Hi, folks,

we got a lot to talk about.

Claude's source code was leaked.

LinkedIn scrapes your browser extensions.

There's a horribly insecure messenger app

going around and more.

All this and more coming up this week

in on this week in privacy number forty

seven.

So stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

in the PrivacyGuides community and this

week's top stories in data privacy and

cybersecurity.

I am Nate,

and joining me again this week is Jonah.

How was your week, Jonah?

You know, my week has been pretty good,

thanks for asking.

Besides misspeaking during the intro

there.

Can't complain.

A lot of these things happen, right?

Yes, yes.

All righty.

Yeah.

I guess with that,

we'll jump right into our headline story

this week.

And you guys have probably heard about

this one.

So there's an AI called Claude,

Claude Code specifically,

because there's a few different kinds of

Claude.

I'm not a heavy AI user myself,

so I've heard that Claude is one of

the better ones in terms of the results

it puts out are mostly accurate.

It puts out mostly good code.

That's just what I've heard.

You could do a lot worse than that

one,

but we're not going to talk about that.

We're here to talk about the fact that

Claude code had its source code leaked

thanks to some human error.

To clarify,

this is the source code for the app

itself, the Cloud Code CLI,

not like the models or anything like that.

But it still gives us a little bit

of insight into what's going on under the

hood.

And...

I guess I'll go over it a little

bit, but I'm also mostly going to,

I mean, we're a privacy podcast, right?

So we're going to focus mostly on the

privacy and security stuff.

But just to kind of give you a

little bit of a recap.

So this happened because when they

published the newest version of the NPM

package, there was a source map file,

which I'll be honest,

that's technical stuff that goes over my

head.

But basically it allowed clever people who

noticed it

to access the source code.

Like we said,

it was almost two thousand TypeScript

files and more than five hundred and

twelve thousand lines of code.

I saw somebody else round up to five

hundred and thirteen thousand.

So, yeah.

I mean,

it's one of those once the cat's out

of the bag things, right?

Or once the horse has left the barn.

Because everybody quickly went and

downloaded this,

and there's other repos are springing up,

which we'll talk about that in a second.

Anthropic tried to get some of them taken

down with a DMCA takedown,

a copyright thing, basically.

unrelated we're not going to talk about it

but you know there was a whole uh

like github interpreted that dmca

according to the the official story github

interpreted that dmca a little harshly and

took down even things that were not

supposed to be taken down but yeah it's

it's been a whole thing um

So I've also seen some pretty polarizing

takes here because I think it was this

article.

Yeah,

this article said that its sophistication

is, quote, both inspiring and humbling,

according to some people who looked at the

code.

I saw some people on Mastodon look at

the code and say that it was pretty

sloppy and kind of shocking that it was

so bad.

But I mean, to be fair,

Mastodon tends to be a pretty anti-AI

crowd.

So I don't know who's telling the truth

there, but.

Yeah.

So, and then real quick,

before I jump into an analysis part,

we have like a follow-up to this story

that's related that says,

Clawed code leak used to push InfoStealer

malware on GitHub.

And this one comes from Bleeping Computer.

Basically, once the leak was out there,

a lot of people started...

putting up their own GitHub repos where

they would advertise that this was cloud

code with all the paywalled stuff removed,

basically.

So free premium cloud code.

And they would game the SEO to make

sure that it would show up in the

front.

If y'all are watching the video,

you can see here,

this one outlined in red is like the

third result from the top on Google.

And this is one of the malicious ones

that the article focused on.

And yeah, turns out, shocker,

it includes an InfoStealer malware.

I'm going to go out on a limb.

The article didn't say this,

but I'm going to go out on a

limb and say that it did work once

you fired it up.

Because usually that's how it is, right?

It works,

so you don't think anything's wrong.

But when you install it,

it's actually got that InfoStealer in

there.

And they said that there were multiple

repos like this.

So...

yeah so um cyber security takeaways from

this the we're covering this as a headline

story partially because this is a really

big story going around right but there's

there's a couple reminders here um one of

them is as far as the uh the

repo thing goes you know we we always

talk about making sure you get things from

an official source and um not not to

go too far out of my way to

pick on google here not like they don't

deserve it but uh you know we've been

covering a lot this whole google side

loading story and you know google

is trying to act like, oh,

this is all for security, right?

It's dangerous to get apps from a

third-party store,

even though the Play Store has plenty of

malware on its own.

But even so,

the point being is get things from a

trusted source.

Signal, for example, does have an APK,

but it's kind of hard to find.

But it is okay to get it from

the Play Store because that's a trusted

source.

Um,

there's also other places that you could

get the APK directly.

There's third party app stores like F

droid,

which I know have some concerns about

them.

But the point being is like,

this is when I go to download something,

typically what I do is I go straight

to the developer's website and I go, okay,

what are their official channels?

And then they'll say, you know, it's,

it's on the play store.

It's on F droid.

It's on GitHub directly.

And then I'll look at the list and

decide which one I want to use.

It's not so much the channel it's making

sure it's, it's official.

Um,

So maybe don't try to get free Claude

doing that.

And then, yeah,

just the other takeaway I had was the

whole source code leak thing.

Anthropic was really quick to own up that

it was a human error.

They said here, what was it?

Yeah,

this was a release packaging issue caused

by human error, not a security breach.

Yeah,

not like AI doesn't do this kind of

stuff all the time.

But, you know,

it's just remembering that there is...

remembering the human element in

everything.

You know,

if you listen to any social engineering

people,

they're always quick to point out that

humans tend to be the weakest link in

any system.

You know,

I could spend a lot of time trying

to,

if I'm trying to get into a building,

right?

I could spend a lot of time trying

to hack the door code or the card

readers or whatever,

Or I could come up with a really

convincing story for why I need to be

there,

usually involving a high-vis vest and a

clipboard, in my opinion.

But yeah,

so I think those are kind of the

more technical things that I took away.

Jonah,

was there anything specific about this

story that jumped out to you from your

expertise?

yeah there were a couple things that i

noticed and i was trying to find a

tweet that i saw from somebody else but

i couldn't pull it up here um but

i'll talk about some stuff going back to

what you said about mastodon i do think

it's interesting um

like the supposed quality or sloppiness of

the code,

because I believe Anthropic has said for a

while that all of their code base is

now AI-generated by all of their

developers.

That does, I think,

at least bring into question whether you

can DMCA or copyright any of this code

at all.

Maybe you can't because it's all

AI-generated,

which AI companies have been pretty firm

about saying, you know, this is not...

like a copyright concern at all.

So it's kind of a taste of their

own medicine there that all of this is

out, I think.

The main thing that I think we see

in this source code,

because like you said,

the models aren't leaked,

but there is a lot of information about

the

system prompts that Claude uses for a lot

of different tasks,

which definitely gives a lot of insight

into how Claude works and how like,

it like to to their competitors,

I think it gives a lot of insight,

like how you could make a similar product

and also

to people who are trying to do prompt

injections to bypass some of the

restrictions in placing cloud code,

you can more easily see how they're

implemented and get around them.

So I don't know how people are going

to end up using that,

but I think that there is a lot

of opportunity for people to do something

with it.

All of the AI stuff, I mean,

we've talked about it on the show before,

not...

the most interesting to me from a security

or privacy standpoint,

because like cloud code and all of these

AI models,

they're going to run fully in the cloud.

So they get all of this information.

I think it is sort of dangerous to

be using and relying on,

especially for sensitive information.

And that hasn't changed from any of this.

But yeah, it's interesting stuff.

The tweet that I was trying to pull

up talked about how Claude and how

Anthropic is using their AI to contribute

security patches to a lot of different

open source projects.

And they've been doing that out in the

open.

Certainly,

I've seen a lot of security

vulnerabilities submitted to

GitHub from Anthropic.

I think one of the latest Mastodon

security vulnerabilities in patches was

submitted by Anthropic.

So I believe I've seen contributions to

that and to Firefox and a lot of

other open source projects from them.

Unfortunately,

I just cannot find this source,

but maybe I'll be able to pull it

up later.

But I saw some information about internal

tools that Anthropic is using where the

system prompt is like,

create these security vulnerability

patches without giving any indication that

AI or cloud code is used at all.

So it's very specifically told not to

attribute anything to cloud or Anthropic.

It's told...

you know,

not to include comments that might

indicate it's AI, et cetera.

So I think that that's really interesting

that they are,

I don't know what cases they're using

those tools in.

I would have to find out more information

about that,

but I think it's interesting that they are

doing that.

Yeah,

it looks like you pulled up on the

screen some of the instructions that I

saw.

Yeah,

I found it on another article from Ars

Technica.

Yeah,

I don't know where the original thing is.

But yeah,

basically they were saying there's an

undercover mode.

So as you can see there...

they're basically telling Claude that

they're operating undercover in a public

open source repository.

So they can't contain any Anthropic

related information.

I can imagine that's probably used because

a lot of open source projects are very

anti-AI contributions and anti-AI pull

requests and just automatically close

anything that's AI generated.

