Google removed a critical security feature
from the Pixel XI,
California's operating system level age
verification bill has passed,
and another controversy from a renowned
name in the privacy space.
All this and more coming up on This
Week in Privacy, so stay tuned.
welcome back to this week in privacy our
weekly series where we discuss the latest
updates with what we're working on in the
privacy guides community and this week's
top stories and data privacy and cyber
security while answering viewer questions
i am nate back from a couple weeks
off and with me this week is jordan
how have you been jordan being good really
excited to dive into some stories this
week we've got uh some very interesting
topics to discuss this week
Yeah, for sure.
It's a little bit of a shorter week,
but some pretty big stories along the way.
I guess we'll jump right into it.
We'll start by talking about Graphene OS.
Man,
this was a roller coaster of a story
this week.
So we mentioned a few weeks ago,
right here on This Week in Privacy,
that the Pixel XI had launched.
And the big question at the time was
like, will it support Graphene OS?
And I'm actually in love with you guys.
When we asked that question,
I think we kind of...
At least for me,
it was kind of like, yeah, of course,
it's almost certainly going to support
Graphene OS or vice versa.
Graphene will support the Pixel XI.
Like, I don't see why it wouldn't.
And, you know,
it was just kind of like something to
talk about, really.
But to our surprise, earlier this week,
Graphene posted that...
They had,
I'll scroll down here so you can actually
see the tweet.
They said,
we have a partial port of Graphene OS
to the Pixel XI series complete after a
week of working on it,
but we're unable to complete the port due
to a lack of support for ARM hardware
memory tagging in software, firmware,
and near certainly hardware.
It appears Google cut an important
security feature.
And then there's a whole thread,
of course,
that you can access on Blue Sky or
Mastodon or Twitter,
whatever your social media of choice.
And...
We have this excellent write-up here from
Fria that we're referencing that kind of
offers context and stuff like that.
So what they're referring to is something
called MTE,
which is memory tagging extension.
And it...
It says here, Fria says that,
so the way it works is it detects
and prevents memory violations.
It decides a random tag to each location
of memory.
And then if the memory is accessed,
but the tags don't match,
it will detect that.
And then it'll block the program
basically.
And this used to be a really big
deal.
At one point,
even Google themselves said it was like,
seventy six percent of all vulnerabilities
in Android.
and therefore eliminating this, I mean,
means getting rid of a whole class of
vulnerabilities, right?
And, uh,
this is one of the rare moments where
Google be Apple to something, um,
a little bit of an arms race between
the two,
but Google rolled this out first with the
pixel eight.
And, uh, at this time,
pixels are still the only Androids that
actually have MTE.
Apple rolled out their version called
memory integrity enforcement on the iPhone
seven series and max with the M five
chip and above.
And, uh,
graphene did actually say in their,
their threads that, uh,
Apple's implementation was really good for
the record.
But Graphene considers this an essential
part of their requirements.
Like, again,
if you go read that thread that I
referenced,
they –
they basically say that like MT is now
at this point really deeply integrated
into graphene OS.
So, uh, that's one of the requirements.
So that's one of the reasons they support
pixel and with the upcoming Motorola
devices,
that was one of the requirements is you
have to start supporting MTE.
So, um, yeah, it's, uh,
it was really weird that Google got rid
of this thing.
Um,
at the time graphene was saying to just
like stick with the pixel eight,
the pixel nine, nine and ten for now.
But like I said,
bit of a roller coaster of a week
because there was actually an update a
little later in the week.
And I'm going to turn this one over
to Jordan to give you guys the update.
Yeah,
so this week has definitely been quite a
roller coaster, like Nate said.
After Graphene OS had previously hit a
roadblock porting to the Pixel XI due to
that missing security feature,
they found that the hardware does at least
have bare minimum support for MTE.
And, you know,
they say that memory safety bugs made up
around seventy six percent of
vulnerabilities in Android at one point,
according to Google's data and switching
to memory safe languages like Rust helped
them reduce that number significantly.
So.
With the release of Android,
QPR two beta four,
it appears support has been added back
into the firmware.
MTE support is still completely disabled
in the OS.
And the arm-sxty-four.no-mte is
unconditionally passed by the firmware to
the kernel according to Graphene OS.
So this is kind of strange, right?
Like Nate was saying,
this is like it was originally completely
missing and then suddenly it's being added
back in this beta four release and
permanently disabled by default.
So this is kind of a strange thing
for Google to be doing.
It's
Kind of also like touching on this as
well,
GrapheneOS did say that they did some
initial testing and they found that there
was no significant performance decrease
from enabling this.
They did say they did some preliminary
testing.
So we don't really know the specifics of
this.
And some people in our forum were actually
discussing and saying, like, you know,
could this have been disabled because of
something more significant?
Could this have been disabled because
there's a...
significant vulnerability in how this
works or that this doesn't work correctly.
And that's the reason why Google has
disabled it.
So there's definitely some interesting
things being discussed there.
I guess I'll throw it back to you,
Nate.
Like this is sort of an ongoing story,
but it's interesting that this is being
disabled,
especially when Google is pushing for
these new security chips,
like the Titan M three, right?
Yeah, definitely.
Like we mentioned in the past surveillance
reports,
the Titan M three seemed really cool
because it comes with this like post
quantum secure boot and just kind of,
you know,
a lot of companies now are bracing for
like the post quantum encrypted future.
Apple's done a lot of work to upgrade
like iMessage and stuff like that.
So it just seems really weird that they
like rolled out this new, which I think,
I don't know if you mentioned this,
but Graphene mentioned in their thread
that I referenced that,
basically mte like the support is there
but the apps have to opt in opt
into it it's uh it kind of went
a little bit over my head but basically
they were saying like for the most part
it's not really like widely used but
graphene enables it anyways which is also
why graphene has the option to like you
can go per app and like disable the
mitigations because every once in a rare
blue moon it will break an app here
and there so you can go disable it
but um but the point being is like
it's not like um
Like this was already something that was
not heavily adopted.
And it seems weird that Google wasn't,
instead of like pushing for more people to
require it,
which is usually what companies do in
these kinds of situations,
especially like Google,
where they control the Android platform
and they can kind of pressure companies
into doing that through some means or
another.
Instead of doing that,
they just rolled it back completely,
which yes,
it's weird that they added some security
and then rolled back others.
They mentioned that the lack of MTE makes
after first unlock state significantly
less secure.
So like the post quantum secure boot makes
before first unlock better,
but it was kind of a trade off
and it was super weird.
But I had a thought written down here.
I'm not sure if you know the answer
to this,
but it seemed when they updated and they
said that they did find support in the
beta,
it almost sounded like it was something
that was going to be coming back to
all pixels.
Like maybe they temporarily disabled it
for some reason.
And then now they're going to add it
back in.
Do you know anything about that?
Or am I just reading into it too
much?
I don't exactly know what you mean.
From what the GraphiNoise team said,
I believe,
if we just read directly what they said
in the master,
like they posted stuff on Blue Sky Master
and Twitter.
I think, what did they say?
While I'm looking for that,
you can maybe discuss something.
We have talked about it before,
but this is also another reason why
GraphiNoise is moving away from pixels
entirely, right?
Yeah.
Yeah, for sure.
So originally,
the original first thread they posted
where they're like, hey,
there's no MTE support,
they kind of ended it by saying, like,
we haven't decided what to do.
We're still kind of figuring it out and
researching.
And one of the things they said was
they might just have to skip the Pixel
XI series altogether.
because again,
it's like MT is now such a vital
part of the graphene code base.
And, um, but they did mention it's,
you know, they've, uh, and again,
we announced that on the show as well.
So stay subscribed everybody.
But we announced when graphene was
working, uh,
announced their partnership with Motorola
and they would be working with Motorola
to, um,
to make their own phones,
basically to like have phones that were
designed from the ground up.
And they have a lot of say in
how the phone gets designed and they have
access to the code.
So it's a lot easier to support it.
And yeah, it's just, I don't know.
I guess that's the good news is we
do still have the Motorola phones that
should be coming out.
I believe,
I didn't put it in the notes here,
but I believe next year, early next year,
they're still on schedule.
The only drawback is we did cover,
I think you guys covered a story last
week, like a last minute story that,
The Motorola phones are expected to cost
more than the Pixels,
probably starting over a thousand dollars.
So pretty hefty phones.
