Graphene OS has released an in-house

text-to-speech software,

California is exempting Linux from age

verification laws,

and some major new research in both

privacy and cybersecurity.

All this and more coming up on This

Week in Privacy, so stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

within the Privacy Guides community and

this week's top stories in data privacy

and cybersecurity.

I am Nate.

Glad to be back.

And with me this week is Jordan.

How have you been, Jordan?

Oh, you're muted.

Good.

Yes.

Thank you.

Let's comment to dive into some of the

stories this week.

All right, yeah, there's, oh man,

there were so many stories this week,

so many big stories,

but we picked a handful of the ones

we feel are the most important,

and we're gonna go ahead and dive into

those,

starting with the initial release of

Graphene OS speech services for

text-to-speech.

So this is kind of what it says

on the tin.

You know, to be totally honest,

it's very straightforward,

but it's still really exciting and pretty

big.

I don't personally I'm subscribed to an

RSS feed where I'm subscribed to a lot

of the major projects in the privacy

community.

So like

I think I'm subscribed to the blog for

Signal, Debian, Fedora,

a bunch of projects.

And Graphene is one of them.

But I kind of only get their releases,

I think, on GitHub or something.

So I don't know if this is something

they announced they've been working on for

a while or not.

But to me,

it kind of came out of nowhere.

And, um, it's pretty cool.

So it, uh, again,

it is what it sounds like.

It's if, if you have, well, I mean,

any phone really, um, you know,

when it talks to you,

like if you're using a navigation app or

you're using a Duolingo or, um,

trying to think what else, uh,

maybe like a screen reader.

Um, a lot of these apps do not,

as far as I know, don't come, uh,

like built in with their own voice

library.

Um,

they rely on the phone's text to speech

ability and, uh,

For those of you who have ever used

a custom OS,

you may have realized that

A lot of the custom OSs do not

come with a built-in text-to-speech

library.

And up until now,

I believe I saw in the comments on

this thread that Sherpa is a really

popular one.

I've never heard of that.

I hate to admit,

I historically have relied on just the

Google text-to-speech.

I've went and downloaded that from the

Play Store,

which is probably not great for privacy.

I honestly,

it didn't even occur to me that there

was a...

I think I did a search in F-Droid

and I didn't find anything,

and that's why I did that.

But...

Might check out Sherpa now.

I don't know.

But this is really cool because Graphene

now has their own that they're offering.

It is currently only available for US

English.

And if you're in another language,

you basically have to go and manually

change that.

It says here in this announcement that

once it's bundled with the OS,

it will be enabled by default.

So activating it won't be necessary.

According to the changelog,

that just happened, I think,

on the twenty fourth.

So like earlier this week.

So if you are a Graphian user and

you are on the latest version or you're

about to install it,

this should be enabled by default.

If for some reason you are not on

the latest version,

the Android UI for this is super,

super confusing because...

Let's say you go ahead and download this.

Let's say you're on an old version.

You download it and you go to settings

and you go to system and you go

to language and region.

It says all this right here, speech,

text to speech output, preferred engine.

It'll show it there.

And it looks like it's enabled.

So it's really confusing because you're

like, yeah, it's there.

It's on.

Why isn't it working?

But again, it's bad UI.

You have to actually click on it and

select it as if it wasn't there.

It's a horrible UI.

And that's not graphene for the record.

That's just Android.

That's Google.

That's all on them.

It's terrible,

but thankfully it's bundled by default.

So now you won't even have to think

about it and it'll work.

They say that this was built from a

fully open source model for text to

speech,

which they created themselves using

existing open source code and data.

And they actually,

I guess they just recently got like a

better, I think that's a GPU and RTX,

so now they can continue to improve it

and they can build these models faster and

stuff like that.

They said that they will most likely be

doing German and French next.

because they believe those are their next

biggest user bases.

And they said UK English would likely be

much easier to add because of the shared

code and data.

So pretty interesting stuff.

And what I thought was exciting was they

said they also plan to make their own

speech-to-text implementation so you can

talk to the phone, again,

for things like Duolingo or not so much

voice notes, but I think dictation.

You can say what your text messages are

and stuff like that.

They said that if they do more languages,

they might add the language as an optional

download in the App Store,

the Graphene App Store,

just because that would be a lot of

stuff to download.

And I get it.

Let's say they get a lot of community

support and they're able to pump out

German and French and Finnish and Chinese

and all these other languages.

I personally would have no need for those.

So I really appreciate them trying to keep

the model pretty light.

But yeah, I think that's kind of the...

The core of this announcement,

the only thing I did not see anywhere,

I don't believe it's...

Because sometimes Graphene will make some

of their apps available publicly,

like their camera and their PDF reader.

You can go download those from the Play

Store right now.

But I did not see any indication that

they're going to be doing that for this.

I don't know if that's something they're

planning to do or not, but...

I didn't see anything about that.

So those are kind of the facts of

the story.

I'll turn it over to Jordan first.

I don't know if I have a whole

lot of analysis or opinions,

but so Jordan,

did you have any thoughts on this one?

I mean,

I just think this is a good step

in the right direction, right?

Like we should be having

this feature built in by default.

I think accessibility gets put on the back

burner a bit.

I think most people when they think of

text-to-speech, this is mainly used...

The thing that came to mind for me

personally was navigation apps.

You probably want

Because I don't know,

it depends on where you live, I guess.

But generally looking at a phone while

you're driving is legal.

So you probably don't want to do that.

So like having someone read out

instructions is kind of important, right?

Like that's a basic function that I think

a lot of people would

would want right and that's something that

has originally it was done through

Google's speech synthesis um model which

you know that's another problem you have

to download that from Google you probably

don't want to have to do that if

you can avoid it right so um I

think this is just another addition though

that Graphene OS has been doing where

they've been building out stuff

specifically for like

like as a replacement for Google's tools,

right?

Like we saw how they've got, you know,

they proxy a lot of requests that are

made on the operating system,

stuff like that.

It's just another additional thing where

we're not relying on Google for their

software because, you know,

like we saw

we've been seeing, I guess,

is that Google is kind of being a

bit restrictive with their whole

ecosystem.

The future of Graphene OS on Google Pixels

is a little bit up in the air.

There's a possibility that it may not

continue in the future or it might have

issues because

Google wants to lock things down and limit

access right so I think this is good

from that perspective and also for people

that are you know low vision or no

vision you know like some people use their

phone like specifically in uh in Android

there's this option for talkback

which basically allows you to navigate

your phone without having to look at the

screen, right?

So I think this is also going to

be kind of big because I think,

you know, here at Privacy Guides,

we really kind of push this a lot,

but like privacy should be accessible to

anyone, especially, you know,

people that shouldn't be excluding people

based on,

silly things like that, right?

I think this is just a step in

the right direction on that aspect from an

accessibility point of view as well.

Like for people that...

I think having this added by default is

going to make it a lot easier, right?

Because before you would have to go

through, log into the Google Play Store,

download this thing.

It's like you can't expect someone to be

able to do that.

So I think this is pretty cool.

It's a good addition.

I personally found that...

This wasn't enabled for me by default.

I had to go and download it on

the GrapheneOS app store and then follow

the instructions in the GrapheneOS forum

to actually enable this.

So I would probably look at that if

you're interested in using this.

Another thing is it's...

I think they definitely are going to be

working on the sound of this a little

bit.

I'll just play some example audio clips

right now so you can hear kind of

what it sounds like,

because I'm sure some of you probably are

wondering that.

Here's just a test from Organic Maps.

If you know a software developer,

you can ask him or her to implement

a feature that you need.

Our main goal is to build fast,

privacy focused,

easy to use maps that you will love.

So, I mean, I think it sounds fine.

You can understand what it's saying,

right?

But I think it's definitely a very

early...

I think it definitely doesn't sound as

good as what Google offers, right?

Which kind of makes sense.

They're a massive trillion-dollar

corporation.

But I think it does what it says

on the tin.

So, I mean,

I think that's just good in that respect.

But yeah,

it wasn't enabled by default if you

already have the operating system

installed.

But I think like Nate said,

it'll be enabled by default and selected

on new installations possibly.

So I would follow the instructions if

you're interested in getting that

installed.

So just to clarify,

you're saying that when you updated to the

latest release,

like you already had graphene,

you updated to the new release and it

still wasn't enabled by default for you as

a pre-existing user?

So I had to go into the GrapheneOS

app store and download this package.

So the GrapheneOS speech synthesis

package,

and then I was able to enable it

in the settings.

Okay, okay.

So yeah, so okay,

I guess if you're an existing user,

you have to go grab it via the

instructions here on this post,

which are in the show notes.

We link directly to this post,

but if you are moving to Graphene for

the first time,

it should all be bundled with,

which is pretty cool.

Yeah,

there were a couple things you said that

I wanted to add to.

Number one,

you did mention the Google one, and...

One thing I forgot to mention is the

Google one, in my experience,

doesn't always work offline because I know

that's kind of like that was my first

thought when I was like, OK, well,

I'll download the Google speech synthesis

and then I'll just use the firewall to

just cut off access.

And for some reason,

some people said they've done that

successfully.

For me, that didn't work.

It like needed an Internet connection.

But yeah,

so it is really that is one reason

it's really cool to have this like private

alternative platform.

It is if you're one of those people

that it's not working for you to just

firewall Google.

And yeah,

I also just want to back up what

you're saying about accessibility is I

feel like and, you know,

I I have good vision as long as

I have my glasses on.

So so I could be wrong here,

but I feel like open source has done

a.

mostly OK job,

at least some of the bigger services like

Mastodon.

People are really sticklers,

in a good way,

for making sure that you alt text your

pictures and stuff like that.

And I know even Loops,

when I upload Loops,

there's an option to add a description of

the video.

And so I feel like some privacy or

some open source has done a really good

job of being accessible for visually

impaired people.

But overall,

I do agree that there's a lot of

work to go still in terms of having

a good, smooth voice sound.