So this is probably a way for them

to

um try and get around those restrictions

whether that's a good idea for them to

be doing or not i guess that's a

debate but um it seems to be what

they what they are doing and that's kind

of confirmed with this so i thought that

that was um fascinating yeah i agree i

i feel very torn on that because on

the one hand um

there's probably an angle I'm missing

here.

On the one hand,

I understand the idea of like,

let's just assume they're doing that

altruistically, right?

Like we want to make these open source

projects better.

We want to make them more secure.

You know,

like I don't think at Privacy Guides,

for example, correct me if I'm wrong,

we don't typically go out and solicit

people to like, hey,

come check out our website and make sure

all this information is accurate.

But we totally welcome it if somebody does

come up and they're like, hey,

I found an inaccuracy and they report it.

And I feel like that's kind of what

they're doing is, you know,

on the one hand,

it's like it's still creating a more

secure project, right?

Assuming that the bug report is good.

I know that's historically been a problem

is a lot of AI slot bug reports

that aren't really valid and they're not

really bugs or whatever the case.

And semi-related,

but I did see an article earlier this

week.

that said that actually there's been a

noticeable increase in quality on AI bug

reports.

So maybe they're starting to make some

progress on that.

But either way, point being,

I understand the idea of the end result

is the same and either way it makes

the project more secure.

But it also feels very disrespectful of

like, if I don't want AI reporting it,

why would you go out of your way

to hide that?

And I don't know,

it's a really weird thing and I don't

know how to feel about it.

But I did see that too.

That's really strange.

yeah i would be really interested to see

data on like all of the security related

pull requests or vulnerability reports

that anthropic specifically has reported

because i feel like there's two different

types of ai contributions to to these

projects i think a lot of them are

kind of slop contributions because a lot

of

a lot of people in the open source

space or some students, for example,

they want to pad their GitHub profiles

because it looks more attractive to

developers.

I see that quite a bit where if

you can get like a PR merge into

a major project,

it just kind of

looks good for you.

And so I think a lot of people

are just spreading a wide net and just

submitting a ton of AI slot pull requests

and hoping that some of them get accepted,

which is very annoying for open source

maintainers.

But on the other hand,

if Anthropic themselves,

if they have a legitimate interest in

improving open source tools,

which they probably do because a lot of

these big companies do use these open

source tools themselves for a lot of

different reasons,

I can imagine that

like somebody being like an engineer at

Anthropic being paid to use AI and submit

these pull requests might be doing a

better job in not just completely

submitting slop but like using AI to find

these vulnerabilities and write this code

but checking it themselves before

submitting it and writing like explainers

because they're getting paid to do this

unlike the people who are just you know

rapid fire submitting

vulnerability reports and PRs, right?

I don't know if that's true or not,

but I would imagine Anthropic would

probably argue that that's true and would

probably use that as the reason that

they're doing this.

And like I said,

I have definitely seen AI companies report

security vulnerabilities that were patched

to open source projects,

and some of them were major

vulnerabilities.

So there is some merit to the idea

that AI can find these vulnerabilities

more easily than, I mean,

I don't know if it's more easily than

people who are auditing the code,

but it certainly is happening.

So yeah, I mean,

if all of the reports that Anthropic

themselves are submitting are accurate and

worthwhile to fix,

I don't know if that's necessarily a

problem.

But of course, people are

all along the spectrum of AI and AI

contributions and AI code specifically.

So yeah,

I think that's going to be quite a

debate in the open source community for a

while,

and I don't know how people are going

to handle that.

Yeah, I don't know either.

It seems like one of the better uses

of AI, in my opinion,

as opposed to writing songs or putting out

blog posts.

It's still just, yeah.

Like you said, what, what would be the,

I wonder what the success ratio is,

especially from Claude.

And is there a human review?

It doesn't sound like it from that,

that snippet that I shared,

but that's personally,

that's where I fall.

Like,

I don't mind and I'm not a developer,

so maybe I just don't understand how,

how bad the problem is, but like,

I would imagine,

I don't mind if AI helps you find

the vulnerability,

as long as a human looks it over.

um but yeah i'm sure there's a lot

of people that are not doing that

unfortunately so yeah i mean we've we've

definitely talked about this in the

privacy guys community and when we're

talking about all these different tools

that we recommend um people really want to

see audits but they're extremely expensive

and um if ai is not being used

to like write new code but it's being

used as like a second pair of eyes

to take a look at all of this

code that could be a good thing um

You know,

it is not going to be perfectly accurate,

but if we're being honest,

all of these security audits that projects

are paying for are not completely accurate

or totally thorough either.

And they're certainly going to be cheaper

to run AI than have a whole team

of people auditing this code.

So while I would imagine it's probably

going to...

be worse quality and probably have more

false positives if you're using AI.

I do think that doing it and revealing

some of these vulnerabilities is probably

better for a lot of open source code

bases than not doing any sort of audits

at all and just hoping that the maintainer

catches all of these bugs.

So I can definitely see a use case

here.

It's a tricky situation.

Yeah, for sure.

I know it's not really AI per se,

but I know, and you probably do too.

I get the emails from GitHub every once

in a while.

That's like, Hey,

there's a thing that you use NPM or

whatever,

and there's like a vulnerability go ahead

and upgrade.

So yeah, I, I would be, uh,

I don't know.

I mean, mine's,

mine's just a static website,

so I can't imagine the damage would be

too terrible,

but still it's nice to get that proactive

without having to go out and get a

whole code audit thing.

So useful stuff.

But I don't have anything to add to

that story unless you did.

Did you want to tell us about this

next story out of California?

Yeah.

So this one was reported by the Los

Angeles Times.

Their headline is California bill would

require parent bloggers to delete content

of minors on social media.

Yeah.

So they have a quote here from somebody

directly impacted.

It says,

as the daughter of a social media

influencer,

Kami Barrett says she navigates life

within a digital footprint she wished

never existed.

Everything my mom posted is still on

social media, she said.

Photos I wish never saw the light of

day, private details about my health,

even when I started my first menstrual

cycle.

She was saying this at a Wednesday news

conference to advocate for Senate Bill,

which would require social media platforms

to offer a process for adults to request

the removal of content that features

themselves as minors and was created by a

family member who received compensation

for sharing material online.

So yeah, this is an interesting story,

and I guess it specifically relates to all

of these family influencers that we see,

which has definitely become more of a

problem lately.

Especially, I would imagine,

in California.

So it's interesting,

but probably makes sense that this is only

going to apply to...

kind of public influencers,

ones who are receiving money or

sponsorships in exchange for all of this

stuff.

But it is only going to be available

for adults.

So there isn't really a process that

prevents any of this stuff from being

posted in the first place or anything like

that.

It's only a retroactive thing that

adults can do about their childhood if

they were a part of like a family

influencer situation um does i i would say

i don't know if that makes a lot

of sense from my perspective because i

think as we always say um

anything that you post on the internet is

sort of permanent all of this stuff is

going to be archived and it could be

potentially years before you're able to

take any of this stuff down so uh

children who are like uncomfortable with

all of this going on um at the

moment i don't think have a lot of

protections um and i don't know um how

that should be handled to be honest i

know that that's been a debate that's been

going on for quite a while how children

should be

um like compensated for that is that

considered child labor um there's all

sorts of laws especially in the

entertainment industry and in hollywood

and on the internet um that that come

into play here so

I don't know if this is going to

really impact a lot of the people that

we see in the privacy guides community who

are trying to clean up their digital

footprint,

because I think a lot of people are

more concerned about smaller scale

situations than some of these commercial

ventures that this bill is going to

attack.

But I do think it's a good idea

for more privacy protections and some sort

of

process to get that data removed if you

are an adult and you don't want that

information out there.

So it seems to be a good thing.

I'm not sure how effective it'll be or

if it goes far enough,

but I think any protections and processes

to protect your privacy are good at the

end of the day.

Was there anything you wanted to note in

this article, Nate?

No, I agree with you.

It's funny.

I think most people would agree I'm a

lot more

lenient with some privacy stuff than a lot

of other privacy people are.

But like kids are kind of one of

the few things where I'm actually kind of

like,

like in a perfect world,

I think it should be illegal to post

pictures of your kids online at all.

Um, or at very least publicly, like,

you know,

if you're going to post pictures of your

kids,

it has to be in like a closed

group chat or like a,

a friends only Facebook post again in a

perfect world, there wouldn't be Facebook,

but that's beside the point.

Um, so like, yeah, this, I,

and I agree with you.

It's really sad.

Cause like, even in this article, um,

one of the,

one of the people they talked to said

that, um,

I think it was that first girl, Barrett.

Yeah, Kami Barrett.

Further down,

she says that she recalled being a target

for predators and online bullying,

said her mother was aware of the problems

it created,

but continued to share her daughter's life

on social media.

So, like, cool, thanks.

Now that I'm twenty, twenty-five, thirty,

I can ask you to take it down,

but that doesn't help me when I'm ten,

fifteen, sixteen, seventeen.

You know, like you said,

the damage is already done in so many

ways, and...

I mean, I guess, yeah, I don't know.

It's just, it's crazy.

And it's one thing I thought was

interesting is it says the legislation

requires that social media platforms offer

a process for adults to request the

removal of content.