Hopefully the specs make it worthwhile,
but yeah.
Did you find what you were looking for
there or?
Yeah, I'm not seeing any,
I'm not seeing anything that directly
calls that out.
I will say that like the GrapheneOS team
has been trying to contact Google and
trying to get information about what
exactly is happening here.
And basically everything they've gleamed
so far is basically just been relying on
leaks and insider info basically that
they've been able to get.
So
It's a little frustrating that Google
seems to just be kind of dragging their
feet on responding about this and not
really wanting to comment,
which I guess it probably would look
pretty bad if we found out that they
purposely broke it or it's not functional
on their devices now.
It's pretty strange.
But I think we should also just mention
there's people commenting here.
So do you guys read the YouTube comments?
Yes, we do.
We just try to cover the story.
first but after after each story story we
usually try and answer comments um there's
a comment here from david good morning
from melbourne australia good morning yes
it is quite early in australia at the
moment especially on the east coast so so
nice to have you today um yeah so
we got a comment from lulu cuckoo but
surely this is done in an attempt to
stop graphene west possibly under the
guise of saving money
Yeah, that's not super clear yet,
actually.
Personal opinion,
I don't think that's the issue.
I don't think there's enough Graphene
users or custom ROM users in general for
Google to care.
And there'd be so many other ways.
They could just stop supporting bootloader
unlock.
There's a million other ways that they
could stop Graphene.
I don't think Google really cares that
much.
Maybe if it keeps growing,
they might worry about stealing their user
base.
But I don't know.
Personally,
I don't think that's the issue.
Yeah, another comment here from Rastanuka.
Hi from Guatemala.
Hello.
We've got viewers all over the world
today.
Awesome.
I did find it here on Blue Sky.
It's the second thread where they
announced that they did find MTE support.
Basically,
they said it was forced disabled when
Android SEVENTEEN originally launched,
but it's not disabled anymore in the new
beta.
So yeah, I guess it'll,
and it says Google originally claims,
or there were leaks that claim that they
cut MTE because of performance issues,
which is weird because like you said,
they said it was a, like what,
a five percent performance hit so far.
So I don't know.
Yeah, that's strange.
I don't know.
I hope it does come back for stock
Pixel users as well, just because...
It is a good security feature.
It's one of those like behind the scenes
invisible things that protects everybody.
And I just,
I hope it'll come back for stock users
too.
So, but I don't know.
We'll see, I guess.
Let's see,
unless you had any more thoughts on that.
I think, well, let's see.
David here says there are twenty million
people in Australia and yet estimates only
five K graphene OS users.
Yeah, the last estimate I heard,
I think they said that based on because
obviously graphene doesn't like keep
statistics,
they don't ask you to register or
anything,
but they can kind of take an educated
guess based on how many update pings they
get from the server.
And the last estimate I saw,
this was years ago, was like,
thirty thousand users,
which is still globally not that much.
So, I don't know.
Braden here said,
Jonah is the one that's been using Zen.
I've been more interested in as of late.
It seems like the forum people were saying
was a honeypot.
I have not seen that thread.
I have not been keeping up on Zen.
That would kind of be news to me.
I don't know if you've heard anything
about this.
I would say that's not something that I've
heard it claimed,
but I would say just take that with
a pretty large grain of salt.
As far as I know,
there's no evidence of that being the
case.
I think there's some people who might be
unhappy with the amount of connections
that Zen makes by default,
but they're sort of people that would be
like,
any single connection without my
permission is a honeypot.
And I'm like, well, I think, you know,
we have to have
You have to have reasonable expectations.
It's not really a privacy browser.
It's just a browser that has these
features.
And Oddbite said,
everything is a honeypot, lol.
Yeah, I mean,
it is kind of a thing in this
community.
Like a lot of times people just call
things a honeypot if they don't like it.
So unless there's actual proof that that's
the case, then I just...
I'm not sure if that would be applicable.
I use Zen.
I've never had any issues with it.
I don't think there's any evidence that
that's the case.
It's definitely beta software.
It definitely is...
There's issues with it that are very minor
issues,
but it's definitely not a stable piece of
software at this point.
It does have issues,
but they're mostly being worked out.
So if you do want to try it
out,
it's definitely worth giving it a shot.
If you need a good vertical tab
integration, because, yeah,
there's not really that many other
options.
Yeah, I think...
personal pet peeve is i think it annoys
me when people don't understand
circumstantial evidence and so they'll be
like oh like signal is a big one
right everybody's like oh it's it's owned
by the u.s and i think way back
or owned by someone in the u.s and
i think way back in the day they
got a little bit of funding from incutel
or maybe that was proton and but you
know they like they draw these red strings
and they're like therefore signal is a
honeypot and anyone who disagrees with me
is either in on it or just doesn't
understand and it's like no it's
You're welcome to think that it's a
honeypot, but you also need to understand,
like, look, I don't have a smoking gun.
Here's all the reasons I think it.
But I don't know.
I think people are just a little bit
too quick to be like, no,
I know this for a fact.
And it's it's I don't know.
I think we all need to be a
little more open minded sometimes when it
comes to that stuff.
But I don't know.
I'm probably rambling already.
It's a little too early in the show
for me to be rambling.
No, Nate, I think you've got to,
I think you've got to move on to
more rambling.
I think you've got to talk a bit
about this next story here.
One password, unfortunately.
Oh, nice transition.
I love it.
Yeah.
So, uh, this, this is a forum update.
Um, for those of you who didn't know,
we,
we have a forum at discuss at privacy
guides.net and, uh, yeah,
people are always asking questions,
sharing articles, um, really good stuff.
A great forum for sure.
And, um,
This was posted a little bit earlier this
week.
This kind of comes from a blog post
that went viral and then got written up
in The Verge.
And I'll quote The Verge headline.
It says,
one password wades into right-wing mess
after funding a Linux project.
So basically what happened is one password
pledged three hundred thousand dollars of
support for a Linux distro called Omarchy,
which is overseen by a nonprofit called
Omacom.
And
OnePassword pledged that money to Omicom,
to be fair.
Omicom and Omarchy are headed up by a
guy named David Heinmeier Hansen,
who I believe is called DHH for short.
And let's see, I did my research.
He is best known for creating Ruby on
the Rails, Basecamp,
and the Hey email client.
And Omarchy is basically DHH's version.
I'm just going to call him David.
It's basically David's version of Linux.
And it's a base of Arch Linux.
And apparently is like one of one
passwords, biggest customer environments.
Like apparently a ton of one password
users are using this distro.
Um, so yeah,
This kind of went a little bit viral
in our community, or I should say,
I was interested in this post when I
was reading through it.
Because obviously the first thing that
came to mind, I shouldn't say obviously,
but for those of you who were here
a couple months ago when we talked about
Mulvad's CEO donating to a political party
in Sweden,
that was also very heavily right-wing,
and they had a lot of... Oh, yeah,
sorry, I skipped over that part.
Um...
this David guy, DHH,
the reason this is so controversial is
because this dude's been very open for
years.
Um,
at least going as far back as twenty
twenty three,
where he's been writing very,
I would say very overtly racist blog
posts.
Um,
Like, what is it here?
He wrote something.
Okay.
So back in twenty twenty three,
Duke University Libraries dropped one of
his products, citing, quote,
harms we see perpetuated by the leadership
of Basecamp's parent company,
Thirty Seven Signals,
which is co-owned by DHH.
At the time,
they noted DHH's attacks on DEI programs
and that Basecamp had banned societal and
political discussions at work,
which basically
I don't know, to be fair, maybe,
maybe work isn't the best place to talk
about that.
I don't know.
Um,
but this year he published rants and blog
posts that call for ethnic cleansing in
Europe.
In July, he posted a blog titled wolves,
sheep, and gypsies,
where he implies the immigrants are wolves
and his solution quote,
when wolves get out of control,
you shoot them.
When gypsies take over public spaces,
you deport them unquote.
And, uh, for the record, um,
I'm actually told that gypsies is kind of
a racial slur and I should probably stop
saying that, but, um, uh,
So one password kind of defended this.
One of their co-founders played it down by
basically saying like,
everybody's entitled to their opinion.
Actually, I'm going to read what he said.
I'll let him hang himself with his own
rope.
As I said,
people have different personal...
This comes from my internal Slack
messages.
As I said,
people have different personal opinions.
