Google is Using Your Emails for Targeting Ads AGAIN

Google goes back on their policy of not

scanning Gmail for advertising.

Bitwarden's dual licensing move cleared

up.

And Proton's CEO is in full AI psychosis.

All this and more coming up on This

Week in Privacy, so stay tuned.

Welcome back everybody to This Week in

Privacy,

our weekly series where we discuss the

latest updates with what we're working on

in the Privacy Guides community and this

week's top stories in data privacy and

cybersecurity while answering viewer

questions.

I am Nate and with me this week

is Jordan.

Hey Jordan, how have you been?

Been doing good.

Super excited to dive into some really

juicy stories this week.

Oh yes, quite a week.

Arguably just as big as last week,

but we'll get to that for sure.

I guess we'll go ahead and start off

with our main story here,

which is about Google.

So back in twenty seventeen,

some of you may remember that Google

updated their privacy policy and said that

they weren't going to be scanning your

inbox anymore on Gmail for targeted

advertising.

They'll still scan it for other reasons,

you know,

make sure there's no illegal content or

whatever,

but targeted advertising was no more,

which personally at the time I was kind

of like,

sounds like maybe they just don't need,

like they already have so much other data.

They don't need that anymore.

I was kind of weird, but anyways,

they've gone back on that now sort of

in a way.

And they will now use Gmail and photos

specifically for ads and

So this story comes from Android

Authority,

who says that this is related to their

personal intelligence AI service that

they're offering people.

And they say that instead of giving you

generic answers,

Gemini and Google Search can pull

information from connected apps,

including Gmail and Google Photos,

to better understand what you're asking

and provide more relevant responses.

So...

Yeah,

it says privacy policy still says that it

doesn't use content from Gmail driver

photos to personalize ads by default.

However,

an important exception now applies to

users who explicitly connect that

information to Google services that offer

personalized advertising,

which I'm sure as soon as you connect

to Gemini or personalized whatever,

I'm sure it's buried in those ten thousand

pages of legalese that it's like,

by the way.

So they say that giving Google access to

your personal information for smarter

recommendations could also lead to more

targeting ads depending on the services

and permissions.

There was actually another article from

Ars Technica that originally led back to

this one,

or that's how I found this one.

They said that this change took place on

October,

or like that's when the privacy policy was

updated.

They noted here,

there's like a little screenshot for audio

listeners that before it said like, um,

we don't use your stuff for personalized

ads.

Now it says,

we don't show you personalized ads based

on sensitive categories such as race,

religion, sexual orientation, or health.

Um,

we don't show you personalized ads based

on your conference from drive,

Gmail or photos,

unless you choose to make these ads

available.

Um,

Yeah,

and so the example they give here is

they say,

you might ask Google search for restaurant

recommendations near a hotel you've

booked.

With access to your Gmail,

search could pull up your reservation

details and suggest places nearby.

Well,

I guess I'll get to my opinion in

a second.

It says, to be clear,

this doesn't mean Google automatically

scans your private emails and photos to

serve ads.

The exception concerns information users

choose to share with eligible services.

Again, I'm certain it's buried in there.

And they say, let's see.

Still,

there's a difference between using your

information to answer a question and using

it to decide which ads might interest you.

Users comfortable with former might not be

happy about the latter.

Fortunately, you can control this.

If you'd rather prevent Google search from

accessing information in your connected

Google apps, here's what you can do.

And then there's detailed steps about all

the different... Because Google's...

For those of you who've never dealt with

it, Google's privacy and settings are...

word that comes to mind is labyrinthine

labyrinthine um it's confusing and to this

day i will just be bored digging through

my google account and i will still find

like oh here's an address from ten years

ago oh here's a an old phone number

i don't have anymore you know just like

weird things that you know here's a bunch

of youtube comments that i didn't find and

delete before like it's so hard to manage

google data it's really confusing

Um,

but thankfully they have a breakdown on

where you can go find this stuff or

needless to say, you can, um,

just stop using Google of course.

So yeah.

Um,

I'm checking my notes here to make sure

that I've covered everything.

Oh yeah.

The, uh, what was,

what was the thing I was going to

make a comment about up here?

Um, yeah, the whole, like you could, uh,

Google could give you recommendations for

a restaurant near a hotel you've booked.

I don't understand how hard it is just

to be like, um, you know,

uh,

pizza places near the Hilton in Seattle.

Like,

I don't know why it needs to go

digging through your Gmail when you're

usually,

at least I'm usually pretty specific about

that stuff, but I digress.

Um,

I think I'll turn this one over to

Jordan or bring you back here for this

one.

Um, I,

I kind of snarkily made the comment that

like,

you could always just use another

provider, but, uh, do you have,

first of all,

do you have any opinions on this story

and do you have, uh,

other providers that we recommend that

stand out to you?

Yeah,

I think you kind of nailed it on

the head there when you said like,

why does this even need to exist?

Like,

surely this is something that you can do

manually yourself, right?

I mean, that is true as well.

But I think giving access to your email

inbox,

like when we talk about email inboxes,

like

maybe you don't think about it but there

is a lot of information that goes into

your email inbox like there's you know

doctor's appointments there's uh you know

all sorts of invoices that you get from

purchasing things um there's a lot of

information that's available in your

emails right and allowing google's gemini

service or you know connecting this to

other

other services in your Google account is

potentially allowing that data to be

sucked up into an AI service,

which could be quite bad if that's leaked.

I think obviously don't connect personal

intelligence to your Gmail account.

Go and check.

There's a whole bunch of personalization

settings that you can actually change in

Gmail.

you can disable a lot of the features

that it does use that are a little

bit more privacy invasive.

So even if you are still using Gmail,

you can actually make some moves to make

it less,

like the data to be less shared with

other people.

So I would say if you are still

using Gmail, go check that,

check in the settings,

make sure you're disabling all those

personalization options and

personal intelligence as well.

Don't connect it with Gemini.

Don't connect it with other apps.

That's the first thing you can do.

And then like Nate said,

why aren't you just using another service

at that point?

Like if you do care about your privacy,

you shouldn't be using an email service

that is

provided by an advertising company.

So Google is an advertising company.

That's where they make the most of their

money.

So we recommend three different providers

on privacyguides.org.

And those three providers are Tutor,

ProtonMail and Mailbox.

So ProtonMail is probably the most similar

to Google.

And the reason why we recommend

switching your entire email service is

because these services that we recommend,

they implement certain security features

that Gmail doesn't have.

And

Gmail being unencrypted,

like your email inbox isn't stored

encrypted,

it allows them to make all these extra

personalization options available and

enable these intelligence features.

But because of these more secure

providers,

they encrypt the data and they don't have

access to...

the actual email content itself.

So that protects you quite significantly

from a lot of the privacy issues that

Gmail actually has.

So we would recommend switching from Gmail

to something better.

And it's become so easy at this point

where they offer easy switch tools and

stuff like that.

So there's definitely

less of a reason not to switch at

this point.

But I guess I'll throw it back to

Nate here.

There was some questions in the chat as

well, if you want to hop on those.

But

Yeah,

we are going to cover the Proton story

thing in detail.

So feel free to leave questions and

comments,

but I think we'll save those until we

get to that story for sure.

Yeah,

I think you hit the nail on the

head.

They do have easy import tools,

and especially Proton, which again,

we'll talk about them later.

But they even have a tool where it'll

automatically import all your emails and

set up the forwarding rule.

And I think you can even use Gmail

in Proton now,

which I'm not going to lie,

that one kind of confuses me a little

bit, but whatever.

Yeah,

and just to kind of throw it out

there, like you...

You really get it, obviously.

But I get that a lot when I

talk about email and people are like,

well,

I don't really use my email for anything

anyways.

And it's like,

but you use it for password resets.

And we always run into those people that

are like, well,

nobody should use email because it's

insecure.

And it's like, yeah, that's true.

But my doctor's not going to signal

message me appointment reminders and

messages and stuff like that.

And so using an encrypted email provider

still cuts that risk in half.

If Proton or Tudor has a data breach,

they can't leak those emails versus Gmail

who totally can,

or the targeted advertising can be used to

manipulate you as we saw ever since

advertising existed.

And yeah,

so it's definitely really important in my

opinion,

even though email has a lot of flaws,

even though you're only encrypting half of

the chain, in my opinion,

it's all about like reducing the amount of

attack surface.

Exactly.

I will say a couple people here,

you know,

Foundog said you're early this week,

and then Alex said first time catching it

live, so thank you so much, guys.

Somebody said the irony of complaining

about this while using a Google account.

We're on StreamYard on this end, but...

No, I hear you.

I mean, I get that,

but it's also like a...

everybody's in a different situation,

right?

Like we're on Google because we're,

we're trying to reach people who are not

familiar with the message of privacy.

Like, you know, not,

I was brought up in a church,

so I apologize, but this is the first,

first place my brain goes to is like

in the Bible,

Jesus was criticized for hanging out with

all the sinners.

And he's like, yeah,

the healthy people don't need a doctor.

I'm going to the people who need to

hear my message.

And that's why we hang out on platforms

like Twitter and, and YouTube.

And I think we even have like a

LinkedIn and a Facebook.

So yeah,

But I digress.

Yeah, that's a pretty quick story.

But like you said,

if you are forced to use Google for

whatever reason, I mean, first of all,

we use this for YouTube,

but we don't use Google for email or

anything else, really.

So that's an option.

But yeah, you can, again,

the article has instructions on how to go

through and turn all that stuff off.

But I think with that,

we'll go ahead and check our forum

questions real quick.

And...

We actually had a lot of questions this

week.

Well, we had a lot of discussion.

We had some people, let's see here.

We had one person said,

it's unbelievable how many people still

don't care about this Google story,

despite the amount of times companies just

break their promises.

Somebody posted a pretty good meme about

that guy standing at a podium and like,

who hates this thing?

And everybody raises their hands.

Who will stop using it?

And everybody puts their hand down.

Yeah.

There was somebody else asked us to talk

about Proton, which again, we will get to.

And yeah, Discord,

which we're going to get to a little

bit later as well.