Which again, yeah,

considering we're competing against a

company that probably built their voice

synthesizer by just stealing everybody's

voice all the time.

I think the graphene one sounds pretty

good for what it is.

But definitely, I think...

I've been trying to think...

I would like to write some blog posts

about this topic,

but I'm trying to think of how to

put it into words.

I know like...

You know, my wife, I'm very open,

has like severe ADHD and that's something

she struggles with is the UI.

Like for someone like me,

it's just kind of like, yeah, you know,

it's not that pretty, but it works.

But for someone like her, like that,

it fails to grab her.

And it's like,

it's grating to use.

It's like nails on a chalkboard for her

because of her ADHD,

or they're missing things.

Like she hasn't switched a proton calendar

yet because it doesn't have tasks like,

like Google does.

And like, she needs those,

like she lives by a to-do list.

And so, yeah, I think in general,

open source has a lot of room for

improvement on accessibility.

And it's really cool to see people taking

a step forward,

not trying to get on anybody's case,

just pointing that out.

So.

Yeah.

If that's all we have,

you have any more to add to that

one?

Ah, no, not really.

I guess we can jump onto the next

one here.

So this next topic is about researchers

issuing a warning about tech that could

turn every router into a potential means

for surveillance.

So here's this article here from Gizmodo.

Um,

so basically researchers warned that a new

method of detecting people through wifi

signals poses a serious privacy risk.

So basically they did a study, um,

And they focused a little bit on beam

forming feedback information.

So I guess for people that don't know

what beam forming is,

basically it allows routers to direct

signals towards devices more efficiently.

And there's like,

that's like an unencrypted connection that

is made basically.

And that feedback that is received by the

router can be accessed.

So that is kind of what this research

paper is talking about here.

So according to the study's press release,

once a machine learning model has been

trained,

identifying someone takes only a few

seconds.

So they can identify people based on their

feedback that their device basically makes

to a router, which is, I guess,

kind of makes sense, right?

Because, you know,

That would be, I mean,

I think this is interesting,

but I'm not sure how likely this would

be in practice.

But it says, during the study,

researchers collected Wi-Fi signal

recordings from nearly two hundred

participants as they walked through a

Wi-Fi field using different walking

styles.

The data was recorded from four different

perspectives using both the BFI method and

another

older wi-fi sensing approach relying on

channel state information basically

channel state information is basically how

a radio signal changes as it travels

through a room that's what the article

says here so the old csi method was

able to identify individuals based on

their normal walking style at eighty two

point four percent accuracy

Basically,

they're saying that this technology where

they can analyze the feedback from

people's devices using the beamforming

basically enables them to identify that

device as being there.

So that could be used to track your

location or track where you've been,

basically.

I'm not really sure what the...

what the fix for this would be.

I guess like there would have to be

an update to Wi-Fi standards to basically

overhaul and replace beamforming

technology completely.

But I think also the other technique that

they mentioned in this article is also

kind of

still applicable in that method as well so

I don't know it's kind of it's kind

of concerning but I think this is

basically you know if your device is

making or connecting to like any sort of

radio signal it's kind of able to be

tracked I think this is kind of a

a normal thing that we should be

acknowledging as possible like we talked

about this a little bit last week or

the

cellular technology, for example, like,

you know, that's the same thing, right?

You're connecting to towers, radio towers,

like cellular towers.

So, you know,

whenever you're making connections like

that,

the information can be intercepted or like

tracked, right?

So, I mean, I think this is

I guess this is kind of obvious to

me so I'm not sure if this is

like it feels like it's a little bit

scaremongering this article um like your

device makes wi-fi signals that can be

tracked like I don't know that seems kind

of obvious to me but um yeah do

you have any thoughts on this one Nate

that you wanted to add I feel like

I'm not seeing this this is that much

of a concern but

No, yeah.

So I think one of the reasons we

picked this article this week is because

it did make the rounds.

A lot of people were sharing it.

I did see some people had very similar

takes to you where it's like, yeah,

this is – like is this genuine research

or is this just kind of fear-mongering?

And I think it's a little bit of

both because like I didn't really pay much

attention to this article when I first saw

the headline because I'm the same as you.

We covered a story exactly like this I

think two or three times back at

Surveillance Report when I was on there.

But I think –

From what I understand,

this is kind of like the next evolution.

You know,

we talked again back on surveillance where

we talked about how like at least the

first time I remember seeing this,

which I think somebody said in like

because I found this article through Bruce

Schneier and somebody in his comments were

like, yeah,

they've been able to do this for decades.

Like there's proof of concepts going all

the way back to I think he said

the nineties.

And

I think when, again,

when I first heard of a story similar

to this a few years ago,

it was kind of like, Whoa, that's crazy.

And then we heard about it again,

like a couple of years later and it's

like, Oh, this again.

And I think what it is is it's,

it's just getting better every single

time.

And, um,

I think that's what makes it concerning.

Cause yeah, basically the idea is, uh,

for those who don't know radio waves of

any kind, um,

when they pass through something that

changes, it's like sound waves or light.

If you've ever seen,

like as a school experiment or you've seen

the, I wanna say animation,

but that's not the right word,

the examples,

the graphics of like light hits water and

then it bends, right?

Like anytime something passes through a

medium, it's going to change.

ask me how I know this is a

sound guy who works with wireless

equipment.

Um,

one of the most annoying things people can

do that they still do.

And I get it is in a big

room,

they'll take their little wireless

microphone pack that like clips on here

and they'll stick it behind them.

And it's just like, cool.

So now the antenna has to pass through

your body,

which is a giant bag of salt from

an RF perspective.

And you've just dampened my signal signal

significantly because of that.

And, um,

so it's the same thing with wifi.

It's the same, it's a radio wave.

It's the same thing.

And as it passes through a person or

drywall or, uh,

a couch or a cat or whatever it

changes how the signal moves and so

basically they're just getting better and

better at detecting those changes to the

point where now not only can they say

like oh there's a couch and a cat

sleeping on it and someone in the room

they can be like i know who's in

that room and which cat is in that

room and i i think that's

A little bit scary.

But that said, you're right.

Like the researchers did say that they

have not seen any evidence of this being

used in the wild.

The article really didn't give a lot of

detail.

They just said that researchers are urging

the I, I think they call that IEEE,

the organization that sets industry

standards to include stronger privacy

safeguards in the upcoming eight or two

dot eleven BF standard,

which is meant to standardize Wi-Fi

sensing applications.

So they didn't really go into detail,

but it sounds like there are

some changes that could be made to,

to at very least mitigate this.

And hopefully those will get made,

but yeah, I think it's,

it's I don't know.

I find research like this really

interesting because it's, it's kind of a,

it's like a balance, right?

Because I think this is the kind of

stuff that if we're not careful,

this can turn into paranoia.

Like your wifi signals can track you and

this could track you.

And hypothetically,

we're gonna talk a little bit later about

a story where like your hard drive could

be used to track you.

Like there's so many ways to track you,

But it's also a question of, like,

is this actually happening?

We have no evidence that this is

happening.

The article didn't really specify, like,

do you have to be local?

Like,

they mentioned that beamforming is

unencrypted.

So, okay,

does that mean you have to be my

next-door neighbor who's hacked into my

Wi-Fi and you're doing this?

Or does that mean that, like,

my ISP on the other end of the

connection could be doing this?

It's not really clear, but...

Yeah,

I think it's just I think I like

covering stories like this just to kind of

make sure people are aware, I guess.

I don't know if it's a huge threat,

but it's definitely interesting to know

that these kinds of things are possible

and hopefully fix them before they do

become widespread,

commonly abused tactics.

I think one interesting thing that you

brought up there was like, you know.

the radio wave stuff.

Like I feel like we almost might have

seen this before, right?

Like we saw lots of stores implementing

Bluetooth beacons to sense like Bluetooth

is the same thing.

It's a radio, right?

Like it's radio waves.

So like, you know,

I can imagine that this would be used

by stores to track customers or to track

activity within a store, right?

This could be used for something like that

too, right?

I don't think so because the Bluetooth

thing is based on someone correct me if

I'm wrong, but as I understand it,

the Bluetooth thing is based on the idea

that like your phone.

So most people.

myself included, I hate to admit,

when I go into a store,

I have my, this is a pine time,

but I have my watch and I have

Bluetooth turned on,

connected to my phone,

mostly because sometimes I won't hear it

ring.

Like sometimes I have my headphones in and

I'll listen to podcasts while I go,

sometimes I won't.

And if I don't have my headphones in

and my wife texts me like, oh, hey,

I just remembered to grab milk or

whatever, I won't hear my phone.

But then if my watch buzzes and I

look down and it says new signal message,

Um, but anyways,

the reason I bring that up is,

you know, I've got my phone connected.

And so my phone is,

and my watch both are broadcasting

Bluetooth signals and, um,

stores will like,

every time you go into the store,

I think they,

they basically record your device and

they,

they track it as you walk around because

it's broadcasting.

It's not really so much like the RF,

like physically tracking you.

It's that they recognize your device.

It's like a type of fingerprint,

which I think is why, um,

a lot of like apple and android both

i think or maybe it's just like graphene

does it but i know like apple will

randomize i think they randomize the mac

bluetooth address i know they do it with

wi-fi but um they're they're basically

trying to fight that a little bit so

that way you don't have the same bluetooth

address every time you walk into the store

and they can't track you as easily but

i think that's the i think that's how

the bluetooth thing works um uh so okay

terracotta has an interesting point here i

feel like at this point scientists should

hold back from any research that's

potentially harmful to privacy i don't

know i appreciate this research in the

sense that they're like trying to get it

fixed you know like i said at the

end they're they're trying to get the ieee

to fix it and it goes both ways

right because there's um like i don't

I do and I don't agree with you

because, yeah, on the one hand,

it could be,

it's almost like a disclosure, right?

Like when you publish a vulnerability,

now all the cyber criminals are going to

use it.

But also like if we publish it,

then maybe people will know it's out there

and we could like try to get it

fixed.

