, uh, yeah, like you said, this, this,
um, this is a big story,
which is kind of why we're talking about
it.
Um,
so there's a lot of coverage out there.
So, uh,
there may be additional details in other
articles.
We tried our best to, um,
pick bleeping computers are usually a
pretty good source and some of their
articles are actually like really super
technical.
So I like going to them.
They're,
they're one of the more reliable sources
in my opinion, but yeah.
Jordan says it's massive in Australia too.
I would, yeah,
I would imagine it's in a lot of
different countries.
I mean, that's a huge company.
Yeah.
This article didn't really specify where
they're,
which is unusual because usually they do
say like, Oh,
it's popular in like the U S and
parts of Europe or something.
But yeah.
Um,
Yeah, I mean this is the question, right?
It's nice to have Jonah said,
what do you think should happen?
Make it illegal to pay ransoms?
Find companies for bad security?
I mean I think – I fully admit
that I'm not an expert on this kind
of stuff in terms of like what should
we do.
But I do think that's a good start
is like I think we need mandatory
disclosure laws because I remember there
was a few years ago they raided –
God, which ransomware gang was it?
It was one of the big ones.
Interpol shut them down and raided their
servers, and we learned so much.
They had hit so many more companies than
we knew about because most of them just
paid the ransom and made it go away.
Made it go away.
We learned that they,
like you were saying,
they never delete the data.
That was something we learned is when we
pulled their servers, it's like, oh, look,
here's everybody,
including the people who paid the ransoms.
They never deleted the data like they
promised they would.
They just hold on to it.
So...
I don't think – and when they do
pay the ransom,
that just encourages them to keep doing
it, right?
If we make it not economical,
they're going to stop doing it.
At some point, eventually,
they'll stop doing it.
So it's really –
I think that's a good start.
And yeah, I do.
I mean, personal opinion.
I think the problem with bad security is
that it's really hard to define in a
legal sense.
Like,
I think there's certain things that like
two FA, right?
I mean, it's twenty twenty six, dude.
No offense to any newbies watching this.
I'm not trying to make you feel bad,
but it's twenty twenty six.
If you're not using two FA,
you're you need to reconsider.
I'll just say it that way.
You know, and I mean, ideally, yes,
it would be nice if they had good
passwords,
but that's kind of an ongoing debate right
now is like what defines a good password.
There's a lot of nuance to that,
but it's, I mean,
that's like little things.
Like if you have something that was
patched or like if you have,
of vulnerability from six months ago that
the patch was already released and you
still haven't updated it and it's a
critical vulnerability,
I think we can all agree that's negligent.
Like when you get closer to like a
week lead time, like, I don't know,
it's just my point being like,
there's some nuance there,
but I think there is a certain baseline
we can establish.
And it's like, yeah,
you guys were just basically being
negligent at this point.
And unfortunately it's a,
I've said this before.
It's like a lot of these,
A lot of these smaller, or not smaller,
a lot of departments don't get the funding
they deserve because the bean counters
just look at them and all they see
is red.
So like cybersecurity, for example,
they're always like, oh,
we're always spending money on technicians
and software and this and that.
And it's just spending money and spending
money.
They never make us money.
We're just losing money on that.
And it's like, yeah,
because that's what's keeping you from
losing more money when something like this
happens.
So it's-
Yeah.
IT in general,
it's always seen as like a cost center
by businesses until you need them.
The problem with IT in general is that
I think the entire industry suffers from
its own success because when everything is
working properly, of course,
you never notice it at all.
Like it all just runs in the background.
Exactly.
Yeah, and then the last thing is,
like you said, a centralization issue,
which that one's harder, right?
Because that's kind of one of the
hallmarks of the free market is people
should be able to go to whatever company
has the features they need and makes the
best sales pitch and whoever they want to
go with.
So the centralization thing I feel like is
tricky, but I don't know.
Maybe there's some levers we can pull
there too to try to encourage a little
bit more competition.
I don't really know.
That one's definitely above my pay grade,
but it's all just kind of a big
–
know what the word i'm looking for is
it's all just kind of a big soup
of like a bunch of problems but even
fixing a few of them i feel like
would probably go a long way in my
opinion yeah neville matthew uh on youtube
points out same thing with epic uh
electronic health record systems all
hospitals use them uh that's a huge
problem as well i mean the centralization
uh that we're talking about this is
happening among
pretty much all industries at this point.
So we're definitely putting all of our
data in single gigantic baskets.
And I really don't think that's a good
thing,
which is why I always suggest
decentralization as much as possible.
But
not all organizations are going to do that
and i think the unfortunate reality is
that all of these organizations are going
to choose the cheapest option um yeah i
don't know if we pulled up this comment
but nice step jonah said uh i'd rather
use google workspace honestly google's
locked into their security and their
workspace privacy might not be terrible
I mean, with Google Workspace,
especially with the schools,
you never know what they're doing with
this data.
But according to their privacy policies,
it's all above board for students.
But no company is perfect at security,
and it's very possible that Google could
have a breach someday.
I think there's problems with all
centralized services.
kind of inherently.
So I wouldn't just rule out the
possibility that Google will suffer some
sort of security issue in the future.
I think a much bigger issue with all
of these schools adopting Google Workspace
for Education is just that it really
normalizes
I mean, the entire Google suite,
a whole generation of students who are
then going to demand that in the workspace
and in their personal lives.
People are just using alternatives like
Microsoft Word or Apple Pages or whatever
software was typically used in schools.
And now they just...
are used to Google Drive and used to
Google Docs,
and then they will grow up and they'll
continue using that or they'll use it in
college or they'll say to their employers,
like,
you should switch to all these Google
services.
That's really the big Google play here.
And there used to be more companies in
the education space.
I mean, for a very long time,
Apple was huge in the education space,
and then they basically randomly gave up
on supporting education customers,
which is really dumb, in my opinion.
You could certainly argue Apple isn't much
better.
And I would love to see...
We talked maybe a couple episodes ago
about these governments who are adopting
Linux systems among...
their own agencies.
I would love to see something like that
in schools too,
where more of these education providers
adopt open source software like Linux.
But we're not really seeing that right
now.
And even when Apple was in the game,
there was
at least some competition here,
which is always a good thing.
You always want to see competition.
And right now,
Google kind of has a stranglehold on the
entire education industry,
which is not great.
Maybe Apple will make a comeback with the
MacBook Neo,
but their software game has a very long
way to go before they get back into
a serious IT world, unfortunately.
Yeah, I was going to say,
I agree with the idea of like...
Like I've complained about that.
Not my last job,
but the job before that.
We were a very small company,
like less than ten people total.
And we used Google.
We used Gmail.
We used Google Drive.
We used Google Sheets, Google everything.
And then I moved to the bigger company
that was like super, super corporate.
And all of a sudden everything was
Microsoft.
And I remember just being like, God,
I would give anything to go back to
Google because Microsoft's UI is just –
everything about Microsoft is terrible.
Full stop.
I don't care.
It's bad.
So,
but I really appreciate what you're saying
about like, yeah,
but then you train people into that way
of thinking and that's what they're going
to want.
And, um, but, uh, yeah.
And another thing you said is just real
quick.
I'm,
I've been saying for a long time and
I know I'm not the only one that
like,
it blows my mind that public money can
be spent on private things.
So like,
I usually say that in the context of
policing and surveillance systems,
but yeah,
like Microsoft licenses for public
offices.
And it's like, dude, just switch to Linux.
Like,
And that's a new contract there too,
right?
Like somebody has to write this software
for Linux so they can manage the lakes
or whatever.
Like, great, that's a new contract.
We just made new jobs.
So I don't know.
Yeah, it's crazy.
Yeah, the whole tech ecosystem in general,
once you get into like proprietary stuff
is not great because we've really
transitioned to like full subscription
services.
I used to work at a school district
and towards the end of that,
Google changed their education pricing.
I think it was around like when the
pandemic was happening and there was a
huge push for remote learning,
but they were basically like, okay,
all of these
features that all these schools want now
we're going to be charging something a
month and it was still a lot cheaper
than like Google workspace for businesses,
but it just goes to show that like,
all of this free stuff can't and really
never does last forever,
even for schools and nonprofits.
Google's whole plan is not just to lock
students into this Google ecosystem,
but also to lock schools and districts
into
having to do whatever Google says,
basically,
because now they're kind of stuck with all
of the software and all their Chromebooks
and Google can kind of charge whatever
they want if they want to.
And it's very unlikely that any of them
will switch at this point,
which is a shame.
Yeah, very good point.
I think that's all we have on that
story.
In a minute,
we're going to talk about Microsoft Edge
and passwords.
And boy, that's a wild one.
But first,
we're going to talk about what we've been
working on this week at Privacy Guides.
So like I mentioned at the beginning,
it's been...
You know,
we kind of go through ups and downs,
right?
Like we kind of go through periods where
we're releasing a bunch of stuff and then
we go through periods where it seems like
we're a little bit more quiet.
But that's because it's just we're always
working behind the scenes.
I mean, we're always working,
but sometimes there's just a lot happens
at once.
And I think the last few weeks have
been like that.
So, for example.
I'm going to share this little tab here.
We have just released today a new video
about how to run a Signal proxy.
And we talk about this in the video
for the record,
but there are alternatives to Signal,
but censorship is on the rise and Signal
is around the world for the record.
And Signal is an extremely popular
messenger.
So you could try to get your friends
and family to switch to something like
SimpleX or Briar,
or you could look into Signal proxies as
a way to help around with that.
So
Yeah, if you're a member,
that's already available on YouTube.
If you are a Privacy Guides member,
like you went to privacyguides.org slash
donate and you're a member, it's also,
I believe, available on PeerTube.
And we share that link directly in the
member section of the forum,
or I believe you also get it in
your inbox.
So yeah.
Those are options there.
And then that'll be coming out to the
public next week.
We usually release those about a week
early for members.
And then we have an awesome interview
coming soon.
Hopefully next week.
Depends how much editing we have to do.
But I don't want to say too much.
It's just really exciting.
It was a great interview.
I had a lot of fun.
And it will include a bonus section,
again, for paying members.
Yeah, excited to share that.
And actually on the topic of memberships,
I just I keep forgetting to tell you
guys that we're actually now posting the
show notes for the show in the members
only section.
So throughout the week,
you guys can see what stories we're
considering discussing and stuff like
that.
So definitely check that out if you're
interested.
And I'll turn it over to Jonah to
talk about what else we've been doing.
We definitely got a lot of requests for
that because people wanted to ask
questions about the stories we would talk
about on the show,
but I know this show time isn't ideal
for everyone.
It's pretty late in the year right now,
so I know a lot of people skip
it and watch it later.
So hopefully that helps out some people
with getting your questions answered
during the Q&A that we have at the
end of the show.
In other Privacy Guides news,
the biggest thing that we launched this
week is a new DPA directory.
This is a tool that we have in
our Activism section,
which you can find at privacyguides.org
slash activism,
or you can click the Activism tab at
the top of our website.
And the DPA directory is basically a tool
that will help you find the main consumer
privacy law in your area or region or
country that describes what privacy rights
you have as a consumer and the authority
that's mandated to enforce the law,
which is very important.
because you should know where to report
these privacy violations and what privacy
violations may even be occurring.
I think for a lot of countries,
there are more protections than you might
think.
Of course, in a lot of countries,
I would definitely say the protections
could go quite a bit further,
but anything helps.
And reporting privacy violations by...
companies that you interact with not only
has a benefit for you personally,
but it has a huge benefit for your
entire community because it causes these
companies to make changes that will
ultimately improve the privacy for anyone
who are using these products or services.
So definitely check it out.
Find your region on there.
We have at the top of the directory,
we have buttons where you can click by
continent, basically,
and then you can find
whatever country.
If your country isn't listed,
either we couldn't find anything.