And then basically from there,

they pass it on to the parent and

the parent has ten days to take it

down.

After ten days,

they get a three thousand dollar a day

fine.

So I don't know.

It's just it's really I'm with you.

I feel like it doesn't go far enough

and it doesn't.

it's not proactive enough,

but at the same time, I mean,

I guess it's better than nothing.

And I think that's, I don't know.

It's.

It frustrates me.

I wish it would do more,

but it's a story for sure.

A couple of things to note about this

story.

This bill hasn't passed yet.

It's just a proposal.

But this the person in question in this

article was talking about their support

for it.

The other thing I would note is similar

laws do exist in a couple of other

states, including here in Minnesota.

There are some laws that

here restrict um more highly how children

can participate in like commercial content

in the first place um so I think

if you're under thirteen you can't

actively uh participate in any of this

content creation at all you can maybe be

featured in it but you can't be um

Like an active part in it,

so I think that in Minnesota,

at least a lot of those toy unboxing

channels where people have their children

unbox a bunch of toys and that kind

of thing that's not allowed.

teenagers here in Minnesota are allowed to

participate,

but there are laws in both of these

situations around how that revenue is

split between everyone involved,

so there are some protections I think for

people participating in these commercial

ventures.

But from a privacy perspective,

I think they probably don't go far enough

in any case.

But it is interesting to see how this

is being handled.

It is a very, I think,

new issue with the internet and everything

that none of the existing laws were really

equipped to handle around child labor and

stuff like that.

So it's good that this is at least

getting attention,

and we'll see how this plays out.

Yeah,

it does say in California they have a

law that was signed two years ago that

content creators that feature minors and

at least thirty percent of the material

have to place some of their earnings into

a trust that children can access when they

turn eighteen.

So, yeah, like you said,

there's there's some it's an issue that's

starting to get attention for sure.

But.

Also, just on a personal note,

they interviewed Alison Stoner,

who they said was a former child actor

who appeared in films like Step Up and

Cheaper by the Dozen.

They were also Isabella in Phineas and

Ferb, and no mention of that.

And I feel so offended because I love

that show.

I just had to call that out.

Interesting.

I had to.

So in a little bit,

we are going to talk about LinkedIn's

browser scanning.

So that should be fun.

But first,

we're going to go ahead and jump into

site updates and talk a little bit about

what's been going on at Privacy Guides

this week.

Just this afternoon,

we dropped a new video.

It is currently members only.

So we usually leave those members only for

about a week.

This one is about encrypted email.

This is another one of those like really

beginner friendly videos that if you're a

bit of a privacy veteran,

you probably know this stuff,

but hopefully it's something that you can

share with your friends and family.

It talks about why mainstream providers

like Gmail and Yahoo aren't quite good

enough and how encrypted email works and

some of the different ones we recommend,

pros and cons of each.

So yeah,

if you are not a member yet and

you want to check that out,

you can join on YouTube or you can

go to privacyguides.org slash donate and

that will take you to a link where

you can sign up for a membership.

But that's what we did this week in

the video department.

And I will turn it over to Jonah.

Very cool.

Yeah, another thing we did recently,

Nate and I recorded this a few weeks

ago, but it's finally live.

We did a panel discussion on the Firewalls

Don't Stop Dragons podcast.

So episode four seventy four of that

podcast is now out.

It's called Privacy Guides Panel.

Nate and I are on it and we

talked about a ton of interesting stuff.

So I would definitely recommend checking

that episode out if you want to listen

to those discussions.

You can look at the table of contents

here.

It looks like Nate's showing that on the

screen,

but you can find the Firewalls Don't Stop

Dragons website for more information.

And if any of those topics sound

interesting to you,

Definitely check it out because it was a

ton of fun for us to record.

I think we talked about a lot of

cool, interesting, informative stuff.

So hopefully somebody finds it useful or

at least finds it entertaining.

In other news,

we again published a bunch of news briefs

that we're not covering here on this show,

but you can find our articles at

privacyguides.org slash news about them.

We have stories on Mac OS,

improving security in the terminal app.

a grandmother who was wrongfully arrested

because of facial recognition, iOS,

twenty six point five beta,

including end to end encryption for RCS

messages, Walmart,

digital price labels and more.

So definitely check that out.

Again,

it's privacyguides.org slash news if you

want to read those stories and let us

know if you have any questions about them

on the forum or anything else,

because there's always a lot of

discussions about these stories.

over there as well everything that we do

at privacyguides is made possible by our

supporters you can sign up for a

membership or donate at privacyguides.org

donate or you can support us by picking

up some swag like this water bottle for

example at shop.privacyguides.org

Privacy Guides is a nonprofit which

researches and shares privacy-related

information,

and we facilitate a community on our forum

in Matrix where people can ask questions

and get advice about staying private

online and preserving their digital

rights.

Now let's move on to our next story.

This is about NextCloud and OnlyOffice.

That is right.

So, um, full disclosure,

I am a next cloud user and a

little bit of a next cloud fan boy.

So, um, I'm bummed to hear this story,

but only office has suspended their

partnership with next cloud for forking

its project without permission.

And this comes on the heels of another

announcement.

So earlier this week, uh,

next cloud IONOS and several other

European tech companies

came together and announced this new open

source project called Euro Office,

which they describe as, quote,

a sovereign replacement for Microsoft with

intuitive interface and strong

compatibility backed by European open

source community.

Only Office has basically claimed that

this is a fork of their code.

And they say that this violates license

agreements because they offer only office

is source available or open source.

And they use the AGPL version three.

So specifically towards the end here,

if you're watching on screen,

you can see this, but towards the end,

it says we require compliance with

applicable licensing conditions,

including,

but not limited to the preservation of

only office branding logo and all required

attribution elements as defined in our

licensing terms, which is,

If this is a brand new project,

it would, of course,

have none of those things.

So for those who do not use Nextcloud,

you may or may not know that Nextcloud,

one of the things that it comes with

by default is an online document editor or

Office editor.

And there's a couple different ways to

make this work.

You can use Collabora online,

or you can use only Office.

And this has been...

I think they said for eight years,

only Office has partnered with NextCloud,

and now they are terminating that.

They do say...

I think they said that no, yeah,

no existing partners or clients will be

affected.

So basically if you've already got it

installed, you're good to go.

I don't know what that means for updates

and stuff, but yeah,

I guess we'll find out.

They also, interestingly, um,

just to throw it out there,

only office said that in the past,

and I'm quoting the article here,

next cloud has behaved in a manner not

expected from a partner,

including trying to poach its employees

and influencing customers against the

company,

but directly forking the project and

repacking it was the straw that broke the

camel's back.

Um,

Yeah, then kind of a statement here.

They said partnership is built on trust

and trust requires shared principles where

those principles are no longer upheld.

Continuing operation is no longer

sustainable.

For this reason,

we made the decision to suspend our

partnership cooperation.

And then just kind of, I guess,

a little bit more background towards the

end.

Lever Office has criticized OnlyOffice for

being, quote unquote, fake open source.

They say, for one reason,

OnlyOffice defaults to Microsoft Office

formats like DocX, XLSX, and PPTX,

which is Word, Excel, and PowerPoint,

rather than open standards like Open

Document Format or ODF.

And there's also, apparently,

Nextcloud says they didn't just

collaborate directly with OnlyOffice.

Let me rephrase that.

When asked why they didn't just

collaborate with OnlyOffice,

they said that there were a number of

reasons,

including that OnlyOffice is a Russian

company that tends to obscure its origins.

Developers often leave code comments in

Russian and many users are hesitant to use

software potentially linked to the Russian

government.

They also claim the only office

discourages contributions,

ignores pull requests and lacks

transparency since commit messages

frequently reference internal issue

trackers only.

So yeah,

I don't know that I have a lot

of thoughts on this one.

Jonah, did you have any,

like what do you know about this AGPL

V three, for example?

Yeah, so what's in question here is, well,

only office says that they've added

provisions to AGPL requiring certain

attribution in forks of the project.

So we could,

if I could share my screen here,

let's see.

Huh.

So they're talking about in their license

two things.

You have to retain the original product

logo when you distribute the program.

And they do not grant any rights under

trademark law for the use of any only

office trademarks.

And the Euro Office Project Initiative

basically removed these provisions saying

that

Basically, if I can find it here,

section seven of the AGPL says that you...

Which line is this?

Says that you can remove any additional

restrictions or any of these terms from

that license on your own.

And this is kind of the basis of

Euro Office's claim that they can kind of

change this license.

And they say that they don't have to

use their logo to...

Give attribution to OnlyOffice.

The AGPL is still going to require that

they provide some attribution somehow,

but according to the Euro Office project,

they don't have to use the OnlyOffice

trademark.

I think this is kind of interesting

because usually open source projects like

OnlyOffice in this position,

fight tooth and nail for forks to not

use their branding at all.

So the fact that they want them to

use their logo is kind of strange because

we've seen like Mozilla, for example,

when there's any Firefox forks,

they want to make sure that there's no

Firefox branding whatsoever associated

with that because they don't want it

associated with their

project um and related to this there's

actually another case um around it a few

years ago this started and then there was

a i think the latest update on this

was in um but a company called neo

four j um started a lawsuit against uh

another company purethink and

about a very similar issue.