So I don't know.

I feel like that's a,

that one has pros and cons that go

both ways in my opinion.

I think also it kind of sucks.

I feel like the Wi-Fi ecosystem is...

They said that they might introduce a fix

in Wi-Fi BF or whatever that...

I think Wi-Fi eight or...

Yeah.

So I feel like that's another issue with

Wi-Fi is like some people I know,

they're still using like eight or two to

eleven B or like some like ancient like

Wi-Fi access points and stuff like that.

So it's like, you know,

I think it's probably not going to be

something that's going to be fixed very

quickly because I feel like most people

that are using Wi-Fi six,

even Wi-Fi six or Wi-Fi seven or Wi-Fi

six E they're like on the cutting edge.

I feel like most people still haven't

upgraded because there's not really that

much of a need.

I guess maybe if you live in a

country where there's actually fast

internet, maybe, but I don't know.

That's another problem.

No,

I totally agree because I'm in the same

boat.

I've had my same router for, God, like,

ten years now, I think,

or close to it.

And, yeah, like, why would I upgrade?

Like, the speeds are fine.

You know, maybe – I mean,

maybe I need to upgrade to a better

plan for my ISP, but the router works.

It covers the whole home.

If I got a bigger home,

then I could just, like – you know,

most people would resort to, like,

repeaters or, like,

a mesh network at that point instead of

just, like, buying a bigger router.

So –

Yeah,

I feel like routers are one of those

things that you kind of only replace when

they like break break.

So I don't know if that's necessarily good

or bad, but I agree with you.

I think it's something that a lot of

people just don't replace very often.

And so if you have an old router

that is not compatible with this new BF

standard,

then you might be vulnerable to this for

a while.

But again,

I hate when the articles don't mention

like how possible is this?

Again, is this something that like,

I need the KGB agent surveilling me next

door in secret,

or is this something that can be done

remotely?

I don't know.

I'm going to read the paper.

I'm going to see if I can find

out.

I mean, I don't know.

I was convinced that you don't actually

have to connect to a Wi-Fi network to

actually cause it to...

to be able to sense someone, right?

I think it's just walking within a Wi-Fi

connection, I believe.

But definitely double check that because I

didn't read the paper.

Right.

But I think the thing is that somebody

has to be listening.

It's a tree falls in the forest kind

of situation, right?

Any beamforming network is capable of

this,

but somebody has to be listening for it

in order for it to work, I think.

At least that's how I read it.

I don't know.

Yeah, exactly.

Yeah.

I might keep that tab open and read

it later.

Cool.

Sounds good.

I guess, I mean,

that's everything I had to add on that.

Do you have anything more that you thought

we should cover on that one?

I don't think so.

So on that note,

I think it is time to move on

to site updates.

We will be talking in a little bit

about some new developments from FDroid

and Tor about funding and digital freedom,

some really exciting stuff there.

But first, yeah,

let's talk about what we've been working

on this week.

So it's another one of those weeks where

we've been doing stuff behind the scenes.

I know it hasn't been a super big...

publicly forward-facing,

but we have a new video coming up

that I think should be ready pretty soon,

diving into NIST's updated password

advice.

So historically, you know,

the password advice has always been...

you know, long password, uppercase,

lowercase, letters, random,

all that fun stuff.

But now a lot of people know that

NIST's new guideline is that your

password,

you should focus more on length and

complexity doesn't matter so much.

So we put out a video explaining,

first of all,

like where did this complexity advice come

from?

How does it even work?

And then on top of it,

we talked about the new advice.

And like,

how does it relate to the old device?

How is it better?

Is it better?

So yeah, I'm excited for that one.

I have not seen the edit yet.

I know Jordan's been working hard on that.

But

I'm proud of the script.

I think we did a good one there.

And then after that,

I am in the middle of working on

a new tutorial tackling the recent Plex

price change.

And I think you guys will like that

one.

yeah um there's so many different

directions you can go one thing i like

about this job is that i have a

lot of creative freedom um but sometimes

that makes it hard for me to know

the best path to take so uh but

that one's coming along i think it should

be ready to send to jordan here in

the next few days so that's kind of

everything that's been going on in the

video side

Cool.

I'm excited to see how the Plex video

turns out.

I'm kind of interested to hear thoughts,

actually,

because maybe we can dive into that a

bit later,

because I think that would be an

interesting topic to talk about.

But yeah,

just to keep things on track here,

I guess I can dive into some of

the site updates this week.

I've kind of been following a lot of

this stuff, but just for...

Clarity,

this has all been Jonah's work here.

Basically,

there's been a new project that we're

working on at the moment,

and that is a Android app verifier

database.

If you've been following along and you're

quite into the custom Android space,

you'll know that

A lot of times it can feel like

downloading apps off GitHub and other

places like that.

It's hard to know if

app is safe or if it actually does

come from the developer itself or if

you're downloading the right thing and

originally the way to kind of check that

was if the developer offered a app

certificate hash which you could compare

to the one that you download so to

basically verify that the app you

downloaded is the one that the developer

actually created so that was

kind of only limited to very specific

developers who actually made that

information public,

which was kind of frustrating, right?

Because there'd be a bunch of apps that

you're not sure if their authenticity is

actually verified or not.

So we're kind of working on,

and when I say we,

I mean mostly Jonah,

but there's this GitHub repository that

we've basically opened up to the

community,

which

allows people to submit their app

certificate hashes.

And it basically, through GitHub Actions,

it'll verify whether someone's submission

is associated with currently known

applications, like on FDroid,

on Google Play, or a direct GitHub link.

And that basically gets processed by

someone on the team and

added to this database.

Basically,

the goal is to have a database of

apps that have app certificate hashes to

basically make sure that you are actually

running the apps that the developers have

actually created.

It's to avoid inauthentic apps.

I think this is actually a lot more

important when we talk about custom

Android.

I think this is less important if you're

just downloading everything from the

Google Play Store because it's a trusted

place to download apps.

Trusted,

I say in very large quotation marks

because it's often filled with malware and

all that stuff.

But you at least know that if you

click on something and download it,

it's definitely going to be from the

actual developer.

Although, you know, asterisks, as usual,

there's apps that are trying to bypass

that and all that.

But it's a lot safer to do things

through Google Play.

But obviously,

there's the issue with Google Play is it's

not very privacy respecting because you

have to have a Google account,

download apps from there.

And a lot of apps...

don't meet the requirements for the Google

Play Store.

So basically,

I hope I've kind of summarized things well

enough here,

but

There is also,

this is all like pre-production stuff.

So I wouldn't go out and use this

right now.

I think it's good to get people from

the community to contribute to this

project because I think it's good to have

this resource.

Jonah also just recently,

he put together a, basically a website,

which you can like search and check to

see if, you know,

if the apps that you've downloaded,

you can compare the hashes.

So if you want to check that out,

I've just put it in the chat here.

But it's definitely an interesting new

project that we're working on.

So definitely keep an eye on that.

I think it's also

project that we want to keep working on

at this at this point though uh you

know we're still kind of early in the

process of developing it and there was

someone that was working on an app

verifier app which would basically allow

you to check your installed apps and uh

check to see whether the hashes match our

database um so you know it's

It's...

that was an unofficial project by someone

else and at this point we don't have

any plans on maintaining any Android app.

like that so we can't really promise

anything on that aspect it would be nice

I personally would like that but I think

it also is a lot more effort on

our end and we're already like quite a

small team and we're just trying to

provide the best resources for people and

I think even if this is uh done

through a website at this point I think

it's still very useful and very uh uh

very

good you know community project that we

can all contribute to I personally already

contributed a couple apps it's really easy

to do that if you just download the

app verifier app you can get that on

a crescent or you can download that on

github you can basically get the hashes of

your apps and submit a an issue which

will you know

line it up to be added to the

database.

I would definitely recommend checking that

out if you're interested in contributing.

We've already had so many submissions from

people in our community.

So thank you so much to anyone who's

been contributing on that.

It's been really awesome to see just how

enthusiastic people are about this new

project.

And like, I mean, enthusiastic.

Like we've had like probably over three

hundred.

Let's over four hundred.

Yeah.

Between open and closed.

We've closed three hundred and nine,

but there's one hundred and two still

open.

They need review.

yeah so that is really awesome uh and

that's only you know that's only popular

apps so if you've got apps that are

less popular i think that could be a

good addition to the database as well um

but yeah i'm just really excited for that

project i think that was a really uh

really awesome idea so uh what else have

we got here so

there is a lot of information there kind

of i just info dumped super hard so

definitely just check out on the forum on

discuss.privacyguides.net definitely check

that out um there was also some uh

news as usual we have news stories that

freya and uh nate usually work on so

if you check out privacy this week

Ah, all free this week.

But yeah, sometimes Nate, if he has time,

it just, you know, we're busy.

We're busy.

We've got a lot of stuff we're working

on.

But I did notice Nate did put together

a data breach roundup as usual.

So if you want to look at that,

that's definitely another thing to check

out.

Some posts by Freya.

One here about...

Google Family Link,

allowing people to get locked out of their

accounts.

Signal macOS desktop app,

not actually deleting messages when it

should.

And yeah, as I said before,

the Data Breach Roundup,

some big stories in there,

actually quite a lot this week.

So definitely check that out if you're

interested.

And okay,

I think that's everything this week in

terms of site updates.

But yeah, I guess I can...

kind of plug stuff a little bit here.

Basically all of this is made possible by

our supporters.

You can sign up for a membership or

donate at privacyguides.org,

or you can even pick up some really

cool swag at shop.privacyguides.org.

I recently got some from the store and

I will say I've got one of the,

I'm wearing one of the hoodies right now

and it's really high quality.

It's actually probably one of the best

hoodies that I own.

So I'm not trying to shill too hard,

but it definitely is.

High quality.

So definitely if you're considering that,

definitely check it out.

Privacy Guides is a nonprofit which

researches and shares privacy related

information and facilitates a community

online on our forum and matrix where

people can ask questions and get advice

about staying private online and

preserving their digital rights.