We were able to do it for a
lot of countries,
but certainly not all of them.
We hope to continue updating this with
more information as we can and as we
get it.
If your country
isn't listed or if some of the information
you want to update or what have you,
definitely submit a PR or even open a
topic on the forum sharing what
information you want us to add or change
and we can get that updated.
Or just let us know what country you
want us to update and we can look
into it as well.
Whatever works for all of you,
we definitely want to keep this updated
and get as much information out as
possible,
so
you can share uh what information you
would find most helpful here and hopefully
we can continue to build more legal
resources and other resources like this in
our activism section going forward so
we'll continue to keep you updated with
that um thank you carrie from fireworks
firewalls don't stop dragons uh for the
compliment i totally agree it is another
fantastic resource um it's one of the
final resources that are
former staff member m uh worked on with
us and it it came out really great
so i hope people find it very valuable
um that was the main update that came
out with our uh may release of all
the changes on our website i believe all
of the other changes were pretty minor um
we just
updated some information that was outdated
and changed some logos.
So not a lot of huge changes besides
that.
But, you know,
we're always changing the site,
making sure everything stays up to date.
So hopefully we'll see more changes in the
future.
I know we have twenty six pull requests
open right now.
So a lot of updates that we're hoping
to get made as soon as we can
review them.
this is episode fifty two of the show
which means that we've been doing this
every week for a full year which is
fantastic it's it's been a lot of work
to get this oh great Nate's celebrating if
it works I think it's busted now I
have a whole bag of them I'll find
another one I had to buy these for
a video one time it was like five
bucks so now I don't know what to
do with them
I had another one.
But yeah,
hiring Nate to get these done has been
a real game changer for this entire show
because we can really do this more
reliably.
And yeah,
we plan to continue doing this every week
for the foreseeable future.
News briefs are another big thing that we
do almost every day, pretty much.
Freya works very hard on those,
but we have other people on the team
publishing those as well.
I know Nate writes some of them on
occasion.
And this week we had updates on copy
fail, ChatGPT advanced account security,
Fedora releasing sealed bootable container
images, which is super cool.
Definitely look into that if you're using
Fedora, it's good for security.
RCS end-to-end encryption in iOS,
which I actually downloaded on my phone,
but I haven't been able to use it
too much yet.
So hopefully it improves a bit soon.
Disneyland, California,
facial recognition,
the FCC banning a data broker from selling
location data,
ProtonMail launching post-quantum
encryption,
which I believe we are going to talk
about later on in this stream,
if that's of interest to you,
certainly of interest to me,
Chrome for Android,
including approximate location,
which is a new web standard that'll
hopefully make sharing a location with
websites a bit more private,
and two more major Linux vulnerabilities
in the same class as
copy fail.
So a lot of news briefs,
we can't talk about all of the news
on this show specifically,
but we try and keep all of the
news briefs updated with the biggest stuff
that we can't discuss.
So if any of those things sound
interesting to you,
you can find that under the news tab
at privacyguides.org,
and we'll continue updating that and
updating our form with all of the news
stories we can find.
All of the stuff that we do at
Privacy Guides here, again,
like I said earlier,
it's all supported by our generous members
and other one-time donors.
You can sign up for a membership or
donate at privacyguides.org slash donate.
Or if you want to support us by
picking up some swag at
shop.privacyguides.org,
that is great as well.
Privacy Guides here is a nonprofit
organization.
and we research and share privacy-related
information and we facilitate a community
on our forum and other platforms to share
advice, ask questions,
get updated on the news with other people
who are in this privacy activist space.
So it's a great place,
especially our forum,
to get advice about staying private online
and preserving your digital rights.
I think that's my spiel.
We can move on to talking about how
Chrome has been downloading some AI stuff
to your device without telling you.
Well, maybe not you specifically.
You're probably not using Google Chrome,
but Google Chrome users.
Yeah,
hopefully if you're watching the show,
you know that Chrome is basically spyware,
and that's not much of an exaggeration,
unfortunately.
Warn a friend about it.
What's that?
Be sure to warn a friend about it.
Yeah, no kidding.
Pass that on.
Friends don't let friends use Chrome,
but seriously.
So yeah,
the latest Tomfoolery from Google Chrome
is that they have been quietly pushing a
four gigabyte AI model to your device
without asking.
Correct me if I'm wrong.
But I actually did some digging into this
and I was trying to put the four
gigabytes number into context.
And if I did my research right,
that is about, what is that?
About eight hundred to a thousand songs,
depending on how big the file is,
how long the songs are and stuff.
What is it?
It's like a similar amount of photos.
But the one that got me is that's
about four to six hours of high quality,
not like four K, I think,
but like high quality video footage.
Which is longer than the extended edition
of Return of the Kings.
And that just...
That was my favorite thing I learned from
researching this.
So anyways, yeah,
so Chrome has been pushing this AI model
onto your device.
It's Gemini Nano.
The article I don't think explicitly says
it's on desktop,
but it seems to imply that it's on
desktop because it says that right here it
says deleting the folder doesn't offer
lasting relief.
Chrome will simply redownload it.
On Windows, the folder is here.
It has also been confirmed on Apple
Silicon and Ubuntu machines.
So I think it's specifically on desktop.
The weird thing is,
from what I can tell,
this does not seem to be...
Because a lot of Apple and Google are
trying to do more,
especially on mobile phones,
they're trying to do a lot of AI
processing on device.
And I think for most of them,
that has more to do with performance than
privacy.
But of course,
never miss a good PR opportunity.
So they're like, oh,
it's also really private.
And it's like, meh.
So I think they try to do things
on device.
But from what I can tell,
if I remember this correctly...
Um, yeah, it says here,
the downloads carry a notable irony.
Chrome's most visible AI feature,
the AI mode integrated into the address
bar and Google search runs on Google
servers rather than the locally stored
weights.
The four gig folder is only used for
writing assistance and a handful of other
accessible or a handful of other features
accessible, several menus deep.
So it's not even like the,
the most commonly used things that they
would put on there.
It's just such a weird, weird choice.
Um,
I don't know.
Yeah.
So going back here, again,
if you uninstall it,
it just reinstalls itself.
I do appreciate this article.
Uninstalling Chrome entirely is the most
effective way to remove it.
However,
for those who wish to continue using it,
you can disable it by going into the
Chrome flags and finding an item called
Enables Optimization Guide on Device on
Android and selecting Disabled.
So apparently,
that basically just tells it that your
device can't handle it,
whether that's true or not.
So, yeah.
And then it looks like somebody is already
accusing Google of violating European
privacy regulations.
And I unironically wish them the best
because I want to see these companies sued
every single... You know,
we've mocked many,
many times how when these companies get
sued, it's always like, oh,
they got sued for four million dollars.
And it's like, bro...
who's, who's in charge of Google?
Sergey Brin.
Did he move on?
I don't know.
Whoever the guy in charge of Google,
it's like his shoes probably cost four
million dollars.
Like that's nothing.
They don't care.
But my hope is that if we keep
doing this,
maybe it'll be like death by a thousand
cuts.
Like if we just do them every single
time it happens,
maybe eventually it'll start to add up.
I don't know, man.
I'm trying to be an optimist.
I realize I'm probably delusional, but,
uh, yeah.
So I mean, I,
I think we kind of, to, uh,
hit our, our main points going into it,
but, um,
Well, let me start by saying,
I don't know.
I guess I'll really just jump to it
and say we don't recommend Chrome.
I mean,
in addition to just doing crap like this
all the time that's incredibly hostile to
users, that's incredibly unfair to users,
that's really, really sneaky,
I think it's so funny how they always
try to roll these things out that they're
like, oh, but this is good for users.
And it's like, well,
then why'd you hide it?
Why didn't you tell us how awesome this
new feature is?
But in addition to all this stuff,
you know, Chrome is like over the years,
it's really become a resource hog.
Like everyone I know says that it takes
up tons of space.
It eats up your Ram.
I don't know how true that stuff is.
Cause I haven't used Chrome in several
years, but that's what I hear.
So I think I'll have to bounce over
to the privacy guides website.
I know that brave is a big one.
We recommend Firefox is, is pretty good,
but it does require some some tweaking to
really get the most out of it for
sure.
And browsers are one of those things that
I know everybody kind of has their
favorite browser, right?
Like some people prefer...
Yeah, I mean, here,
I'll put you on screen while I'm looking
this up.
But some people prefer their LibreWall for
Mulvad, which Mulvad's a really good one.
Actually, here, I've got the page here.
I'll bounce this up real quick.
Mulvad's a really good one that we do
recommend.
I think for a lot of the power
users in the crowd, Mulvad will be fine.
But there are, like,
I remember when Mulvad came out,
I asked some of my friends and family,
like, hey,
can you test this out for me for
like a week?
Because I want to know if this is
a good browser I can recommend to the
average non-technical person.
one person couldn't download it because
their antivirus kept flagging it,
which I still need to talk to them
about why you shouldn't pay for third
party antivirus.
And then the other person was able to
download it just fine, but they were like,
Hey, um,
and they weren't mad at me for the
record,
but they just told me they're like, Hey,
FYI,
literally none of my streaming services
work like Netflix, Hulu, Disney,
like none of them work with Moldad.
So it's a great option.
It's just, you know,
the average person may struggle, um,
to do some like day-to-day things.
Um,
Firefox, like I said, is pretty great.
There's just some settings you need to
change.
Add uBlock origin.
Brave.
I think for people coming from Chrome,
Brave is probably going to be the best
replacement since it's based on Chrome.
So yeah.
And then people are obviously leaving
things here in the comments like Helium
and Zen.
Those are fine, I guess,
if you want to use those.
They're not our official recommendations,
but they're probably way better than
Chrome, I think.
So yeah, I think I've been talking plenty.
I'll turn it over to you for a
minute.
Any thoughts on this?
It was funny that you mentioned how many
songs there are because I think four
gigabytes was the amount of storage that
the original iPod had in in two thousand
one.
And that classic tagline,
a thousand songs in your pocket.
Now we're just kind of wasting that
storage space on random AI models that it
sounds like are going to be barely used
in Google Chrome since most of this is
still going through their servers.
So it just kind of goes to show
how much tech has changed in the last
twenty five years and how
not not really for the better i think
all of this software just becoming very
bloated for very little gain um and i
think at the end of this article um
someone pointed out that pushing four
gigabytes of data to the millions or
billions of devices that have google
chrome installed on them um results in
like just a huge amount of data being
transferred over the internet like all of
these software updates do um which is you
know i mean that's kind of normal we
get software updates all the time so it's
not that crazy but
That's still a huge amount of data there's
there's always a cost to that sort of
thing, not just financially,
but in terms of CO two environmentally all
of this Ai is just speeding up all
of those issues in many different ways.
So yeah technology is just.
Crazy.
Yeah,
four gigabytes times the amount of Chrome
users.
Absolutely.
It's exactly like Kerry just said in the
chat as well.
When these stories pop up,
you just got to stop using Google Chrome.
And I think all of these browser solutions
are going to be better.
We obviously,
the general consensus among Privacy
Guide's team members and also people
in the community on the forum is that
Brave and Firefox tend to be the best
choices for a lot of people.
But as other people have mentioned,
and like Nate just said,
there are other options that are coming up
and becoming very popular.
I've been using Zen Browser for some time
personally, and I like it a lot.
I know a lot of people are starting
to use Helium Browser lately,
which definitely has some good things
going for it.
I would also throw in Brave
origin as a great Google Chrome
alternative in addition to Brave,
just because it has a bit less of
the bloatware like the VPN stuff that
Brave does or the cryptocurrency related
stuff.
That obviously costs money for some
people,
but what I would say to that is
if you don't want to pay the sixty
dollars,
You should be on Linux anyways,
where Brave Origin is free.
So you always have that option.
Linux is a great operating system to
switch to, and you can start using that.