So I'll check some of the other places

that people leave comments.

But otherwise,

I think we can move on to our

first forum discussion.

Yeah, sounds good.

Let's dive straight into this forum

discussion.

And once again,

just letting everyone know,

you can leave your comments in the chat

and on our forum at

discuss.privacyguides.net.

So this post here was kind of an

ongoing story that's been going on for at

least, as far as I'm aware,

a couple of weeks at this point.

Bitwarden has been going through some

license changes.

So I guess quoting from the post itself

here,

that Bitwarden made on their own community

forum.

Starting in the next release,

the Bitwarden apps published to various

stores will be commercially licensed

builds.

No action is needed and the apps will

work exactly as they do today.

Bitwarden remains committed to open source

security and transparency.

The GPL v.

Three open source license version

continues to be updated and published on

GitHub.

All current features are available

In both versions,

license details are on GitHub.

Bitwarden remains committed to a robust

free forever plan for everyone.

And just so we're a hundred percent clear

on this,

Bitwarden is not going closed source.

You can still fork Bitwarden,

no change to self-hosting.

The licensing change only affects those

who are repackaging and reselling

Bitwarden.

So I think this is a little bit

of a confusing story for people a little

bit.

Um,

there was definitely a lot of heated

discussion.

Let's call it a heated discussion in the

Bitwarden community forum about this.

And certainly some people with some

thoughts on our community forum too.

And even someone from Bitwarden team

actually did respond to this,

to this forum discussion.

Um,

Basically,

the person from Bitwarden mentioned

basically what they said is this is more

about giving Bitwarden protection for

certain features for those who are

repackaging and reselling Bitwarden,

and it doesn't prevent any community

projects from existing.

So one of those community projects that

you probably are familiar with is

Vaultwarden, which is basically a forked,

easily more self-hostable, easily...

more easily self-hostable version of

Bitwarden's server, basically.

But some people were concerned that since

Bitwarden is moving,

changing their licensing,

that this might

mean that they're moving towards more of a

closed source model,

which a lot of people that use Bitwarden

specifically don't want.

So that's why some people were frustrated.

I guess further on to that,

new enterprise features,

new products and other items that provide

Bitwarden at a straight strategic

competitive edge in a new market will be

behind a commercial license.

This in most cases will apply to business

plans only.

Some features for premium plans may also

fall under the commercial license,

but that will be evaluated on a case

by case basis.

So it seems to me like a lot

of the enterprise features for Bitwarden

would eventually become, you know,

part of this commercial build instead of

available in the GPL v three open source

version,

but basically all the actual backend and

like, you know,

specific important stuff that actually

needs,

to be available for people to actually

look at is still available for people to

look at on GitHub.

So it's definitely a choice to do this,

but it kind of makes sense because

Bitwarden wants to protect their

commercial interests.

They don't want competitors being able to

see the code for specific features that

give them a strategic edge over

competitors.

So it makes sense that they would consider

doing this sort of move.

Yeah,

there's a lot of discussion in this thread

as well.

I don't know if you have anything more

to add on this one, Nate,

but it's definitely an interesting

progression for Bitwarden.

Yeah, not too much.

I just kind of wanted to share this

because, like we said,

this is a little bit of an older

story,

but I keep seeing people referencing it,

and it kind of went under my radar.

So I was like,

what are people talking about?

And I agree with you.

It's one of those things where their

stated reason makes sense, in my opinion.

Yeah.

but uh but i i i also agree

that it's one of those things worth

keeping an eye on like this by itself

is not bad and you know australia said

a good point here too just now um

this alone is not that bad it's this

with the private equity incident that

makes it even worse for paranoid people

which yeah i agree like bit orton has

venture capital and they they have been

clearly moving in a more like business to

business kind of direction um which i'm

fine with if you know that's the direction

they're trying to take to to make money

um they haven't

extremely generous free plan,

in my opinion.

So what I don't want, personally,

is I don't want to see them turn

their back on consumers.

Like they say, oh,

the free plan will always be there.

Yeah, but...

Personal opinion.

I don't even mind if they take away

some of the features.

I'd have to sit down and think which

ones I'm okay with.

But what I'm scared of is it's going

to turn into a LastPass situation where

it's like, oh yeah, it's a free plan.

You get one device with like ten entries

and it's like it's so limited.

It's like practically not even like it's a

joke to call it a free plan.

So that's what I'm worried about is...

the potential that this could be shifting

in the direction of and shitification.

But again, at this time,

there is no indication of that.

It's still fully source available,

open source.

They're not cracking down on vault warden.

They're not cracking that they're even not

cracking down on resellers, which is way,

way back in the day.

Um, the new oil, I, I started, um,

looking into affiliate links there.

And so I reached out to some of

the services that I recommended on the new

oil and was like, Hey,

do you have an affiliate link?

And I remember Bitwarden was the only one

that got back to me and they're like,

we don't,

but you're totally welcome to like host

your own version and sell like a premium

version and like basically become an MSP.

And I'm like, I'm not doing that,

but wow, that was,

they were the only ones that did that.

And I thought it was so,

that was pretty wild, but, um, yeah,

anyway, sorry.

Uh,

I think right now there's nothing to be

worried about, but it's, again,

it's something to keep an eye on and

to make sure that it doesn't get any

worse in my opinion.

So yeah.

I guess also just to quickly add as

well, the,

they did post like a roadmap and stuff

and you can see, you know,

some of the enterprise features that

they've actually added or planning to add

at this point.

So, you know, for instance,

one of the features that they've added is

stage users using SCIM and directory

connector.

This is not a feature that anyone who

is a personal or business user would

probably need.

This is for large corporations that have

lots of users and that are going to

need these features.

The other one was adding support for

CrowdStrike security information and event

management.

Again,

not a feature that anyone here is going

to actually need access to.

I think it's always good to actually keep

on top of this news and make sure

that you're paying attention because

You know,

it's always possible for things to go bad,

but I think, you know,

a lot of times it is a lot

of fear, misinformation and doubt.

You know,

like people are spreading stuff and trying

to say things,

but you always should double check

everything that's happening.

Just looking at their roadmap,

a lot of the features that they are

suggesting are

you know,

for enterprise users that are locked

behind this commercial license are not

features that anyone here would actually

need access to anyway.

So we still have full access to the

source code and what the actual Bitwarden

apps are doing.

It's just some of these enterprise

features that are being locked behind

that, which I think is fair enough for,

you know,

Bitwarden's commercial interests.

They are a company.

They need to make money.

So it makes sense.

Someone here, Australis, said,

I moved to KeePass because I don't want

to gamble on this.

And that's totally fair.

I think it's totally fair.

Like,

everyone has a certain line that they're

willing to cross.

And if this...

you know,

move from Bitwarden is the line that you

personally take when it comes to this sort

of thing, that's perfectly fine.

And I think, you know,

Keepass has got a lot of great clients.

They don't have any, you know,

like venture capital funding.

They don't have,

There's definitely less risk using

something that's offline.

But also there's also concerns with key

pass as well.

I will say they were accepting AI

generated code.

You know,

there's all sorts of things that happen no

matter what tool you're using.

It's always best to be more vigilant about

everything that you choose to use.

But yeah,

that's kind of everything I have to add

on that.

Unless you had anything.

No,

I was just going to add to you.

Like, yeah,

I totally respect that like open source,

the licensing side of things and like the

deep, I say this with love,

the deep nerdy details like that.

I think they're very valid and very

important and I'm not trying to invalidate

them, but I'm with you.

For me,

the important thing is the transparency of

the code.

Is the code visible?

Can people verify that it does what it

says it does?

Can people verify that there's no like

major gaping security holes that it's

like, like again,

last pass when that happened and we found

out everything that was wrong.

And it's like,

how the hell did we even end up

here?

Like personally,

that's the important part to me.

But yeah, I, I mean,

same thing with Australis.

Like if I wasn't married,

that's the main use case I have for

Bitwarden is like syncing logins with my

wife and stuff like that.

So if I wasn't married,

I'd probably be a little bit more willing

to like, you know what, let me,

Let me figure something out with key pass

that works for me.

I'm willing to put in that kind of

work.

But yeah, for now, I'm not too worried.

And Lucas loves your latest haircut,

Jordan.

So yeah.

Incredible.

I think with that,

we can move on to our next story.

We're going to head over to France now

for some unfortunate news.

France is basically blocking quad nine.

Kind of, sort of, not really.

Kind of, sort of, yes.

So, for those who don't know,

Quad Nine has, for years now, like,

this was back when I first started with

Surveillance Report back in, like,

that may be a different case,

but I know Quad Nine was involved.

They've been in this ongoing lawsuit where

Europe is really trying to crack down on

piracy,

and they decided the easiest way to choke

off piracy would just be to make it

harder for everybody to get there.

Because, you know, to their...

Tiny little bit of defense.

When you're talking about trying to crack

down on international crimes,

it's really hard because, first of all,

the thing that they're doing may not

necessarily be illegal where you are,

but even if it is,

it's like now you have to coordinate with

international law enforcement and the

country you're coordinating with may have

bigger problems than trying to catch

somebody who's streaming a freaking

football game and stuff like that.

So France is just like, you know what?

If we just make it so people can't

even get to the website, problem solved.

And I see how they got there,

but I disagree with it.

Anyways...

For some reason,

Quad Nine is who they chose to target.

And they said, hey,

you can no longer resolve requests to go

to these known piracy websites.

And Quad Nine has pushed back on that

in court and been like, no,

we should not be held liable for that.

And unfortunately, in France, at least,

they have lost this lawsuit.

So I'm going to start reading from this

EFF article.

They say Quad Nine, a free DNS resolver,

has said it will reluctantly stop serving

users in France on November twenty fourth.

This follows a French court order that

Quad Nine must block access to websites

that are accused of infringing the

copyrights of a sports broadcaster.

And it says, just a quick brief,

when you visit a website,

for those who don't know,

a DNS resolver reads your domain you type

in, such as EFF.org or privacyguides.org,

translates it into a numerical IP address

that's used to direct data across the

internet.