Now let's talk about the latest

developments in California around age

verification laws and Linux.

Yeah, let's see here.

All right, so California,

for those who don't know,

where do we begin?

So California has been doing all kinds of

there's been a number of states here in

the US actually,

that have been implementing a wide variety

of age verification.

Okay,

so age verification laws in any form in

the US are unfortunately, I think,

officially, more common than not,

I think more states have passed age

verification laws of some kind than have

not.

But that said,

some states have gone a little bit, well,

I don't know if I'd say it's overboard

or not.

I mean,

it's definitely age verification laws of

any kind are overboard.

I'm just... You'll see what I mean.

Anyways,

some states have gone above and beyond and

decided that they need to add this to

the operating system level.

And this has been wildly unpopular for a

lot of reasons.

And usually,

a big reason with a lot of these

laws of any kind,

usually one major reason that people have

issues with them is they're overly broad,

which...

I could get into a whole thing about

whether or not laws are made to be

brought on purpose and whether that's good

or bad.

Uh, I digress.

But, uh,

California specifically was one of the

ones who said that like, you know, we're,

we're gonna,

every operating system has to age verify.

And because California is one of the

biggest States in the U S uh,

the open source community was kind of

like, all right, hold on.

Because again,

this is like the way it was originally

written is I think it would even require

like things like firmware to,

to update and, or not update, but to,

to age verify.

And,

Yeah, it was pretty crazy,

but I guess the long story short is

thankfully there was enough pushback from

the community that lawmakers are now

adding an amendment.

What's it called?

Assembly Bill one eight five six A.B.

eighteen fifty six.

currently moving through the California

legislature ahead of committee reviews in

June,

would amend the state's earlier age

assurance law by excluding software

distributing under licenses that allow

users to copy, redistribute,

and modify the software.

And the article says here that in

practice,

this would probably exempt most mainstream

Linux operating systems like Debian,

Fedora, Ubuntu, Arch, and Mint.

But they do point out that things like

SteamOS, for example,

would probably still fall under the law

because Steam is based on Arch,

but I think it is.

I know the Steam Deck is based on

Arch, and I think that is SteamOS,

but I could be wrong.

But because it is a variation put out

by Steam,

there are some changes to the licensing.

So yeah, yeah.

I don't know.

I mean, I'm going to be honest.

My opinion on this one,

I don't think this is a win because

I don't think these laws should be there

in the first place.

It's really weird because I know...

I will be fully honest.

I used to think if age verification is

going to happen,

this is probably the least invasive way to

do it.

And I still think that may be true,

but I still think that overall,

these laws in general are trying to solve

the problem the wrong way.

And I'm sure a lot of you guys

would agree with me in the sense that

I think the focus should be...

Not on blaming the parents,

but empowering the parents.

Like, I've told this story before.

My sister, she had her first child.

And granted, he's still a toddler.

Like, when he has a device,

it's because they, like, you know, okay,

you can...

You can watch YouTube for...

What do they used to watch it?

Hay Bears?

It's... I mean,

that was back when he was, like,

an infant.

But it's literally just, like,

dancing shapes on screen.

Anyways, like, it's stuff that it's,

like... It'll keep him busy, but it's,

like, for, you know, like,

they don't babysit him with the screen.

And the reason I mention that is,

you know, when I asked her, I'm like,

hey,

did you know that your iPhone has parental

controls?

And she's like, no, I didn't.

And granted, you know,

he's not old enough to need those parental

controls yet because he doesn't even have

his own device.

But...

I think it would be better to focus

on

making sure that parents are aware of

these.

And we've had some conversations on this

podcast before,

because I know Jordan has mentioned that

every time you set up an iPhone,

it asks you for your age.

And I don't know if that's standard

everywhere now.

Maybe that's something Apple just does

now,

or maybe that's because you live in a

country that has age verification laws.

But I don't know.

Getting back on topic,

I don't think this is a win.

I think we should be focusing more on

those kind of solutions because I think

it's twofold.

I think first of all,

it's kind of selfish.

It kind of says like, well,

we don't care about the Windows people.

We don't care about the Mac people.

They don't deserve privacy,

which I think is a very messed up

attitude to have because privacy is a

human right.

And that's like saying like, oh, well,

this person's not a farmer,

so they don't deserve food.

And I really disagree with that take.

And I also worry about what if,

you know,

I could see the argument of like, okay,

well,

what if this pushes people toward Linux?

first of all, not everyone can use Linux.

There are people in perfectly valid

situations that can't do that,

or at least can't daily drive it.

And second, like, okay,

what happens if we push enough people

towards Linux?

Then now the government decides actually

Linux has enough users that this now needs

to be regulated too,

which personally I could totally see

happening.

So, um,

I think this is a short-term win,

but I don't think it's a long-term win.

And I think it leaves a lot of

people up a Creek.

Um, but that is my, my personal take.

I don't know.

Am I, am I missing something here, Jordan?

um i mean yeah i think we're we've

kind of like i don't know what's the

what's the way of saying it like beating

a dead horse something like that uh we've

we've talked about this like a lot like

the the you know we're going to be

against any form of age verification and

like oh wow they made it so linux

doesn't have it it's like

It can be changed at any point.

I don't think this is particularly great

from that aspect as well.

I think also the issue with this is

they haven't really backed down on age

verification.

They're just basically excluding very

specific stuff that was the most

controversial.

I think we should be pushing these

politicians

to think like, oh, so why?

Why?

Why are you exempting certain operating

systems?

Aren't all the children just going to

switch to Linux and then start using that

instead and then bypass it?

It doesn't really make that much sense to

me.

I think you either...

put age verification on everything and

it's like dystopian and like absolutely

awful to use and it locks down the

entire internet or you don't like there's

not really a middle ground like this i

think it doesn't really make that much

sense to make a specific exemption for

linux uh

I also don't think these politicians

actually think that far ahead.

They just think, oh,

this will sound really good to my voters.

This will sound really good to my

constituents.

That's great,

but how are you actually going to apply

this?

How is it actually going to be

implemented?

And

I feel like that's also an issue that

I've seen.

Like,

I guess I'm going to open about this,

but I'm not from the US.

I'm from Australia and we've had some

really bad age verification stuff.

I think we're one of the first countries

to have that.

I think it might have been the UK

first.

And then we did social media bans as

well.

So it's like, you know, it's... It's...

It's really...

it's really just the way that I'm seeing

platforms actually move to implement these

changes is it's not really working.

Like I don't think they thought that far

ahead.

They never thought like, Oh,

like how are we actually going to

implement these changes to actually do

this?

And you know,

didn't think about it from like a privacy

perspective like there's definitely some

people in our team that i've talked to

that you know they hold the opinion that

maybe there could be a way to do

this in a privacy respecting way maybe

there is a way to verify someone's age

privately um which you know i respect that

like if if that's the opinion that you

hold but i think also the

The fact is that a lot of times

when we see this stuff, they always,

they never do that.

They never make it the most private and

secure possible.

They always go the easy route,

which is people uploading their IDs and

people, you know,

being linked to their accounts through

their ID, like, you know,

I'd love to live in a society where

that is the priority,

but that is just not the priority for

these companies and it's not the priority

for these politicians either.

So anyway,

trying to at least conclude my thoughts

here a little bit.

I think asking people their age on setup,

like Nate said,

like that was something I noticed on not

just, not just iPhones and Apple devices,

but also I noticed it when I was

setting up a Google pixel as well.

It asks you during the setup, like what,

what age group are you?

But it doesn't really seem to really push

you on that.

It's like, oh yeah, I'm,

I'm above and you just press continue.

Like it's,

it doesn't really see like this,

this thing that they're asking is,

it doesn't seem like a very robust system

in the first place.

It just seems like another thing that is

going to leak people's privacy and it's

going to be kind of hard to implement.

So yeah,

I guess Nate kind of said like, oh,

is this a positive thing?

I mean, maybe a little bit,

but like maybe it's good for the people

that are using Linux in California.

But like we kind of already thought that

that would be the case, right?

I don't think...

I don't think you're going to get a

whole bunch of these Linux developers who

can barely even agree on what the best

desktop environment is to how to implement

age verification.

I just don't see that ever happening.

And I think people in the Linux community

are even more stubborn about this sort of

stuff,

like implementing specific stuff like

that.

Some people completely avoid systemd

because of all of that debacle.

People will avoid using

Wayland because they don't like that

debacle it's like people are already very

opinionated I don't think people are going

to be rushing to implement age

verification on their Linux distro like

it's just maybe on the more corporate

focused distros that might be the case but

I think a lot of these community ones

are just not going to comply anyway so

I was like less of a concern I

think SteamOS definitely could be one of

those that it does comply but especially

because they are accessing you know

allowing access to games that are

restricted.

So yeah, that's kind of my thoughts.

Do you have anything else you wanted to

add as well, Nate?

yeah i uh i definitely agree what you

said about like the the community is

already so fragmented like i remember

system d added an optional field for age

and everyone lost their minds and i'm not

saying i'm not i don't have an opinion

either way for the record but like just

even the comment section in our videos

like the people got so angry and one

dude like forced system d and removed that

field and

Yeah, very opinionated.

But yeah, no,

I agree with a lot of the things

you said.

You mentioned that, yeah,

I do believe there is, in theory,

and I don't even mean like if you

squint in theory,

there are so many ways that we could

do age verification in a

privacy-respecting way,

like everything done on device, encrypted,

this, that, the other,

all this sends is a yes or no

flag.

But we don't.

You're absolutely right.

We never do it that way because...

it's cheaper it's easier you can double

dip in the data i guarantee you some

companies will do that if this stuff comes

around um like that's not even a matter

of if it's a matter of when so

it could be done in a privacy respecting

way but it it won't it never will

um one thing i did want to mention

is uh at the beginning you said that

like this could change later one thing i

will give california

I don't know if credit's the right word,

but apparently from what I understand,

it's really hard to change laws in

California because I remember when they

came out with the, what is it,

the CCPA, their privacy law,

EFF was actually against it.