A big benefit of Brave Origin versus these
other platforms is mainly
Just having the backing of a much larger
company behind it,
and Brave has been very timely with
security updates and other Chrome updates
for a very long time,
whereas a lot of these other alternatives
are somewhat hit or miss with those
updates.
And just like with Graphene OS,
like we were talking about before,
staying up to date with those updates is
super important from a security
perspective.
I would typically probably recommend Brave
Origin to most people who are looking for
the cleanest Chromium experience these
days.
But yeah,
there are certainly a lot of options with
their own pros and cons.
And if you want to know any of
the specifics of that,
I would always recommend checking out our
forum or asking your questions there.
I mean, with a lot of these browsers,
I know there's already discussion threads
about them where you can find out the
pros and cons and why they're not
necessarily recommended on the site yet.
but can still be good in certain use
cases.
So the first generation iPod had a minimum
of five gigabytes.
And I don't know if this is going
to make you feel old,
but it made me feel old.
The connection was FireWire.
Yeah, that was an interesting time.
I will say,
for everything I just said about
technology going in a bad direction in
some ways,
I will say switching everything to USB-C
is one of the biggest improvements that
has ever been made, honestly.
Having one universal connector is just so
nice, so much nicer,
if anyone remembers how it was before.
Totally agree.
Yeah, I do want to point out,
I just want to drive home something you
said,
which is that I think there's something to
be said.
Privacy Guides kind of operates under the
idea, or under the philosophy,
I should say,
of recommending the best product.
I think,
kind of going back to our headline story,
I would argue that...
and maybe this is open for debate because
of what you mentioned about like micro G
running at an elevated privilege level.
But I would argue that something like, um,
Calix is going to be a little bit
better for your privacy,
assuming it's fully updated and
everything,
but it would be a little bit better
for your privacy than like stock Chrome or
stock Android.
Right.
Yeah.
But obviously we don't recommend that
because graphene is even better and it's
really not that much harder.
So we recommend graphene instead.
Um,
so where I'm going with that is I
think, uh,
a lot of the time I think, uh,
this is something I've harped on before,
is a lot of the time I think
we in the privacy community kind of
undersell how much we've learned and how
tech savvy we are.
I consider myself not very tech savvy
compared to a lot of other people that
are like developers and programmers and
hackers.
but even I like,
I know how to self host next cloud.
I know how to self host jellyfin.
Like I know how to mess with the
settings on my router.
I flashed my router,
like all these kinds of things that the
average person I think doesn't really know
how to do it.
And so I think, um,
sometimes it can be really empowering to
take those baby steps.
And I think sometimes those baby steps are
going to be, um,
I think some of them are going to
be like,
even if you never go further than this,
it's still better.
And so I'm kind of talking to the
audience here where, you know,
some people get mad that you say things
like you in general,
that we say things like, you know,
like switch to brave.
And some people are like, oh,
but brave has all these problems,
which is fair.
But also like if somebody switches to
brave and they're just like, oh,
this isn't so bad.
This is just like Chrome.
Well, I hear that Firefox is better.
What if I check that out?
What about the small bad browser?
What about that might be the gate that
opens them up to check out the gateway,
the gateway drug that opens them up to
check out other browsers.
And maybe eventually they will end up at
something way better and way more secure.
But even if they never go further than
that,
like it's still better than using Chrome
in my opinion.
So yeah,
um yeah i just i guess i just
kind of want to defend that uh not
not that you were not doing that but
just to the audience i want to point
out that like i think these these can
still be useful baby steps along the
journey to get people because something
like brave is going to be again i
think i said this already it's going to
be like the most familiar for people who
are coming from chrome and then once they
realize like oh that was really easy that
was simple maybe i'll check out firefox
maybe i'll check out these other ones so
you know it could potentially become a
journey for some people so
Absolutely.
I think our general philosophy,
at least mine,
but I think the general philosophy among
the team is that our recommendations on
the site are geared towards being the best
option with the least amount of downsides
for literally pretty much any
use case or threat model as much as
we can.
Obviously,
there's still going to be upsides and
downsides to each of these.
But like compared to Calix or even Lineage
OS,
it's our opinion that Graphene OS offers
the most benefits with the least amount of
downside to the most people.
If we're talking about Calix OS or Lineage
OS,
Those both have some merits.
Certainly,
like Jordan just mentioned in the chat
here,
there's wider device support with both
CalixOS, but especially LineageOS,
and that helps people get into this
de-Googled ecosystem.
which is always, I think,
great from a privacy perspective.
But at the same time,
the downsides of using CalixOS or
LineageOS are potentially very high,
especially from a security perspective.
And people can really shoot themselves in
the foot, I think,
if they don't know what they're doing.
Whereas with something like Brave,
not my favorite browser,
but the downsides are pretty minimal and
it's very easy to recommend to most
people.
And I think...
I think it probably goes without saying,
we don't explicitly have it on our site
yet,
but we should probably just update it
because Brave Origin is the same.
But I think Brave Origin is even better
because it's just the exact same thing as
Brave, but less,
which is typically good from a security
perspective.
You want to keep things as minimal as
possible and also just from a user
experience perspective.
But if we talk about other browsers like
Helium or like Zen Browser or even
LibreWolf,
like there are a lot of upsides for
a lot of people,
but there are also a lot of downsides,
which make it very hard to recommend to
a general audience who might not look into
all of this stuff further than what we
put on the site.
I think that's a common thing.
misconception that people have with the
privacyguides.org resources is that people
think that if it's not listed there,
that means there's some problem with it.
But typically if something is omitted,
it's not like an anti-recommendation in a
lot of cases.
And
This is a reason why I think our
forum has become even more popular than
our main website at this point.
It's because we can have these more
in-depth discussions if people are
interested in that.
So that's kind of the case with everything
we don't recommend on the site.
There are in-depth forum discussions where
you can learn about these tools,
but also learn about the potential
downsides,
which I think people should at least know
before they use them.
So yeah,
I think that's kind of where we're at
with the recommendations in general.
Yeah, for sure.
That is one nice thing about the forum.
Cause there's so much information and so
much to consider that, you know,
for some people may not be relevant and
for others may be relevant.
Like I know, um, and we'll,
we'll get to the forum in a minute,
but I know on the forum,
there's been an ongoing discussion about
only office and how only office like
allegedly has some ties to Russia.
And like the licensing is kind of weird.
And, you know, some people are like,
maybe we shouldn't list only office.
And me personally, I'm over here going,
I don't care.
Like none of that is part of my
threat model.
Um,
Not interested,
but I completely respect that there are
people who are like, no,
that's very alarming,
and I don't want to be using OnlyOffice
at my politically motivated nonprofit,
right?
So I think it's really cool that you
can go to the forum and get that
kind of in-depth because if you make a
website too wordy,
people aren't going to read it.
Ask me how I know.
Right.
So it's really cool that people have that
supplementary resource they can go to.
Not to shill the forum too much,
but I like that about it.
There's no way to shill the forum too
much.
I can shill it all day, any day.
And it'll never be enough.
You should check out the forum.
Fair enough.
uh nice to have jonah just said in
the chat is there no privacy respecting
streaming option yeah unfortunately uh
streamyard is not super great um either we
mainly offer it as a solution because i
mean it's a service that we're using so
you're kind of getting it directly but and
it's also better than literally all the
other options but streaming is a pretty
difficult system to to get up and running
because you have to imagine, I mean,
even if we're self hosting it,
every single viewer is going to use like
a certain amount of bandwidth.
So you just have to multiply that by
every single user who's watching it
simultaneously.
The problem that we have is
more to do with, I mean,
we just can't have a great experience.
We've got a lot of chats this week
and we wouldn't be able to integrate chats
with StreamYard if we were hosting a
stream ourselves.
And yeah, like you just pointed out,
unlike YouTube,
there's really no filtering going on with
StreamYard.
So that's the main reason we offer this
StreamYard option for most people.
I would say like if people...
I mean,
I can see why you'd want to watch
it live,
but if you're not going to interact with
the chat or anything,
the most private option is probably just
downloading the podcast to your app
because then it's just a download and you
can watch it anytime without being tracked
after that.
So usually that ends up being the most
private solution,
but all of this chat being integrated into
one place is super nice and that's why
we are streaming on these platforms and
not
Not anything better, unfortunately.
It's just more challenging, I think,
than you would imagine.
Yeah, for sure.
And I also want to mention that the
nice thing about StreamYard is like we
were talking about at the beginning,
we can broadcast to multiple channels at
once.
So that's kind of, I think,
one of the main reasons we use it.
I'm sure there's probably other reasons
behind the scenes that I'm not aware of.
But that unfortunately also kind of limits
us to...
what they're able to support.
Cause I mean,
there might be some kind of like third
party script that can mirror to pure tube,
for example.
But then like Jonah was saying,
we can't see the comments there.
And it's just, it's, you know,
it's like you were saying a minute ago,
or we were saying a minute ago about
switching to services and recommending
services.
It's like,
we kind of have to balance like what's
technically possible with what's going to
give us the most.
I don't want to say return,
but you know,
like we only have so much time and
technical energy that we can spend in
places and we need to make sure we're
maximizing it.
So.
Yeah, absolutely.
It will be on PeerTube.
It will be on whatchamacallit,
on podcasts like you were saying.
So we do our best to try and
offer people private alternatives,
but it can be rough.
I think there was something else I saw
that I wanted to mention.
Oh, yeah.
Somebody stopped by and just said,
thanks for everything you're doing.
So thank you.
Just wanted to shout that out.
Yeah, thanks for all your support.
I mean,
even like just from an algorithmic
perspective, one of the main goals,
both with this stream and with our YouTube
channel in general is to reach new
audiences who wouldn't be interested in
the in the type of content that we
would publish on privacycast.org,
for example.
So any sort of engagement on YouTube,
especially
is helpful for us,
even though we're asking you to use
Google, which is not great.
But in terms of reaching people who have
never seen any of this before,
it's super helpful.
And anything that we can do to improve
that and maybe help other people get this
information that they otherwise wouldn't
is super good.
Because it's exactly what Nate was saying
earlier,
not just about software being a good entry
point,
but
I'm hoping that a lot of the videos
that we're publishing is a good entry
point where people will then feel inspired
to check out the privacyguides.org site or
check out our forum when they otherwise
wouldn't have any awareness of it at all.
So that's a big goal for everything that
we're doing on YouTube and our videos in
general.
I think the last thing on that note,
what Carrie said about our conversation a
minute ago is I was pointing out that
for some people, when they start software,
it could be their entry point to move
on to other things.
If something's too complicated or onerous,
especially as a first foray into privacy,
it can derail people.
So yeah,
kind of similar to this whole streaming
thing.
If we tell people like, oh,
you can only find us on PeerTube,
and by the way,
there's like a hundred million instances
and just trying to be user-friendly to
everybody in that sense.
Lots to think about.
Anywho.
Yeah,
let's move on to our next story here.
This was reported by the Proton blog.
Looks like in their business section, but
They wrote about Microsoft Edge keeping
all saved passwords on your device
unencrypted.
So if you save passwords in Microsoft
Edge,
this article says there's a security risk
you should know about.
According to a new disclosure,
whenever you open Edge,
the browser immediately loads all saved
passwords into memory in readable form,
not just the password for the website
you're logging into.
That means credentials for every account
saved in Edge could be exposed if malware,
a compromised admin account,
or another attacker gains access to your
device or user session.
This is a really interesting story to me
because,
as I believe it's pointed out in this
article,
this isn't typical for Chromium-based
browsers in general.
If you look at Google Chrome,
they will only release the password in the
memory.
when you're using autofill,
and then they delete it after.
And your passwords could be at risk if
you just leave Microsoft Edge open,
like it's showing on the screen there.
Which is probably happening most of the
time for people because you always use
your browser.