And a DNS resolver can see the names

of websites you connect to,

so its privacy policies are important.

QuadNine is a non-government organization

that's incorporated in Switzerland,

in part to protect its users from data

demands.

The company also helps protect users from

malware and phishing by blocking domains

that are known to be malicious.

So this is

One thing that makes QuadNine really

attractive is they do not keep logs.

They are based in Switzerland.

Years and years ago,

I actually interviewed their CEO when I

was with Surveillance Report,

and he talked about that.

They moved to Switzerland specifically to

get the legal protections for privacy.

But the only thing they block is malware.

So if...

Personally,

I like the ones that block ads,

the block trackers.

But if you're like, no,

I want to handle that myself,

I want the most uncensored Internet

possible without opening myself up to

risk.

Quad nine is very popular for that.

In a blog post explaining this decision,

Quad nine explains that the French court

ordered to force it

forces it to make that decision either way

is bad for its users.

It could either extend French law to the

whole world and block the website globally

or try to identify and block users only

in France,

something that it cannot do reliably and a

move that could leave the company facing

massive fines if it fails to block

websites perfectly.

Quad nine says it is currently facing

about twenty other lawsuits in France

seeking similar blocking orders.

So rather than accept these demands,

Quad nine has decided to withdraw from its

service from France.

That is a real loss for French users

who rely on the service to protect their

privacy and security.

But it is also the right thing to

do.

Um, and, uh,

EFF goes on to point out, they said,

uh,

quad nine decision will not remove any

allegedly infringing material from the

internet.

The organization doesn't host websites.

Users looking for particular websites can

easily switch to another DNS resolver.

So the material targeted by the copyright

holders will remain online and accessible

even while they drive a privacy protecting

service out of France.

And then they go on to point out

that here in the U S, um,

The clowns in our Congress – I'm just

going to go ahead and say that –

have floated multiple laws about,

what if we block this?

What if we block this?

What if we block this?

Because – well,

I think I've been political enough for

now.

But yeah,

so they're kind of reminding people like

this doesn't work.

It doesn't get rid of the material.

It just puts everybody at risk.

So –

Sorry, I saw that there was a comment,

but I didn't read it until just now.

Good thing France doesn't have any other

issues going on right now.

Yeah, like I said, to their defense,

this happened years ago.

But yeah,

probably some bigger fish to fry at the

moment.

Uh, anyways, yeah.

Um, I mean,

I was going to throw this one over

to the audience as well,

but I don't know if you have an

opinion too, Jordan, like let's,

for the sake of argument,

let's go with something we all agree is

bad.

Like, you know,

CSAM should infrastructure providers be

forced to block illegal content.

Cause I feel like that's a very slippery

slope.

Like Cloudflare also pushed back on this

when it's like, you know,

like they've also been pressured to like,

Oh, don't resolve domains to this.

And it's like, look, we're just,

we're not the content moderators.

We make the internet open.

And I think as soon as you start

shutting doors, like, I don't know,

that's maybe CSAM was a bad example to

pick when I'm defending free speech,

but you know what I mean?

Like if it's something we can all agree

that should be illegal,

I don't know if it's, it's,

I feel like it's a slippery slope when

you make the infrastructure providers

start blocking it instead of going after

the actual hosting providers and the

people responsible for the content itself,

you know?

So.

Yeah,

I think this is definitely like one of

these hotly debated issues where it's

like, you know,

how much control do we want to give

to certain

levels of internet infrastructure, right?

Because, you know,

DNS providers do control some level of

access to websites.

But again,

there's always another alternative to

QuadNine.

There's always another alternative to

Cloudflare that's not going to be blocking

all these certain, you know,

DNS resolutions.

So...

You know,

we've had this issue before with

Cloudflare, not as a DNS service,

but also as a DDoS protection service,

because so much of the Internet is reliant

on Cloudflare to actually protect their

websites.

They have somewhat of a large amount of

control over who can access certain

websites.

And, you know, same thing for QuadNine.

They have a certain level of control over

who can access whichever websites and

I think personally it should not be down

to a DNS provider to decide whether a

website should be able to be accessed or

not.

That's not a decision that should be made

or forced on a DNS provider.

Yes, even in the case of like CSAM,

that should be something that is

investigated properly and taken with care

and, you know,

being investigated at a level of,

you know,

finding the actual source of the

information and the issue, right,

instead of actually broadly blocking

information.

a certain portion of the internet.

Maybe that's a hot take,

but I don't think a DNS provider should

be the gatekeeper of what websites you can

access.

And we've already had this problem here in

Australia.

Our government forces ISPs to basically

block certain websites.

So if you're using your ISP's DNS

provider,

a whole bunch of websites that the

government doesn't like are all blocked.

So, you know, when you give access,

when you push this sort of thing on

DNS providers,

it does censor some content.

Obviously,

you're not actually censoring the actual

content.

The content still exists.

The content still exists.

It's just not being able to, like,

the DNS can't, like, resolve.

So, you know,

it's not actually solving the problem.

It's just, you know,

blocking some people from accessing that

domain.

So it doesn't really solve the issue.

It's, like, not the greatest solution.

It's kind of like an easy way out.

Yeah, exactly.

Like it's, it's,

it's still able to actually, um, oh,

we did get a comment here from

FuriousDragonNineteenSeventySeven.

Are you going to cover Proton going down

the shitter?

Yes, we are later on.

Um, so please do stay tuned for that.

Um, but yeah,

I'll throw it back to you Nate on,

on that note.

No, yeah,

I mean that's all I got too.

I agree with you.

I think it's much more effective,

especially in the case of something really

horrible like CSAM.

It's way more effective to actually go

after the person doing the bad thing than

– this is just – I complain all

the time, and I think we all do,

about lazy politicians with age

verification laws, right?

oh,

we'll just require everyone to hand over

an ID and that'll solve all the problems

with the internet.

And it's like, no, that's just a lazy,

catchy soundbite by people who don't

understand the internet,

who just want to get reelected.

And it's the same thing with this.

It's like, well,

if we stop people from going to the

piracy websites, same thing, right?

And it's like, no, there's a balance.

There's always the argument that like,

well,

people are going to find a way anyways.

But it's also like, yeah,

but if you make it too hard,

there's a balance to it.

And it's like, is it really worth...

that, that slippery slope of, you know,

you could block anything like today.

It starts, you know, it's,

we see this all the time with like

us laws, right?

Like, Oh,

we're only going to use this for like

terrorism and drugs and CSAM.

And then also somebody stole a car and

then also arson.

And then also now it's protesters

exercising their peaceful first amendment

rights.

And it's just, just goes downhill so fast.

So, so, so fast.

Yeah.

Oh, we did have a question here.

We had somebody...

I think they said that was the barcode

for Red Bull.

So I'm just going to call you Red

Bull from now on.

They said,

just wondering what you guys think about

TwoFAS and their new password manager.

I didn't even know they had a new

password manager.

I know...

It says they're free and open source,

but they don't have a security audit yet.

I know two FAS is not super recommended

as far as a two factor app.

Cause I think there's some, um,

like there's a little bit of metadata,

if I remember correctly,

a little bit of analytics and there's just

kind of like better options,

but that's kind of all I know about

it.

I don't know if you know anything I

don't.

Yes,

so I've been following this for a while.

I know a little bit more about it,

but there was a thread on the forum

about adding this to FAS as a two-factor

app, specifically,

not related to the password manager,

just the two-factor app.

As of October, when the tool was rejected,

there was an issue with basically

the storage of the cloud kit data of

the actual um to fas like database wasn't

being encrypted if you had advanced data

protection on and

Basically,

it wasn't end-to-end encrypting the actual

sync data,

which was kind of a problem for a

IIFA app.

So that's the reason why it got rejected.

EnteAuth and Aegis are the only ones that

are recommended currently.

So for that specifically,

IIFAS is not recommended.

I'm not sure if that's changed.

We haven't looked into it again.

So maybe they've fixed this again.

If someone wants to get this re-added on

the website,

they can a hundred percent just go re-add

that as a forum thread,

get that discussion happening,

but currently they're not recommended.

I think it's definitely one of these

things where take a look at the forum.

If there's a tool that you're looking at

that you're considering,

just search up the name of it.

It's probably being discussed at some

point.

I can't comment on ToFAS password manager.

I'd never heard of it.

It sounds interesting.

But again,

if that's something you want people to

look into,

I would open a forum thread for that.

But quickly,

we did get a gift membership from Sod

This All,

and they also resubscribed for ten months.

Loving the stream.

Keep up the good work.

Thank you so much again, Sod This All,

for those memberships.

And it looks like

FuriousDragonNineteenSeventySeven just got

gifted a membership.

Awesome.

Yeah, for sure.

I think with that,

we can go ahead and move into the

site updates.

All right, sounds good.

So before we dive into any of the

chaos going over on at Proton and what

it means for the privacy community,

let's give some quick updates with what

we've been working on in the privacy

guides, at privacy guides this week.

Remember to leave your questions and

comments in the chat and we'll get to

them in a moment.

But first,

throw this over to Nate to discuss some

of the video changes that we've been

working on.

Yeah, there's not too much.

This has, again,

been one of those slower weeks where

there's a lot of stuff going on behind

the scenes and stuff will be coming out

to you guys soon.

Our interview,

Jonah's interview with Obscura VPN's

founder should be up pretty soon.

I'll be honest,

I haven't actually listened to it yet,

but I'm excited to because...

I pulled up the project very briefly

because I had to add the intro and

the outro.

And there were a lot of questions.

There were so many questions.

So I think it was probably pretty

thorough.

And yeah,

just excited to share that one with you

guys.

And then I am actually working on an

Obtanium tutorial.

So I just wanted to throw it out

there.

If you guys have any specific questions or

tips that I should include,

definitely let me know.

I'm excited for this video because I'm an

Obtanium user.

And I'm not afraid to read the

instructions,

but I kind of only do it if

I have questions.

And when I started using Obtanium,

I felt like it was pretty intuitive.

So I was just like, all right, cool.

So I just downloaded it and started using

it.