You believe in your heart that DHH is
evil and you have the moral high ground
and nothing will change your mind.
However, not everyone believes that.
It is not fair to claim a monopoly
and ostracize team members who might
disagree with you.
There are people who are afraid to speak
up simply because they will be personally
attacked.
in which case maybe stop attacking your
employees.
But the actual CEO was a little bit
more diplomatic.
He said,
one password does not endorse hateful
dehumanizing or exclusionary views,
including those shared publicly by DHH.
And the article goes on to note that
Omicom has been funded by twelve other
patrons, including Michael Dell,
Jack Dorsey, Shopify's Tobias Lukey,
Stripe CEO Patrick Collison.
And the Shopify CEO recently endorsed the
idea that wealthy Canadians should have
more voting power than poor people.
So yeah, really,
really great ideas going on there.
But no,
the reason I said I was a little
bit –
I found this discussion interesting
because in the forum,
the first thing that came to mind was
everybody thought about Moldad.
And everybody seemed to kind of agree that
this is a little bit different because in
Moldad,
it was the case of the CEO donating
directly to a political party.
And in this case,
it's more of the company donating to a
project that happens to be headed by
somebody who has not great political
views.
I will say –
I guess this might be me getting on
a soapbox a little bit.
One thing that really bugged me with the
Mulvad controversy is I saw a lot of
people attacking each other in the sense
of like, oh my god,
you're so dumb if you care about this.
Who cares?
Mulvad's a good VPN.
And it really kind of bugged me that
it's like, man,
even if you want to keep using Mulvad
VPN,
I think you should have a little bit
of sympathy for people and understand that
maybe they don't want to be giving their
money to this person.
And I feel like I didn't see that
as much this time around.
I feel like the discussion was a lot
more civil, a lot more open-minded, but...
the other thing that I thought was
interested was this kind of shifted to a
discussion about Oh Marky,
which was kind of my thought.
Cause when I first saw this story,
I was like,
I've never even heard of Oh Marky.
And I looked it up and granted,
I'm not super technical,
but I skimmed the Wikipedia page and I'm
like, why are they even donating to this?
This doesn't seem like there was nothing
in the description that I looked at.
And I'm like, Oh,
it makes sense why one password would be
interested in that.
But yeah,
that's kind of what the discussion turned
into from there is everybody talking about
like,
what does Oh Marky bring to the table
that, you know,
other things don't do better.
Why are they giving their money here?
But yeah,
I don't know.
I'm not super, like I said,
I'm not super technical on this stuff and
I've never heard of Omarky before,
but I see you made a couple posts,
I think, in this forum thread.
Do you have any additional thoughts or
context that I missed or anything like
that?
Yeah, so over the last week,
we had an issue actually opened quite a
long time ago by someone called Cynthia on
a GitHub page.
And basically,
she just put together a list of a
lot of issues with this distribution.
So firstly,
this is probably one of the worst Linux
distros I've ever seen.
It's basically,
it goes against almost everything that I
think a lot of people that use Linux
use Linux for.
And that is, it's,
it bundles a lot of privacy invasive
applications by default.
Like it includes a bunch of Google apps.
It includes AI integrations by default.
So on top of all that weird stuff,
It also does some pretty bad stuff from
a security perspective too.
So it uses outdated packages.
It actually holds packages back for twice
as long as Manjaro.
Manjaro already had this problem and
somehow they decided to make it even
worse.
So I'm not sure why they did that.
They also use blindly built AUR packages.
If you're not really aware of AUR
packages,
it's basically a
it's a file that has instructions for your
operating system to build a package for
your operating system.
Right?
So basically anyone can upload these to
the AUR and
It also kind of increases the chances of
someone maliciously changing one of these
package build scripts to include malware
and stuff,
which we have seen in the past.
So blindly building from a package build
is extremely dangerous,
and you probably shouldn't do that.
You should be reviewing the package build
every single time you build the package.
So they're blindly building them and
deploying them to people's devices,
which...
all it takes is one person to basically
just modify one of those packages.
And now every single person that's using
it is now infected.
So that's kind of a massive problem.
It used to rely on the chaotic AUR,
which is basically means that it's
even less of a requirement to actually
commit to it.
They also migrated to their own package
repository,
which automatically builds package builds
again, which just has the same problem.
And yeah,
there's a lot of other issues as well.
They have a very strange security posture
here.
they decided to disable package
signatures, which the AUR,
like the Arch Wiki specifically says,
do not disable this unless you absolutely
know what you're doing.
So basically you could, you know,
build a pack,
like you could maliciously install a
package because it doesn't check against
the PGP key of the package.
So that's already kind of concerning that
they would allow that.
And then also what Nate said is this
whole thing surrounding this DHH guy.
It's a terrible Linux distribution that's
getting money from one password.
And the guy that runs it is an
asshole.
So, like, this is just, like,
every single possible bad thing all in
one.
And one password is giving them money.
So I think just from a technical aspect...
even if you don't care about this DHH
guy,
even if you agree a hundred percent with
everything he says,
this Linux distro is bad.
It's not a good Linux distro.
They should not be getting money.
They don't know what they're doing.
There was even another post that I saw
here, basically,
which allowed anyone on a Omaki Linux
system to gain root access because they
allowed the Docker group to have access to
root so basically docker would always run
as root so you could run any command
as root without any authorization so you
know this is like basic stuff um this
is basic security stuff that you know i
think a lot of times this this this
this linux distro seems to be quite
focused on vibe coding quite focused on ai
stuff
Maybe not the best idea from a security
perspective.
They're probably using it in the
development process too.
But yeah, in other words,
you can basically compromise a normal user
application could basically just gain full
root access on, on Omaki Linux.
So if you are using Omaki Linux,
I would suggest not doing that.
Um,
cause they don't seem to have very good
security practices.
Um, and so, yeah,
we're not going to recommend using that,
but I think the main thing here is
one password giving money to such a
terrible project.
And then also like Nate said,
this guy has like pretty,
pretty ad abhorrent views on a lot of
things, which,
Obviously,
that's up to your own political
orientation,
but I think it's definitely a good thing
to note and an ethical concern for a
lot of people.
yeah for sure that's uh what a lot
of people were saying like towards the end
of the thread here um one user said
it's really frustrating to see the wrong
things getting rewarded in what universe
is the work of omarkey worth thirteen
million dollars i think he's talking about
all the other people that have donated as
well he said there's better places for
that money to go like kde sfc hyperland
etc um
Um, he's like, I think,
I think less of one password now,
and that's putting aside all the
horrendous political stances at issue.
Somebody else had said,
imagine XIII million going towards wine or
steam proton prime Linux gaming,
maybe even wine getting more improvement
to allow a solid transition away from
windows.
So yeah,
that seems to be a popular take.
Like you just said is it's just even
putting aside the political stuff.
Like this is just not a very solid
distro and it's super weird.
So unfortunate,
but really quick before we do move on,
I do want to share, you know,
some people are still, as with anything,
some people are like, Hey, whatever.
It's still like one password,
still a good password manager.
I'm still going to use it.
Some people are just kind of like that
one guy.
Like,
I don't know if I trust one password
anymore.
So at this time, our recommendations,
we do recommend proton or yeah.
Proton pass.
We do recommend bit warden at this time.
We do still recommend one password.
We recommend persona.
And we recommend KeePassXE as well as
KeePassium, GoPass,
and KeePassDX for Android.
I was skipped right past that, my bad.
So yeah,
check out the website if you want some
other recommendations,
if you're interested in getting away from
one password.
If you care, if you don't care,
then hey, we still recommend it.
Yeah, on that note,
we did actually have some updates
pertaining to Arch and one password.
But real quick,
I think I flagged a couple of questions
here in the chat.
Yeah, somebody asked here,
recently heard about Kagi search engine
rejected as a tool suggestion on the
forum,
but that was back in twenty twenty three.
Any more recent thoughts about it?
I would have to go look up why
it was rejected to have thoughts,
to be honest.
I don't know if you have any thoughts
on that.
Um,
I think there was a response here from
Jonah.
So I'll just read what Jonah said and
the reasoning behind what happened,
like why it was marked as rejected.
Um, so Jonah said,
given that four search engines,
which meet our existing criteria and also
are quite good, um,
give you the option to disable ads
natively for free.
Um,
Basically,
that's what is excluding Kagi from being
included in our criteria at the moment.