But I mean,
even if you open it for a second,
malware can potentially get all of that
information at any time,
which is not great.
Microsoft kind of defends this with a
similar excuse to what Signal has said in
the past about their desktop client,
which is basically...
If this is something that's going to
compromise your data,
you probably already have malware on your
device that can get access to all of
this data.
And that's certainly true.
I mean, you probably have,
in such a case,
you might have bigger problems to worry
about than just this alone.
There are a lot of ways that malware
can exfiltrate your data without your
knowledge.
Yeah,
you just don't want to have malware on
your computer, obviously.
But at the same time, and again,
when signal desktop had some issue with
information being available to other
programs on your device,
we also said this, like,
there are technologies that edge could be
using that would improve the situation
beyond
beyond this.
And for them to do this means that
they've explicitly changed some aspect of
Chrome because, again,
stock Chromium doesn't have this behavior.
So it's just an edge-specific problem if
you're using edge in Windows, which is...
Not great.
I actually don't know if this article says
whether this occurs if you're using Edge
on another operating system like macOS
or...
I think there's a Linux version of Edge,
isn't there?
I don't remember.
Somebody tell me.
But there is.
Yeah,
but I don't know why you would be
using Edge on any of those platforms.
So it's probably not a huge issue,
even if this is the case in other
ones.
But, you know, on Windows especially...
Windows is still super popular and edge.
Microsoft really tries to force it to be
your default as much as possible.
So I mean,
I would imagine this would affect a lot
of users.
But at the same time,
only only making this available to like
local users or local software like
malware.
It's not the worst thing in the world.
It just seems completely unnecessary.
So I don't
Yeah,
that's what I would have to say about
the edge stuff.
Did you have any other takeaways from this
article, Nate?
Um, I think just the, uh, um, yeah,
I mean, it's, it's, unfortunately it's,
uh, it is unique to edge,
which kind of weakens the argument of like
move away from that stuff.
Cause I don't know a lot of people
that do use edge, but, um,
I think my big thing is it reminded
me of, you know,
and of course Proton's going to take this
opportunity to show their products and
they say use a password manager, but I,
I kind of agree with them on this
one.
Um,
I think there's a lot of reasons to
use a third party password manager.
Um, one of them is, um,
their browser agnostic, right?
We were just talking a minute ago about
maybe somebody starts off using Brave and
then eventually uses other browsers.
If they have a third-party password
manager,
that makes it a lot easier for them
to switch browsers because that's one less
thing they have to worry about switching.
There are also, I believe,
correct me if I'm wrong,
but I know there is malware that is
capable of stealing data that's stored in
the browser, like passwords, history,
credit card numbers.
And I think that it does not work
anywhere near as well, if at all,
on third-party password managers because
of the way that they're segmented away.
But I think a lot of other browsers
are also segmenting it away in a similar
manner.
I mean, obviously,
in most browsers except Google,
It's optional in Firefox,
I believe you can do this,
but you typically don't need a master
password to unlock your passwords or
anything,
so there are certainly ways to get into
that locally.
As this article points out,
on the disk they're using standard
encryption,
but what's happening is all of the
passwords are always being loaded into
readable memory or RAM as soon as you
launch the browser,
so
Since the browser is open most of the
time,
the fact that it's encrypted on the disk
is probably not super relevant.
But yeah, another... Oh, can't talk today.
Another thing I wanted to point out that
I just remembered was, I mean, Microsoft,
this has happened before.
There was a similar issue with Microsoft
Recall, where they...
just let anybody access all of that recall
data, all of your screenshots.
Any malware on your device could access
all of that without any protections in
place.
And that just seems to be Microsoft's MO
when it comes to developing software these
days.
They don't seem to take into account any
sort of local attacks, unfortunately.
Carrie just pointed out,
even though Signal originally said that
plain text messages while the app was
running wasn't a problem,
Didn't they eventually fix that?
And yes, they did.
And this is a case where I wouldn't
be surprised if Microsoft fixes it as
well, just because, again,
this is non-standard behavior.
I have no idea why...
Microsoft would choose to do this.
I don't know what feature that they
thought this would enable.
I don't know how they I have no
idea how they use this or why it
would be necessary for them to change it.
But now that it's getting attention,
they might do it.
Of course, on the other hand,
Microsoft isn't a company super well known
for security.
So unlike signal,
so I also wouldn't be surprised if they
don't fix it.
I guess we'll just see what what happens
there.
Microsoft, not well known for security.
That's blasphemy.
Yeah.
Signal kind of dragged their feet with
fixing that.
They like kicked and screamed about it,
but they did eventually.
So, yeah.
um yeah i mean i guess that's that's
all i got that was my big takeaway
is to use a password manager and that
kind of eliminates the problem and also we
don't recommend edge anyways so um but
yeah definitely uh hopefully they will fix
it because i know i mentioned before at
my last job um i used edge on
the work computers because first of all
they issued us those computers and we were
so deep in the microsoft system that
everything just integrated better with
edge and like if i used any other
browser
it added so much more friction which i
didn't have a desk job anyway so it's
like the less time i spent on my
computer the better if i was spending a
lot of time on my computer something was
wrong because we were like searching for
manuals or trying to get a hold of
somebody or like tech support or like so
yeah i just used edge because again work
computer i didn't have anything personal
on there that's their problem if it gets
breached but um it was you know
What I mean by that is it's their
problem because they're the ones deciding
that we want to use all this insecure
crap.
But anyways, so yeah,
I mean it's very popular in corporate
environments,
and they should probably fix that.
I think,
I guess that's kind of all we got
now on those stories.
So we're gonna start taking viewer
questions here in just a moment.
So the chat's been really active,
which has been super, super awesome.
But if for some reason you've been holding
onto questions and you haven't dropped
them in the chat,
go ahead and do so.
But for now,
we're going to check in on the community
forum.
And I mentioned that there's a pretty
active week.
I mean, it's always really active.
But there were a lot of good discussions
this week.
Ironically,
we're actually going to talk about Proton
again for a minute here because Proton now
supports post-quantum encryption.
And I think it was last week that
Jordan and I talked about this a little
bit because somebody asked about it in the
chat,
but I thought this could be a good
opportunity to talk about post-quantum
encryption specifically and what it is and
all this kind of stuff.
So definitely correct me if I'm wrong
here, but I think...
without turning this into a deeply,
deeply technical video that hurts my
brain.
Basically,
quantum computers are like the next
generation of computers.
You guys probably know this stuff,
but just in case.
And basically,
they're exponentially more powerful than
current computers,
aka classical computers.
And it matters.
I mean,
it's a good thing in a lot of
ways because they're way more powerful.
They're way faster.
They can do a lot more computational work.
But it also has a lot of implications
for cybersecurity and concerns about being
able to crack certain forms of encryption,
even without a zero day or a
vulnerability.
Like they're just so powerful that they
can do.
Cause here's where I'm starting to get a
little out of my element.
Cause modern cryptography basically relies
on the idea that like,
The numbers and mathematical equations
we're using to create this encryption are
so astronomically high that no computer
could realistically do these kind of
computations at scale without knowing the
password and the key.
And quantum computers kind of laugh at
that and say, hold my beer.
So yeah,
we're seeing a lot of companies both in
and out of privacy are really kind of
starting to roll out post-quantum
encryption.
Signal is one in privacy.
Tudor's one.
Proton's one now.
And outside of privacy, we've seen Apple.
I mean, arguable privacy on that one.
We've seen Apple.
We've seen Cloudflare.
I'm sure there's a lot of others that
I'm forgetting.
I think Google is messing with it a
little bit too.
So yeah, I think,
was that a pretty good summary so far?
Yeah, I believe so.
I mean, the quantum computers,
I guess it is sort of the next
generation of computing.
Not in the sense that it's going to
replace any of our current computers right
now, though,
because quantum computers are never going
to be
good at certain things.
It's very niche.
But certainly breaking encryption,
some encryption schemes,
is one of the things that they can
do.
Not currently because they're extremely
not powerful, but maybe in the next ten,
fifteen years,
it's a very real possibility.
And post-quantum encryption today is
Super important, in my opinion,
because there are definitely a lot of
scenarios where all of this data could be
stored and decrypted later by any number
of parties.
I would imagine governments are
probably...
uh working on collecting as much internet
traffic as they possibly can um without
really knowing what to do with that
traffic yet but we know like for many
years now the nsa for example has built
that huge data center in utah basically
just to store a huge amount of data
um so for some people and for some
threat models i think this is a real
concern when quantum computers would get
into the hands of
normal attackers.
It's hard to say if that'll happen,
if ever,
but certainly within the realms of
governments and probably within the realms
of huge companies that you might be
concerned about to get quantum computers
in ten, fifteen, twenty years or whatever.
We do have a full video on post-quantum
encryption on our YouTube channel that I
would definitely recommend checking out
because
There's a bit more nuance to all of
this, but I think it's a good explainer.
Yeah,
I was just logging into Proton right now
to see if I had access to this.
And this is a big problem that I
have with Proton that annoys me a lot,
that even though
I have a visionary subscription that they
say will get you access to all the
features when they come out.
They never give me access to features
first.
It's always like randomly after a lot of
other people get them.
So the blog post does say they're rolling
out gradually.
You probably won't see it in your account
yet, but maybe some of you will.
Unfortunately, I don't see it yet.
But what can you do?
I can complain about Proton all the time,
and they probably won't change this or
improve it for me.
But maybe they will.
If anyone from Proton is listening,
you should do things better for visionary
subscribers.
I know it's a very niche problem.
This is like first world problems to have,
because most people are not going to be
on a visionary subscription.
But yeah,
if you do have access to this,
let me know how it goes.
I believe it's optional.
You have to upgrade to it,
but that does make a bit of sense
because, I mean,
Proton can't do it for you because they
can't decrypt your data in order to
re-encrypt it.
I would imagine at some point,
maybe Proton could...
do it automatically when you sign in,
but they're obviously not doing that now.
And it's probably a good thing that
they're not doing it now because it would
be very hard to do that automatically in
a way that perfectly protects your data,
I would imagine.
So yeah, it's an optional feature.
Definitely upgrade to it when the feature
becomes available to you because I think
it's important to get going now.
And again, in our video about it,
we explain more of the reasons why it's
important to get started with it sooner
rather than later.
Yeah, there's the video.
Yeah, sorry,
I just found it and pulled it up.
Yeah, so for any audio listeners,
it says The Threat That Makes Encryption
Useless.
That's the title of the video from October
of twenty twenty five.
So definitely check that out.
And yeah, I
real quick on the topic of proton and
not having that switch.
I think they paused it because I think
a lot of users were reporting issues that
it was like breaking proton drive or
something like that.
So I think that's why you don't have
it.
I think they paused it while they're
trying to figure that issue out.
Interesting.
Okay.
But yeah,
one thing I wanted to address here is
Jordan said it feels a little bit like
AI hype.
Yes and no, because I agree with you.
I've heard a lot of experts talk on
this topic on like various podcasts and
stuff.
And I've heard a lot of them say
that like,
it's probably not coming anytime soon.
Like there's always certain technologies
that are like in the next five years,
right?
Like the running joke is cold fusion.
Um, for decades,
scientists have been like, no, no, no.
Like,
like we're right on the edge of cracking
it.
Like in five years,
we're all going to be using cold fusion.
And they've been saying that since like
the eighties,
probably even earlier than that.
So it's kind of become like a running
gag.
Like, Oh yeah,
it's always like five years away.
And, uh,
a lot of people are saying that about
like, uh, AGI, uh,
artificial general intelligence,
which is like the actual,
the stuff you see in sci-fi movies.
And it's like, you know,
of course Altman and,
and everybody's out here trying to hype up
their stock prices.
Like, yeah, man,
we were just going to roll out next
year.
It's like, uh, yeah,
that and cold fusion too.
Sure thing, buddy.