And I remember them saying on one of

their podcasts that the reason they were

against it

is because laws are so hard to change

in California.

Like normally they would be like, well,

okay, cool.

This is a good baseline and we'll work

to improve it.

But again,

because laws are so hard to change in

California, for some reason,

it's a California specific thing.

It's so hard to change existing laws that

they were just kind of like, no,

we need to push for better from the

start because we might never be able to

change this or not be able to change

this for a very long time.

Um, so yeah, it's, I don't know, but,

um,

only other thing that came to mind while

you were talking is i i do think

this shows that pushback can help like um

we we really got to get louis rossman

on the channel one of these days to

tell the story but uh there is a

video um full disclosure i'm on the board

but louis rossman last year spoke at eff

austin and he told his origin story and

uh part of it was basically like

It's a great video,

you should go watch it.

But to kind of summarize,

my point is the first time he went

and spoke with his local representative,

he very politely was like, oh,

I think this bill you're endorsing is

wrong.

And he explained why the bill was wrong.

and the senator or not senator i can't

remember what it was he might have been

a senator but basically he like he um

he did take rossman's advice and he he

sided with rossman but he pointed out he's

like yeah of course i didn't know that

he's like i'm like i don't know how

any of this technology works and the only

person who showed up to say anything was

the lobbyist from the other side who told

me all this crap i didn't know he

was full of crap i don't know how

any of this works and um

So that was when Lewis realized,

he's like, oh,

especially at the local level,

at the state level, in the city level,

a lot of the time, nobody shows up.

Nobody says anything.

So yeah,

the whole Linux community came out pissed

off about this, as they rightfully should,

and the politicians rolled it back.

But nobody did that for Microsoft.

Nobody did that for Apple.

I'm surprised they didn't push back on

this because there seems like none of

these companies ever want to be the ones

on the hook for the IDs.

But anyways, my point being is like,

I guarantee you if more people in general

were pushing back on age verification,

the politicians would back down.

It doesn't always happen,

but ninety percent of the time it happens.

And yeah, so I don't know.

I just wanted to point that out.

It's like

Not to shill our own stuff too much,

but you know,

privacyguides.org slash activism.

We have a whole activism section on how

to push back on this stuff because if

nobody does,

like clearly the open source community

pushed back and they were forced to change

course.

Yeah, who knows?

And I do want to highlight real quick,

Puring Pudding pointed out,

does Android technically count as Linux?

Great point.

I don't think so because it's been

modified and now it's released under like

a different license.

So like Android in the sense of like

stock Android that you get on your Google

Pixel or your Samsung if you buy a

Samsung for some reason.

But, you know,

I don't think that technically counts as

Linux under the definition of this law.

But yeah, it's...

It just goes to show that this stuff

is a lot more complicated than politicians

realize.

So, yeah, I think that's all I got.

No, that's good points.

I think it's, yeah,

it's important to get involved in your

local community,

like stuff like if you live in California,

you need to make more noise.

Cause I think if most people would be

against this, I think, you know,

maybe not, maybe not everybody,

but I think a lot of people would

probably be against this.

It's already had so much backlash already,

especially from people like Lewis Rossman

and, you know,

all these, all these types.

So I guess that is one question.

Is there, is there someone that,

that people can contact about this?

Like, how does this,

do you have to contact your

representatives in California?

Is there like a way to find where

to talk to someone like that?

I'm not really sure.

Obviously, you know, maybe.

There is, I did,

let me go find it.

I did a blog post a while back

about, oh, it's hold on.

It's actually pinned at the top.

Yes,

basically there are websites where you can

look up who your representatives are.

Congress.gov, House.gov,

and Senate.gov are all for state level –

or state or federal level.

I mean CommonCause.org and USA.gov.

I think CommonCause especially.

I was on one the other day that

went all the way down to like –

like city judges and like these people

didn't even have pictures the the role is

so like quote unquote small um i think

that was common cause um there's proposed

laws there's like bill track there's gov

track there's fast democracy there's

legiscan um so in the u.s those are

some resources um i think we might have

a bill tracker on the activism section now

i'm not entirely sure um because i know

we did just add a new section recently

but

Oh, no, that's the DPA directory.

OK, my bad.

I think that is something we do want

to add in the future, though, hopefully.

But yeah.

I mean, yeah.

I would start there at least to learn

who you represented.

Read the local news, honestly.

Like I have a couple of different local

news stations saved and like in the

morning when I'm still kind of waking up,

which is probably not the best time to

be checking the news,

but like when I'm still kind of waking

up,

I'll sit on the couch and I'll skim

the headlines and I will see things about

like, oh,

there's a data center in this town next

door.

Like there's a meeting coming up on

Thursday to talk about the data center.

And I wanna start showing up to those

things and be like, yeah, no,

these are a bad idea and here's why.

I know at least in my area,

they've managed to get one data center

temporarily paused because there was so

much pushback,

and I'm very proud for that.

But it can make a difference.

I saw this person in the chat here

said,

P P P P P P said in

the chat, uh,

get Lewis Rossman on the show.

I think it's definitely possible.

Uh, it's definitely possible.

So it's, it's very possible.

Um,

we do want to do an interview with

him.

I just,

I don't know what to ask him because

I feel like he's such an open book.

It's hard for me to come up with

questions.

Um, but yeah, no, we,

we definitely want to, it's,

it's something we've been thinking about

and talking about a lot.

It's totally doable, but yeah.

I don't know.

Maybe we should just have him on the

podcast one of these days.

We should talk to him about it.

That would be fun.

I was about to say that.

That'd be fun.

Yeah, there's also this other person here.

So Terracotta Pie also said,

every time I hear about age verification

laws, it brings me pain.

Yeah,

we're kind of a little bit sick of

it here.

It's like every week there's like

something new relating to this.

Yeah,

I don't know why governments right now are

just like super obsessed with this

suddenly.

It's like AI, except, I don't know,

they're obsessed with like

verifying people's identities it's kind of

unfortunate but I do think you know kind

of coming back a little bit to that

lobbying thing I do think these these

lobbying groups are you know

probably kind of pushing for this a lot

of this technology because when they

implement all these age verification like

systems it's all like kind of getting

funneled back into these companies uh

because you know that's a lot of customers

you're about to get a lot of customers

if every single person on your platform

needs their age verified so i can see

why that might be a thing uh someone

here said

That'd be a good convo, yeah,

to have Lewis Rossman on.

Yeah, I definitely agree.

That would be really cool.

Yeah,

and something else you said that I forgot

to make a note about was when we

talked about you set up a device and

it asks you what's your age,

what I would love to see is...

Because I think something that I've been

trying to focus on a lot more is

like in arguing with this – or when

talking about this age verification stuff,

especially with parents,

is to point out that it takes away

their –

agency as parents it takes away their

right to decide what sites they think are

okay for their kids to visit and when

they think their kids are old enough and

i think i completely sympathize with

parents who feel like maybe the internet

is a little overwhelming and technology is

overwhelming these days i think that's um

a perfectly legitimate way to feel but

I think, again,

going back to the example of my sister,

how many of these devices will prompt you?

Like, is this a child's phone?

And how many of them?

And I genuinely don't know.

I haven't set up a new phone in

ages.

And, you know,

since I mostly use custom operating

systems, like maybe they're all, you know,

they don't do this stuff, obviously.

But yeah.

It would be nice to see a phone

that like asks you, you know, OK,

this person is like thirteen to fifteen

and it shows you here are the parental

controls available instead of.

You know,

I don't know if it does that,

and I think that's what I would like

to see is, you know,

to raise awareness that there's already

tools that, from what I understand,

are pretty decent.

And yeah.

And also we need more of those tools

on the privacy focused stuff.

Like I saw an article from proton earlier

this week about how Chrome has built in

parental controls and you can block

specific websites and stuff.

And I'm like, that's amazing.

I bet you brave doesn't have that.

Cause you have to sign into a Google

account to do it.

But yeah,

that's what I would like to see is

just more stuff that's focused on

empowering the parents to know what

options are out there and how to exercise

them rather than just trying to parent for

the parents,

which I don't think any parents really

want to be honest.

So.

I don't know.

Just a thought.

Definitely.

I guess here we could jump into this

next topic.

This one here comes...

They're just two kind of quick topics that

I thought we should cover this week,

which was something about F-Droid and

another thing about the Tor project.

So just quickly jumping into these two

topics here.

This one here from F-Droid is...

new financial support for fdroid thanks to

floss fund so fdroid was recently uh was

awarded fifty thousand dollars in funding

from the floss fund and basically it's a

fund that basically uh funds valuable open

source projects um

I think this is also super important for

these projects because a lot of times

hiring developers,

developers are really expensive,

especially if you need a good developer,

that's easily over a hundred and fifty

thousand dollars a year.

in employment costs to get someone

employed for that.

I think that's really cool.

Basically reading more into this article

here,

some information about the Floss Fund.

The Floss Fund aims to donate up to

one million dollars annually to Floss

projects worldwide with no strings

attached with the purpose of empowering

developers and maintainers through

financial resources to sustain and grow

critical open-source ecosystems.

Notable FOSS projects like Blender,

FFmpeg,

OpenStreetMap have gotten support in the

past and now FDroid has too.

The introduction of the funding,

funding.json standard built on JSON allows

projects to add funding details in the

code base,

making it easier for backers to navigate

aid efforts.

This streamlines donor support and quietly

builds a stronger financial foundation

across community-driven tech work.

So basically,

they kind of go through how they're going

to use these funds.

Basically,

what F-Rite is saying is they're going to

move some key tasks forward,

like supporting core operations,

updating infrastructure,

securing new features for better access to

ad-free community-built software.

Working on supporting a new format called

funding.json,

this is a standard way for app creators

to share information about how people can

donate money to support their projects.