But now that I'm making this video,

I'm really digging into like what it's

capable of and how to like, quote unquote,

use it properly.

And I'm like, oh my God,

I have not been taking full advantage of

this app.

This app can do so many things.

And so I'm excited to share that with

you guys.

Yeah, and then last but not least,

I believe I did mention in the past

we are working on a Graphene OS video,

which is off to Jordan now.

Jordan is editing that,

and it's hopefully going to be really

cool,

and hopefully you guys are going to like

it and be able to share it with

people who don't know what Graphene OS is

and be able to be like,

here's why you should use this phone,

because I really tried to hype it up.

Not like that's hard to do, but...

Yeah.

And again, a reminder,

we will talk about Proton.

I do see the comments.

But with that,

I'll go ahead and turn it over to

Jordan to let you guys know what else

has happened this week behind the scenes.

Yeah, definitely.

So this week's kind of a slow week,

mostly like, you know,

administrative changes.

There's definitely some site changes that

are happening.

There was just a couple of small updates

this week, which was, you know,

correcting some grammar,

fixing a source code link,

pretty small changes this week,

but changes nonetheless.

And there's definitely some more pull

requests that are in the pipeline.

for changes that are coming soon.

I did author a pull request for Obscura

VPN.

We're not sure if that's going to actually

happen or if it's going to be added,

but it's something we're looking at at

this point.

I will also say there's been more articles

posted this week.

Again, privacyguides.org slash news.

We always post news updates,

and that's usually done by Freya and Nate.

So this week we had quite a few

great stories posted

From Freya,

so SystemD adds Rust program support.

Apple introduces selfie age verification

in iOS twenty seven point two.

Nate did another data breach roundup the

other day and Reddit announces migration

to a primary logged in experience.

all really interesting stuff,

but definitely keep an eye on the

privacyguides.org slash news page for some

of the latest updates in the privacy

space.

So yeah,

all this is made possible by our

supporters and you can sign up for a

membership or donate at privacyguides.org

or pick up some swag at

shop.privacyguides.org.

Privacy Guides is a non-profit which

researches and shares privacy-related

information and facilitates a community on

our forum and website.

matrix where people can ask questions and

get advice about staying private online

and preserving their digital rights now

let's talk about a quick discord update

worth having on your radar and just

another reminder remember to leave your

questions in the chat and we'll get to

them in between stories

I am excited for the Proton story later

because we're literally getting updates as

we talk.

Like,

I just checked one of my Signal group

chats and apparently Andy has put out a

statement on Reddit that I guess we'll all

read together because it's a little bit

long and I don't have the...

I don't have the brain to do this

while also reading that.

So yeah,

we'll get to that a little later and

we'll find out together guys.

But yeah, for now let's talk about this.

Oh,

I should have sent the link to you

while, while I was doing that.

But yeah, anyway, sorry.

We'll talk about discord real quick.

This is actually a really,

really quick story.

Basically it's still a worse,

a story worth knowing about.

Yeah.

Discord is now making its public

communities more searchable,

and people have concerns,

which if you are not a consistent Discord

user like me,

like I'm not a consistent user,

this sounds a lot more worrying than it

is.

Like, it's still bad,

and I definitely want the audience's

opinion on this,

but it kind of sounds like it's saying

any public server is going to be visible

to everyone, right?

And it's not quite like that.

So...

Anyways, we'll read this.

So Discord announced on Tuesday it will

make some conversations in its public

servers searchable and easier to find on

the internet.

The new update targets conversations in

discoverable servers,

public Discord servers that administrators

have made eligible to appear in the

platform's server discovery feature.

So I've used a little bit of Discord

over the years.

And just to clarify,

this doesn't affect DMs.

This doesn't affect private servers.

Even if you're in a server set to

public,

your admin has to opt in to being

a public community,

which even that requires a certain amount

of like, you have to have,

I think like,

like a thousand members or something.

And, you know, something like that.

Like there's, there's requirements.

You can't just flip it on.

So this affects a very narrow range of

servers,

narrow range in terms of the number of

overall servers,

but not very narrow because a lot of

them have like tens of thousands or

hundreds of thousands of users, I think.

Anyways, back to the article.

So the stated aim is to help people

find useful information that might

otherwise remain buried in Discord

conversations to a wider audience.

According to Discord,

more than sixty three thousand

discoverable servers host discussions on

everything from gaming strategies and

fandoms to language learning and niche

interests.

By making some of these conversations

searchable,

Discord hopes to extend the reach of its

communities beyond the platform itself.

So they're talking about the wider

internet.

They're talking about like,

which I'm actually going to touch on this

in a second, like right now,

or maybe not right now,

because Google's all in on AI.

But up until recently,

if you go to Google or any decent

search engine and you type in, you know,

I don't know how to how to replace

my shoelaces.

I don't know.

I'm just picking something random.

A lot of the time,

it would not be uncommon to get Reddit

results.

Right.

And I think that's what they're trying to

do is the same thing.

Like now it'll be like a discord result

will pop up.

It says this move on that note also

taps into the appeal of traditional

internet forums where users can find

answers by searching through publicly

accessible discussions.

Gaming communities could draw attention to

walkthroughs,

developers could reach more people with

technical advice,

and content creators could attract new

audiences without relying solely on

Discord's internal discovery tools.

So this will roll out November sixteenth.

Each server will have its own web page.

Discoverable server will have its own web

page,

which may feature automated summaries of

discussions and active channels,

public channels.

Beginning in mid-December,

selected messages from public channels may

also appear in search engine results.

Here's an important part.

Server administrators will be able to

choose which channels are included,

and individual members can opt out of

having their messages made publicly

searchable.

So if you are in one of these

servers,

make sure your admins know about this,

and you go ahead and opt out yourself.

Again, private servers, direct messages,

and group direct messages are excluded.

And...

What was I about to say?

It'll come back to me.

I want to skip to the end here.

It says Discord users can manage the

preferences and settings while server

administrators can retain control over

which channels participate.

Notably,

the option to make messages discoverable

is turned off by default in the EU,

UK, Canada, Brazil, Australia,

and South Korea because of legal

restrictions,

and teen users are also excluded from the

feature.

So I just want to take a moment

there to say that...

I am well aware that laws are not

a silver bullet that do not solve

everything.

But clearly,

if America had some decent privacy laws,

this would be off by default.

And honestly,

they probably wouldn't even roll it out

because so many people would have it off

by default.

They wouldn't – like how many people are

really going to opt in?

But yeah, it's – oh,

I remember what I was going to say.

I remember when I was talking about this

with my wife who's a pretty heavy Discord

user,

and she kind of wondered about like –

a lot of the time when you join

a bigger community,

you'll end up in like a waiting room

and you have to like react with a

certain emoji or like fill out a

questionnaire or something.

And that's what gets you access to the

rest of the server.

I have a feeling this will not work

because this is being rolled out by

Discord itself.

I don't think that's going to stop this

indexing.

Discord is very easily able to bypass

that.

So that is a really useful feature for

weeding out spam.

It's fifty fifty effective,

but I don't think that's going to stop

this indexing.

So be sure to go in and

opt out of that if you don't want

to be part of it.

And yeah, I guess we're mostly just,

again,

signal boosting this to let people know,

go ahead and opt out or switch over

to something like Fluxer.

You can join the privacy guides community

if you want to.

We're pretty active there.

And yeah,

so the last thought I had is somebody

said Reddit sock tanked about thirty

percent today.

I kind of wonder if this

is related to reddit um because now that

reddit is we didn't have time for it

but there's another article about how now

reddit's going fully like you have to be

logged into view anything um they're

probably final stage of certification

that's not true they'll find a way to

make it worse but um you know i

almost wonder if this is a response to

that like oh look now there's a um

now there's like a void in the market

that we can take advantage of so

Yeah, I don't know.

I guess that's where they're at.

Jordan,

is there anything that I missed on this

one?

And viewers as well,

do you think this is an okay compromise

like being just large communities?

Do you think it's a disaster waiting to

happen?

How do we feel?

I mean,

I think one of the main issues that

a lot of people have with Discord itself

is that, you know,

it's kind of hard to find information.

A lot of a lot of communities put

everything on Discord and it's a little

problematic to find.

Like if you're like, oh,

I need if you play some very obscure

game, for instance,

and they only have a Discord server,

there's no wiki and you have to find

somehow information about this in a

Discord channel.

It's not easy to find.

I can understand why they're using this as

an excuse,

like why they're moving in this direction,

right?

It makes sense that they would do this.

But again,

I'm just not really sure how this would

even be displayed in a public way.

Like, is this going to be like...

a link on Google that you click,

and then it's just like a chat that

you scroll through.

I'm not really sure how this would even

work, um,

which is why it's a little bit confusing,

I guess.

Um, would this just be like, you know,

a link to someone's specific message that

they posted?

I'm not super,

it's not super clear how this would, um,

actually work.

But again, um, like what,

like you read from the article,

it said more than sixty three thousand

servers would be

discoverable.

So maybe there is a lot of information

in there that is really important that is

going to be good that it's listed on

Google, I guess.

Yeah.

Um, in my experience,

you can link directly to a specific

discord message.

I think that's usually something you have

to turn on the developer options to

access.

I could be wrong about that,

but it is possible.

So that's probably what they'll,

they'll do.

But yeah, I, um,

I don't know.

I have mixed feelings because I am

frustrated that there are so many,

even in the privacy community,

there's so many places now that are using

Discord for tech support,

mostly because of Discord's privacy issues

and now their age verifying everybody and

all that crap.

So I'm kind of not a fan of

that, but...

Yeah, I don't know.

Personally,

I think the fact that it's just the

big opt-in communities I think is a good

start, at least.

Because when I first read it,

I thought it was like,

anyone who's set to public, and I'm like,

oh no, oh no,

this is going to be so bad.

And then when I read that, I'm like,

oh, well,

that's already going to weed out millions

of servers, so...

yeah RL says I wish just I use

discord with my cycling league for comms I

wish we could go back to something like

ventrilo but I'm dating myself yeah man I

miss IRC I miss the good old days

but I don't know that's that's all I

got on that one so

Yeah, that's fair.