Um,
this one I've heard people be a little
bit less pessimistic.
In the sense that they're like, well,
it's probably not five years away,
maybe ten years away.
I mean, it's probably possible.
It's just like they're definitely
overhyping how close it is.
But I think you may have said this
is like I do still think it's a
good thing that we're getting ahead of it
because you mentioned the harvest now
decrypt later where like.
The NSA,
which a quick little piece of trivia for
anybody who looks at my online presences,
it's a selfie of me outside of a
building.
That is the NSA's data center in Utah.
I've done that twice now.
I am absolutely on a list.
There's not a doubt in my mind.
So yeah,
I think the whole point of the NSA's
data center is just to collect as much
information as possible so they have it
later when they...
quote unquote want slash need it.
So, um, yeah,
I think it's really cool that they are
getting ahead of this, but I'm with you.
I think I'll probably turn this on
whenever they roll the feature back out.
And, um,
whenever I stopped seeing people say that
it borked their proton drive,
not that I use proton drive a whole
lot, but still it's, uh,
it's good stuff to have.
I think personally, um,
I think somebody else said something too.
yeah i'll look at this question from uh
terracotta pie on youtube um and i'll
actually um share a thread that i saw
on on x about this from
Matthew Green,
if I can get this pulled up.
I'll sum it up so you don't have
to read the whole thing.
Matthew Green, if you don't know,
he teaches cryptography at Johns Hopkins,
and he's a big expert in the cryptography
space.
And basically what he says about the whole
quantum computing thing and why it's
probably not a huge issue now is that
There isn't really a lot of reason to
invest in quantum computing for
businesses.
Unlike normal computers back in the day,
traditional computers had very clear
business impact.
This is going to improve businesses in so
many ways as soon as they were developed.
No matter how slow they were, there were
huge practical applications for regular
computers to get those developed and make
them even better as fast as possible that
don't really exist for quantum computers
right now.
There's not a,
there's just not a lot of reason that
businesses would need them in the first
place.
So that slows down investments into it and
that slows down development overall.
Um, the other point that he made,
and I think this ties more into, um,
Well, I guess, yeah,
I guess your question,
whether there's a concern about whether
these could already be in use,
I think it's fairly unlikely.
Just because these companies really don't
have access to super powerful quantum
computers and
If they did, I mean,
there would probably be big announcements.
The other point that Matthew Green points
out in this thread, though,
is that we don't really know exactly what
the government's capabilities are.
There's different trains of thought on
this.
Some people would think that the
government and their technical
capabilities has really fallen behind the
academic and tech community,
and that big tech is really pushing all
of these improvements.
And the
what's available to big tech now might
just be the best in the world.
But some people think the government could
be like,
thirty years or fifty years ahead of
what's publicly known right now,
and they could have access to all of
these quantum computer resources and could
be using them to break encryption at the
moment.
So it depends on what you think about
the government,
but we likely wouldn't know because
As he points out,
if the government has access to this
capability,
they would try and keep this as secret
as they possibly can.
Um,
which has always been the case when
governments have new encryption schemes or
whatever,
you can think about like the Enigma
machine back in what world war two.
Um, the, the British, once they,
once they cracked it,
they went to extraordinary lengths to hide
the fact that they could now break this
encryption scheme that,
that the Germans were using because.
having that power and keeping it to
yourself and not sharing it is super
important.
And if they had quantum computing
resources,
that would be like a huge massive
advantage to every government and they
would be definitely trying to keep that as
secret as they possibly can.
So this whole thread was basically in
response to a lot of
crypto people and Bitcoin people are like,
well,
we're going to know when quantum computers
are powerful because somebody will use it
to hack Bitcoin, basically.
And the point of this thread is that
it's not really the case that that would
happen.
I mean, in the grand scheme of things,
there's a lot of money in Bitcoin,
but it's not like to the government or
to somebody else who would want these
quantum computing resources.
The whole Bitcoin
market uh value is probably a drop in
the bucket for them and they would be
much more incentivized to not not do
something like that and to keep it secret
instead so yeah that's basically the whole
thing i would say we don't know for
sure um but i i would say it's
fairly universally accepted that's
probably going to be a problem you know
within the next
I mean, even conservatively,
probably thirty to fifty years,
because there is progress being made on
all of that.
Neville Matthew on YouTube asked,
I'm assuming there's a considerable amount
of compute power to crack these
encryptions by quantum computers.
I don't, okay,
I don't understand what you mean exactly.
I assume you're asking
whether a considerable amount of compute
power is required.
And the answer is yes,
you need like a massive amount,
like quantum computers are nowhere even
close to being near to what you would
need to have any sort of practical
application and to, to,
craig encryption so we're we're very long
ways off um in the quantum computing power
as far as we know like i just
said doesn't exist yet um so i think
that answers it either way right now there
is not a considerable amount of quantum
computing power um
at least among these tech companies and
the academics who are publishing this
stuff.
And yes, you would need far,
far more than what we have now to
do anything practical with it.
But, you know,
progress is always being made.
My only thought is what you said about
governments aren't interested in the
market cap of Bitcoin.
Asterisk does not apply to North Korea.
Yeah, that's certainly true.
I don't think North Korea is on the
bleeding edge of quantum computing,
but you never know what's going on over
there.
Yeah, no kidding.
I never miss a good chance to take
a pot shot at that guy.
We did have one other forum thread here
that was interesting.
It's about IVPN has revamped.
I'm actually going to share their blog
post here.
Not the forum thread,
but the blog post from IVPN.
Let me swap it around here a little
bit.
IVPN has revamped their plans.
So for those of you who don't know,
I want to say about two years ago,
I want to say it was the end
of twenty twenty four.
IVPN purchased Safing,
which is the company that makes Portmaster
and SPN, which is a pretty awesome.
I think Kerry Parker once described it as
a reverse firewall.
It's kind of like a like on Mac.
We have things like Lulu and Little
Snitch.
And Port Master is probably the best
Windows version of that.
I know there's also things like Simple
Wall, for example.
But Port Master was really slick.
It's really good.
It comes with good defaults out of the
box.
I think I mentioned in previous episodes
that whenever my wife gets a new computer,
she asks me to set it up and
do all the privacy stuff.
And that's one of the things I do
is put Port Master on there.
Admittedly,
it does not work very well with other
VPNs.
It's designed to be used either by itself
or with SPN,
which is their version of a VPN.
It's not really a VPN per se.
It's like a multi-hop VPN.
It's interesting.
They do some interesting stuff with SPN.
I like it a lot.
Um, yeah, so IVPN acquired safing and, uh,
they basically said that they were going
to roll port master into IVPN and there
was going to be not a required
functionality.
Like you could still use them separately
if you want to,
but there was going to be
interoperability.
And, uh,
they also announced that they were working
on some other stuff like, uh,
an email aliasing feature and a DNS
feature.
And that all appears to be coming to
fruition now.
So there are three plans for IVPN.
There's standard plus and pro,
which are sixty,
eighty and one hundred dollars a year,
respectively.
And basically the changes are the standard
VPN is now including multi hop and a
five device limit,
which I kind of wish they did.
Oops, wrong way.
Still getting used to max.
I kind of wish they would have a.
Oh, OK, here we go.
So for the standard plan,
it was two devices and did not include
multi-hop.
The plus plan will also include the new
email, AOListing,
and DNS that I mentioned.
And the pro plan will offer a ten
device limit and access to all additional
services, including Port Master Pro,
which for the moment is only available on
Windows and Linux, unfortunately.
And they said that there are no price
changes on existing pro and standard
plans.
Pro is now the pro suite.
So, yeah,
I think if I'm reading this correctly,
basically prices haven't changed.
You're just getting more bang for your
buck regardless of which plan you're on
because.
Again, like even the lowest plan.
Now you've got more devices.
Now you've got multi hop,
which is super cool.
Multi hop is, I would argue,
not necessary in every situation,
because there is a considerable hit to
speed.
But there are times when it absolutely
makes sense.
Yeah,
it says pro went from seven to ten,
and you have access to all these different
port master pro male x and mod DNS.
So yeah,
Yeah, I like IVPN.
I think they're really cool.
I know I cannot find it to save
my life.
I should probably try again because it's
been a while.
But I swear back when I was on
surveillance report,
there was a period of time,
like a six month window, I think,
where we were covering VPN
vulnerabilities.
And I swear to God,
every single one of them was like, oh,
it affects this VPN, this VPN, like Nord,
Surfshark, Proton,
but does not affect IVPN.
And they were like, I swear to God,
there were like four or five of those
in a row where they would find
vulnerabilities.
And there was something about the way IVPN
was running their architecture that it
didn't impact them.
And I always thought that was...
I always thought that really spoke to
their security.
So they are one of the VPNs we
recommend.
We also recommend Mulvad.
We also recommend Proton.
They're all really great choices.
They all have pros and cons.
IVPN has a few cool features that I
really like, but yeah,
I think that's kind of these new exciting
changes.
Jonah,
did you have any thoughts about IVPN's new
direction?
I was just taking a look at the
forum thread here.
I don't want to like,
volunteer him to answer a ton of questions
necessarily but i will say victor from
ivpn is on our farm and it's pretty
active at least in ivpn related threads um
and i saw he was answering some questions
about the changes in this forum thread so
if you want to check that out if
you have any questions he might have
already uh shared some stuff i totally
agree that um
The device limit changes are very welcome.
Two is very limiting for sure,
especially as Jordan just said in the
chat.
To me,
it never made a lot of sense because
I think a lot of services were offering
more than that for quite some time.
Also, there are workarounds for it.
Like on your home devices,
you could use IVPN on your router to
kind of connect as many devices as you
want.
But then you can only do that at
home.
You can't do it for a lot of
remote devices.
Obviously,
you have to distinguish your pricing plans
somehow.
But yeah,
I think it still makes sense for them
to increase it at least a little bit.
Otherwise, yeah,
it seems to be a good value.
As far as I know,
they had they had all three plans before,
right?
There's not a new one.
I don't remember what the difference was
between them, though.
I'm gonna go dig it up on the
web archive.
Yeah,
cuz I'll just I'll just go back like
a week or something.
Because I don't remember how you got
access to mail exit my DNS before.
No, no, no.
Those are new.
I think those didn't exist before,
but that's being added to the plan.
They existed before today, though,
I thought like male X was announced a
while ago, I believe.
It was, it was announced a while ago,
but I think it was in like closed
beta because I remember they actually,
I feel bad about this.
Um,
they actually sent me an invite to test
it out and I got it.
Like I made an account,
I got into it and then I like,
I was like, okay,
now I need to find something I can
sign up with.
And I just kind of forgot to go
back.
Oops.
Oh no.
It looks like a week ago.
It looks like there were only two plans.
That's what I was.
Okay.
So what were the two plans?
So there was IVP and standard that says
all protocols,
two devices and anti-tracker,
and that was.
A year.
And then there's pro that's all protocols,
seven devices,
anti-tracker and multi-hop and that's the
a hundred dollars a year.
So it looks like,
so they added the plus plan.
Yeah.
And, and then ups the device limit.
Okay.
Okay,
that's what I thought happened because I
did not remember three before.
But the changes are welcome.
I definitely think if iVPN is going to
add more services like MailX and ModDNS,
it is great that they added an
intermediate plus plan instead of...
just increasing the price of the standard
plan.
You always want to see a bit more
delineation,
especially with features that probably not
everyone needs.
Some people are going to IVPN just because
they only want a VPN and nothing else.
And it's nice that you can still get
the standard plan that they had before
with the increased device limit for the
same price.
And it's also nice that you can get
these additional features
In the meantime, as an intermediate plan,
I haven't used Portmaster in quite some
time,
so I'm not sure whether I would say
it's worth the extra money,
but maybe it is.
A lot of people on our forum seem
to use Portmaster and like it, so...
Definitely worth checking out, at least.