And once that work's done,

FDroid's server,

the tooling we use to manage our app

store,

will be able to automatically collect

donation information from app projects

that have set up funding.json on their

website.

So basically,

this is kind of like a move to

allow developers to get funding that they

need for their apps.

It's kind of interesting.

Basically, if your app is on F-Droid,

you may qualify for the Floss Fund.

It's basically there to support existing

and widely used open source projects on

there.

So I think, you know,

this is going to be really good for

developers that are

you know, making apps that, like,

a lot of people are downloading but, like,

no one is supporting because, you know,

I think a lot of people kind of

take things for granted a little bit.

Like, behind every app that you're using,

there's, like,

a person developing that and, you know,

it takes a lot of time to maintain

things, keep things updating,

keep things working properly.

Yeah.

So I think people should try and donate

whenever they can.

I think that's super important.

I guess to dive into the second story

here from the tour project,

there's this new coalition of

privacy projects and this is led by the

Tor Project and the Funding the Commons

and basically it's a participatory funding

campaign so if you go to

internetfreedom.torproject.org

Or you can go to that website through

their onion link.

It's basically a Web three native

crowdfunding initiative.

Basically,

this is a way to accept contributions in

Bitcoin, Ethereum, Zcash, Monero,

Gollum and others.

Yeah,

it basically can benefit ten non-profit

projects working across privacy,

censorship, circumvention,

secure communications and public interest

digital infrastructure.

And basically there's an initial one

hundred and fifteen thousand USD matching

pool, which was supported by Cake Wallet,

Zcash Community Grants, Logos and Octant.

So I think this is also one of

these things where I think the Tor

project,

as well as a lot of other projects

that are listed on this page,

a lot of them were benefiting from, like,

US government funding through, like,

the Open Technology Fund as well.

So, you know,

that is currently being stripped down a

lot by the current US government.

So, you know,

they've definitely seen a dip in funding.

And I think this is...

kind of important to develop a parallel

system to allow these projects to keep

getting funding.

And I guess to talk about some of

these projects.

So this includes SecureDrop, Open Archive,

Onionshare, Ricochet Refresh,

Onion Browser,

Open Observatory of Network Interference,

Passcouchet, I don't know that one,

Unredacted, Digital Security Helpdesk,

and

I don't know that one that one must

be uh one that's a bit more international

um I haven't seen that one before but

yeah that is that is really interesting so

basically it's designed to ampli this this

whole like funding model is basically

meant to

amplify the impact of small contributions

like they're basically those those

organizations that were there they're

basically uh boosting the impact of of

that funding um so that is really

interesting uh but yeah i don't know

there's i don't really have too much to

add here not really super familiar with a

lot of these cryptocurrency things um so i

don't know do you have any thoughts on

either of these quick stories here nate

Um, just a couple of quick thoughts.

Uh, one of them you,

you kind of already touched on,

but I really want to drive home is

the F droid one is, um, you know,

some,

some developers I know like absolutely

refuse to take funding.

Like you block origin famously does not

take any, any donations at all.

Um, and I, I think that's fine,

but I think also, um,

I know in the, again,

to reference it in the past as

surveillance report,

we had like less than one percent of

our viewers were

donating in any way.

And I mean,

I think all we had was like a

Patreon or something like that,

but it was like literally less than one

percent of viewers.

And it's it's I know it's tricky,

especially right now.

Trust me,

finances are keeping me up at night with

the cost of everything.

Thanks.

But it's it's I know right now it's

really tricky.

But if anybody is in a position to

support projects,

any projects like it doesn't

I don't know if they'll like me saying

this, but it doesn't have to be us.

It could be Signal.

It could be Tor.

It could be whatever you get value out

of.

Or one thing that I recommend to a

lot of people is cycle it.

This month, give five bucks to Tor.

Next month,

give five bucks to Signal or whatever.

I don't know why I keep fixating on

those two, but you know what I mean?

Sit down and think about what are the

apps you use that you would be really

devastated if they went away.

There was actually an update this morning

on Session.

It looks like Session...

secured enough funding to basically keep

going past their original shutdown date,

but they're going to have to do it

in a severely weakened state.

Like they're basically only going to have

enough money to pay for like one developer

and basic infrastructure,

if I remember correctly.

I read that at like eight this morning

and I hadn't had my coffee yet.

it's, it's things like that are, you know,

that's the risk of not funding these

things.

And again, I understand I, I,

not everyone has money and I,

I completely sympathize with that.

But if you do have money,

even like five bucks, a couple of dollars,

like if, um, you know, these,

these are projects that have like

thousands of users.

And if everyone gave a dollar a month,

like that would probably fund these

developers full time.

So yeah.

Um,

I think that's a really important thing.

This is kind of my time.

I'm going to kind of plug privacy guides

here.

We also need funding as well.

This whole project, to have Nate,

to have me,

to have Jonah working on this a lot,

full-time working on this, it costs money,

right?

People need money to live, unfortunately,

and...

If it was a way to do this

without having to do that and we could

like, you know, dedicate all the funds to,

you know, whatever, something bigger,

it would be great.

But, you know,

people need money to survive and get a

live.

So, you know,

every donation that you make here is

supporting people working full time on

this project and trying to bring people

the most joy.

important information on this topic and

build out resources like the app verifier

database,

like videos that we're putting out,

all the articles that we have,

like with Freya and Nate putting out

articles.

activism section merchandise that we

create like this is all stuff that you

know we need to pay people for um

unfortunately like that's just the reality

right so uh you know if you do

really like what we're doing and you want

to see this continue that is one thing

that i think you know

even if it's like a very small amount

of money, like I think any amount helps,

especially any project.

And again, like Nate said,

like you don't have to,

please don't like donate if you're in a

position that is not financially stable.

Like this is, you know,

I feel like we're like at a really,

really,

really tough point in history at the

moment where things are just like,

really expensive and it's really tough so

definitely don't feel obligated but if you

are in a position where you can support

things you know consider donating to us

consider donating to these projects like

you don't even have to donate to us

just donate to something uh these projects

uh they need

support so uh and oh sod this all

just gifted a privacy guides membership so

thank you so much um so this all

does that a lot we appreciate your

generosity

Yeah, that is really kind.

So congrats to someone who got that

membership.

Speaking of memberships, I guess,

you'll be able to access a bonus section

of the Naomi Brockwell interview if you

did sign up for that.

We did see there was two people

who signed up for that again.

Uh,

they rejoined our membership program on

YouTube.

Uh, it was someone with a Korean name.

I'm not gonna,

I don't know how to say that.

So I can't really say that.

And there was also someone as well named

Thomas.

So thank you to those people that rejoined

to access some of that early access

content.

Um, it's definitely, uh,

It's a cool perk that we're happy to

give people.

And we hope that you get some value

from that.

We're just trying to give back to people

who do support us because we do really

appreciate it.

Yeah, W, sod this all.

Yeah.

Yeah.

You've been very generous.

So thank you so much for gifting regularly

as well.

It's really, really appreciated.

That is so kind.

um yeah i think uh if that's all

we had on that there was one last

story i wanted to sneak in real quick

um just because i thought this was super

super awesome and exciting and this will

be real quick because we don't have too

much to say about it but uh um

researchers at eth zurich believe they

have created perfect randomness for the

first time so uh for those who don't

know um i would argue nothing in life

is perfectly random um

Certainly almost nothing in the digital

world.

Even like your password manager,

when you tell it to generate a random

password, it's not really that random.

And the thing is with computers

specifically, if you generate randomness,

they have to have something that they're

deriving that randomness from.

So usually what they'll do is,

for example, they'll do...

let's say they'll take the time and

they'll go all the way down to like

the millisecond or like however far the

clock can go.

They'll take the actual timestamp with the

date and the time and everything.

And that will be the,

I don't know what the technical word is

for it,

but I'm gonna call it like the seed

or the key.

That'll be the seed

that they feed into an algorithm and that

algorithm generates a random thing based

on the time.

But it's technically not random because if

you feed that exact same time into the

algorithm,

you're always gonna get the same response

out.

It just seems random because

theoretically,

we're never gonna see that time again,

right?

So it's really good.

And this article points out that in most

applications, this is fine.

But in cryptography, especially very,

very sensitive high-level stuff,

this can be,

a bit of an issue and for the

record we're talking like really advanced

advanced advanced like like state level

zero day kind of stuff this is like

really advanced but technically there is

not perfect randomness and for the record

this is also true of coin flips if

you flip a coin a thousand times

technically you will statistically have

more of heads than tails or vice versa

So anyways,

researchers at ETH Zurich basically say

they figured it out with quantum physics.

And there's a pretty good breakdown here

in the article that I'm not going to

go through.

But basically, they made this like,

thirty meter long tunnel and they had

superconducting chips on either side.

And they something about quantum

entanglement.

And they were basically it kind of goes

over my head about how it works.

But they are very positive that they have

made actual true randomness.

And if you were to

Jonah and I were talking about this

earlier, and Jonah's like,

how would you even test that?

And I was like, well,

you just flip a coin, basically.

You tell it to pick between zero and

one, and if it is perfectly random,

if they do that,

we'll say like a million times,

which a computer can do very quickly and

very easily.

If you do that a million times,

then you analyze it.

You should have an almost perfect,

if not totally perfect,

like within a certain,

I think it's like .

five percent is the accepted

I took a statistics class once in college

and I barely remember it anymore.

But in theory,

you should have that almost fifty-fifty

split.

It might not be exact because, again,

it's random,

there's chance in the universe,

but it would be statistically

insignificant,

the difference between the two.

Um, yeah.

And the reason I wanted to share this

is because if that's true, that's really,

really exciting.

Uh,

I am assuming that this research probably

still needs to be peer reviewed and tested

and everything,

but ETH Zurich is very well known.

They are very reputable.

Um,

I don't think they would just make

something.

They might be wrong for the record.

They might go under peer review and they

might find out like, Hey, you know,

you overlook this or you didn't do this

right.

But I don't think they're just like trying

to sell snake oil or make something up.