So, yeah.
There's some interesting stuff in this
thread.
I would say, you know,
if you're considering it,
we can always come back to this again.
I think...
They've definitely made some progress on
things.
And if you do think that maybe we
can...
have a further discussion about this.
There was someone from Kagi who joined the
forum and answered some of the questions.
I think they have improved the privacy of
the product a bit more,
but the issue I think was using an
account,
linking it back to your identity is a
little bit of an issue.
I know they've worked pretty hard on
trying to protect that information,
but it does kind of happen when you
when it requires an account,
it becomes a privacy issue.
And especially when we have all these
other free options that don't require
that, it becomes tricky.
I don't think just because we don't
recommend it doesn't mean you shouldn't
use it.
You should weigh up if this is reasonable.
Oh, yeah,
Oddbyte says there is the privacy pass.
Yes.
So they do have, like,
a way of protecting that information.
But I think...
It's, it does make it a little bit,
I'm not sure if that would still fit
our, our requirements though,
but we can revisit this.
We haven't really had much like movement
on this really.
So I'm not really sure if it's sometimes
it's just like people in our community are
not like pushing for it super hard.
So if people aren't pushing for it,
then it doesn't get updated and it doesn't
get added.
So if this is something you want to
see,
you have to really make your voice heard
on the forum.
Yeah, looking at the minimum requirements,
it says must not require users to create
an account for search engines.
So if you believe that Kagi should be
eligible,
then I guess that would be the argument.
Like, why is that OK?
But like you said, yeah,
I don't think any of us recommend against
Kagi.
It's just we've already got several other
options listed.
And yeah, I don't know.
I guess I got nothing else on that.
What else here?
Somebody on the graphene topic real quick,
they said,
sorry to bring it back to graphene,
but I lost it.
Where'd it go?
Could it be that Google may want to
backdoor on pixels?
I don't know.
I don't think so.
I feel like a lot of phone providers
are actually being pretty adversarial with
police and making life harder for them.
Like, you know,
iPhones rolled out that thing where they
automatically reboot after three days now.
So I don't, I'm also, again,
I'm not sure if getting rid of MTE
was necessarily the best way to do that,
but.
I could be wrong.
I'm not an expert on that kind of
stuff.
The last one I had here,
Jan Modal said,
any thoughts on the proposed takeover of
Hugging Face by NVIDIA?
Seems like a threat to open source weights
and local AI.
I mean, me personally,
I don't really have too many thoughts
because I think, again,
this is another technical thing that goes
over my head,
but I don't think AI is really open
source enough anyways.
Yeah.
Like,
I don't know if open sourcing the models
like that really counts.
And also like our old coworker M really
made a good point that I think about
a lot now that like,
there's kind of two sides of AI when
we talk about privacy.
There's the privacy of the end user and
using open source models and open source
clients and stuff like that.
But then there's the fact that all this
training data was taken from people who
didn't consent to it,
who can't opt out of it.
So there's kind of the argument that AI
can't be private in the first place.
I don't know.
To me,
it's very low on my list of priorities
when it comes to AI.
I don't know if you have any better
insights.
Yeah,
I think we're kind of pushing for people
to use local AI instead of these cloud
providers.
If you do check our recommendations,
we do recommend some stuff that's like
using these
I guess like local,
like open weight models, I suppose.
And, you know,
we've got some recommendations.
We recommend Kobold, CCP, CPP, CPP, CPP,
Olamer, you know, stuff like that,
Olamer file.
So, you know,
we think people should be using these from
a privacy perspective, but like Nate said,
and like what Em has kind of,
if you follow Em on Mastodon,
you'll know that she's like,
very outspoken against this ai stuff um
and she has really good opinions on this
sort of thing um the the data that
is getting scraped up by these ai models
is gargantuan it's non-consensual it's
it's not great so i think we have
to also think about the privacy of you
know all those people as well uh when
you use these models i think you are
kind of
I guess using all that data that's been
scraped up by these AI companies.
So, you know,
I think that's a little bit morally,
it's a moral issue,
but I think if you just want privacy
for yourself,
you should be running these local models.
But I think, you know,
The takeover of Hugging Face by NVIDIA,
I don't think it's going to have that
big of an issue because there's so many
other companies that have and host these
models too.
So I'm not really sure if that's going
to have a huge impact in my opinion.
Yeah.
I know we're getting some other questions,
but we'll save those for a little bit
and we'll move on to some of the
site updates.
And I think I'm going to turn it
over to you, Jordan,
because we were talking about Moldad and
Arch,
and I know we have some updates pertaining
to that stuff.
yes so um i've been i've had a
little bit of extra time this week so
i was going through some of the pull
requests that we needed to get um put
through so i guess the first one is
fixing some dead links on the site there
was a bunch of stuff that was like
originally linked to the original page and
the link became dead so we've had to
archive those um
So those have been updated to actually
include archive links instead.
And like I talked about before,
we were talking a bit about Omaki Linux.
And it was because we had suggestions to
recommend against Omaki Linux because we
recommended against Garuda and Manjaro
before.
But that was, as far as I'm aware,
I could tell was those were old
recommendations from privacy tools.
So we kind of don't do
anti-recommendations anymore.
We don't recommend against anything.
We just make suggestions that people
should use something.
So we kind of had a bit of
a discussion between some team members and
also some community members as well about
this.
And we kind of came to the consensus
that we shouldn't be recommending against
specific arch derivatives.
And instead we should just be making
suggestions such as, you know,
being careful about using the AUR and
suggesting that people use only the
mainline arch
distro so yeah we are trying to move
away from anti-recommendations because I
think if we did include
anti-recommendations the entire site would
have it would be so bloated there would
be so many things everywhere about not
what we what we don't recommend what we
do recommend it would just be not great
and I think that's
kind of been something we've been pushing
for for quite a while to update that.
So that has been updated.
And there was some work there from Daniel
and Freya who both worked on that.
I also did a little bit of work
on that pull request too.
And there was another one here and that
was removing Molvad DNS because
The writing has been on the wall for
a while,
but Molvad's public DNS provider is not
available anymore.
So I guess this is something that we've
known was going to happen for a while.
There was information about that happening
for a little while,
but we removed every mention of Molvad's
DNS service from our website because we
did used to recommend them.
So their encrypted DNS providers are no
longer operating.
There was a forum discussion about this as
well.
It's kind of been sad because we've seen
quite a lot of DNS servers being shut
down as well.
But it looks like Molvad made a blog
post here and they're sponsoring QuadNine
instead, which I think makes sense.
QuadNine is a great project.
They've also been super reliable when it
comes to
public DNS servers.
So it's definitely interesting.
I guess I'll read a little bit from
Malvad's blog post for why they're doing
it.
Malvad has operated public encrypted DNS
service since twenty twenty two.
They are unnecessary when using Malvad
VPN.
Traffic is already encrypted and Malvad's
VPN internal DNS handles all queries
outside the VPN.
They serve two purposes.
Malvad browser uses them by default when
you're not on Malvad VPN,
preventing your ISP from seeing the
domains you visit and anyone can use them
as a free public service to protect their
DNS queries.
We want
A public service to be available going
forward will support Quad Nine instead of
running it ourselves.
Running a privacy focused public DNS is
highly specialized undertaking and the
Quad Nine Foundation is the undisputed
leader in the field.
Rather than duplicating their efforts to
achieve only part of what they do,
we're putting resources towards
financially supporting Quad Nine instead.
So, yeah.
You should be good if you're migrating.
If you're manually selecting the server,
you'll need to update that.
And if you use iOS or macOS profiles,
you'll need to delete those and replace
them with the quad nine ones.
So, yeah,
very interesting stuff going on with site
updates this week.
Lots of changes.
I guess I'll throw it back to you,
Nate,
for we've definitely been having a lot of
news briefs going up this week.
So definitely a big week.
Yeah.
For sure.
I'll just say I'm sad about them shutting
that down because Quad Nine's great,
but they don't do any ad blocking or
anything.
And I think I was using Mulvad's DNS
on my TV,
so I need to go check that after
this.
But yeah,
I guess we'll find out when the TV
just stops resolving.
Um, but yeah,
you guys saw on the screen I was
sharing, we,
we do have other recommendations,
add guard control D quad nine cloud flare
next DNS.
So if you're, you were using mall bad,
go check that out.