I should check it out again,
although I see they still don't support
macOS,
which is what I told them I kind
of wanted from the beginning when Saving
launched Portmaster.
And it seems like that has never changed.
So I couldn't use it on all of
my devices, then only my Linux devices,
which is kind of unfortunate for me.
But I guess if you use Linux,
you wouldn't have that problem.
Uh, and they also,
I was just going to say on their
old pricing plans,
they advertised like the two and three
year plans with an additional discount.
It looks like they,
they do still have those.
They just don't show it on the pricing
plan anymore.
So if I try to buy a plan,
you can see those additional tiers.
Um,
and that seems like a good option if
you want even more of a discount, um,
than, than they already provide.
Nate, you're muted.
Okay.
Yeah,
I'm gonna have to test out MailX for
sure.
Because I think I'm,
I'm always I'm very happy with simple
login and Addy.
But I think it's one.
It's kind of like email, right?
Like Tudor and Proton and mailbox are all
good.
But it would be nice to have a
little bit more competition.
Instead of encrypted messenger number five
hundred and fifty seven million.
Um, and I, I feel that way about,
uh, uh, like aliasing services too.
It would be nice to have a little
bit more.
Cause I mean,
there are things like Firefox relay,
for example,
but they're very limited in what they can
do compared to something like simple login
or Addy.
So, um,
I'm really curious to check that out,
but I was just going to say, yeah,
I, um, up until last year, cause, uh,
when, when we moved,
we really scaled down a lot of our,
our stuff to kind of save money.
And, uh,
Um, I used to have SPN and it,
it's definitely come a long way.
When I first started using it,
it had a lot of like, um, disconnects,
I guess you could say,
like there were a lot of times that
things wouldn't load and I would have to
like on like disconnect and connect again
to get it to like reestablish the
connection.
Um, they really fixed that stability.
I, I liked it.
I never really noticed any issues with it
other than again, everyone,
it would still do that every once in
a while,
but nowhere near as bad as it used
to.
I think the, um,
The big issue that I have with it
is, again,
the fact that it does not work well
with third party VPNs,
which I don't know if that's maybe
something about the architecture and the
way that it's worked,
the way that it works.
Because like, like, again,
I put it on my wife's computer because
she doesn't usually use a VPN.
She doesn't really care for them.
But on my computer,
it's either basically you have to use SPN.
you have to use the router level VPN,
which I don't like to do because there's
certain things that I trust and I want
to send outside the tunnel,
like Tor or Signal,
or I just can't use Portmaster.
And unfortunately,
that's where I'm at right now.
So, yeah.
I don't know.
I like it though.
It's got a really clean UI.
The SPN is a nice benefit.
I was just looking at the Portmaster
pricing because there's another point I
want to make after this.
But I will say,
Portmaster Pro is a bit more than I
thought it was.
It's already eight euros a month to pay
for independently.
So IVPN's pricing,
if you want Portmaster Pro...
which includes access to SPN,
which is like, I mean,
it's a VPN service that Safing offers.
Safing being owned by IVPN now, obviously,
with some additional benefits beyond a
VPN.
So if that is something you want access
to,
and then you also want any of these
other IVPN features,
the plan change actually seems like a
great deal because I don't think any of
them, I mean,
none of the plans came with
port master before for sure so it is
kind of a step towards something like
proton unlimited for example that gives
you access to all of these things um
but on the other hand what I dislike
about some of these services is that uh
my DNS malex you can't pay for separately
which I think is kind of unfortunate
because like even with simple login right
now if you don't want
a Proton subscription or you use Proton
but you don't need all the additional
features of Unlimited and you just want
simple login,
you can still buy those products
independently.
And typically, if you use all of them,
bundling ends up being a lot cheaper,
but I would love to see some tier
of MailX that you could use independently
of all the IVPN stuff,
especially because you don't get it on the
IVPN
base plan so that does make it fairly
expensive for people as opposed to simple
login which is thirty six dollars a year
um just for access to simple login but
that probably continues to make more sense
than paying eighty dollars to IVPN if
that's the only service you need um so
it'd be nice if that was independent but
Beyond that,
the bundles do seem like a good value
for people who are using it.
And especially, I mean,
if you're using IVPN standard already and
you're using something like SimpleLogin
for thirty six dollars,
you basically get a new ALUsing service
for only a twenty dollar difference for a
year plan instead of the thirty six.
So, yeah, bundling it could make sense.
I see a lot of different opinions about
bundling stuff in general,
like on the form.
I don't know if my camera just
disconnected.
That's weird.
Yeah.
Did your camera overheat?
We still hear you though.
I don't know.
I'll figure this out.
You can go back to talking more stuff.
Yeah, no,
I was gonna say I know what you
mean.
Like bundling is it I mean,
you really hit the nail on the head.
Like on the one hand,
it's it's cool to have a whole bundle
like proton unlimited or like this ibpn
plus or pro suite.
And it's really cool.
But only if you're actually going to use
all those things.
If you're just like, No,
I just want male x for whatever reason,
or I want my DNS for whatever reason,
it,
it probably doesn't make sense to pay at
dollars a year.
Um, but yeah, it's, uh,
it would be nice to see them offer
that more modular thing.
I think my concern is, um, uh,
I,
my only reservation is I worry about
companies trying to do everything at once.
Like one thing I really admire about
Mulvad is they're basically, I mean,
they do have Mulvad browser,
but for the most part,
they only do a VPN and that's all
they do.
And they don't really seem interested in
doing anything else.
And that's great.
I mean,
they do have like some public DNS servers
you can use, but it's not like this,
you know, this...
my DNS standalone DNS service with block
list combinations and configurable rules.
Like more of that is just like,
here's our DNS.
You can use it if you want,
or you can not, we don't care,
but there it is.
And I,
I really respect that kind of like
specialization.
Whereas you look at things like proton
that rightfully so get a lot of, um,
a lot of criticism for the fact that
it's like, yeah, that's cool.
You have five hundred tools,
but like they don't work for crap on
Linux.
Ninety percent of the time, you know,
the the feature parity across operating
systems is just trash.
Like, you know,
there's there's features that people have
been asking for since I got into privacy
ten years ago that you still haven't
rolled out.
And so I just I worry.
I hope that they they aren't going to
bite off more than they can chew is
what I'm getting at.
So it is really cool to see them
add more and especially like
as much as I love IVP and I
gotta be honest,
like I think between Mulvan and proton,
I have kind of been struggling to figure
out like what their,
their niches and what their selling point.
Like, again,
I think they have really good security and
I don't think they're bad.
Like,
I don't think we shouldn't list them or
anything.
And there's,
there's a couple of neat features they
have.
Like they have this feature on,
I think it's Android only where you can
set up a trusted network.
So like, let's say your home network,
you have a VPN on the router, right?
You can tell your,
your IVPN app that like, Hey,
when you connect to this wifi turn off,
Because there's no point in having two
VPNs.
I mean, I know some people want that,
but for the average person, it's like,
I don't need that kind of speed slowdown.
But then when you disconnect from that
network, turn back on.
And so it automatically,
like you never have to manage your VPN.
And I think that's a really,
really cool feature.
But, um,
But yeah,
other than like little things like that,
I'm like, yeah, what are they really?
Because like Mulvad's thing is like
hardcore privacy,
hardcore anonymity and Proton's obviously
got the suite and they promised they work
with streaming services and stuff like
that.
So I guess what I'm getting at is
it is nice to kind of see them
starting to like carve out a niche again
and start to have like these competitive
features again.
And I think that's really cool.
And yeah, I saw that comment too.
Damn, almost two hours stream.
Yeah, this is normal, man.
Where you been?
No,
what was crazy was the other week we
went for like three and a half or
four hours.
That was wild.
We got a lot of stuff to talk
about every week.
Exactly.
Got a lot to say, man.
And then, yeah,
somebody else said ProtonDrive for Linux.
Yeah.
Yeah, exactly.
I wish.
Is ProtonDrive supported by Rclone yet?
I feel like I saw something about that.
Oh, I don't know.
That's above my skill level.
Oh, yeah, it is.
Yeah.
So technically,
there is a way to use it.
But yeah,
Proton Drive sadly doesn't have an
official API,
so they kind of just did the best
they can.
But Proton can kind of change it any
time.
I vaguely remember that now.
Which is interesting.
Their website says that they believe it
works.
I don't know what has...
Maybe something has changed.
Like I said,
Proton can kind of change all of that
at any time, so...
Not a great solution.
I would definitely rather Proton Drive
just release a Linux client,
but Linux support doesn't seem to be a
huge priority for Proton in general across
any other stuff.
I think that's one of the many problems
I have with Proton.
But what can you do?
I agree.
Just about IVPN really quick.
I was trying to look through their site
and find out more about these plans.
And if anyone from IVPN watches this,
I literally signed up and then tried to
change my plan one time and it says
too many requests.
Try again later.
So I don't know what's going on with
your site,
but the rate limiting might need a bit
of work.
rate limiting plans.
I've never heard of that.
That's interesting.
Yeah, I don't know what's going on there.
But yeah, overall, I think it's cool.
Definitely some concerns.
But yeah.
I think that's all I got for forums.
You ready to move on to the q&a?
Yeah,
we'll have to look through the chat here,
see if we miss anything.
I saw on the forum thread,
we basically just got one question in
advance this week.
Expert-FortyEightSeventy asked,
if we could add XMR chat as an
option for stream donations?
And the answer is yes,
I would love to do that,
but I keep forgetting to do that.
But also,
I'm not sure if we can show Super
Chats on the screen with an XMR chat
in the way that you've seen it on
other streams.
Just because we're not using OBS,
unfortunately,
so I don't think we can show those
banners in StreamYard here.
But we could definitely do it, and...
I don't know, manually type it.
We currently type the banners like the one
you see on the screen right now.
So yeah,
if I remember to set that up,
we can definitely test it out.
Hold on.
So it, uh,
I don't know if it will relay chats,
but if you go to their front page,
it says how to use XMR chat.
It does have instructions for stream yard.
It looks like it has to go through
Twitch though.
Interesting.
Oh,
cause it'll cause it'll send the message
in the Twitch chat and then we could
do it like all the other comments we've
been doing.
So I guess, I guess we could potentially.
Yeah.
I mean,
we'd have to look into that more.
I don't know if that's exactly what they
mean, but yeah,
that could potentially be an option.
Yeah.
All right,
let's see if I got any other questions
here.
Cool.
Yeah,
that's all we had in the forum this
week.
And I think we've been trying to answer
questions as we go,
so hopefully there's not too many.
So I'm looking through some of the names
here on some of the other creators on
XMR chat.
Not a FBI honeypot.
That's a good one.
Thanks for letting us know.
Cool.
Let's see here.
I could get lost in that.
I do that sometimes.
I just scroll through pages and pages of
usernames and stuff.
I like seeing what other people come up
with.
It's very fun.
I feel like I have heard of an
FBI honeypot.
I think they subscribe to our channel.
I think I've seen a lot of comments
from them on our videos, actually.
So that's interesting that you put that
out.
Oh, then hi if you're watching.
I like your username.
It was funny.
Here,
we just got a question from Cannabidder.
Any thoughts on Session shutting down?
Um, I mean,
I have thoughts on that one.
I'm, I'm really sad about it.
I've, uh,
I think he was actually one of the
first people I interviewed, um,
back when surveillance sport used to do
more interviews on the channel.
And, um, I don't know.
I, uh,
Maybe he was first.
I can't remember if he was first or
John Todd was first, but I don't know.
He's always been a really accessible and a
really cool guy, and I'm disappointed.
I'm disappointed for a lot of reasons.
I'm disappointed because I think even
though Session was never an official
recommendation from Privacy Guides,
or at least hasn't been for a long
time,
But I think it still served a useful
space for people who didn't want a phone
number,
for people who wanted the
decentralization.