Basically Neo-FourJ added a lot of clauses

to their AGPL license,

and Neo-FourJ said that because the AGPL

says that you can remove certain passages

or restrictions that were added onto the

AGPL, that they were able to do that.

And Peerthink actually lost this case.

This twenty twenty five article is

basically announcing an appeal that's

taking place.

I don't know if that's actually gone to

court yet,

but they

So yeah,

this article says that the AGPL allows

added-on terms like the Commons clause

that Neo-FourJ was using to be stripped

from the license.

And Neo-FourJ said that because they added

it,

you have to comply with all of the

terms of the license.

And the court basically agreed that any

terms in the license have to be followed

regardless of what the AGPL says.

And then the Free Software Foundation and

other organizations in the open source

space

said that that's not the case and that

they did intend this tenant or this

provision in the AGPL to work and for

these restrictions to be removed because

they believe that you can't really have

restrictions on free and open source

software,

which is kind of the point of the

AGPL.

So

It's a strange case.

It's definitely in a gray area.

And it really depends on how much

OnlyOffice wants to fight this.

But I think you could certainly argue in

the Neo-FourJ case and probably in this

OnlyOffice case that any of these

restrictions that are being added onto the

AGPL that have very...

specific restrictions on how the software

can be used probably make the software not

open source um so at the end of

the day you shouldn't be calling it an

agpo licensed project if you really want

these terms to be followed i think that

they would have to call it something else

and it

wouldn't be, I mean,

it would be at odds with the open

source in the same way that a lot

of these source available licenses that we

see are.

It's definitely a hot debate in the

community in general.

We've seen a lot of talk about like

the FUDO license, for example.

not being open source and they went with

a different name because of that.

But there's certainly other licenses that

projects are trying to use and they still

continue to claim to be open source when

in reality they're source available.

So I think that if only Office really

wants to follow through on having these

restrictions in place,

I think that would be very at odds

with their claims that they are an open

source

project um which would be a bit concerning

because the entire idea of open source is

that these forks should be able to exist

and like you should be able to completely

fork and create um this euro office that

nextcloud is making um without any

restrictions or preservation of OnlyOffice

branding.

That doesn't make a lot of sense for

a fork to be doing.

And so OnlyOffice is in a bit of

a strange situation here.

It's always the business

pace against open source software in

general.

They don't want people taking their work.

And OnlyOffice clearly believes that

because they say that they've spent years

building a fully functional production

ready Office document editor.

But at the same time,

they marketed that as an open source

project.

And that is what people kind of expect

from that.

I would also note,

Nextcloud kind of has a history of

forking open source projects um in not a

very collaborative way i mean their next

cloud itself was forked from own cloud of

course and that division was um

I don't think super well received by

OwnCloud themselves.

So it's kind of a situation that they're

used to.

But I think a lot of people side

with Nextcloud in that case.

And I think that a lot of people

are going to side with Nextcloud here as

well.

So it might just kind of be what

it is.

yeah and like kind of going back to

what you were saying about um you

mentioned that like a lot of companies

they they put work into it and then

they don't want people stealing that work

it's one of those things where like in

that case and i say this kind of

spitefully but like then just don't be

open source because i mean obviously in a

perfect world i would prefer everything

was or at very least be like you

said like be transparent about being

source available because um

in a perfect world,

I would love for everything to be at

very least source available,

because that's how we're able to verify

that the code is doing what it's doing.

And it helps build that trust at very

least, I think, um,

especially things that deal with security,

like password managers should at very

least have their cryptographic bits be

source available, um, bare minimum,

but cause security is something where like

everyone benefits.

Right.

But

To me,

it's just such a crappy thing because

that's the risk you take.

And I've talked to a lot of projects

that are not open source and I've asked

them that.

I'm like,

why don't you guys have any open source

clients or anything?

And that's usually the number one reason

they give is they're like,

we're worried that people are going to

take our stuff and steal it.

We have no real way to control that.

And then there's...

to counter their argument.

There are plenty of companies who seem to

be doing just fine despite that.

But yeah, so it's, I don't know.

It's just me.

I say this with a little bit of

bitterness in my voice towards only

office.

It's like, then just don't be open source.

Like it feels almost, um,

it's going to be a really niche reference.

And I don't think this is as much

of an issue anymore,

but back in like the early two thousands,

um, there was a real,

I don't know if you'd call it an

issue or not.

I guess it depends on how you feel

about it, but a lot of bands would,

um,

would market themselves as Christian bands

because the Christian market would be a

lot easier to break into.

And then once they hit a certain level

of success,

they would quote unquote go mainstream.

And some of them would even like

vehemently deny, like, no,

we were never a Christian band.

And it's like, well,

we have interviews with you where you said

that you were, so whatever, dude.

But to me,

it just feels the same way.

It's like,

you don't actually believe this stuff.

It's just some kind of marketing gimmick.

And in this case, the open source,

I just feel like that, I mean,

I guess in the Christian thing too,

just feels kind of crappy.

It's like, you know,

don't say that you believe in this stuff

just to get ahead in the competition,

like commit to it or don't.

So I don't know.

That just, that really frustrates me.

Quick thanks to at Sod This All for

gifting a Privacy Guys membership.

Thank you for your support.

Oh, nice.

I just saw that.

Yeah.

I had comments closed down so I could

see the screen a little better.

But yeah, thank you.

That's super cool.

All right.

I think that'll take us into a LinkedIn

story that Jonah actually alerted me to

this story right before we started

recording.

This one's like hot off the presses.

Yeah,

I think this was reported just yesterday

or today, if I remember correctly.

I definitely saw it only yesterday,

but maybe it's been talked about a bit

for a while.

But there's this report that LinkedIn is

illegally or allegedly illegally searching

your computer.

They are scanning installed browser

extensions without user permission.

So this is reported by Apple Insider.

And something is wrong with my computer.

There we go.

They say researchers have determined that

Microsoft's LinkedIn is scanning browser

plugins and other information without

permission and building user profiles

using data that the company did not get

permission to take.

A European advocacy group claims LinkedIn

is probing browser extensions through its

website code.

Fairlinked EV published a BrowserGate

report alleging LinkedIn detects installed

browser extensions by probing for known

identifiers through JavaScript.

The group says the technique reveals

personally identifiable information.

And so this is a threat that we've

talked about before,

I think in a previous episode of this

show,

but definitely on the forum where the

browser extensions that you install can

definitely add to your browser fingerprint

and can specifically identify you based on

what extensions you have installed.

And that's been a known threat for quite

a while,

but I think this is one of the

first and maybe the largest examples of a

real world situation where this is

happening.

And so if we look at this Fairlinked

BrowserGate website,

they point out a lot of different problems

with these tools,

namely that

Microsoft is designated as a gatekeeper

under the Digital Markets Act in the EU.

So Microsoft Windows and Microsoft

LinkedIn are both regulated products under

the DMA, and they need to allow,

as a result, free, effective,

high-quality, continuous,

real-time access to all data,

including personal data that's generated

through the use of these products,

which LinkedIn is not doing because

they're doing this

in the background.

They also point out that this search of

all of your browser extensions can reveal

a lot of different personal information,

and they give some examples of extensions

that could potentially reveal that.

It could reveal your political opinions,

for example,

because there are extensions like

anti-woke, anti-Zionist tag,

no more Musk that you can install.

I don't know what those extensions do,

but obviously having them installed

definitely shares a bit about what you

believe.

It could share some...

Could reveal your religious beliefs

because there are extensions like Porta AI

which blur haram content or Dean Shield

which blocks haram sites.

It could reveal potential disabilities or

neurodivergence through extensions you

have installed like Simplify which aids

neurodivergent users in browsing the

internet.

Certainly,

LinkedIn could be getting your employment

information.

There's a lot of obvious ways to do

that,

but there are job search extensions that

people use on LinkedIn where that could

reveal information to LinkedIn or your

current employer.

And then it just reveals a lot of

potential trade secrets because LinkedIn

is this network where so many

professionals are located and they share a

ton of information about where they work

and Microsoft would have access to all of

that data and they would also have access

to all of the extensions that these people

have installed,

some of which would be mandated by their

companies.

So like whether you use

The examples that they give are Apollo,

Zoom, Info.

You could imagine other browser extensions

of professional tools that would be

installed by these companies.

I don't know what tools companies use,

to be honest.

I know in the education space,

we would use tools like GoGuardian,

for example.

And so...

In that example,

they could find out what we're using.

But a similar case would apply to all

of these organizations and their employees

who use LinkedIn.

They say,

Fairlink says in their BrowserGate site

that LinkedIn has not disclosed this

practice in its privacy policy.

There's no mention of extension scanning

in any public-facing document that

LinkedIn has published.

And so on this BrowserGate website,

which you can find at browsergate.eu,

they list six thousand two hundred twenty

two extensions that a hidden JavaScript

program on LinkedIn will scan your browser

for.