Um, in the meantime, yeah, we did have,
uh, quite a few, um,
privacy and security news i uh i normally
don't toot my own horn about the data
breach roundup but i do want to give
it a shout out this week because there
was actually a major id uh identification
driver's license driver's license breach
that's actually still ongoing i think that
brian krebs wrote about it and then like
several other major outlets wrote about it
um so it's it's pretty big scope i
think they said they have like
Um,
it's a vendor who works with age
verification stuff.
So, uh,
definitely check that out and just kind of
get the, the basics.
If you're haven't heard that story,
cause it is a big one.
Uh,
the signal Android beta has support for
numberless accounts, uh,
thought about covering that this week,
but I think we'll wait until it's fully
launched.
Cause right now,
like we don't know how the payments are
going to work still.
So there's not a lot to talk about.
Google had a crazy bug where the messages
app was sending old texts to random
people,
a router manufacturer found with multiple
backdoors in the product.
And of course the headline story was
discussed, uh,
as it happened this week.
You know, if you're watching the video,
you can see here's Graphene OS unable to
complete the Pixel port and then Pixel XI
hardware MTE support may still be usable
for Graphene.
So definitely subscribing to our new
section is a great way to stay updated
on things as they happen.
And the last thing to mention is we
do have some new videos coming out.
We had our password manager tier list
video, which got a lot of views,
got a lot of traction.
People had a lot of opinions.
That's super cool.
So if you haven't seen that,
check that out.
And we have an interview coming up with
someone who works on the
the more like corporate side of things in
privacy.
I don't really know how to describe it,
but yeah,
it's gonna be really interesting.
We talk about a lot of how do
you figure out what marketing is legit and
what's not,
how do you read your privacy policy,
all kinds of cool stuff.
And we just started editing,
Jordan just started editing a video about
Apple versus the FBI.
For any of you who were around and
old enough to have memory in twenty
fifteen, twenty sixteen,
that was a really wild story.
And we got to dive into how it
worked.
And I think that one's going to be
pretty cool.
I'm excited about that.
So, yeah.
All this is made possible by our
supporters.
You can sign up for a membership or
donate at privacyguides.org or pick up
some swag at shop.privacyguides.org.
Privacy Guides is a nonprofit that
researches and shares privacy-related
information and facilitates a community on
our forum and on Matrix where people can
ask questions and get advice about staying
private online and preserving their
digital rights.
And I think now we're going to talk
about a story that illustrates how much
control certain governments can exert over
the internet.
And again,
remember to leave your comments and
questions in the chat,
and we will get to them in between
stories.
Yes,
so this week there was something that
happened that involved the current United
States administration, let's just say.
Trump goes after anonymous email provider
in Italy.
The real target is free speech in the
US.
So Secretary of State Marco Rubio and
Treasury Secretary Scott Besant
announced Wednesday that they were
targeting the Italy-based Autistici
Inventati Collective with terror
sanctions.
A wide array of anarchist, anti-fascist,
and far-left groups in the US and abroad
use the privacy-minded collective's
offerings,
including an anonymous email service and
its popular NoBlogs.org blogging platform.
The practice of designating an internet
platform and service provider as a terror
group
rather than those pursuing violence
themselves,
has huge implications for the future of
free speech on the internet,
warned Gillian York,
the Director of International Freedom of
Expression at the Electronic Frontier
Foundation.
They're going after the messenger,
York said.
I don't think that the members of the
group would necessarily condone the
actions of people that they hosted.
What they do condone is the freedom to
host, the ability to be anonymous,
and the ability to be private.
The AI collective told The Intercept that
it is exploring its legal options to fight
the sanctions which blocks US citizens and
companies from providing the group with
financial support.
Anti-fascism and anti-capitalism are not
terrorism.
The group said protesting is not terrorism
and everyone has the right to speak out
and to struggle for humanity.
And the state and Treasury departments
justify the designation by alleging that
the Autistici Inventati Collective,
also known as AI,
has provided services to foreign terror
groups,
including anarchists who have launched
attacks on railroads and pipelines in
Europe and by domestic left wing groups
that have employed violence.
So I guess we will start by saying
This is, well, okay, I'll just,
I'll pivot to this other article here.
This is from the EDRI,
their European group that basically
supports digital rights.
And it says,
EDRI stands in solidarity with Autistica
Inventati after terrorist designation by
the US government.
And basically,
their stance on things with how this works
is that
this is an attack on decentralized
nonprofit communications providers.
And that if this was to be,
you know, if they were,
if they were to do this properly,
they should have gone after the specific
posts and gotten those removed instead
through, you know,
legal means instead of just blanket
labeling this entire organization as
terrorist group.
That is usually how things work.
Imagine if, for instance,
Signal was designated a terrorist
organization and just because there was
people using it who were, you know,
using it for supposedly nefarious purposes
which, you know,
I think even then we don't really know
how accurate a lot of these claims in
the press release from the US government
were.
I think, you know,
that's a lot of loaded language in there.
It's definitely like, you know,
we're not a hundred percent certain that
those things are actually true.
So I think it's definitely an attack on
free speech.
It's an attack on...
freedom of expression.
And one issue that happened with this was
that the public interest registry,
which is based in the United States,
they disabled Autistici's main domain,
Autistici.org.
And, you know,
their PayPal account got seized.
Their bank is like almost,
it's possible their bank account might be
closed due to these sanctions by the
United States government.
And it's kind of showing, you know,
a lot of people think, you know,
the United States are the good guys,
but what happens when they're not the good
guys?
What happens when the United States
government doesn't,
isn't on the right side of history?
What happens when that happens?
And it's,
It's not good.
They have too much control over...
This is an Italian hacktivist group.
Like,
they shouldn't be able to have their
domain seized by a foreign country.
That's a little weird.
So anyway,
kind of been rambling a little bit,
but hopefully I've kind of shared enough
about the situation.
Do you have any thoughts, Nate?
Uh...
Sarcastically,
my first thought is I am an American,
born in Texas,
several generations of American,
and I approve everything you just said.
And a veteran.
No, yeah, it's really unfortunate.
You and I were talking about this a
little bit prior to hopping on the call
here.
It's – I don't know.
To me, this is such an obvious –
attack on free speech and it's so like
the the thing i haven't seen anybody
talking about is exactly what you
mentioned and you brought up where it's
like it shows in this case america but
i'm sure america is not the only one
like some of these countries can just
exert way too much control over um
over technology.
And I know I've,
I've personally been harping on this quite
a bit lately, but there's, um,
there's like an overlap, you know, we've,
we've criticized that.
Some people are just like, Oh, you know,
I stay out of politics.
All politicians suck,
which for the record,
a hundred percent with you on that one.
Um,
but like all politicians suck and like,
just, it's, it's all about the encryption.
It's all about the tools.
Cool.
And what happens when the government comes
in and shuts down the servers or makes
that tool illegal and they have other ways
of pressuring?
Because even with the decentralized stuff,
it's easy to sit here and be like,
oh, well, yeah,
they could shut down Signal,
but they can't shut down Session,
for example.
There is not a doubt in my mind
that they can find a way.
They can start – or at the very
least,
they can make it such a pain in
the ass like –
I wrote a personal blog post a few
weeks ago about signing in over Tor and
when it's a good idea and when it's
not.
And I mentioned that websites that block
Tor, known Tor exit nodes,
like banks and stuff like that,
doctor's offices,
there's not really a point in doing that
because most of them are already, again,
they're banks, they're doctors,
they know who you are.
But on top of it, yeah, sure,
you could sit there and refresh Tor five
hundred times until you get an exit node
that's not blocked.
But me personally, after a while,
it just becomes such a pain in the
ass.
It's like, I don't even care anymore.
I'm just going to do it with Brave
or Moldat or something with a VPN.
And so, I mean,
that's kind of the thing is like, yeah,
they may not be able to block a
hundred percent of the session nodes,
but maybe they can block enough of them
that it's effectively useless.
And my point being is just, it's all,
it's everything matters.
It's like the technology matters.
The encryption matters.
The like taking away their ability to
recover the data or spy on the data,
but also the politics and having good
privacy laws and voting in politicians who
are not completely insane and understand
how technology works.
And yeah, it's just not great.
Not great.
Not a fan of this.
So.
I also think this is another thing that,
you know,
this is a platform that supports
grassroots activism.