I think it's definitely Discord.

As much as people will crap on Discord,

there's really not that many good

alternatives.

I feel like Fluxer is, at this point,

one of the better alternatives to it.

Again,

it doesn't fill every single niche that

Discord has, but it's pretty close.

It's pretty close right now.

So definitely keeping an eye on Fluxer.

We've been testing that

for a beta community for a little bit

now.

And it seems to be going quite well.

A lot of activity over there if you

want to join that.

I guess I can like shout out our

Fluxer link.

It's fluxer.gg forward slash privacy.

So if you want to join that,

go ahead and do that.

But I guess we can jump right into

the next topic we have here.

And this is a forum discussion again on

discuss.privacyguides.net.

And this was a discussion about

basically the differences between Linux

GUI versus CLI updates.

So the person was basically saying,

I'm not sure whether I should use the

software GUI to update my Linux apps or

the terminal.

The GUI includes RPM and Flatpak updates.

If something like the kernel gets updated,

it requires a restart.

That results in a special installation

screen that I never get if I update

with the command line.

The GUI doesn't include snap for some

reason.

If I want to update it,

I have to use the command line.

What is better for updating?

I'm on Fedora, by the way.

For the case, it's important.

So...

I think this is one of these things

where it is entirely personal preference.

I think, you know,

there's obviously benefits and downsides

to either of these things.

If using Fedora,

it actually uses the service called

package kit D,

which does automate some of the

installation and update process.

But again, it is kind of a heavy,

more heavy application that requires more

computing

speed to basically keep that running in

the background and checking for updates

and updating stuff.

So that is the reason that, you know,

Fedora uses that is because it makes it

easier to update programs in the

background and

manage updates through GNOME software.

So if you're installing apps through GNOME

software,

it should be a relatively painless

experience.

My only reason for not using the GUI

interface is that it can oftentimes have

issues that you wouldn't have if you're

using the CLI version, which is, I guess,

an interesting...

It's been less of an issue recently.

I think they've definitely fixed a lot of

the issues with the GUI installation and

stuff,

but there's still sometimes hiccups with

that that don't really exist with the CLI.

Someone replied and said,

Fedora Magazine at least says to stick to

the GUI and restart every time you're

prompted for security and stability

reasons.

Another user suggested making a script you

could easily run by typing update in the

terminal.

And I guess this is kind of where

I share my personal thoughts on this.

I just don't like using the GUI for

anything.

I'd rather use the CLI for basically

everything.

Managing everything is so much easier in

the terminal.

In my experience, again,

it is one of these things where if

you prefer using a GUI interface for doing

this sort of stuff,

then I think stick to that.

Stick to what you're used to.

And if it works, it works.

I wouldn't try and force any specific tool

for any reason.

You can just...

use what you're comfortable with.

And I think all the discussion here has

been pretty non-judgmental at least in

this thread,

which is great to see from our community.

Yeah, I'm with you.

I think it's really personal preference.

I also prefer the CLI just because I

think you read it.

Somebody here pointed out that like

sometimes it has met.

Actually, first I need to point out,

he's like,

if something like the kernel gets updated,

it requires a restart.

The results in a special screen that I

never get if I use the command line.

Who are you serial killers that don't

reboot your devices?

But yeah, I don't know.

That's just weird to me.

I shut everything off when I go to

bed.

Like, okay, it's bedtime,

shutting my computer off, going to bed.

That's just me personally.

But yeah, I agree with you.

Like if something doesn't install from the

GUI,

and it depends on what kind of GUI,

obviously,

but if something doesn't install from

there,

usually it's just like installation

failed.

And it's like, well, that's not helpful.

But if, like they pointed out,

if you do it from the command line,

it'll say like, oh,

you're missing this dependency or like you

don't have this permission or something.

And then you can kind of dig in

and be like, wait, why isn't that working?

So yeah,

I prefer the CLI and it just looks

cool.

Like my wife has literally sat there and

watched me run updates before just because

she thinks it looks cool.

So yeah,

I'm a big fan of the GUI or

the CLI.

But yeah, if anybody has any other,

if there's anything we missed,

definitely let us know if there's any

third option that was not brought up

somehow, but.

I think with that,

it's time for us to move into our

big,

exciting story that everybody's been

waiting for.

Yes.

All righty, y'all.

Let's do it.

Let's talk about Proton.

All right.

I get to take this one,

so buckle up.

All right.

I'm going to try to start from the

beginning here because this –

This isn't really like essential to the

story,

but it is kind of some additional context.

And this is also why we didn't make

this the headline story,

because it didn't really completely

escalate off the rails until about

yesterday.

So it started earlier this week with this

article from Forofior here that says

Proton to re-interview staff about AI to

see who gets to keep their job.

I am logged in,

and I don't know if that's a paid

article,

so I'm going to switch back to this

one real quick while I scroll down.

To me,

the part about this that I thought was

really concerning,

so I'll read the first couple paragraphs.

It says Proton told staff on Monday that

it would be re-interviewing staff across

the company about how they use AI in

their jobs,

with the implication that the interviews

may decide whether they have quote-unquote

continued employment,

according to an internal email obtained by

A part of the email reads,

these re-interviews are consequential.

Interviewers will document their

assessment,

which will inform the broader review of

our organization and talent.

That review may lead to changes in role,

responsibilities and continued employment.

Individual outcomes will be communicated

directly once the decisions are finalized.

So this kind of is where the pushback

started.

I mean, there's always pushback on Proton,

some of which is well-deserved.

But this is kind of where the pushback

started because people were kind of like,

this sounds like you're basically going to

fire anybody who's not all in on AI.

And Andy went on Reddit and said, like,

no, that's not true,

to which a lot of people pointed out.

It's like – pardon my language.

I know I curse sometimes without meaning

to,

but here I'm going to do it for

effect.

A lot of people responded.

It's like, well,

then what the fuck was the continued

employment line?

Because that sure sounds like to anyone

who can read English that that's –

you know,

says what it is on the tin.

Um, so yeah,

I don't know what was up with that,

but, uh, while that was being debated,

we got, um,

treated to this wonderful article that

I've got on the screen here, which, uh,

at the time I'm recording is still public.

So I'm going to go ahead and scroll

this one.

Um,

and the headline for anyone listening on

audio says manifestos fear and quote

unquote, loser thinking inside protons,

AI reckoning.

Um, and,

This is a very long article,

and I'm going to try not to read

all of it.

Andy N., the CEO of Proton,

had a message for an employee in the

company's security Slack channel who urged

the company to at least take a few

days to pen test newly written code before

pushing it live.

Quote, that's bullshit and loser thinking.

Of course,

it's possible to be fast and secure.

And in a follow-up message,

he said only losers think like that.

And his ultimate message for the team was,

quote,

to stop lovingly handcrafting all our code

and use AI more.

which I'll circle back to that part.

That exchange was just one of many that

showed how Yen and other company

executives are aggressively pushing Proton

towards AI.

In the last few, let's see here.

You know what, I apologize,

but I'm just gonna switch to my notes

where I picked out, because like I said,

this is a really long article and I

kind of picked out the important parts.

So Proton,

and there are updates for the record that

are coming out, like I said,

as we are streaming,

there are updates coming out.

So according to the article,

Proton installed software on workers'

computers that track how much AI code the

company is generating.

And Yen said this is the last year

that Proton will hire engineers at all and

instead only hire people to build things

with AI.

For For Media spoke to eight current and

one former Proton employees and reviewed

Slack chats, meeting records,

An AI manifesto and an AI manifesto

written by the company's CTO.

Our reporting reveals a culture of fear

deep inside Proton where many employees

are hesitant to even mildly critique Yen's

views or discuss engineering problems.

Workers describe an environment where

employees have genuine concerns about

security or being asked to develop

security products with AI.

uh but feel unable to voice them lest

yen berates them in front of everyone and

threatens their employment at the company

in response to detailed questions from

four or four media a proton spokesperson

did not dispute our reporting or

characterization of what's happening

inside the company they said quote it is

clear that some people at proton are

unhappy with our direction or

misunderstand it and many people are

anxious in our determination to move fast

we have sometimes been too blunt or too

slow in explaining ourselves to people we

will work on that as their questions are

the ones we need uh we most need

to answer

uh they said in and this is just

kind of giving some examples they said in

may proton announced that it was

implementing post-quantum cryptography

which should protect against future

attacks from quantum computers the work

took years of effort with the caveat that

it would not work on older emails only

those written after the features launch at

least for now yen was not happy with

that proton drawing attention to this

limitation in a slack channel dedicated to

thanking people for their work yen jumped

in quote get it fixed

Now Reddit is pissed and we look worse

than Tudor.

When employees explained to Ian the

nuances of encryption and why that was not

immediately possible, he replied, quote,

I find this whole thing stupid.

You cannot announce this in this way.

In the future, there are two options.

Either you guys are confident enough to

not fuck this up or you get my

advice to make sure it is not fucked

up.

He then told a member of the team

to go on Reddit and start responding to

comments.

And he went on to say,

go there with your personal account and

comment to set the record straight.

Perception is more important than truth.

The truth doesn't matter if you don't win

on perception.

Sorry, this is hard to read.

This is still a quote from him in

a different context.

The train is coming,

get on board or get crushed.

Don't be the professional fax machine

operator in the internet age.

I think by the end of the year,

most developers stop programming and start

writing specs for tests that AI will code

and run to validate AI code written that

humans will no longer be able to be

reviewed or will be able to review.

This will be the last year that we

hire engineers and starting next year,

we hire what we used to call product

managers to build things with AI.

Proton CEO or CTO said that Proton needs

to change in three key ways,

except that an engineering job is now to

help LLMs write better code faster,

that Proton needs to get to the point

where code is not being reviewed by

humans,

but by AI and to more fundamentally change

the company as a whole and quote,

commit as an organization to the

transformation that the moment requires.

I love corporate PR speak.

Uh, earlier this week,

Proton sent the email to employees saying

that they would re-interview workers about

how they use AI in their jobs.