I believe this only applies to Chrome

browsers,

but that's probably most people visiting

LinkedIn, I would imagine.

and you can't opt in or opt out

of that and there's again no mention of

any of this happening in any of their

privacy policies um which is definitely

very concerning um so

It's kind of a mass breach of your

personal data.

They say that this is deceiving

e-regulators, which is probably true.

And so I think it's just interesting to

note for sure that this definitely leads a

lot of credence to the idea that your

browser fingerprints are going to identify

you and reveal a lot of information about

you and what you do,

especially when it's being done by a

company like

LinkedIn that has probably a lot of

information about you if you use it.

It has your real name.

Some people ID verify on LinkedIn.

They have your whole resume and being able

to tie all of this digital data to

those profiles.

creates a very unique and very

comprehensive profile of you when you use

the service.

So I think it is very concerning for

sure.

And it shows that the threats that we

talk about when it comes to your privacy

are in fact a real issue.

And these companies are trying to get all

of this data wherever they can.

Yeah, for the record,

I tried to show the browsergate.eu

website.

For some reason,

it's not loading on the device.

It worked fine earlier,

but I guarantee it's DNS.

It's always a DNS issue.

But yeah, it's my first thought.

OK, so my first thought,

because I was recently educated,

for general browser fingerprinting,

like the day-to-day,

Some browsers like Firefox, for example,

they do actually try to obfuscate what

extensions you have installed.

And I guess just to back up a

little further, I know that for, again,

for general fingerprinting,

it's not always a guarantee that having

more extensions will make you more

fingerprintable because it generally

depends on what does the extension do and

whether or not it modifies the page.

But obviously this one is going out of

its way to scan your extensions, right?

So that's a little bit of a different

story.

which I would argue that general

fingerprinting probably does that too.

But going back to what I was saying

about Firefox,

I know Firefox basically tries to,

and I'm probably going to get the fine

details wrong on this, so I apologize,

but they basically try to like randomize

the ID that your extensions have to make

it a little bit harder for you to

be fingerprinted.

Do you think that would,

do you think that would stop something

like this or slow it down?

Or is it just going to be able

to get past that anyways?

um it could potentially but i mean yeah

it depends on you know i'm not sure

how these programs work randomizing it

could work if you can't find the files

in the first place um and that probably

is a strong protection against it um but

If those extensions modify the page

itself, which a lot of extensions do,

then that probably is still going to be

detectable.

And so that's only going to protect your

privacy against certain extensions you

have installed that make public resources

available, but don't modify the page,

which I don't think would be a ton

of extensions,

especially like password managers.

I can imagine where...

like if they edit the page itself to

add like a pop up or like a

drop down menu to logins,

that's going to be impacted.

So if you disabled all of that autofill

stuff, and you kept the extension,

and only like manually copied from it on

certain pages, you know,

it could potentially protect you in that

situation.

But I don't think most people are doing

that.

So I don't know how extensive that

protection would really be.

Which even then,

my thought process is that kind of defeats

one of the advantages of a password

manager, which is if it doesn't autofill,

that could be an indicator that you're on

a phishing page.

So if it never autofills,

then you never have that moment of like,

wait, am I on the right page?

Yeah.

Yeah.

And then I guess my other thought, too,

is just not really a question,

but just a thought.

You pointed out that this was tested on

Chromium browsers,

which is probably what most people are

going to use anyways.

I, at my last job,

they gave us work computers that came with

Microsoft.

And I mean,

ninety nine percent of what I did was

logging into the company stuff anyway.

So I just use Edge because that's what

it came with.

And at one point,

I think at one point I did get

Brave installed on it and then I was

never able to do it again.

But I think I did try Firefox because

I was like, well, you know,

it'll it's not Edge, right?

It'll be a way bigger improvement in

privacy.

But I got really annoyed because

everything in a corporate environment is

optimized to work

with Edge.

And so it was just so much extra

friction to use Firefox.

So where I'm going with this is, yeah,

like most corporate environments are

probably going to be using either Chrome

or Edge because everybody's familiar with

Chrome.

And where I was going with that is

at my job, they said like, yeah,

if you go to our little app store,

you can download Chrome or whatever.

We don't care.

Use whatever browser you want.

So most people are probably going to be

using Chrome or Edge.

Maybe some will be using Safari,

which I think the article did say that

Yeah,

Safari users are less likely to be

affected by the specific mechanism based

on how extension detection typically works

across browsers.

Apple's browser model limits

fingerprinting surfaces.

But it kind of goes back to...

It's unfortunate because not everything...

Where am I?

How am I trying to word this?

It's important to try to compartmentalize

your professional life and your personal

life, right?

Like never...

Never do personal stuff on a work

computer.

For some reason, people do anyways,

and I don't know why.

But even then,

LinkedIn is something that...

You wouldn't get in trouble for doing that

on a work computer, I would imagine,

but it's also something you would do at

home, right?

LinkedIn is supposed to be something that

follows you from job to job to job.

It's not necessarily specific to that job.

So it is something that I could see

people checking on a home device,

which is so frustrating because it's like

you're trying to...

I don't know.

It's like,

it's one of those things where like,

you're not really necessarily doing

anything wrong and you're still getting

punished.

And that's, that's super frustrating,

but yeah, I guess I,

I just wanted to point that out.

It's, it's, yeah, I don't know for sure.

I mean, a ton of people, I think,

um,

Their work laptop is their only computer

in a lot of cases besides their phone.

I think a lot of I know people

in that situation.

And yeah,

definitely do not recommend doing that.

You should get your own personal laptop

and use that instead.

But I know a lot of people do

that anyways.

Another thing that I wanted to share,

not in the notes,

but kind of related to this is browser

extensions aren't the only ways that

websites can potentially fingerprint you

or like software you have installed on

your computer.

Sometimes the software itself on your

computer can work against you.

And so kind of recently,

I think this has been going on for

a while,

but it's been picked up by some news

sources.

Basically, Adobe Creative Cloud,

of course it's Adobe,

is changing the host file on your

computer,

which allows websites to detect whether

you have Adobe Creative Cloud installed.

So this is posted to Reddit.

Basically,

Adobe is adding this line to your host

file.

And then when you visit the Adobe website,

it tries loading an image from that exact

domain.

And if the image loads because of this

line that they've added that points that

domain to a specific IP,

then they know that you have Creative

Cloud installed.

And that could, of course,

be checked by any number of different

websites to detect whether you have Adobe

Creative Cloud installed.

And so even if you don't have any

browser extensions,

there are other ways that software

on your device itself can um increase your

browser fingerprinting profile um

regardless of what you do with the browser

so that is something to definitely keep an

eye out for because the only thing that

would really protect you against this is

either not letting creative cloud do this

which i don't know if there's a mechanism

to do that but it might be

uh worth looking into or using a browser

like tor browser which is going to bypass

all of your local network stuff

specifically but that's um challenging to

do and not a lot of people are

doing that for day-to-day use um and so

software that does something like this um

is a problem i don't know of any

other software that's going to do this

besides adobe but um

Of course, again,

of course it's Adobe doing that, but yeah,

that is another attack vector unrelated to

extensions that websites could be using

that you'd also have to look out for.

That's insane though.

Editing the host file.

I don't even like screwing with that.

That's some deep level stuff.

Oh my God.

Wow.

These companies are out of control, man.

Yeah.

My brain hurts.

Just related to that, it's always DNS,

right?

DNS can be used against you.

DNS is used for evil.

Anyways,

I think that's all I have to say.

Do you want to talk about our next

story here?

Yeah.

My brain is still hurting from the host

file thing, so we'll just move on.

So this next story,

it helps if I share the actual screen.

Here we go.

So this next story comes from Four of

War Media.

It says,

a secure chat app's encryption is so bad,

It's quote unquote meaningless.

I mean, okay,

we'll go through it a little bit.

So the app is called Teleguard and I've

heard of it a little bit.

It actually rang a bell when I read

this.

I really, I'm not going to lie.

I really wanted a moment where I went

and checked the DMs on the forum because

we get a lot of projects and privacy

guides that message us directly.

And they're like, hey,

you should recommend our product.

And we always tell them like,

go post on the forum.

This is a community project.

Let the community vet it.

Um, so I,

I went and checked and I thought like

maybe I,

I knew their name cause they messaged us,

but, um, nothing like that, I guess.

So I don't know where I've heard it

from, but, um,

it has been mentioned on the forum once

or twice,

but never really like heavily recommended

or anything.

Just, I don't know.

But either way.

Yeah.

So this is an app that markets itself

as a secure end to end encrypted messaging

platform.

It's been downloaded at least a million

times.

Um, but apparently this researcher, uh,

found, it says there's no storage,

highly encrypted, highly encrypted, um,

kind of like military grade encryption,

right?

Anyways, um, Swiss made,

and there's an anonymous researcher in

March who contacted four Oh four.

They said that the private encryption keys

are sent to the company server upon

account registration.

And, um,

Jonah can correct me if I'm wrong about

any of this, cause I'm,

I'm speaking a little bit outside my

element here, but I think I'm,

I'm right about this.