This is like one of these things that
we really harp on to people,
like grassroots activism is really
important,
like getting your city council to get
these flop cameras down, to get, you know,
all these laws pushed through, right?
It's important stuff that
uh, that these organizations are doing.
Um, I'm sure, you know,
we don't agree with everything that this,
uh, organization has, you know,
hosted on their platform.
I'm sure the people that host, um,
Autistic Inventati don't agree with
everything that everyone posts on their
platform,
but that's like not really that relevant.
I think it's,
it's just a platform for people to
organize
grassroots campaigns.
And I just think that's really important,
but also there's other organizations that
do a very similar thing to, um,
to order Stacey,
like rise up.net is another one that does
a similar thing.
And that's a U S based one.
And I think this also pushes us towards
this idea of, you know, I know,
I don't want to bring it up,
but like slippery slope,
like if this is the first,
if this is the first platform that gets
taken down, um,
what could be next?
What could be the next platform that gets
taken down?
And I think anyone that's super familiar
with the United States sanctions will know
that it is very brutal.
It basically can destroy an entire
country.
It can destroy an entire project.
So
I think it's definitely not great,
but it seems like Autist DC is still
surviving.
Their main domain got taken down,
but all their other domains are still up.
So yeah,
you can still visit their website and
everything seems to be rolling along
pretty well still for them.
So it'll be interesting to see what
happens on September,
which is when it's the deadline for
basically all U.S.
entities to basically drop any sort of
support for the organization.
So it'll be interesting to see what
happens by September, September,
and EDR is calling upon basically a bunch
of organizations to reverse that course on
this.
They're saying the United States
government needs to reverse its decision.
The EU needs to actually make a move
on this.
The government of Italy needs to publicly
defend
Autistici.
Financial institutions,
internet registrars and infrastructure
providers need to refuse to act on third
country designations that have no force in
European law.
Yielding to financial pressure when no
legal obligation exists is a choice and
not a necessity.
And also digital social justice and other
civil society organizations and
collectives need to stand in full
solidarity with Autistici Inventati.
And yeah,
acknowledge the key role that safe and
secure decentralized digital
infrastructure plays in our collective
strive for justice.
So yeah, this is really worrisome.
There's already been a lot of
organizations that have already signed on
to the EVRI's statement.
Lots of important organizations have
already signed on.
So it's really important that we do stand
for free speech and
against this unjust restriction of an
internet service provider.
So yeah, it really sucks.
I think it just shows the vast reach
that the United States has over the
internet in general,
and it's definitely a scary time for the
internet.
Yeah,
I don't have anything to add to that
that you didn't already say very well.
So let's take a couple of questions.
This one came in right before we went
to site updates, but Hair Elite says,
any thoughts on the minimal phone two now
offering an OEM de-Googled ROM option?
It's not graphene,
but it's a step in the right direction.
I don't know much about the minimal phone.
I actually looked it up just now.
I guess I will say me personally,
I like the ethos, you know, distractions,
free smartphone.
Oh, wait a minute.
No, I'm looking at the pictures now.
And I think I have seen this thing
before.
I don't know.
I don't think it would be right for
me,
but I think it's a pretty cool idea.
I don't really have any thoughts on the
OS itself because I don't know much about
it.
Are you more familiar with this, Jordan?
It does look like it's based on the
MPO two phone model,
which I believe is like a
It's a design that other devices also use,
it looks like.
I'm not entirely sure.
Yeah,
it's not really something that I've looked
into too deeply.
I think it definitely looks interesting.
I kind of like these small form factor
devices.
It kind of sucks no one's really making
any of these.
I mean, it looks interesting,
but I guess we don't really know too
much.
It looks like it might still be...
Is it available right now?
I'm not sure, but it looks cool.
I think I would be interested in trying
it out, but it's like, yeah,
it's definitely a more niche product,
I think.
Should be available.
I'm looking on the page here and I
see a buy now button.
It says expected to ship in ten business
days, free worldwide shipping.
Looks like their Kickstarter campaign has
got four days left.
So, yeah,
it looks like it might be coming soon.
That's interesting.
No, it's interesting.
I don't know.
I don't really have too much to add.
We would have to, like,
there's so many things that we have to
review.
Like,
we're reviewing so many different products
at the moment.
Like,
I know there's security keys and there's
hardware wallets and there's all sorts of
stuff.
And it's, like, another phone.
Like, yeah, it's tricky.
I know Jonah does a lot of that.
So maybe Jonah...
Might have an opinion on this device,
but he is not here this week.
So, yeah,
if you do want to get his opinion,
maybe ask next week when he's around or
the week after.
Yeah,
that's kind of all I have on that
one.
But Lulu Cuckoo says...
I just want to say thank you so
much for all your work.
You guys are really doing necessary work
letting and helping the average Joe like
myself know of genuine and true dangers.
You're awesome.
Thank you so much for like such a
sweet comment.
That is, that is really nice.
Yeah.
I hope we, we can provide some,
some good information and yeah, it's,
it's awesome.
I love doing this work.
It's really, it's really rewarding stuff.
So I'm sure Nate feels the same way.
I do, yeah.
Thank you so much.
The human brain is wired to remember
negative stuff more than positive stuff,
which is an evolutionary advantage.
If you walk through the forest a thousand
times and nothing bad happens,
then that's fine.
If you walk through it once and a
tiger almost kills you,
you need to remember that.
But unfortunately,
in this modern digital age where we're
online,
it just means that one person leaves a
bad YouTube comment.
It's just like all your brain thinks
about.
It is nice to get the
The nice comments like that,
my brain is blanking on words right now,
but it is helpful.
It's very motivating and it is appreciated
to get that kind of stuff every now
and then.
So thank you.
Real quick,
Skin Compile talking about the Italy
story.
He said,
this is another reason why I have nothing
to hide is invalid.
Yeah,
it's nothing to hide is a very
self-centered argument for sure.
And usually not true, but...
On that note,
speaking of having nothing to hide,
we're going to talk about California's age
verification bill that has passed with a
Linux exemption.
So a lot of you guys,
I think you've heard of this.
This is kind of an update, really.
So California proposed this law that would
require age verification to be done at the
operating system level.
So...
I don't really know how to explain this.
Basically like when you set up windows or
Mac or at the time, even Linux, uh,
you know,
it would ask for your birthday or
whatever.
And, um,
I will say I have not read the
bill itself, so I don't know.
Um, yeah.
Uh,
when an operating system runs on a device
and includes an account setup feature,
it must offer an interface that asks for
the account holder for the date of birth
age or both of the devices,
primary user during account setup.
Um,
I will say from my reading of this
again,
I haven't read the bill itself or the
text of the bill.
I don't think they force you to turn
over ID.
They just ask you to put in a
birthday or an age.
Um,
and then it's supposed to provide an age
range.
One of four under thirteen,
thirteen through fifteen,
sixteen through seventeen or eighteen and
older.
Um,
Yeah, I mean,
we've we've railed against age
verification so much here.
I'm not even going to bother getting on
that soapbox.
But a little while ago,
I think it was California or Colorado,
because that's where Systema Seventy-Six
is from.
The team at Systema Seventy-Six went and
talked to their politicians who were
considering a very similar bill.
And basically they pointed out that like
the way these things are worded.
you basically described everything as an
operating system, you know, the,
the firmware that runs on my fridge or
my router, um,
which my fridge shouldn't have firmware,
but here we are.
And, uh, they point being,
they successfully got Colorado.
I think it was Colorado.
Cause I know this one was largely modeled
after Colorado,
but they successfully got them to
introduce like an open source exception.
And it looks like California has now done
the same thing.
So this hasn't been signed by the governor
yet, just to be clear.
It hasn't technically passed,
but I do seem to remember him saying
he was going to sign it.
So now there is this exemption for Linux.
Where is it?
It's a very specific...
Hold on,
let me just check the show notes where
I have it written down.
The definition of an operating system
provider explicitly excludes an entity
that distributes an operating system or
application under license terms allowing
recipients to copy, redistribute,
and modify the software.
So it says most traditional open source
operating system, including Linux,
are outside the scope.
So Linux does not have to do this
in California.
Which is smart,
because how are you going to enforce that?
That would be such a nightmare.
And there's already been several operating
Linux developers who are just like, yeah,
I'm not doing that regardless.
But I will say,
this is my personal take,
is I do think this is less bad
than just a blanket,
like the original version of the bill.