The tone was clear.

You may lose your job because of these

interviews.

Um,

Yeah, so... Yeah.

Again, love corporate speak.

The company's year over year growth is

quote,

far away from what the market considers to

be good, unquote, and quote,

by all metrics that matter,

we're an underperforming company.

Sorry, I have a lot of opinions.

Second,

the document says that Proton is

transitioning to an AI-first company.

Excuse me.

Second,

the document says Proton transitioning to

an AI-first company,

and that's also in quotes,

requires additional time and effort before

it will start to see efficiency gains.

For around six months,

Proton has been in an experimental phase

with AI,

but now the company is taking concrete

steps to restructure the company around

AI, according to meeting audio,

and in another meeting, if,

A Proton employee said they do not trust

Andy's judgment on highly technical

choices.

In another,

even the CTO said that Yen doesn't

understand the technical points about AI

topics he's re-interviewing people on.

A few updates.

This came out like right as we started

streaming.

Apparently,

Andy has canceled these re-interviews.

And let's see.

Jordan,

do you want me to read off this

Reddit post or do you want to take

this?

Because I still have not fully had time

to read this myself.

Yeah, all right.

I can give this a little bit of

a read here.

This one is from Andy's personal account

on the Proton Mail subreddit.

It's titled, A Message to the Community.

A lot of you probably don't want to

hear from me right now,

but I spoke to the Proton team earlier

today,

and you also deserve to know what was

said because I've let you down too.

First of all,

I take responsibility for the failure of

communications that has led to such

uncertainty, confusion,

and hurt within the staff.

We'll be bringing in internal

communications lead

to help keep this from happening again.

Anyway, more personally,

I shouldn't have said some things that I

did to the people who helped build this

company.

They were hurtful.

I'm sorry,

and I'm determined to do better.

I want to address some points that have

raised concerns.

First, the re-interviews, in quote,

that have been publicly discussed will not

take place,

and no one will lose their jobs because

of them.

So that's good.

Second,

Proton does not install tracking software

on employees' laptops to measure how much

AI-generated code they produce.

This is false and stems from someone's

misunderstanding about AI.

mdm software works but most importantly i

need to categorically state that our use

of ai will never be at the expense

of security in the past year contrary to

what has been alleged actually additional

layers of security review have been added

to meet the threat posed by hostile ai

scanning protons open source code for

vulnerabilities fast and secure

need not be mutually exclusive.

We also leverage AI to find

vulnerabilities in our own code before

attackers do.

Our code is open source and its security

mains open for all to verify.

I recognize the burden of proof.

This is about, sorry, I recognize

that the burden of proof about this is

on us,

and therefore I'm recommitting to Proton's

deeply held belief in transparency.

We will lift the hood on how we

use AI internally at Proton.

This includes publicly releasing and open

sourcing several of the internal tools

that we use,

including more advanced versions of LUMO

with greater capabilities,

which have never been made available

outside of the company.

We will also publish how code reviews and

security reviews at Proton

are done and detail our AI policies,

including where AI is permitted,

where it is not, and our rationale.

Instead of just being able to see the

final open source code that we produce to

verify security,

third parties will be able to assess how

that code is produced.

Even if we wish it wasn't,

AI is here and it unquestionably change

how software is developed forever and

Proton must also change.

But we're committed to proving to you that

we're doing it in a responsible and safe

way.

The past few days have been humbling to

say the least.

When you see your words reflected back at

you all at once,

you can't help but see yourself in a

different light.

I've made mistakes,

but I will learn from them.

The coming days, weeks, months,

and years will be difficult,

not just for us,

but for all the people who'll be impacted

by the changes brought on by AI and

automation.

Proton will not go the distance with an

army of agents,

but with an army of smart,

thoughtful people who can care deeply

about our mission, our users,

and this community.

So interesting to see here.

The community is not enjoying this.

It's currently sitting at zero upvotes.

So it's majority negative perception so

far.

Again, this is on Reddit.

So it's not really that surprising.

Two hundred and sixty eight comments.

And this has been posted three hours ago.

So rather a large discussion happening

here.

I think this is.

Definitely quite bad.

Some of the discussion topics in this,

I guess to throw this back to you,

Nate, does this change how we view Proton?

Do you think this might even result in

possibly getting them delisted at some

point if they can't actually hold true on

their promises here?

What does this actually look like?

Yeah, yeah, for sure.

I mean, that's the big question, right?

Like, that's what everybody's wondering.

I mean,

I have personal opinions on that apology.

I will say, I don't know,

I'm kind of mixed.

I kind of...

I think it's, I mean, yeah,

Sockhop said here, Andy's so full of it,

a blind man like me knows his eyes

are brown.

That's rough.

I don't know.

I think it's possible that maybe,

I don't know, man.

I mean,

to be as much of a jerk as

the article was painting him out to be,

unless that was like every single instance

of,

Because I could see how if that was

every single bad thing he ever said over

the course of five years,

I could see how maybe he didn't realize

that he was being kind of a dick.

I am a person who tends to skew

towards cynicism just in my personal life.

And I have also taken many years to

realize that I'm like, hmm,

I'm not always that fun to hang out

with and I should probably work on that.

But I also don't go around calling people

stupid or losers or bullying them.

Um, and, but it's, I don't know, man,

it's, I,

I guess we'll wait to see on,

on that front,

if he actually changes or not.

I don't know.

I don't know how we'll know.

Um,

I don't think he's going to start

publishing meeting notes or anything,

but whatever.

Um, as, as far as actual concrete,

cause like the, unfortunately,

an unfortunate reality of the privacy

space is that like,

this is my personal opinion.

Um,

Everybody kind of sucks,

to be totally honest.

I mean,

when we're talking about developers,

we've got like, you know,

Volvad has one of their CEOs donating to

Nazi parties.

Brandon Eich has supported very homophobic

causes in the past.

Mozilla's...

just completely out of touch with reality.

Like it's really hard to find any

developers that are like not a jerk in

some way, shape or form.

Even apparently this predates my time in

the privacy community,

but apparently even Linus Torvalds used to

be such an asshole that he basically got

pushed into exile and had to like go

to therapy and rethink himself.

And he still definitely has moments where

he snaps at people according to the

headlines I've seen.

So I don't know.

It's one of those things where like,

in my personal opinion,

if you only use tools from perfect people,

you're basically just gonna have to like

go live in a cabin in the woods.

um again that's just my personal opinion

that's my personal read on things so i

think objectively speaking putting him and

his behavior aside which for the record i

do think is unforgivable if we look at

the security and privacy of proton i think

right now there's not really i don't want

to say cause to be concerned there's

definitely cause to be concerned right now

proton is at this moment in time i

think still a very technically secure and

private project project

But if the picture that four Oh four

painted, which Andy disputes,

is this like,

we're going to stop hiring developers.

We don't want humans writing code.

Everything's going to be AI and like AI

can be very useful.

I've in the past week,

every tech thing in my stack has broken.

My pie hole broke.

My uptime monitor broke next cloud broke.

Peer two broke for me personally,

everything broke.

And honestly,

AI was really helpful at troubleshooting

those errors and figuring out what does

this mean?

What am I doing wrong?

Run this command?

What does it say?

So like, I'm not, again, me personally,

I'm not anti-AI,

but the idea of like taking the human

out of the loop scares the living hell

out of me.

Because even me,

as little as I know about tech,

there are times where I feed it into

the LLM, you know, the error code.

And it's like, oh, try this.

And I'm like,

that's definitely not the problem.

I know that's not the problem.

I know you're wrong about this.

And just this whole idea of like AI

checking AI and writing AI and AI all

the way down.

I'm like,

this is just asking for disaster.

So I think it really remains to be

seen.

If what he said in this updated statement

is true, if he's changed his mind,

let's put it that way.

If he's changed his mind and realized, oh,

I'm in the wrong here and I suck.

And he's like,

maybe we shouldn't take humans out of the

loop.

If that's the case,

and if they use AI as a tool,

I personally think that it still has

potential.

I know some people are very staunchly

anti-AI, don't want to use anything AI.

That's fine.

I'm not talking about that.

That's a very valid view to hold.

But in terms of like the technical

security,

as long as they don't take humans out

of the loop,

I'm not super worried about it.

But if he does take humans out of

the loop, I personal opinion,

I think it's only a matter of time

before they get delisted.

Like there's just no way.

I don't know.

Sorry, that was very long and rambly,

but yeah.

I think as soon as I heard that

Proton was working on an AI product,

I became worried.

As soon as I heard, oh,

we're working on Lumo, I was like, well,

I think my values are diverging from your

company.

I think this is clear that you're trying

to chase certain objectives that don't

align with mine.

Again,

this is probably the case for a lot

of people here as well.

If you're...

if you're not a big fan of AI,

you're not a big fan of developers losing

their jobs,

then of course this makes sense for you

to consider switching to something else,

right?

But I do think it's become one of

these issues where

I heard some people saying, you know,

I was thinking of switching to Proton,

but now I'm not going to.

I'm going to stay on Gmail.

It's like, well,

that's actually not really that good of a

decision.

I think you'd still be safer on Proton

because at least with Proton,

they're using AI.

They say there's some checks and balances

happening.

You definitely can't say the same for

Google.

They're using Gemini for everything.

They're using AI agents.

They're not testing the code properly.

I guarantee it.

So just keep that in mind.

I think basically at this point,

if you work at a company and you're

a software developer, you're basically,

everyone is using these AI tools to build

software at this point,

which kind of sucks because like we've

talked about in the past,

and like Nate said,

it can introduce security vulnerabilities.

We've already seen it happen.

It doesn't make the most secure code ever.

um it's kind of somewhat it needs to

be looked at at least by somebody um

and the amount of software developers i've

talked to that have just told me like

the code that ai produces is just bad

quality code it's just bad like i'm not

i'm not able to tell the difference but

i kind of trust you know if someone

tells me that i'm kind of trusting their

judgment that like you know the code that

it's producing is is low quality um so

i don't know i think this is

is very unpopular and very out of touch.