Um, there are services like proton,

for example, that, um,

I don't know if I'd say the private

key gets sent to the server,

but they do have a way where like

you can log in from any device and

your email is decrypted.

Right.

But they also store that in such a

way where they don't really get the key

itself.

Um, I, again,

I could have the details wrong here,

but my point being like,

I think there is a way to store

private keys,

but they weren't doing it this way.

They weren't doing it in a way where

it's like,

we don't have access to your private key.

Like, no, they just had your private keys.

Um,

So yeah, they also...

I think it's further down.

They go through every single issue they

found,

which is basically like your private key

was derived from your user ID.

So anybody who had your user ID could

plug it into this API and decrypt your

messages, which is anybody you message.

Or a lot of people will post their...

Well, Signal, for example,

but a lot of people will post their

username publicly because they're like,

hey, anybody who wants to contact me,

go ahead.

They said further down that metadata was

stored in plain text.

So basically every single mistake you

could possibly imagine a company doing or

a messenger doing,

it seems like they were doing.

And oh, man, hold on.

I do have to find...

Yeah.

So the CEO, after publication,

the CEO contacted four Oh four via

LinkedIn,

hopefully from a company computer in a

direct message and said, quote, this,

the information is incorrect.

Exclamation point.

The person who gave you the technical

information that has completely misled

you.

That person is not competent.

Exclamation point.

Uh,

the CEO did not provide any evidence for

this or point to any specifics.

Um, very.

Yeah.

I don't know.

I always like when people do that kind

of stuff.

Very professional.

Um,

So is my making fun of them,

but whatever.

So yeah, I personally,

I wanted to share this story because I

feel like in the privacy community in

general,

I see a lot of people who I

think...

we get excited about new projects.

I think there's two kinds of privacy

people.

I think there's the people who get excited

about new projects and the people who are

suspicious of anything new.

But I see a lot of people who

get excited about new projects and they're

constantly like, oh,

there's this new messenger I just heard

about.

I'm excited to try it.

What does everybody think?

And first of all,

I think that's really awesome when you go

to other members of the community.

What do people think?

And because I have seen one of the

messages that I mentioned when I was

trying to figure out where I've heard of

this app before.

I went to the privacy guides forum and

one person was asking like, hey,

what does everybody think of this?

And a lot of people were like, oh,

it's proprietary.

Like this seems weird.

This seems weird.

There's a lot of red flags here.

I don't think anybody did like an actual

technical analysis like this person did.

But, you know,

it's good to get that kind of feedback

from other people.

Like I'm very open about the fact that

I don't really know a lot of code.

I did take a...

There's a little app that kind of gamifies

learning code, kind of like Duolingo does.

And allegedly it taught me Python,

but I wouldn't trust me to code anything

in Python if I were you.

I can now look at Python and recognize

it as Python, basically.

So that said, like,

I think it's really good to,

in my case, you know, like, hey,

I don't know enough about code to

understand this.

Can anybody else weigh in on this?

That's a really good thing.

But I think it's just this...

be a little bit cautious, right?

There's a fine line because on the one

hand, if we never trust anything new,

we would never have any mass adoption of

all these great tools like Proton, Intuda,

Signal, SimpleX.

All these really good tools would never

get out of the small phase because nobody

would ever trust them.

But at the same time,

we have seen so many apps that shut

down, sold.

Every once in a while,

it does turn out to be a honeypot.

And so there's a very fine line between

these things.

And-

Yeah, I would also ask,

especially with chat messengers,

one of my personal beefs is I feel

like there's

an obnoxious amount of messengers.

And one of the questions I always ask

with any new product, not just messengers,

but any new product is what are you

solving?

Like people send me links all the time

and they're like, this looks really cool.

And I'm like, okay, what is it doing?

What is it solving?

What problem is this solving that,

you know, whether it's a search engine,

an email provider, whatever,

like what is it doing that this existing

tool doesn't already do?

And I'd say about half the time people

are like, oh, I don't know.

I just,

I saw it and thought it was cool.

it's gotta be solving a problem for me

personally, but yeah.

So, um, I don't know.

Did you have any thoughts on this?

I know,

I think this one may have gone below

your radar a little bit,

but did you have any thoughts about it?

Yeah.

Um, yeah,

I think that's all a good takeaway.

Um,

thankfully the only thing I would say is

in the case of teleguards specifically,

um,

thankfully we've known about some of the

issues with it for a while.

I know that they note at the end

of this article, um,

TeleGuard handed over information to the

FBI in around,

according to the Washington Post.

That article was shared on our forum and

in all of the posts where TeleGuard is

brought up or in the thread about

TeleGuard itself.

People have known for a while that they

can provide information like the push

notification tokens and other information

and hopefully are avoiding that.

But yeah,

it's definitely a good thing to keep in

mind because there is a balance,

like you said.

We do need to have more products in

this space,

but knowing whether they work well is...

kind of tricky.

And it's always good to keep an eye

on this stuff because they certainly do

not always work the way that they

market themselves for sure.

I wasn't aware until I just read this

article that it was made by Swiss cows.

I've heard a lot of, well,

not a lot,

but I've heard their search engine brought

up a few times.

I know that they also have a file

storage service,

which is as far as I know,

just based on next cloud and uses like

the next cloud end to end encryption,

which isn't the best.

So they kind of just seem to be

one of the,

one of those companies where um they're

just putting stuff out there probably with

open source tools without really um adding

too much or changing it i don't know

if telegard is its own homebrew product i

would imagine it is because i don't know

of any like open source stuff that would

be um

that would have this poor encryption,

at least the people who are like forking

element, for example,

are getting a reasonably decent encryption

implementation,

whereas I don't know what's going on with

teleguard.

But yeah,

I think I think in this specific case,

people already know not to use it.

And otherwise,

with with stuff not like this,

it's it's everything you said for sure.

Yeah, I looked into Swiss cows briefly,

I think the only thing it has going

for it is it says,

like the search engine.

It says that it will censor adult content,

which I think could be useful if you

have really young kids,

just as like one of those layers of

defense, you know,

maybe set that as the default search

engine on the family computer and

But then we get into the whole topic

of like,

at what point is it appropriate to kind

of transition your kids off that?

But I don't know.

I remember when I looked into it,

that was kind of the only advantage I

saw was like, okay,

I could see this if I had young

kids and I just wanted it as one

more layer of defense of like,

I don't want them to accidentally find

their way onto something bad.

But yeah, of course,

for for immediate does note that Teleguard

has a reputation of being linked to cam

models and child abusers at the end of

this article.

So how much I would trust their approach

to child safety,

it probably would not be that far.

But yeah, in general,

it's probably a good idea for companies to

be a bit more thoughtful about all of

that stuff.

Yeah, that's fair.

I, I don't know.

I trust four Oh four,

but I'm not going to lie.

When I read that part,

my brain kind of went to like,

I wonder how much Teleguard does get used

for that stuff.

I don't know.

Yeah,

maybe if you turn a blind eye to

it.

I don't know how much they market it,

but I know that Kik had this reputation.

Maybe it still does, I don't know.

It does with me, that's for sure.

Yeah,

I've definitely heard this about various

messaging apps to the point where it seems

to be...

If you have that reputation and it

remains,

it seems to be kind of intentional,

and if it's on the radar...

Of these officers saying that they're

notorious for it,

that is a bit of a red flag.

Of course, with law enforcement,

it can always go either way because a

lot of law enforcement officers will say

Drive Fina OS, for example,

is notorious for being used by criminals

when in reality it's just a security tool.

But seeing as how this chat app doesn't

seem to provide adequate security,

I don't think it's the same sort of

situation.

Yeah.

Which not to get off topic,

but I know I've said in the past,

like,

cause there was that story about a year

or two ago about, um, apparently in Spain,

just having a pixel phone automatically

makes you suspicious,

like maybe not legally, but in practice,

it makes you suspicious because the only

people in Spain that have pixels are drug

dealers using graphene.

Um, and so it's the,

my argument when we covered that story

back then was like,

this is why we need to normalize tools,

uh, privacy tools,

because

if the only people using Signal are,

not that they're doing anything wrong,

of course,

but like dissidents and drug dealers,

then like it becomes like, oh,

you're on Signal,

you have something to hide, which,

you know,

in some countries being a dissident is

illegal.

So my point is I'm not trying to

morally group them into the same thing,

but my point,

it becomes something suspicious.

Whereas like if my stepdad is using

Signal, probably does not know what it is.

I had to download it and put it

on his phone and set it up for

him and get him in the family chat.

He didn't even know it could do video

or voice calls.

I tried to call him on it one

time and he didn't pick up.

So I called him on the regular phone

and he's like,

did you just try to call me on

signal?

I'm like, yeah, it does voice calls.

He's like, oh, I didn't know that.

So,

but my point being like when everybody's

using it,

then it takes away from that stigma

because they can't point to it and be

like, oh,

only bad people are using signal.

Really?

Really?

My seventy year old stepdad,

you think is running drugs from the

border?

Come on.

So anyways, yeah,

I just I know that's a little off

topic,

but I always feel the need to say

that.

So I think that'll take us into forum

updates if I remember correctly.