Um, I think they genuinely believe this.

And if true,

they pointed out here in this article,

for those who are maybe listening on

audio, it says, in the long term,

this work could play a similar role in

digital security as atomic clocks do for

timekeeping.

And atomic clocks, they're useful for,

I mean,

like GPS is the first application that

comes to mind.

I know there's a bunch of others that

I'm forgetting,

but like atomic clocks are,

extremely extremely extremely accurate

clocks and they are crucial for a wide

range of applications that power our

modern world and so this could be a

huge step forward in cryptography if that

is true so yeah like I said kind

of a short one I don't think we

have too much to add but that is

that is that story and if we hear

anything exciting about it we'll keep you

updated but I just thought that was super

cool and wanted to share

Cool.

Yeah,

I don't really have too much to add

on that one,

but I just want to highlight,

I think we might have missed it,

but Sod the Sword just donated two pounds.

So thank you very much again.

That is very kind.

But yeah,

I don't really have anything to add on

that one.

Should we maybe dive into some forum

updates?

Yeah, yeah.

If there's nothing to add to the

randomness story,

then we'll check the forum.

And after the forum,

we'll actually be taking questions.

The Q&A will start.

So if you have not asked any questions

yet in the chat,

go ahead and drop those in the chat,

and we'll get to those in just a

minute.

But for now,

the community forum always has a lot of

activity.

But here's a few of this week's most

interesting discussions.

And the first one we're going to talk

about is actually a discussion about an

article from Ars Technica that says

websites have a new way to spy on

visitors, analyzing their SSD activity.

I'm going to share this article real quick

for a second, just so viewers can see.

So this is a side channel attack that

in response to one of my frustrations

earlier today,

we actually know this can be done

remotely.

This does not require physical access,

but it's basically a way to fingerprint

your computer.

And the way it works is when you

go to a website,

there's something called the Origin

Private File System, OPFS,

which is an allocated storage space that's

reserved for a specific site to run code

needed to complete a given task.

websites can create one with no

interaction required by the visitor.

So it's basically like a temporary little

sandbox where a website can maybe download

a cache or whatever it needs to do

to function.

And basically,

if the attacker is able to continuously

measure the performance of the SSD,

and especially the article says if you

have multiple tabs open,

it's almost like a

it's almost like the way that

fingerprinting works across the web,

right?

Like if you go to Google, hypothetically,

let's pretend, if you go to just Google,

Google doesn't really know who you are.

But if you go to like five other

websites that all have Google Analytics,

Google can track you across all those

different websites.

And it's kind of basically the same thing,

but it's working via that OPFS on your

SSD.

And they do note that there are some

limitations.

So first of all,

the OPS file must be extremely large,

likely a gigabyte or more.

I don't know how big the OPFS is

on average.

To me, that doesn't sound that big,

but maybe it is.

That requirement means the attack at scale

would inevitably be detected by many

users.

They also say the file must be stored

on the same SSD the visitor is using,

which I think for most people is probably

true.

I think most of us don't have multiple

SSDs.

Usually if a computer has multiple slots,

you have like one SSD and a hard

drive,

but

they also say that the best way to

prevent this attack is simply to close

tabs as soon as you're done which I'll

comment on that in a second and

What else was it?

More savvy users can monitor the creation

and size of the OPS files allocated by

unknown websites.

And they did say that the researchers did

propose ways for browser makers to shut

down the side channels.

So we'll see if any of them roll

that out.

And here it is.

The last thing they said that they

performed the full attack on an M two

Mac on Linux.

They showed that the underlying primitive

works,

but didn't run the full attack and they

did not test windows.

So it's not as bad on Linux,

but it does still work.

I'm just going to go out on a

limb and say it probably works great on

Windows.

But yeah.

Did you get a chance to read this

article by any chance, Jordan?

Do you have any thoughts on this one?

I did see some interesting takes.

Like we are kind of focusing a little

bit here on the forum,

but I did see some interesting people.

People had some interesting thoughts on

our community forum,

which I guess I'm not going to highlight

directly because we want to respect

everyone's privacy there.

Don't want to

keep your information stored in this video

forever.

That would be kind of awful.

But I will just kind of highlight some

things that people were saying.

Someone was saying that someone said

laughs maniacally from inside a disposable

virtual machine.

I mean,

that's definitely one way to protect

against this, I guess.

Maybe not everyone is doing that,

but I think, you know,

if using cubes OS, that's,

definitely a plus for cubes OS I think

also another thing with this is I feel

like it's a little bit dependent on like

your internet connection speed as well

like one gigabyte file um is kind of

big I think you know your if your

internet connection is like you know four

G or five G it's probably not gonna

be uh

downloaded particularly fast,

especially if you have like slow internet

connection,

like a hundred megabits per second or

fifty megabits per second.

It's going to be quite a it's going

to take quite a while.

But I also think a lot of browsers

actually kind of have protections against

this,

especially the ones that we recommend.

For example, like one common issue,

I'm going to say issue in quotes,

but it's not really an issue.

It's just something that we notice is

With StreamYard,

the software we use to do these live

streams,

a lot of times we'll have a local

recording as well as

this recording of on YouTube and stuff.

And basically that is done through saving

data into your browser storage API.

And, you know,

if you're using stuff like Brave or

Firefox with all the settings cranked up,

a lot of times it complains about not

enough storage being allowed, right?

So I think, you know,

This could potentially protect a little

bit against this.

I think having something that just has

absolutely no limits on anything like

Google Chrome or like, you know,

these browsers that don't really care

about this sort of stuff,

they kind of just allow anything.

It's definitely going to cause more

issues, I would say,

and allow this to happen.

There's also some people saying you can

enable specific settings in Firefox.

I think this person was saying

dom.fs.enabled to false protects against

this.

And also I think one gigabyte straight

into your browser,

people are saying that that would crash a

lot of websites for people.

But yeah,

I think this is definitely a concern for

the average person who's just using

Chrome.

And I think that's definitely a valid

thing to talk about.

Also, someone was saying that, you know,

they recommend closing tabs as soon as

you're done with them.

I think that is a little bit naive.

I don't know how you use your browser,

but generally,

if you're like researching a topic,

you have tabs,

a lot of tabs open because you're browsing

and stuff and looking at things.

So I think anyone doing like serious

research

research in their browser is going to have

more than one tab open.

It's a little bit ridiculous to suggest

that.

I think people will just have tab,

like I'm looking at my screen right now,

I've probably got like

like, you know,

we've got to have things open.

I think that's not the best advice.

I think the better advice here would just

be to use these browsers that have

actually sane defaults when it comes to

these APIs.

And I think it also is good to

assume

Any API that a browser has can be

exploited to fingerprint you.

We kept seeing this with audio signatures

through the audio API.

We saw this with WebGL.

It's basically any API can be used to

track you.

I would just assume that any API is

going to be used to track you.

And I think disabling them is

generally the better way to go.

I do wonder how this would work in

Tor browser or Molvad browser,

but that's not something that I have time

to test personally.

Did you have any extra thoughts, Nate?

Yeah, no, um, I think the, uh,

I'm with you for the record.

Like, yeah,

especially when I'm researching for a

video, I've got like a dozen tabs open,

but I also know it's kind of a

meme that a lot of people, uh,

especially a lot of mainstream users just

do infinitely leave their tabs open.

And it's like, it's literally a meme.

I've seen jokes about it, about like,

it's okay to close your, your tabs.

Now you're never going to reopen them or

like, um,

I don't know that I've ever dated someone

who didn't have, like,

ten million Chrome tabs open or anything.

Even, not to throw under the bus,

even my wife,

every once in a blue moon, I'll, like,

borrow her phone for a second for whatever

reason, you know, with telling her.

And, like, I'll open Brave,

and I'm just like, oh, God,

do not close Brave.

You'll lose all her tabs,

and she'll be so pissed.

So, but, yeah, I think...

I don't know.

That's probably just something I think

people should do in general is just close

their browsers once in a while because I

think you need to do that for it

to update.

Um, no, the, the other,

something interesting I wanted to point

out is, um, somebody said, uh,

here it is.

They said,

I enjoy the validation of blocking

JavaScript by default.

Um, because the, the article,

I kind of brushed over it cause I

was trying to keep the article portion,

uh, short,

but they mentioned that this is basically

made possible by JavaScript and they use

JavaScript to measure the IO interactions

and stuff like that.

And so it's kind of a double-edged sword

because I,

this is my personal conspiracy theory.

I don't know how true this is.

I think the vast majority of

fingerprinting is enabled by JavaScript

because you go to a website and it

loads JavaScript and that's what measures

how big is the screen.

There's other ways to do it for the

record.

I know there is, but for some reason,

companies don't do it.

They measure how big is the screen and

they measure all the other things that

they use to fingerprint you.

And I strongly suspect that blocking

JavaScript probably blocks a lot of those,

but then there's also a really good

argument to be made for like standing out

because there's not a lot of people out

there blocking JavaScript,

going to these websites.

So it's almost like a double-edged sword.

Like,

I don't know what the trade-off is to

be totally honest.

Again,

I don't have any proof of any of

this.

This is just my, my theory is like,

would that be a case of like, yeah,

but you'll block of the tracking.

So it's worth it to do it anyways,

or I don't really know, but.

it is interesting for sure.

And it's,

it's something I think about a lot,

to be honest,

because there was a phase I went through

where I was using you block origin to

like block JavaScript by default and then

slowly enable it on websites I used

regularly.

And honestly, it was actually,

it was pretty awesome.

Um, it was great, but it's,

it's crazy how much JavaScript you can

block and the website still works

perfectly, but.

Yeah, it's not without risks, I think.

So it's just interesting.

Interesting discussion.

But yeah,

I wanted to share this one because I've

seen this article pop up a lot.

A lot of people have been talking about

it.

So good to see what other people think.

I think it's also like I feel like

we should kind of push back on like

a lot of this technology is like developed

by Google because they control the

Chromium project a lot.