Like it's clear that they're kind of out

of touch with their community, right?

Like if we thought about this and,

you know,

we looked at the vision of the company

and we looked at the changes that they

were trying to make previous to all this

drama,

that didn't align with the vision of the

company, in my opinion.

And we did have a discussion question here

because Proton is owned by the Proton

Foundation,

which basically allows for

you know some other external members to

make decisions to basically you know if

something like this was to happen get Andy

removed or make a change in the company's

direction um so that is one of these

things where you know we can urge the

Proton Foundation and the people that are

part of it to actually make a decision

and as far as I'm aware that um

There are people on the actual – on

the board who have, like,

executive control over the company that

Andy can't actually –

reject basically.

I'm sure they're all quite good friends

and all, but, you know,

I think it's important that they do have

this foundation.

It should be in place for circumstances

like this.

And I will say the behavior that I've

seen from Andy does not come across as

somebody that should be leading a company.

As a leader,

you shouldn't be berating people for their

their contributions.

You shouldn't be calling them a loser.

This is all not characteristics of someone

that should be leading a company.

This is characteristics of someone who is

someone that has basically built this

company from the ground up,

but that doesn't mean that they deserve to

be the CEO and they deserve to lead

the company.

They just built it from the ground up.

I think it could be

a good consideration to actually you know

bring in someone who actually has proper

experience leading an organization of this

size at this point because it is a

lot bigger than a tiny little startup in

in two thousand and fourteen at this point

this is a massive company with you know

employees across all different continents

at this point so i'm not sure if

andy is actually capable of leading a

company like this considering the behavior

that we've seen from him from internal um

communications so

I think that it could be a good

decision from Proton to actually consider

removing him from the organization

completely because, again,

it keeps on happening.

We keep having issues with Andy that keep

coming up and he keeps having to

apologize.

It doesn't inspire confidence in the

company.

And I'm sure a lot of people would

also have the same issues with his

behavior that we've now seen.

Yeah, it's funny.

I actually,

I was looking through Reddit and the

second comment was that.

Yeah, and that's why I like,

I do want to allow,

and this is just me probably being a

little too open-minded.

I do want to allow some people

possible,

like tiny possible room that maybe this

reporting is wrong because reporters

aren't perfect, you know, but it's, yeah,

I have a hard time imagining.

Cause again, like I've snapped at people.

I get it.

I'm sure that being CEO is very stressful,

but I've never like called somebody

stupid.

And I've, I've never like,

and even when I do snap at people,

I always come back to them later.

And I'm just like, Hey man, I'm sorry.

I snapped at you.

Like I was really stressed.

I was hangry, whatever.

Like I, I'm, I shouldn't have done that.

I'm sorry.

And like nobody in there, again,

unless like four or four has an agenda,

like nobody in that reporting was just

like, well,

he did apologize to me later after the

meeting was over.

It's like, nobody said that.

And it's, yeah, it's just, and it's,

it's the fact that like,

The CTO also is like...

There were other quotes in there that I

left out where somebody called out the CTO

and was basically like,

maybe you shouldn't threaten people's jobs

on a Friday afternoon.

That's not cool.

And the CTO was like, well,

you should reread what I wrote and come

back on Monday with questions.

It's basically what he said.

And it's just like...

Damn,

like the whole leadership seems toxic

there, which is not great.

And then again,

that whole thing about like, oh,

we're not meeting profit benchmarks.

Like,

I don't care if you meet profit

benchmarks.

I want you to be profitable because I

want you to exist in twenty years.

But like,

I don't care if you're the next Fortune

five hundred company.

That is not what your goal should be.

And yeah, so.

I think I'm going to take some time

this weekend and, um,

email the proton foundation.

Um, they do have a,

I didn't scroll down to it,

but they do have a contact us by

email thing.

Um,

I might try to track down their personal

websites and email each of them

individually.

Um, you know, or whatever,

like their individual websites are.

Cause like, yeah, this is just like,

this is a leadership problem, dude.

Like you can't, it's not just about the,

like,

actually let me find that comment again.

I'm ready.

He said, um,

He said, ex-global head of software here,

anyone speaking to employees the way you

do is not fit to lead people.

It has nothing to do with style of

communication or something you can fix by

bringing on a communications lead.

It's you.

You can either take responsibility, no,

this isn't it,

and do what's best for the company or

keep leaving the company and its customers

are your means to an end.

And he said,

this opinion has absolutely nothing to do

with AI.

And if you believe the pushback you're

getting is only due to that,

then you haven't understood the real issue

with your actions.

So yeah, it's like...

It's the same thing.

He said, I take responsibility for that.

Do you?

And that's why I want to allow a

little bit of room here.

Does he actually see, oh man,

I'm the problem.

And if he does, then okay, cool.

But I don't know, man.

It's going to take time to see if

he really does.

If he really understands that he needs to

change.

And if he's really going to... Yeah,

I don't know.

It's...

I also want to point out a few

people in our supporter signal chat have

noted that this almost read like an

advertisement.

Where did it go here?

Proton CEO responds to people crapping on

him for using AI.

We're releasing a better AI model.

It's just, yeah.

Somebody said here,

doesn't Yen also own a huge share of

Proton?

I don't believe so.

I believe when they restructured...

There's a blog post about it that I

skimmed a little bit earlier today.

But I believe when they reorganized into a

foundation,

the foundation now owns fifty one percent

of Proton.

So they have the controlling share.

However,

there's five people on the foundation and

I know that at least two of them

are Proton employees.

So I'm not sure what their bylaws are.

I'm not sure what the recourse is.

But yeah, this...

I feel like somebody needs to put this

guy in check,

but I do want to go back.

Somebody earlier towards the beginning

asked about what are the alternatives

besides Tudor?

I don't have any issues with Tudor.

I use Tudor.

I love Tudor, but I think, yeah,

I think we've,

we've kind of talked about the issues

enough unless there's anything else you

wanted to add,

but maybe we could talk about if anybody

does feel like, Nope,

this is the last straw I'm out.

Where do we think people should go?

I know we do have recommendations on our

website for sure,

but are there any off the top of

your head?

Yeah, I think like you mentioned, Tudor,

but also just like, you know,

I've seen a lot of comments to this

and like people saying like, oh,

I was on Gmail and I was thinking

about switching to Proton,

but now I'm going to stay with Gmail.

It's like, please, come on.

That's silly.

That's a silly decision.

Please don't do that.

Yeah, real quick.

I totally agree with you that one,

because if even if Proton is this bad,

I guarantee you Google's worse and it

doesn't have the encryption.

So, yeah, I don't know.

I don't know why you would stay there.

Sorry, continue.

Yeah,

let's not be silly and let's not stay

on Gmail because of this, right?

Don't use this as an excuse to just

sit on Gmail forever.

There's way more issues with Gmail.

Like we talked about literally first,

this episode, we talked about it,

the first story.

Please, like...

proton foundation does control it but also

he still has chairs of his own jonas

said okay that's good to know i think

from what i read though the proton

foundation has one member who has um veto

power i believe so even if andy um

didn't want that then i'm not sure i

didn't like fact checked that exactly um

but i did see someone um posting about

that

Again, though, as we're saying this,

this is all breaking news.

This is all happening within the last

couple of hours.

So take that with the grain of salt

that this is.

It's a breaking story.

We don't have all the details at this

point.

And again,

I'm sure more things will come out as

we're keeping on top of this.

But it will be interesting to see how

that pans out.

Again, though,

going back to alternative services,

when it comes to privacy guides,

we do only recommend...

three different services,

and that's ProtonMail, TutorMail,

and Mailbox.org.

So basically your two other options are

Mailbox.org and Tutor,

which unfortunately don't really come that

close compared to Proton in a lot of

ways, I think.

There's still a feature gap between those,

but

I personally would give a mailbox or tutor

a try.

It's free to try it.

So definitely dive in and give them a,

give them a test to see if it's

something that could replace proton for

you.

But I think it is one of these

instances where, you know,

proton has a lot of good features,

they're good products,

and it's kind of hard to, uh,

to want to switch when they are still

objectively one of the most feature rich

products in that category.

Um,

at least when it comes to privacy and

security.

So it is definitely a tricky decision for

people to make.

Yeah, I also want to mention real quick,

because Proton,

I'm sure a lot of you know,

Proton does a lot more than email.

And all this is on our website real

quick,

so I'm going to blow through this really,

really fast.

But for office suites,

we recommend LibreOffice.

We recommend OnlyOffice.

For VPNs, we recommend Moldad, IVPN, and,

of course,

Proton if you're trying to move away from

them.

I'm kind of tempted towards IPPN right

now,

just because I love their feature where

when you leave the house,

the VPN automatically turns on.

That is one of my favorite things about

IPPN.

And of course, Tor browser,

if you have a very high threat model,

you should not be relying on a VPN.

For password managers, we have Bitwarden.

We have one password.

We have Persona,

and we also have KeePass and all its

various clients.

Let's see, email aliasing,

the only other one we recommend.

SimpleLogin is technically owned by

Proton, so there's addy.io.

Actually,

I did an email aliasing tier list video

a while ago,

so you can go check that out.

Cloud storage,

we have ProtonDrive and Tresorit and

Pyrgos.

And what else?

Photo management.

We only do NT is the only one

we recommend.

Um, proton technically does that.

Somebody asked a minute ago about AI

chats.

Um,

we do have a couple recommendations for

that.

Um, mostly offline stuff.

Um, Kobold, Oh, Lama, Lama file.

Um, I admittedly,

I was using Luma a little bit just

because I'm trying to use the Mulvad

browser more.

And, um,

I mostly use either Leo or Lumo.

And I was like, well,

if I use Lumo more,

at least I can get off Brave Browser.

But honestly,

I've always felt like Leo was more high

quality, in my opinion,

as far as online chatbots go.

That's not like an official

recommendation, obviously.

But yeah.

And then for two-factor,

like Jordan said earlier, NTOth or Aegis.

So...

Yeah, again, that's all on our website.

I know I blew through that pretty,

pretty fast.