Yeah, well, in a minute, everyone,

we're going to start taking viewer

questions.

Of course,

you can always leave them in the chat

anytime.

But if you've been holding on to any

questions about any of these stories that

we've talked about so far, go ahead,

start leaving them now here in the chat

or in the forum thread for this live

stream.

Otherwise, yeah,

let's check it on the community forum.

There's always a lot of activity on the

forum every week,

so you should always check it out.

But here's a couple discussions that we

had

wanted to highlight from this week.

The first one is here about Russia's

internet blocks.

Let me get this pulled up.

This was just a discussion on a New

York Times piece which talked about

Russian internet restrictions and how

Russians are evading them.

So it's a bit of a cat and

mouse game there.

So the person who posted this said,

as some background, since early March,

Moscow and St.

Petersburg have experienced widespread

mobile internet blackouts,

not just blocked apps,

but full mobile data shutdowns.

Telegram is reportedly being blocked

entirely starting in April.

The government regulators now have the

authority to disconnect Russia from the

global internet entirely.

And some regions of Russia are on

lockdown.

whitelist mode meaning everything on the

internet is blocked except state-approved

services like yandex and government

portals um so yeah this version was

interested in whether or not there's a way

around this government censorship um which

could expand to europe and north america

The whitelisting situation,

that is pretty tricky because that's going

to block even the ability to use Tor

bridges, for example.

I know that Tor bridges are probably the

best way to get around censorship,

but if you're in a full whitelist

situation, that may not work.

At the end of the day,

if your internet service provider isn't

going to allow you to make any sort

of connections,

There isn't much you can do about that

besides find an entirely alternative

network.

So people in this thread note that Russian

citizens have started using Meshtastic to

communicate,

which is a decentralized network that

doesn't use the internet at all.

It uses LoRa radios,

which are small devices that you can

connect to your phone to communicate,

but they have very limited range,

although you can set up a mesh with

them.

There's probably other solutions,

but I think, yeah,

there's probably not too much you could do

from a technical perspective here that I

can think of.

Was there anything in this form that you

wanted to highlight specifically?

No,

it was really just kind of the Russian

internet blocks in general.

I know when those, well,

when the war in Ukraine first started,

I know Russia started cracking down on

VPNs.

And at the time I was with Surveillance

Report and Henry really made a good point

about how this is one of the drawbacks

of a centralized app store.

And at the time we were talking about

Apple,

but now it seems like we're starting to

talk about Android too.

Um, because, you know,

with Android and sideloading, uh,

which I know people don't like that term,

but you know,

Android and installing third-party

installs, whatever you want to call it.

It's, um,

it's kind of hard for Android to be

like, well,

we blocked VPN installs because they can't

block VPN installs and Tor installs.

Whereas Apple, you know, when,

when Russia came to Apple and was like,

Hey,

remove proton VPN and Nord VPN and all

these VPNs, they had no choice,

but to be like, all right, we'll do.

Cause you know that everything's so

centralized and locked down, but.

Yeah, with a total internet blackout,

the thing that comes to mind is years

ago, again, back on surveillance report.

So I interviewed John Todd,

who was the president of Quad Nine,

I think.

He's from Quad Nine.

I think he was the president at the

time.

I'm not sure if he's still there.

But it was interesting because we talked

about,

or it briefly came up about censorship

resistance.

And something he said that always stuck

with me is he's not a fan of,

DNS over HTTPS specifically for stuff like

this because if if the government starts

doing mass blocking at a DNS level and

you use something like DOH it makes your

traffic just blend in and eventually it

kind of like

I'm not trying to use language that is

sympathetic to a government for the

record,

but it kind of backs them into a

corner where they just decide to shut off

the internet entirely because they can't

figure out what traffic is going around

the censorship.

And I guess he was really ahead of

his time with that prediction because

that's basically what we're looking at

right now.

So yes,

it's a really tricky thing because how

would you, you know, and especially,

I don't know,

I feel like completely disconnecting from

the global internet is a completely

different beast that I don't even know how

we would handle that.

And I guess at that point it's,

I mean,

it's what are you trying to do?

If you're just trying to talk to people

locally, then yeah.

Things like Meshtastic, I think,

I really want to get into that,

but it looks like it would require a

little bit of skill just to kind of

first time dive in, you know,

to figure out the hardware and figure out

the install and the apps and the,

it feels like a bit of a commitment,

but if there's maybe a way to make

those things a little bit more

user-friendly or...

I don't know.

Yeah,

it's a good question because there's

different things you would need in that

situation, right?

I would need to be able to communicate

with my family here in the country,

hypothetically.

But then I would also need to be

able to communicate with the wider

internet and get information,

which here in the US, unfortunately,

we are kind of the wider internet.

But in another country,

that wouldn't be the case.

Or I mean, Proton even.

I wouldn't be able to check my ProtonMail,

so...

Yeah.

I don't know.

It's crazy.

And even Meshtastic,

that puts people in a dangerous situation.

And there's always the possibility that

Russia could, I mean,

both ban the use of it,

but also ban the import of Meshtastic

hardware.

I doubt any of it is being made

domestically in Russia.

And if anything is or could be,

the Russian government could stop that.

Yeah.

and also just using it,

or any sort of radio service,

you can be trivially tracked.

It does have a short range,

so it depends where you are,

but if people go around from the

government and try to track people down

who are using Matchtastic in the future,

they would pretty much be able to find

out who's

using it um so there so there are

concerns there i mean we even talked about

in a previous episode um i think it

was in belarus if i remember correctly um

ham radio enthusiasts were being accused

of like um being espionage agents

basically um for

for using their own like radio waves to

communicate rather than like these

government sanctioned things.

So it does like any of this amateur

radio stuff does put you in a dangerous

position in a country like this.

And especially if it becomes too

widespread,

it's very easy to imagine that Russia

would take a similar position to the

Internet in general and just blanket ban

it because they don't really need it.

The other reason this can't really be

solved from like a technical perspective

is

Um, like,

I don't think it's something that another

country like the United States or someone

else could kind of reach in and try

to solve for Russian citizens.

Like immediately what might come to mind

is something like Starlink, for example,

providing direct access to the internet,

bypassing, you know,

anything going on in Russia.

But Starlink,

like when that technology is in place,

we see it used for, um,

a lot of different things that the United

States and companies like SpaceX

definitely do not want to promote or

support.

We saw in the war with Ukraine,

for example,

Russian frontline troops were using

Starlink extensively to communicate on the

battlefield.

That's actually the reason SpaceX

does not operate in that region at all

and hasn't for many years.

And bringing it back for Russian citizens

to get around something like this would

just enable that usage of it again,

which they definitely don't want to do.

So it puts Russians in not a great

situation and really the only solution.

like we say for a lot of these

very widespread privacy issues,

whether it's age verification in Western

countries or mass censorship in other

countries, like in this case,

it's more of a social issue that you

have to resolve within your own country.

And hopefully people can fight back

against this there.

Because, I mean,

this should not be unacceptable.

I mean, this should not be acceptable,

if you know what I mean.

So, yeah.

Yeah,

it's definitely something tricky that I

don't know if we're qualified to solve.

But I guess if there's any takeaways on

this one,

it would just be kind of a...

I'm pretty open about having a mild

interest in disaster prep.

And sometimes that gets categorized as

wrongly it gets characterized as like you

know worrying about the end of the world

um which i don't care about that but

you know just little things like floods uh

hurricanes tornadoes earthquakes and

unfortunately we are in an incredibly

digital world so you have to think about

outages and cyber attacks and so um i

guess yeah if nothing else this is just

kind of a thought experiment of

if you're listening and you're in a

situation where you don't have to worry

about this yet,

just think about it a little bit.

Like don't lose any sleep over it,

but you know, what,

what would I do in that situation?

And just kind of give that some thought,

I guess.

The other forum post we were going to

look at, this one,

there's probably not too much to say on

this one, but there's a new video,

a YouTuber, this got shared on our forum,

that said, if you ran this debloater,

reinstall your system immediately.

And this is specifically,

so for the Windows users out there,

you know that there's a lot of scripts

that promise to do all kinds of different

things to your system.

Um,

there's a lot of ones that are popular

in the privacy community that promise to

remove a lot of telemetry and stuff.

There's also some that claim to optimize

the graphics and the performance and this,

that, and the other,

there's even entire windows ISOs that, um,

I want to say it was called Atlas

OS.

And if I've got that wrong,

I apologize to those guys.

But there was one that advertised itself

as like a gaming distro.

And it's basically like you install

Windows from scratch using this customized

ISO and it comes pre-optimized for gaming.

But the downside is it turns off Windows

Defender.

which I don't know why you would do

that.

So yeah, I'll be honest,

I didn't watch this specific video,

but basically it was not trustworthy.

I think it may have even come with

actual malware,

but don't quote me on that.

And so this whole thread is basically

talking about these deep loaders and

stuff.

And I think the official position of

Privacy Guides is that we don't recommend

them because they are...

They're tricky.

I know there's some that are open source

or source available, I should say.

And if you know code and you're

comfortable doing it, then sure,

you could look through it and make sure

that you verify what it's doing.