But I personally still don't really see
this as a win.
This is just my personal opinion,
because...
first of all it still screws over so
many people who are using mac and windows
and you know it if privacy really is
a human right which i think all of
us agree with you can't pick and choose
your human rights like either everybody
has them or they don't so people on
windows deserve privacy even if windows is
garbage that's microsoft's fault not their
fault
People on Mac deserve privacy.
We shouldn't be gatekeeping privacy.
So I'm really not a fan of that.
And then my question is, okay,
what if logically this pushes everyone to
go to Linux?
You think the lawmakers are just going to
sit back and be like, damn,
they thwarted us.
That's not what happened in the UK, right?
In the UK,
everybody started using VPNs and the
lawmakers were like, well,
now we need to ban VPNs.
So if Linux becomes so popular,
they're just going to change the law and
say, well, now it applies to Linux too.
So-
I don't know.
I think this is definitely better than,
again,
the original version where it's just
blanket.
Everybody is included,
but I have my reservations personally that
I hope I'm wrong about.
But I don't know if you have any
thoughts on that story, Jordan.
It's kind of a quick one.
Did I miss anything?
No, I think you covered everything.
I mean,
there was like a discussion topic here.
Is this really a win?
What if Linux becomes so popular that they
simply change the law?
I mean, yeah,
I think that is also another thing that
you should...
kind of think about when these laws pass,
it's like, now it's not including Linux,
but like, what if it's?
It can always change.
Now that it's passed,
it's probably a lot easier to change it,
right?
Actually, I don't know.
Would that be the case?
Maybe not.
So I think California specifically,
it's actually really hard to change laws
because I remember the EFF talking about
the California Consumer Privacy Act.
They actually opposed it strictly because
they were like,
we don't think this goes far enough.
And normally in most states, it's like,
hey, this is better than nothing, right?
We have to take our incremental wins and
this is a step forward.
But in the case of California
specifically, they were like,
it is such a pain in the ass
to change the law here that we would
rather just not pass this and try again,
which unfortunately that's not what
happened.
Well, double-edged sword,
that's not what happened.
But yeah,
so I guess that's kind of an argument
against my point is like,
at least in California, it's like, yeah,
changing this to include Linux would
probably be an uphill battle,
but I don't know.
I still have reservations.
Our politicians have proven they can get
shit done when they want to.
They just don't usually want to.
Yeah.
It's always for the wrong.
It's always for the wrong things.
They can get something like a surveillance
law passed in like one day,
but then when it comes to like privacy,
a national privacy law or something,
it's like they just drag their feet for
centuries.
So it is what it is.
I think you've kind of covered that really
well.
So I don't think I have any more
to add on that.
Alrighty.
Well then how about you tell us about
this new offering from brave here?
Yes.
So this is a new feature that's being
added to Brave browser.
Brave launches email aliases to keep your
personal email address private from
websites.
This was published on August,
integration with the browser itself.
Just to make that clear from the very
start,
starting with today's desktop version,
one point nine point four.
So this is released and available now.
The Brave browser is offering email
aliases to allow you to sign up for
online services without revealing your
personal email address.
Email aliases are integrated into Brave,
which means you can generate privacy
protecting email addresses right from a
website's signup form.
These aliases then forward to your real
primary email address.
This remains hidden from websites,
thus breaking the cross-website tracking
link.
The feature can also prevent spam,
since you can easily deactivate your email
alias and create a new one in order
to create an email alias you'll first need
to create a brave account with an email
address and password note that this
account is separate from your brave
premium account which premium users use
for managing subscriptions to some of
brave services such as the brave vpn
And they also have a blog post with
more information on the privacy of these
accounts as well.
They say emails are scanned for spam and
viruses but deleted from their servers
within seconds after forwarding and notes
on an alias are stored locally on device.
So in this initial release,
they are offering everyone the option of
five free email aliases running a mail
forwarding service has ongoing costs.
So they're starting small and they're
trying to gather some feedback and they
are also working hard to bring email
aliases to mobile.
So it's not available on Brave on mobile
yet,
but they plan to offer a premium version
of the feature in the future.
So I guess throwing it back to you,
Nate, what is this?
This is kind of interesting.
This is another email releasing service.
It feels like we've gotten quite a few
of these at this point.
What are your thoughts?
Yeah.
I think,
I can't remember who presented this idea
and put it in my head,
but I think the promising thing there is,
you know, yeah, we've seen, I mean,
obviously things like temp mail and
gorilla mail have been around for a long
time,
but we've got things like simple login,
Addy.io, Firefox relay,
AdGuard spinning up their own thing
recently.
And I think it shows that there's a
demand for this stuff,
which is really interesting.
I feel like I don't,
run into a lot of people who are
using any sort of email aliasing thing,
not even like the Gmail plus trick,
but yeah, I mean,
I guess it's really cool to see.
I feel like there wouldn't be so many
companies breaking into this if there
wasn't a demand for it, I think.
So I guess that is kind of cool
to see that people are trying to do
that.
Cause I feel like email aliasing is a
very,
A very underrated technique.
It's super useful for managing spam and
helping to break up your profile online.
I guess it's really cool to see that
growing, personally.
Yeah,
I think it's definitely interesting to see
Brave moving more into these...
We're going to go back to Mozilla again.
All roads lead back to Mozilla.
But every time we see all these browser
companies,
like Mozilla has been trying to do this
similar as well.
They've got their own email aliasing
service.
They've got their own VPN.
Brave is doing a similar thing.
It's like, you know,
I think it's good to see alternatives to
services that we do recommend.
But I think a lot of times these
services that these browser companies
make,
they're not really on par with
um, the dedicated services such as like,
like Nate mentioned, like Addy,
like simple login,
like proton pass and stuff.
So I think it's, it's always good.
Um, I guess we could kind of cover,
we do recommend some email aliasing
services.
We do recommend Addy.io and we do
recommend simple login as well.
So I think that's,
Basically the two that we do.
Yeah, that's the two we recommend.
So yeah,
it's going to be interesting to see how
this goes.
I think one limiting factor of this that
we mentioned at the start of this article
was this is limited to the Brave browser.
So that's where these other,
these other platforms are more agnostic.
And I think Brave kind of has a,
it would be pretty weird if they're like,
it's an extension,
you can add it to any browser.
It just,
it just wouldn't really make that much
sense because they have, they have a,
a need for you to keep using their
browser because they want to, you know,
They want you to keep using their browser
instead of other people's browsers.
So it kind of makes sense why they
would limit it in such a way.
Um, whereas as far as I know,
Mozilla has made it a little bit more
platform agnostic.
So it'll be interesting to see if maybe
they add like a webpage where you can
manage this instead as well.
Cause I think that would be a good
middle ground option for people.
Um,
So that's also,
I don't know if you saw,
but there was possibly some limitations on
this as well.
So do you wanna maybe talk about that?
So I didn't see,
it's more just in my personal
investigations with a lot of these
aliasing services,
even the well-established ones is like,
you have to really dig into like,
what do you need out of an aliasing
service and what does it offer?
Like a lot of the,
like SimpleLogin and Addy.io are
definitely the best two right now.
I want to say IVPN's MailX or whatever
they call.
I think it also has all the features.
But a lot of the newer ones like
AdGuard, Firefox Relay,
a lot of them have limitations like you
can't initiate an email.
So if you have to say you want
to reach out to a new doctor's office
or whatever and you want to ask if
they have any openings for new patients,
you can't email them from a forwarding
address
they have to email you first and then
you can reply to it.
Or I know, I think,
I think they got rid of it on
the paid plan,
but I think one of the cheaper Addy
plans has like a bandwidth limit.
A lot of them have like a daily
send and receive limit that at very least
on the paid plans is like so high.
You're probably never going to hit it.
But for a lot of the free plans,
it's like, Oh,
you can only send like five emails a
day or something.
So just if you are interested in this,
just definitely try to do your research
and try to get that information.
Yeah.
Unfortunately,
I did not see it listed here in
this menu or this blog post,
but just things to keep in mind.
But yeah,
that's one of my few complaints with Brave
as far as technical stuff goes is they
have really cool products,
but so many of them require you to
use Brave.
Like Leo is Brave only.
Now this is Brave only.
I think there's something else I'm
forgetting that I think is kind of neat,
but is Brave only.