And you have to remember,
this was before SimpleX.
So now SimpleX kind of fills that niche.
from a security standpoint,
a little bit better.
But, you know,
I think that at the time they served
a really valuable niche.
I'm also just really disappointed because
I know they like just moved their entire
community to Switzerland as a response to
some like pressure from Australian law
enforcement.
And I don't know,
I like and they just announced they were
trying to roll out a perfect forward
secrecy,
which I think would have
I mean,
I don't want to speak for anybody here,
like speculate too much,
but I think could have potentially put
them back on privacy guides.
Like we talked about that as a headline
story.
That was actually one of the first
podcasts I did with you guys.
So I don't know.
I think it,
I know every day that goes by,
it's less and less likely,
but I really hope something good will come
out of it because I do think they're
really showing a lot of potential.
And I do think they potentially serve a
useful niche.
And I don't know.
I hope they don't shut down,
but I know it's getting increasingly
likely as the days go on.
Those are my thoughts.
yeah i think to me it seems definitely
pretty unlikely that they would reach
their goal funding unfortunately it just
goes to show i think how expensive running
a proper messaging service is um you know
people always say something like signal
for example is massively overfunded and
like what could they possibly be using all
of this money for but um
in most cases, like, I mean,
this kind of thing barely breaks even at
best in the best case scenarios, usually.
A couple problems with it is just how
expensive it is to run reliable stuff,
but also having, like,
Mozilla also has this problem where they
say, you know,
you have to pay a lot of money
to get, like,
really good developers behind this stuff
because
the opportunity cost to work at a place
that pays you much less is just so
high because very good software developers
can command huge salaries like one hundred
fifty two hundred thousand or more and you
have to you basically have to pay that
to be competitive even if you don't have
enough money I think yeah you have the
FAQ up I don't know
I don't know what my camera is doing.
This computer is not my favorite so far.
It continues to have problems.
Anyways, yeah, looking at that FAQ,
like I said,
I don't think it's likely that they will
get it, unfortunately.
And they even say,
compared to their competitors,
they operate extremely efficiently,
but I mean...
That's just more proof that it's just
really hard to do something like this.
And I think that a lot of their
excuses or a lot of their reasoning for
why these are problems are more more
believable than than Mozilla's.
I know Mozilla used that justification to
like pay their CEO like
millions of dollars wastefully because
they also were running mozilla into the
ground with insane decisions so it
definitely wasn't worth it in that case
but um yeah in this case like the
people who were developing session um just
need more money than they were taking in
and there's not too much you can do
about that i think it was hard um
because i think a lot of people
I didn't like Session as much when they
switched away from the signal protocol.
I think that made it more difficult for
people to trust them,
especially because Session was relatively
new and rolling your own protocol is
usually not a great idea,
especially if you can't trust them
necessarily to do it properly because you
don't know what their experience is.
So I think that was an issue with
Session.
And then the lack of certain security
features, like perfect forward secrecy,
I think was a challenge for people as
well.
Kerry said he's bummed because it's
fundamentally different than Signal.
I agree.
Session was a weird app because it is
decentralized,
but it's not as decentralized as something
like SimpleX,
which is a decentralization model that
makes...
a lot more sense to me in my
head if I think about like how it
should work.
Sessions was strange and I don't know if
it still is.
I haven't looked into session in the last
year or so,
but I know for a very long time
and this may still be the case,
you needed to be in their cryptocurrency
ecosystem and you needed to have like a
significant holding of of their token in
order to run a node at all.
So it wasn't decentralized in
The same way that SimpleX or the same
way that the Tor network are,
where it can be totally volunteer-run,
there would be really no way for someone
like me, for example,
to contribute to the network in any
meaningful way,
which I think hinders the decentralization
aspect a bit.
I've always said and I would continue to
say the obvious replacement for Session
for most people is probably SimpleX,
but I know that gets in hot water
lately because they've taken on VC
funding,
which is not a great trend that we've
seen SimpleX and Bitwarden and other open
source companies begin to go in lately.
So a lot of problems with all of
these apps,
a lot of upsides and downsides.
Sick Scorpio just asked,
speaking of Mozilla,
are we interested in covering Thundermail
Pro?
I believe at least some of our team
members did get access to the beta and
we are hoping to do something on it.
Absolutely.
Seems like an interesting service,
but don't know too much about it yet.
Yeah,
I think that conversation just came up
today.
So it's a conversation we need to have.
I would love to.
It's not me, by the way.
But yeah,
I would love to cover it for sure
and see if, I don't know,
maybe that person can answer my questions
sufficiently to the point where,
or maybe they want to host the video.
I don't know.
But we'll have that conversation for sure.
I'd be down to do it.
Carrie just said that's the staking unit.
And yeah, I'm looking at the website now.
There is still a staking requirement.
You need twenty five thousand of whatever
this sesh coin is.
I don't know how much that is worth,
but I think it's not.
I think it's somewhat significant,
unfortunately.
They have a thousand nodes,
which is a pretty substantial network,
actually.
I'm not sure who runs those,
but the whole cryptocurrency aspect of it
still doesn't make a lot of sense to
me.
Yeah,
a lot of people really criticized that.
People had a lot of criticisms.
Some of them, I think,
were more valid than others.
I think you mentioned their whole,
the reason it costs so much to stake
is because they were trying to avoid
what's called a Sybil attack,
which is where, for listeners,
it's basically like,
that's an argument people make about Tor,
right?
It's like, well,
what if the US government just rents a
bunch of VPSs and runs like a million
Tor nodes,
and now they own so much of the
network that they can easily correlate
traffic?
Right.
And so that's what session was trying to
avoid is every time somebody spun up a
node,
the price increased so that it would
become financially unfeasible for a
government to do that.
And I think you could argue that like
they, that was the wrong approach.
I think that's totally fine,
but I think their logic made sense.
So yeah, I mean,
then there's other things that people
would criticize that I'm like,
that's just a dumb thing to care about.
So I don't know.
The obvious counterpoint I think is that
If you're worried about somebody with the
resources of the government running a ton
of nodes on the Tor network,
that has a significant cost.
And they can also just spend that on
session tokens.
So I think it actually makes it...
in my opinion,
probably more likely that very well-funded
adversaries could perform a Sybil attack
on the session network.
Whereas with Tor,
there's always going to be like,
that's very possible.
And we've seen very large families of Tor
nodes operated before,
but also we know that
a ton of volunteers are running this,
and there are always going to be a
lot of people who are just contributing to
it for the sake of doing so,
whereas that isn't really possible here.
I'm really curious how much a session
token actually is or where you can buy
it.
Right now, it looks like it's worth zero.
They've probably pulled the plug on it in
light of their impending shutdown,
but it looks like...
In the last year,
it looks like it peaked at about twenty
five cents or twenty one cents.
So it was never a particularly expensive
token.
So, yeah, I guess I mean,
even at like.
Their lowest point before the
announcement, um.
was around four cents.
But if you need twenty five thousand,
you're still talking about a thousand
dollar minimum investment.
That would be hard for people.
I think most independent server operators
to justify unless you really liked
session.
Yeah, that's true.
And for most of the time,
if I'm looking at this graph,
it was a lot more than four cents.
So it would have been it peaked at
like twenty one cents,
which is
I don't know, how much would that be?
That'd be like over five thousand dollars
that you would have to just stake forever.
And it obviously wouldn't have turned out
to be good financially either because now
it seems like you're just gonna lose that.
Nate, you're muted again.
god dang it i just said very unfortunate
so yeah uh can i better just ask
how big is the privacy guides team uh
staff wise um uh it's it's me and
nate and jordan right now so it's three
um
The whole team varies.
What are we at, eleven people?
But you can always go to the form.
I'll just show this really quick.
If you go to the form and on
the on the left hand sidebar,
if you hit the more menu,
there's a team members option and then you
can see how many people are listed on
there.
So.
Depending on how you count it,
some people are more active than others is
the only reason I say that.
But certainly a good number of people
volunteering.
Cool.
I think that's probably it for questions
as far as I see for now.
Anything else, anyone?
Last call.
Oh yeah.
Look at that.
If you go to the website and you
click on team members under the about
section, it lists everybody.
Yes, there are ways to find out.
But currently in terms of staff,
just us three.
And honestly, mainly video stuff.
We do pay for other things,
like on a contract basis.
So like,
Freya gets paid on a per article basis
for the news stuff.
If other people contribute news briefs,
they would get paid as well.
And we do one off projects.
So we're working on some stuff with
individual contributors,
if we think it's a valuable use of
our resources,
but we can only really do so much.
just in case anyone's wondering,
I don't get paid per article.
So you'll see when I put out like
a whole bunch of articles,
it's not because I'm trying to make more
money.
It's because I'm just like, Oh, cool.
I have, I have some thoughts on this.
Cause I know I kind of go up
and down.
Like sometimes I don't post anything.
And other times I put out like three
or four articles a week.
And usually it's,
it depends on the workload.
So I try not to, um,
I try to be very mindful of not
to give you guys a little peek behind
the scene.
Jordan does most of the editing.
So if I'm just constantly writing and
filming,
I will overwhelm Jordan really fast.
So sometimes I hit a point where I'm
like, okay,
I think Jordan has a couple of videos
to edit.
I'm going to,
I'm going to write some articles.
Terracotta Pie asked,
is there a big need currently to have
more people around Tor nodes to strengthen
the anonymity of the Tor network?
And the answer is always yes, there is.
And that's the biggest benefit of running
additional Tor nodes.
I believe,
I just wanted to pull up on their
website to see if they still have this
graph easy to find.
In terms of like
bandwidth.
The Tor network typically has well more
than enough collective bandwidth than
they're actually using,
but additional loads will still speed it
up by spreading out that load a bit,
and the biggest reason is definitely to
increase anonymity.
To prevent those Sybil attacks we were
talking about, the more operators,
the better in pretty much all cases.
If you can't...
There's a huge need for exit nodes more
than anything, but those have...
considerable risks involved.
So I can't really recommend most people do
that because your ISP can see any of
your traffic and they'll be seeing a lot
of random tour traffic that probably some
of it is not going to be desirable
for your ISP to see.
So it could cause a problem, certainly.
But other types of Tor nodes are helpful,
or I think a big help is running
more bridges,
especially if you want to do this from
a residential IP.
Unless you're in a country where Tor is
completely illegal,
then you probably shouldn't be running a
bridge, obviously.
But in most countries,
you can definitely run a relay that's a
non-exit relay with no issues at all.
And if you run a bridge,
that's very helpful,
not just for anonymity,
but for strengthening the anti-censorship
properties of the Tor network.
Because if you run a bridge,
your IP address is not published in the
Tor directory,
It's harder for countries that are
adversarial to Tor to block,
and that allows a lot more people to
access the Tor network than would
otherwise be able to.
And there are various ways that that
traffic is obfuscated as well,
which makes it more difficult to determine
whether you're running a Tor relay in the
first place.
I think general purpose relays are usually
more helpful, but if you can't do that,
running a bridge or running a snowflake
bridge is probably the easiest way to do
it.
But there are other types of bridges as
well.
You can run a dedicated snowflake bridge
on a server or your computer,
but you can also do it as easily
as installing an extension in your web
browser without having to install any
server related stuff.
And then it just runs whenever your web
browser is open.
If you don't want to do literally any
server stuff at all,
you can download the Snowflake extension
and still contribute to the Tor network
that way.
So there's a lot of ways to contribute.
And I think the Tor network would always
appreciate more people doing that.
I just wanted to offer my experience
because I ran a Tor node a while
ago.
It's been a minute since I've done it.
Number one, yes, I'm with you.
I think it would be awesome if we
could get more US exit nodes strictly
because
It's not so much of an issue nowadays,
but I know for a long time,
Tor was practically unusable to me because
every website I went to would default to
usually German because my exit node was in
Germany,
and I could never get an exit node
in an English-speaking country,
and it was so frustrating.