But it's definitely very...

A lot of these deep loaders,

you're giving them a lot of power over

your Windows system.

And...

If you're going to use one,

you have to be like come off of

a mountain and found a religion positive

that this thing is trustworthy because it

would not take much for it to do

something malicious,

whether that's planning malware,

crypto mining, stealing data, whatever.

So, yeah.

Absolutely.

I think I just wanted to take a

moment to mention that.

And it's worth noting this tool in

question is open source as well.

As far as I know,

it doesn't come with malware,

but it basically acts...

the way that malware would.

There's a pinned comment on this video

saying there's a few inaccurate

statements, but overall,

the conclusion of the video is that this

is all implemented poorly.

I do think this is a classic case

of like,

somebody putting something out there

without really fully understanding what it

does.

I don't want to say whether it is

or not,

but I think we're just going to see

this happening more often as more people

try to AI code tools to solve all

of their problems without really

understanding what they are.

Whether or not that's the case in this

situation,

it's definitely something to look out for

when you're running any sort of scripts

that you don't fully understand.

I think that is absolutely the most

important takeaway here,

that you cannot run any of these deep

loading scripts unless you know exactly

what they do and you see how they're

doing it,

because at which point you could probably

do it yourself, by the way.

But yeah, all of these scripts like this,

they affect the system so substantially.

And Windows is already such a not secure

and not private platform in the first

place that it doesn't really make a lot

of sense to me to try and improve

it, especially to this degree,

unfortunately.

There isn't really a ton...

that you can do at the end of

the day to improve your privacy on Windows

because the operating system itself is

going to be constantly fighting against

you.

So that's unfortunate.

It's cool to see more videos from this

YouTuber.

I first...

heard about this person who made this

video calling the other YouTuber who made

the script out because they made a video

about Freely around the same time that I

published a video about Freely.

So they came up in my feed.

And I think we had some overlapping

complaints.

I haven't watched the rest of their

videos,

but I think anybody who is creating

content in the privacy space

That's always a good thing.

And so if they continue to be brought

up and they continue to post more useful

content like this,

I think that's fantastic.

Yeah, I think about that a lot.

There's...

I think there's still plenty of room in

the privacy space for more voices,

for sure.

Yeah, real quick,

looking through his description on his

video, you're right.

It doesn't look like it installs malware,

but it disables crucial security

components and makes your system severely

vulnerable to malware.

So it also makes your system much more

unstable and prone to corruption and

breaking.

I recommend that anyone who ran this tool

immediately reinstall a fresh copy of

Windows.

So yeah, they're dangerous things.

You've got to make sure they're trusted if

you're going to use them at all.

I also totally hear your argument of like,

it's already so like such a lost cause

that it may be safer for a lot

of people to just not even try and

just stick to like the,

the toggles and the settings and stuff.

So, yeah.

Yeah.

Well,

we've been going for about an hour and

a half here.

We'll probably give a last call for any

questions or comments that people want to

leave on the forum.

I don't think we had any on our

forum post today,

and I'm not sure if I've seen any

in the chat here.

I know there's a bit of a delay

on this live stream between when I'm

saying this and when you'll hear it,

so we'll give people a couple of minutes

if you want to add anything else.

Otherwise,

we'll probably begin to wrap things up.

So this is your final morning,

anyone who's watching and wants to chime

in on any of these stories.

It's always my favorite part of a live

stream is knowing that delays there.

So you say stuff like that, like, Hey,

we're going to open the floor.

And now I have to fill time for

a couple minutes and give people time to

hear it and write their questions.

Uh, it just feels so awkward, but, um,

Yeah,

apparently we don't have any questions in

the forum here.

Got one question from Hogan in the chat

here.

There's been a couple of supply chain

attacks recently.

The current best practice is to always

update your apps,

but this opens you up to those attacks.

Does it still make sense to keep apps

updated as recent as possible?

Definitely depends on the app.

I know you have definitely seen this more

prominently in apps that are built with

NPM, probably a lot of web-based apps.

But in general,

I do think it's probably the safer option

to keep your apps up to date versus

not updating them because

Typically,

all of these updates are going to... Well,

not all of them,

because some of them just add features.

But most updates that you see are going

to be patching known vulnerabilities or

vulnerabilities that you already see in

the wild.

And so the potential of a new update

having a zero-day vulnerability that

hasn't been discovered yet is probably a

lot lower than the potential of using code

that

almost certainly has known vulnerabilities

that can be exploited.

So yeah,

I would definitely recommend keeping apps

up to date.

And especially the lower level you go,

the more important it is.

Keeping your operating system up to date

is super important.

As we saw, I don't know if...

when we talked about this on the show,

but recently iOS had a bunch of updates

for zero-day vulnerabilities in Safari and

some other security vulnerabilities which

were not patched at all in the previous

version of iOS.

You had to be on iOS to receive

some of these security updates.

And so it's examples like that where even

a company like Apple,

which is relatively well known to provide

security patches to older versions of

their operating system,

they almost are never doing that super

consistently.

And in that case, they weren't.

And so it's always, I think,

a danger to not be fully up to

date.

It's interesting, kind of related to this,

I just installed an app on my phone

and during the setup process it said you

should disable automatic OS updates

because they don't validate how it works.

And I was like, that's terrible advice.

That was a medical device related app.

So I think they were saying that because

they have to validate how OS updates work,

but it's like that kind of puts all

of the users of this device in danger.

So that's...

yeah sometimes you will definitely see

software and advice that are at odds with

security advice but generally um yeah keep

your stuff up to date yeah i agree

i think um i hope that i would

be interested to see an actual study on

how many like supply chain attacks versus

how many um like known vulnerability or

zero days are being patched um i'd be

willing to bet that

the supply chain attacks are more rare

just by raw numbers.

And, you know, something,

something I struggle with a lot in all

areas of life is I forget what the

name of it is, but, um,

It's a logical fallacy because news is

news because it's out of the ordinary,

right?

Even the example I like to use is

traffic accidents.

Nobody ever goes on... Tonight at five,

man gets home from office safely without

incident.

Nobody talks about that.

And even traffic,

accidents are so common that we don't even

really talk about the accidents that much.

It's usually just like, hey,

traffic's bad because there's an accident.

It's more about the traffic.

But

News is news because it's unusual.

So when we see all these supply chain

attacks, it's because, I'm guessing,

they're still the exception instead of the

norm.

But that said, I hope...

kind of a dark way to look at

it, but I,

I hope we're seeing enough of them that,

um,

companies are starting to wake up and

realize the importance of securing their

supply chain, whatever that may look like.

Um,

and hopefully we will start to see those

go down because if they do become too

common,

it becomes a problem for the companies

too.

Cause think about it.

That's money.

They have to spend a, um, regain control,

kick out the person,

try to push out the good code to

fix the bad code.

Um, the reputational damage,

like all of that stuff.

So,

It affects them too.

I don't know if we're at that point

yet, but... Absolutely.

I mean,

to take it to the most extreme example,

right?

Like,

you never would ever see a news article

today about a new vulnerability in Windows

XP or something like that.

But everyone knows you can't be using

Windows XP on the open internet because

it's just so insanely vulnerable to all of

these attacks.

But, like...

We already know you shouldn't be using it.

So if a new attack is discovered,

that's not going to make the news.

And that's going to be the case for,

I think,

a lot of apps that you don't keep

up to date, which is why, in general,

I would still say the updates are super

important.

Yep.

All right.

I guess that's all we got this week.

Okay.

All right.

Well, I think, yeah, we can, I'll just,

I'm going to give the form thread one

more check unless you just did,

but it looks like there's nothing else.

Yeah,

I've got it open on another window here.

Cool.

Okay, well, thanks everyone for tuning in.

Like usual,

all of the updates from This Week in

Privacy,

we share them on the blog and in

our email newsletter every week,

so you can sign up for that newsletter

or subscribe with your favorite RSS reader

if you want to stay

tuned about new episodes,

and also all of the sources for this

episode.

That's where we post them all,

so if you want links to all the

articles we talked about, check that out.

For people who prefer audio,

we have a podcast available on all podcast

platforms in RSS,

so you can use your own podcast reader.

The recording for this video is also going

to be synced to PeerTube like usual,

so you can watch it outside of YouTube.

Here at Privacy Guides,

we are an impartial nonprofit organization

that is focused on building a strong

privacy advocacy community and delivering

the best digital privacy and consumer

technology rights advice on the internet.

If you want to support our mission,

you can make a donation on our website

at privacyguides.org.

To make a donation,

you can click the red heart icon located

in the top right corner of our website,

or go to privacyguides.org slash donate.

You can contribute using standard fiat

currency via debit or credit card,

or opt to donate anonymously using Monero

or with your favorite cryptocurrency.

Becoming a paid member of Privacy Guides

will unlock exclusive perks like early

access to video content,

early access to the show notes for this

show,

and priority during the This Week in

Privacy livestream Q&A.

You'll also get a cool badge on your

profile on the forum and the warm,

fuzzy feeling of supporting independent

media.

Thank you all again for watching,

and we will see you next week.