So just wanted to make sure we threw

those out there.

So what else did we have here?

Mr. Spoon said,

mainstream non-privacy competitors have

much more controversy.

Yeah,

it's kind of agreeing with what we were

saying.

It's like,

why would you stay on Gmail or something

like that right now?

Apparently somebody in four Oh four,

one of the proton devs said not much

could have happened due to yen having the

majority of protons shares.

Yikes.

I hope that's not true.

And, uh, yeah.

I think there's actually one more thing I

wanted to throw out there.

If we have just a second,

where did it go?

There it is.

So this is something I've seen floating

around.

If you guys kind of want to like

spread the word,

how do I get it up here?

I closed too early.

It's called molecule dot build.

It's from some of the people who work

at proton and they're basically trying to

get their,

their fellow employees to unionize to have

a little bit more,

safety over speaking up and being like,

hey,

I think this is a bad idea and

not being retaliated against.

So yeah,

feel free to check that out if you

guys are interested in that.

So yeah, DuckDuckGo has AI.

Some people said Duck.AI has been solid

enough.

Yeah, I think it's kind of important,

though, for this unionization to happen.

I was personally like, you know,

when I saw this story breaking,

I looked into Switzerland's labor laws

and, you know,

are they allowed to re-interview and ask

about AI and then fire you because of

that?

And the answer is yes.

They don't actually have to have a reason

to fire you in Switzerland.

So, yeah.

That's the thing that you need to know,

I guess.

Kind of crappy, I guess.

That's definitely not the case in a lot

of places.

So that's another reason why they should

be trying to do that.

I think it's kind of inevitable that a

lot of companies are pushing AI tools and

forcing their employees to use them.

But again,

Proton is a company that is supposed to

be, supposed to be,

alternative to big tech supposed to be not

doing these things that crappy big tech

companies are doing but they're dumping

i'm gonna assume tens of thousands of

dollars into claude tokens and like chat

gpt open ai tokens like this is it

doesn't feel like the greatest use of the

money that they receive from users right

if they're dumping a bunch of this back

into big tech they're basically just

being big tech at that point.

You're just funneling money back into big

tech.

It doesn't make that much sense.

I think if we were to,

let's say if we were to be completely

fine with AI, like a hundred percent fine,

all right, cool, AI, using it.

you would want them to not be dumping

the money into Claude or into OpenAI.

You would want them to be using something

internal,

which at least they've acknowledged is

something that they seem to be moving

towards possibly instead of using these

big tech AI models.

Again, though, it doesn't feel great,

especially when you're paying a lot of

money to pay for Proton.

It's not a cheap service.

You're paying a lot of money.

You're wanting a premium service.

You don't want your money going to

something that is

um somewhat unethical like you know giving

tokens to to Claude and stuff um Jonas

says well tens of thousands of dollars of

tokens is probably like nothing could be

more yeah literally it could be five

hundred thousand dollars of tokens like

that's barely anything at this point right

um I see people going through you know

literally millions of dollars of tokens um

and it's it's it's ridiculous so it is

uh well let's hope that they're not

spending up five hundred thousand dollars

on tokens but it's certainly possible

because that definitely does happen at

lots of uh software development companies

so um again though that money being

funneled back into big tech is like it's

kind of antithetical to the entire mission

which is kind of frustrating um

Yeah,

a couple of people mentioning here things

about like, you know, different AI tools.

Do you want to maybe talk about those?

Have you used either DuckDuckGo or Ecosia?

I haven't.

DuckDuckGo is basically,

from what I understand,

it's basically just a proxy for like chat

GPT and stuff, which I mean,

to their defense, they say that they like,

I know I already said proxy,

but they kind of proxy it.

So like,

OpenAI gets some of your queries,

but they don't necessarily get all the

metadata around it,

and they're not supposed to train on your

queries and stuff like that.

So yeah,

it's definitely better than Firefox,

for example, where it's like,

we have an AI integration, and it's like,

this is literally just a bookmark to chat

GPT.

This is freaking useless.

Can't resist taking a shot at Mozilla when

I can.

So yeah,

but I've never used it myself because

again,

there's like Leo where they say like we

host it on our own servers.

It's, you know,

I think it's supposed to be encrypted at

rest or something like Lumo is.

But it's from what I understand,

it seems like it's much more privacy

preserving for the end user.

And again,

I found the accuracy to be pretty good

on Leo.

So I really like that one, but yeah.

I don't know.

I, again,

I also don't use a ton of AI.

I mostly just use it for like when

I'm troubleshooting a technical issue and

I feel like it's really good at that.

But then like everything else, it's like,

like I've experimented with it in the past

about like, write me a blog post.

And it's like,

this doesn't sound anything like me.

This is whack or, you know,

write me a script.

And it's like,

this definitely sounds like an AI script.

So I kind of don't use it a

ton just for complex questions about,

you know,

if I go to search engine and I

look something up and it's like,

Like, actually,

this is a really good – this headline

story, Gmail.

It's like Gmail originally promised that

they weren't going to train on your data.

Not originally,

but they said that in twenty seventeen.

And I couldn't remember what year it was.

So I went to a search engine and

I was like,

Gmail promises to stop training on data.

And of course,

all the articles are from this week about

this story.

And.

In this case,

it's easy enough to just go up and

set a filter and be like, okay,

give me everything before the start of the

month.

And that surfaced it.

But sometimes I ask a question that it's

like, no matter how I word it,

all I get is like SEO crap or

unrelated crap.

And those are the moments where it's like,

okay,

I'm going to go to the AI and

I guarantee you,

it's going to find exactly what I'm

talking about.

Nine out of ten times it does.

So I try to save it for that.

But yeah.

I was looking through Andy's personal

Reddit account because I was like, oh,

I wonder if he's posted any more

responses, actually.

And he did,

and he got completely lambasted in the

replies yesterday,

which I really want to quickly cover what

he said because I feel like it is

kind of important.

Again,

he said in the post today that he

was sorry about his actions, but...

The other day,

he actually said in a response to,

let me just read the quote first and

then what he responded with.

Andy Yen, the CEO of Proton,

had a message for an employee in the

company's security Slack channel who urged

the company to at least take a few

days to pen test newly written code before

pushing it live.

The quote itself is,

that's bullshit and loser thinking.

Of course,

it's possible to be fast and secure.

Yen wrote in the channel at the end

of August.

And then another quote, stop thinking...

are always of how to be slower and

focus more on how to be faster.

Here's a reply to this

to this quote was actually happy to,

basically they, someone said,

assuming this is true,

this is some Elon level BS.

And someone responded to that,

Andy responded to that saying,

happy to answer actually,

since the quote above was taken out of

context.

I'm not really sure how you could take

that out of context.

Like that,

just the fact that you said that is

kind of concerning without any context

added to that.

That is already concerning like behavior

to talk to your employees.

Proton today does way more security

reviewing than we've done at any time in

the past with the proliferation of AI

tools.

Our code is also under more third-party

scrutiny than ever before.

Basically, he said, however,

several extra days of human review is not

the correct way to confront this challenge

of AI scanning of code.

We still have human review,

but now augmented by AI.

It has been exceptionally good at finding

vulnerabilities in code.

Sometime now Proton has also been using

unaligned models with custom skills to do

a thorough review of our code.

This approach is better and also faster.

Yeah, anyway,

also if there's no context there,

maybe he should have provided it.

Why would you say this to someone

your company this is not a professional

way to to operate um so yeah just

just really really unfortunate stuff from

from andy i'm just not really i'm not

really enjoying his responses and i really

think he needs to just log off um

like just please stop you would appreciate

though that uh somebody replied to this on

reddit and said your response is bullshit

and loser thinking

I mean, it's on Reddit.

I think that's fine to say on Reddit.

But if you're talking to an employee,

then, you know,

maybe he should have provided it, Lamao.

Yeah, I mean,

what is the context for saying that to

somebody?

Like that is like already by itself

without any context, very concerning.

And with context,

what is the context for that?

Like seriously,

it's just really concerning when you see

someone who's supposed to be leading a

company.

And, you know,

saying this sort of things to your

employees is really concerning.

I think, yeah, anyway,

I just think this is kind of falling

apart and showing that, you know,

maybe Andy being in charge of the company

is not really working out too great.

We keep seeing issues with him making

posts and people just really,

really not liking it.

So something needs to change.

Something definitely needs to change.

Yeah.

Yeah, for sure.

I, um, I don't know.

I just,

I feel like it's a whole leadership thing.

It's not just Andy.

Cause again, there was the CTO.

Maybe it's just the two of them,

but I don't know, man.

I, it's a, it worries me.

It worries me for now.

I'm not, I mean,

I'm already mostly off proton.

I do still use the VPN.

Um, but I'm not, uh,

feeling super great about their future,

but we'll see.

We'll see what happens, I guess.

Excuse me.

Yeah, I don't know.

That's all I got for this week.

Kind of a bummer to end on,

but anything else?

Yeah, definitely a bit of a bummer.

I guess we have some questions here.

I like Firefox,

but I wouldn't use them if they didn't

have a furry mascot.

I mean, yeah,

that is one of the benefits of Firefox.

They have a cute mascot,

but I feel like that can only take

them so far.

Really need to see some better stuff from

them.

But yeah,

I'm not seeing any other questions here

from anybody.

So we're going to head out into the

outro.

This week.

So all the updates from this week in

privacy will be shared on the blog every

week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

We also offer a podcast available on all

podcast platforms and RSS,

which now includes video on supported

platforms.

And this video will also be synced to

PeerTube.

Privacy Guides is a impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

then you can make a donation on our

website at privacyguides.org slash donate.

You can also make a donation on any

page on the website by clicking the red

heart icon located in the top right corner

of the page.

You can contribute using standard fiat

currency via debit or credit card or opt

to donate anonymously using Monero or with

your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content,

exclusive video content,

and priority during the This Week in

Privacy livestream Q&A.

You'll also get a cool badge on your

profile in the Privacy Guides forum and

the warm,

fuzzy feeling of supporting independent

media.

Thanks for watching and we'll see you next

week.