I realize, as I say,
that I haven't had that issue in a
while, so maybe they fixed that, but...
Yeah, exit nodes, there are certain ISPs.
I don't think the Tor project keeps a
list anymore,
but there are certain like VPS providers
who are friendly to exit nodes.
You can reach out to them and ask.
And I would say that to your ISP
too, because I was very surprised.
For a while,
my wife and I had Google Fiber and
I reached out to them and I was
like, hey,
I want to run a Tor node,
like not an exit node.
I just want to run like a middle
relay.
And to my surprise, they were like, yeah,
go for it.
And I was like, really, Google,
are you sure?
And like,
but I ran an exit node or not
an exit node.
I ran a middle node out of my
apartment for,
God,
probably close to a year and never had
any issues at all.
But check with your ISP because some of
them do not allow that,
even if it's a middle node.
I think by default, your middle node,
once you've been online for a while and
they consider you trustworthy,
you will be upgraded to a guard node,
which is basically like an entry node.
I think there's a way to opt out
of that if you don't want to do
it.
But I think by default,
those are the ones that tend to be
less risky because everything's encrypted.
So as long as your ISP is cool
with it, that's fine.
But yeah, exit nodes,
what I've been told is it's kind of
a double-edged sword because on the one
hand,
if it's coming out of a data center,
like if you host a VPS,
then there's a lot of websites that'll
probably block it just by default.
But on the other hand,
like Jonah was saying,
it can potentially be risky to run it
out of your own home.
I have a friend in law enforcement.
He's told me it's usually not an issue
that I'm not a lawyer for the record.
Let me finish.
He's told me that in his experience,
it's not usually an issue.
What will happen is the cops will like
get a flag that, you know,
from the ISP.
They'll go to investigate and the person's
like, oh, I run an exit node.
Here's my server sitting in the corner.
I can show you.
I'll pull whatever logs I have,
but I probably don't have anything.
And the cops just roll their eyes and
go, well, that's frustrating.
um but again we're not lawyers we don't
know what will happen so yeah i would
talk to a real lawyer i would try
to get some expert opinion on that before
gambling that's why i've never done it
myself so um yeah
I will say real quick,
one last thought on that.
What I tried to do in my last
town that nobody ever got back to me,
this was also right when lockdown started,
which is probably why nobody got back to
me.
I should probably try again in this new
town.
Try if you can to get in touch
with schools or libraries,
public institutions,
because in a perfect world,
that would be the best place to run
it.
If you can get your local university and
be like, hey,
this is a really great project for your
students because it will teach them how to
be sysadmins.
It'll give them hands-on experience with
Linux and
All that kind of stuff.
It'll help strengthen the system.
And they could run an exit node out
of the university's IT department.
And they have the legal team.
They're equipped to deal with it.
Public libraries, I think.
It's hard to get a hold of somebody
because these are really busy,
usually underpaid people.
But I forget where I got that piece
of advice from.
But if you can get a hold of
somebody at a public institution like
that, that would probably be the best.
Because then...
It's less likely to be blocked compared to
a data center,
but it's also less liability on you.
But yeah, it's tricky.
There's no easy solutions for an exit
node.
No.
Talking with law enforcement or the feds,
another thing that I've heard is that
traffic from Tor,
for one reason or another,
is not super big on their radar anymore.
They're seeing a lot more traffic through.
I talked about this a long time ago.
I don't know.
It was probably like...
half a year ago on one of these
episodes,
but they're seeing a lot more suspicious
traffic coming out of residential proxies.
So it's probably far more dangerous than
running a
then running a Tor node to just buy
some random Android box on Amazon and
install that on your network.
That's how most of that stuff happens,
and they end up knocking down some
grandma's door because they bought some
cheap Android box on Amazon that's
relaying some random traffic through
there.
There's a lot of
If you search up pretty much any of
these residential proxy companies,
there's a few of them,
and they all claim that their IPs are
above board,
but pretty much every single company that
is offering access to residential IPs or
ways to get around VPN blocks are all
getting those IPs and connections through
very unethical means,
whether that's
dedicated Android boxes or malware browser
extensions that get installed on people's
computers or what have you.
And that tends to be a bigger concern
nowadays.
So just something to think about.
I think we did talk about that a
few months ago.
I forget what the context was,
but I remember you talking about that.
I guess maybe last question.
Do you have any experience with IDOPEE?
You know, I just wanted to look.
We used to list it on our site,
and then we removed it.
I don't remember if we added it back,
so I wanted to look at Privacy Guides
and see if it's still on there.
While he's checking that, I personally,
I think I tried to tinker around with
it one time, and...
I found it very difficult to understand
and use.
And it's also like,
it's the same problem with like Tor,
right?
Is a lot of people download the Tor
browser and their first thing is like,
okay, now what?
Like, you know,
there's no Google for Onion sites, right?
So a lot of people have a hard
time finding Onion services.
So it was kind of the same thing
for me.
It's like, okay,
now that I've downloaded it, now what?
I guess the only difference is,
And maybe this is a point in IDP's
favor.
I didn't really know if I even set
it up right.
Because, you know, with the Tor browser,
you download it, you open it,
it says you're connected and you start
surfing.
And even if you never go to an
Onion site,
you know that you're using the Tor
network.
With IDP,
I never really had that indicator.
So I was like,
I don't even know if I'm using it
or not.
And I think maybe it was user error
for the record,
because this was way back in my early
days when I was first starting my privacy
journey.
Yeah.
I was screwing up a lot of things
cause I was kind of just throwing
everything at the wall and seeing what
would stick for me.
Um, but yeah, I,
I personally found it at the time to
be a little bit user unfriendly and I
don't know.
I've just, I've always,
I've never really bought into the, um,
the claims that tour is like super
compromised and can't be trusted.
So like, is I to P better?
Maybe, I don't know.
That's above my head.
I'm not really qualified to say,
but personally I don't have any issue with
tour that stops me from using it.
So that's my experience.
yeah i think what holds i to be
back um significantly is the lack of a
user like a general purpose accessible
option um tor is very useful for
non-technical people people i mean a lot
of people probably imagine that like tor
isn't used that much except like in the
privacy community but that that is not
true like in a lot of countries where
there is extensive censorship tor sees
a lot of use by a wide variety
of people, whether that's I mean,
not even necessarily through the Tor
browser on your computer a lot of the
time,
like the people who are more concerned
about privacy and anonymity are,
but like
using it on your phone or using Tor
VPN on your phone or whatever.
Those are very valuable tools to
journalists and to activists and other
just people in these censored countries.
And that really increases the...
usability of Tor a lot,
which first of all means that there's more
hidden services on Tor in the first place,
but also Tor has the option to have
exit nodes,
whereas ITP doesn't have that built in by
default.
It's possible to run an I-to-P service
that acts as an exit note,
and some companies will do that,
but it's very rare for that to happen.
There's only a handful of public exit
notes on I-to-P that I know of,
and so using it
for that purpose,
for just browsing the web,
is pretty limited.
And I think that's a big reason that
I-to-P isn't very commonly used.
We do have it on our site again.
I do remember the discussion about this,
and then I can talk a bit about
my experience.
But we...
When we looked into this,
there are some benefits just from a
technical perspective compared to Tor.
ITP does a lot of interesting stuff that
theoretically does improve the privacy,
security,
anonymity
beyond what Tor is doing.
So for accessing ITP sites,
it's certainly better than accessing clear
net sites like through an exit node,
but it's probably better than accessing
Tor hidden services as well,
but not to a super significant degree.
And since the use case just isn't there
as much, it's...
I don't know,
not a lot of benefits to using it
over Tor, I would agree.
I tried setting up some stuff with it
like a year ago now,
but we just never really saw any
significant traffic, and it is,
like Dave was saying,
a lot harder to use.
When you set it up manually in a
browser, like with a SOX five proxy,
you lose out on a lot of the
benefits that the Tor project provides in
Tor browser as well,
because Tor is not only
network,
but it's also a huge anti-fingerprinting
project.
All of the modifications that they're
making to Firefox improve your anonymity a
lot,
and you're not really getting that on ITP.
I suppose you could probably use Malved
Browser with a proxy,
but I don't know how many people do
that on ITP at the moment, and...
You kind of need a crowd of people
to blend in with, like Tor Browser has.
So unless a lot of people are doing
that on ITP,
Malva Browser is not going to be a
huge advantage.
But I'm curious about that now.
I should test out Malva Browser on ITP
sometime.
But yeah,
hopefully some of that made sense.
It's an interesting project,
but it's just not a lot of use
cases for it that I can think of.
I think looking at the website here,
privacy guides, unlike Tor,
all IDP traffic is internal,
which means regular internet websites are
not directly accessible.
So that's probably what held me back,
because I connected to it.
And I'm like, OK, cool.
Now what?
I have nowhere to go.
I don't know any of these websites.
So yeah, I don't know.
I agree with you.
If it's only accessible for other stuff,
I feel like that dramatically reduces.
Because I try to use Tor where I
can.
Um,
and that's the nice thing about tour is,
you know, I can still go to,
to the proton, um, most news websites,
summer hit or miss, um,
depending on the exit note that I'm on.
But like,
I can still mostly use the internet in
a normal fashion compared to this,
where it's like,
imagine if you could only go to hidden
services and it's just like, oh, cool.
That's not really going to be useful for
my day-to-day browsing personally.
Another thing I will say about ITP,
though, is that, well,
we just talked about a lot of reasons
that it's not super helpful for web
browsing traffic.
A huge advantage that ITP does have over
Tor is that you can really send any
sort of traffic over it,
and so it's far more flexible in that
regard.
You will see it used for file sharing,
for example,
whereas running BitTorrent on Tor
Tor is highly recommended against and also
isn't as usable, whereas on I-to-P,
the network can support that type of
operation much better.
So if you have to share documents or
other files through means like that,
I-to-P could certainly have benefits that
Tor doesn't have there.
Yeah,
I-to-be is definitely something you could
use if you know the other people using
it and you want to connect to each
other through that and you want to build
your own network that goes through this
anonymizing thing.
But just for accessing public services,
there aren't a lot of public things on
there that would make it useful.
So I just want to give them that.
There are some benefits to it over Tor
for sure.
All right.
Is that it for the week?
I think that pretty much just about wraps
it up, doesn't it?
I think so.
Nice and chatty in the comments this week.
I love it.
It really motivates us when you guys are
interactive.
And we're trying to be more interactive
with you guys as well throughout the
episode.
So thank you so much for everybody who
left a comment.
Yeah, absolutely.
All the updates from This Week in Privacy
will be shared on the blog every week.
So if you are not signed up for
the newsletter, you can do that.
Again,
I would like to remind people we send
out the newsletter when we start
streaming.
So it also acts as a good reminder.
You can also use your favorite RSS reader
if you want.
For people who prefer audio,
we offer a podcast available on all
podcast platforms and again on RSS.
And I mentioned earlier,
this video will be synced to PeerTube.
Privacy Guides is an impartial nonprofit
organization that is focused on building a
strong privacy advocacy community and
delivering the best digital privacy and
consumer technology rights advice on the
internet.
If you want to support our mission,
then you can make a donation on our
website, privacyguides.org slash donate.
You could also click the red heart icon
located in the top right corner of any
page on the website.
You can contribute using standard fiat
currency via debit or credit card,
or you can donate anonymously using Monero
or your favorite cryptocurrency.
Becoming a paid member unlocks exclusive
perks like early access to video content
and priority during the This Week in
Privacy livestream Q&A.
You'll also get a cool badge on your
profile in the Privacy Guides forum and
occasionally some early access content or
special content with our next video coming
up and the warm,
fuzzy feeling of supporting independent
media.
So thank you all so much for watching
and we will see you next week.