So it is a bummer that it's not
more cross-platform, but like you said,
it makes sense.
Yeah, I think it'll be interesting.
And we're keeping an eye on these new
services that do come out as well.
There was discussion on the forum as well.
So if you want to weigh in,
maybe let us know a little bit more
about the service because we have limited
time.
We don't have time to be covering every
single product and trying to work out the
limitations and such.
But I think
It'll be interesting to see where this
goes,
considering they're only rolling this out
as a free thing for now.
But yeah,
definitely interesting story to keep up
with over the next couple of months.
For sure.
And on that note,
we talked about Mozilla quite a bit.
We're actually going to jump over to a
story from Mozilla.
Some good news.
Mozilla is adding ad blocking for Firefox
on iOS.
At least I think that's pretty awesome,
personally.
Yeah, so I mean,
it's pretty straightforward.
This is a brand new feature that is
opt-in right now.
I think they said that in the future
it's going to be... Actually, hold on.
I have it pulled up here.
Let me see.
Yeah, once the rollout is complete...
There was actually a comment on our forum
about how this works.
You have to enable allow remote
improvements in the Firefox app on iOS to
get access to this feature.
Just thought I'd quickly jump in and say
that it's not going to be available by
default right now, but it will be.
Sorry.
No, you're good.
I was actually going to mention that.
But yeah,
I'm looking at that blog post right now.
So yeah, it will be...
They say once the rollout is complete and
the feature is stabilized,
it can be enabled by default.
And yeah, they also claim...
This is actually somebody from Mozilla
responding here in the forum,
which is another reason you also check out
the forum.
We get a lot of people who work
for these projects come and answer
questions a lot of the time.
Can't make any promises,
but it does happen quite a bit.
And they basically said this whole like...
it does kind of suck you have to
allow remote improvements and in order to
do that according to this user you have
to turn on like send technical information
um but they say that this is basically
only specifically like they're only trying
to gather information on this particular
feature is what this person says it's this
is an ongoing discussion and we're
actually waiting for the mozilla person to
respond to additional follow-up questions
but they basically say like we're just
trying to get information about this
feature to make sure it's stable and
They said we can pause or roll back
the feature without requiring users to
install another app update.
But yeah, beware.
If you're absolute maximal privacy,
you may not want to enable this thing
yet.
You may want to wait for it.
A question that I saw when this thing
first started popping up was,
why don't they build in an ad blocker
on Android and desktop?
So their answer basically is on desktop
and Android,
Firefox already supports a strong
ecosystem of ad blocking and privacy
extensions, such as uBlock Origin.
But on iOS,
extensions are not available in the same
way,
and they had to build it directly into
the browser.
So that's why, although I do remember...
I remember a couple months ago,
we covered a story about how somebody
spotted some code in Firefox to like,
there's like an about config where you can
enable like a beta easy list blocker from
uBlock origin.
So there may be a very basic ad
blocker in future versions of Firefox.
We're still kind of waiting for that to
shake out, but.
Um, real quick,
y'all shall know here said iOS is not
a good idea for privacy.
I mean, yes, we, we recommend graphing OS,
but there's a lot of reasons somebody
might be on iOS.
It might be a work phone.
It might be, um,
like I know me personally,
when I got into privacy,
I had just bought an iPhone like a
year before.
So I'm like, dude,
I'm not going to throw away a perfectly
good iPhone just to run out by,
by an Android.
Um,
there's actually places where pixels are
not for sale that iPhones are, um,
that may have changed.
I,
that I did that research years ago for
an older video, but, um,
Yeah,
we definitely recommend people go to
Graphene OS wherever possible.
But again, privacy is a human right.
People deserve it no matter what operating
system that they're on.
And then I think the last thought that
I had was, Jordan,
do you think this might change our
recommendations for,
because right now we don't recommend,
we only recommend Brave and a hardened
version of Safari, basically.
Do you think this might change our
recommendations?
We might add Firefox potentially or?
I would say no.
Uh, well, I guess this is my opinion,
obviously, like, you know, this,
the privacy guides community is like kind
of big.
We all have different opinions on things
and it's not down to me, Nate, Jonah,
some,
some random person dictating whether
something is going to be added or removed.
But I think like the, the, the,
the benefits that Safari gives you versus,
uh,
versus like Firefox is greater so the
issue with iOS is that you can't install
extensions for third-party browsers and
you can install extensions for Safari
which is huh that's a little that's a
little wacky Apple what's going on there I
mean well I guess the lawsuits will come
eventually um but I think it's it's it's
the issue that we have here right like
you can install an ad blocking extension
on Safari that has actually good coverage,
that actually blocks a lot of stuff.
And like Nate was saying with this Firefox
ad blocker, it's really not...
It's really not that it's not a wide
spectrum ad blocker.
It's just a very basic filter list,
easy list blocking.
So it's not really going to block all
that much.
Whereas, you know,
if you use something like AdGuard and you
use that in conjunction with Safari,
which Safari has fingerprint protection,
it has some extra privacy features that
these third party browsers don't have
access to.
And I think that's going to still beat
out Firefox or Brave browser on iOS.
So I think Safari is still the better
option, in my opinion, over this.
I think it is kind of down to
Apple, though.
We talk about this quite a bit when
it comes to iOS.
Every browser on iOS is kind of limited
by Apple because they control all the
entire platform and
everything is based on webkit if we had
you know a gecko browser on ios i
think that mozilla would have a lot more
control over how it works and the amount
of blocking that could be done but since
it's all by apple it's a lot harder
for them to make much more sweeping
changes which kind of sucks but that is
kind of the situation that we're in with
apple at the moment
Yeah, for sure.
I forgot about the whole third-party
extensions thing.
That's true.
I haven't been on iPhone in a little
while myself.
Yeah,
we can only hope Apple gets forced to
shape up.
That was actually all of our stories this
week.
I think we'll give it just a minute
in case anybody has any last-minute
questions.
Otherwise,
it was a little bit of a lighter
week.
Not as many big stories,
but the stories that we did cover,
I think, were pretty important stuff.
Hoping...
It's nice when we have good news.
We can talk about, like,
the Firefox getting an ad blocker and
Brave, you know,
adding this aliasing thing.
And it's just nice to have good news
sometimes.
Some weeks we don't have it.
No, it's good.
So I missed this comment here from Lucas.
I like your haircut.
Oh.
I mean, it's not real, but thanks,
I guess.
I saw that, too,
and that was my thought.
I'm like, I can't tell if they're joking.
Believe it or not,
my head doesn't actually look like this.
Okay.
Let's see.
People are saying, oh,
Addy.io is pretty good.
Yeah, I've had a good experience with it,
too.
I think any of the recommendations that we
have, you're going to have no issues.
Yeah, I don't know.
There's not too many questions.
I'm not seeing any questions here and on
the forum.
So I feel like maybe we can start
rolling out into the outro.
Next time I'll have black hair.
I mean, I can change it easily.
So I mean, yeah,
maybe next time I'll have black hair.
Maybe I'll have orange hair.
I was going to say, just shuffle it.
Yeah, just shuffle it every week.
You'll never know what I really look like.
People can place bets on what hair color
you're going to have every week.
That'll be fun.
All right.
Yeah.
Well, on that note,
all the updates from This Week in Privacy
will be shared on the blog every week.
So sign up for the newsletter or subscribe
with your favorite RSS reader.
If you want to stay tuned for people
who prefer audio,
we also offer a podcast available on all
podcast platforms and RSS.
This video will be synced to PeerTube.
Privacy Guides is an impartial nonprofit
organization that is focused on building a
strong privacy advocacy community and
delivering the best digital privacy and
consumer technology rights advice on the
internet.
If you want to support our mission,
you can make a donation on our website,
privacyguides.org slash donate.
To make a donation,
you could also anywhere else on the
website,
click on the red heart icon located in
the top right corner of the page.
You can contribute using standard fiat
currency, such as a debit or credit card,
or you can donate anonymously using Monero
or your favorite cryptocurrency.
Becoming a paid member unlocks exclusive
perks like early access to video content.
Sometimes we even have bonus content,
priority during the live stream Q&A,
and a cool badge on your forum in
the Privacy Guides,
in your profile in the Privacy Guides
forum and the warm,
fuzzy feeling of supporting independent
media.
Thank you so much for everyone that tuned
in and we'll be back next week.
See you next week.