So, you know, I mean,

it exists in Firefox too,

but like a lot of this stuff is

usually pushed by companies that don't

really have most interest in protecting

your privacy.

So, you know,

their concern is going to be functionality

first, privacy second,

and privacy

Who would have thought that it's this

technology that they added for

functionality purposes can also be used to

track people.

It's like, anyway, you know,

it is what it is, I guess.

But I think more people using these

privacy respecting browsers is going to

reduce the identification of that, right?

Like it's going to reduce the

individuality of people not using that

specific API.

Yeah fair enough.

Okay, so someone here is,

it's P P P P P said,

Brave has tab groups.

You can group together, open tabs,

close the browser,

reopen the browser and all,

and then open the tab group again to

get all your tabs back.

And on Firefox,

I'm sure you can do this.

Just bookmark all the current tabs

temporarily to reopen again after closing

the browser.

I got to go though.

Bye.

Yeah.

Thanks for sticking around and thanks for

leaving the comment here.

I guess I feel like Nate, you're,

You're definitely a brave enjoyer,

so maybe you can comment a little bit

more on this.

Enjoyer.

Wow.

Such a strong word.

I have mixed feelings on all the browsers.

That's a discussion for another day,

but I don't know.

No, it's, I mean,

I don't really have that issue because

yeah, I do like,

if it is a site that I think

I'm going to need again,

I will note it down somewhere.

I'll like note to self and signal or

I'll put it.

Usually I'm like doing research on a

script.

So I'll like,

I'll literally just throw the link in the

script and just be like, cool.

Now it's there tomorrow when I go to

work on this.

But yeah,

I'm more thinking of, again,

the typical mainstream user.

It's just the way they use the browser.

I don't understand it.

I've never understood it.

I've never been this kind of person.

They just leave it running continuously.

A lot of people never shut down their

computers, too.

Or if they do, again, they have...

Cause that is a setting in a lot

of browsers too.

It's like, oh,

reopen my tabs when I open the browser.

But it's just,

it's something people do for some reason.

I don't personally understand it.

Like they won't use bookmarks.

They won't use any kind of bookmarking

system, which I know for the record,

instead of note to selfing on signal,

I could just bookmark the tab, right?

like you were saying,

but for some reason they don't.

They just constantly,

like they just open another tab and keep

going and open another tab.

And once they find a site, they're like,

I'm going to want that later.

Open another tab, open another.

And I literally,

I've run into people that literally have

like dozens of tabs that they've

accumulated over the years or the months.

And it's like, I don't know.

It blows my mind.

Cause I'm, I'm,

I've always been a little bit of a

minimalist and I like keeping things neat

and clean and it does come back to

bite me sometimes you know when I'm like,

Oh,

what was that website and I don't have

history enabled and I don't have any of

that stuff and I have to go looking

for it again but like,

I don't know some people just don't use

that kind of stuff like they don't rely

on the history they don't rely on

bookmarks they just

open another tab and move on as if

they've opened a fresh browser.

And the next thing you know,

they've literally got well over fifty tabs

and they're definitely not going to

bookmark those.

It's just it's it's weird.

I don't know.

See, there's Anon.

I use both and I have multiple tabs

open on mobile and desktop.

So see,

Anon is one of the people I'm talking

about.

Yeah, I didn't get that.

I always do like,

at least on my personal devices,

I always do like

always like close every tab like exiting

everything clearing all the data but I

don't know for work I definitely don't

though I just have everything just logged

in all the time because I've got like

a million websites I need to be logged

into like for all the stuff that we

do here it's like I've got so many

logins um so I mean I think you

have to obviously like weigh up the

the benefits, right?

Someone else said here,

Trojan X-Ninety-Nine,

Brave versus Firefox, which you suggest,

by the way.

I'm a Brave user.

I mean, we recommend both privacy guides.

I think it's really just down to, like,

personal preference in a lot of cases.

Like,

if you need something that has better

compatibility,

I'd say Brave is usually the better

choice.

But if you care about, you know,

the Chromium monopoly,

if you want to

if that's something you care about,

I know that there's a lot of controversy

around both Firefox and Brave.

Like Firefox has made some really silly

decisions in the past, same as Brave.

Um, you know,

their leadership has also made really

silly decisions as well.

People get, you know,

have specific irks with each product.

I think you kind of have to look

at the evidence, look at what,

what you think about each product and make

a decision for yourself.

Um,

Personally, I'm more of a Firefox fan.

I've just always used Firefox.

Like, since, like, for ten years,

more than ten years,

I've been using Firefox.

So it's, like, what I prefer.

But I think it's the same thing with,

like, Chrome, Chromium-based browsers.

Like, if you've always used Chrome,

I feel like Brave would be a pretty

easy switch.

Like,

everything's just going to work the exact

same and you're just going to get more

privacy protection.

So I think that's...

It's definitely,

I feel like Brave is definitely a bit

more user-friendly and things are just set

up by default.

And that is one benefit that Brave has

because I feel like with Firefox,

you have to change quite a few settings

to get it to a similar level.

But again,

it's definitely a personal preference

thing.

I don't think there's really...

There's benefits and downsides of each,

so you kind of have to just make

up your opinion.

Someone here said vanadium.

I mean, I don't know.

I think vanadium is...

good from a security perspective,

but I think you can't really compare it

to Brave or Molvad browser or Firefox.

It's not really in the same league.

I think the Graphene OS developers know a

lot about security.

I'm a hundred percent certain that

Vanadium is probably one of the most

secure browsers, if not the most.

um because you know they they utilize all

this hardware security based features and

stuff like that um but i think when

it comes to privacy there's there's people

that have been doing things like that for

a lot longer like the tour project and

uh i think generally they're gonna be the

gold standard when it comes to that but

i think

Your Vanadium is just miles better than

Google Chrome,

and it's not making a bunch of

connections.

I think the main thing is,

like we were talking about earlier,

it's going to leak information about your

system.

It's going to make you more

fingerprintable because it doesn't have

those protections that Brave and Firefox

have,

which I'm sure that the GrapheneOS people

are probably working on that.

I'm sure that they're trying to improve

it.

I know they added some basic ad blocking

capabilities,

but I still think when you compare that

to what Brave has,

they're not really comparable in my

opinion.

Maybe that's a hot take, but... Well,

and also the thing that I never hear

anybody point out is Vanadium is graphene

only.

So it's like, cool,

what are you going to use on your

desktop?

What are iPhone people supposed to use?

other Android.

And I know the obvious answer there is

switch to graphene, but like, okay,

when we have sympathy for people who maybe

live in an area where they don't sell

pixels or, you know, they,

for whatever reason, like it just, it,

it excludes a lot of people,

but I mean,

if you want to use it,

go for it.

I don't,

I don't have anything against Vanadium,

but it's,

It's not always feasible for everyone,

I would argue.

Someone here said Firefox is more secure

than Brave.

I don't think so.

I think Chromium has better sandboxing

capabilities and...

like it's just a more mature product,

obviously, because, you know,

it's basically the entire world basically

runs on Chromium.

So, you know,

it kind of makes sense that it would

be ahead in that aspect.

But it does have better security

protections than Firefox,

especially on mobile as well.

So yeah,

just trying to offer some balance here.

I don't think it does have the same

level of security.

I don't think Firefox is insecure.

I just think that Chromium has more

protections than Firefox.

Yeah, I just want to back that up.

I agree with you because I think for

the average person,

the security difference between the two is

pretty negligible.

I think that gets bandied around a lot.

Like, oh, Chrome Sandbox is better.

Chrome Sandbox is better.

And it's like, okay,

but now we're arguing about the

performance difference between a Ferrari

and a Maserati.

I'm not a car guy,

so maybe that was a bad example.

But there's a certain point where it's

like,

does it really matter for the average

person?

Like, okay, sure.

Maybe if you're like,

a journalist or an activist, then yes,

you need like the most secure thing

possible.

But I think again,

for the average person with an average

threat model,

I don't think it makes a difference.

I think kind of going back to what

you were saying, it's like,

I almost view browsers as like,

which one fits your philosophy better?

Like, yeah,

brave is ready to go out of the

box.

It's very user-friendly.

It has more compatibility.

And for a lot of people,

that's what they want is they want

something that like is the same experience

across all their devices and

um which i don't think firefox can say

yet it's got a built-in ad blocker they

don't need to fuss with it they don't

need to mess with a lot of things

uh again i've said this in previous

episodes in my experience most

quote-unquote normies just ignore all the

crypto stuff like they don't even notice

it they don't even care

Um, they don't even disable it again.

They just don't even notice it.

It's, it's so weird.

It drives me crazy,

but they don't seem to see it.

But at the same time, like, you know,

if,

if you disagree with the Chrome monopoly,

if you disagree with Brandon Ike,

all of these kinds of things, then yeah,

Firefox is great.

You just have to be willing to roll

up your sleeves and do a little bit

of tinkering to,

to get it up to the same level.

So yeah, there's,

I don't think there's really any right or

wrong answers in the privacy or in the

browser space.

I think it's really about like what

matches your threat model and your values

personally.

So.

There's definitely some wrong answers,

like Chrome or N. Okay, okay, fair, fair.

But yeah.

I guess I meant more like in the

whole like Chrome or Brave versus Firefox

debate or like some of the forks of

Firefox,

which even then there are some wrong

answers there, I would argue.

But overall,

I think a lot of the privacy browsers,

like,

because especially people you ask them,

you know, some people are like,

I use Waterfox.

And it's like, personally, I wouldn't.

just because i don't see the point of

using a fork of a fork of a

fork of a fork i know i'm being

a little dramatic when i say that but

you know it's like but then when you

talk to them it's like why do you

use it they list like oh because it's

you know the search engine does have ai

and like this that and the other and

it's like those are pretty good reasons

like it's just it's so much personal

preference and again as long as it fits

your threat model and it's giving you the

protection you need i i feel like it's

it's kind of personal preference so yeah i

don't know

Didn't get too tribalistic.

You can use both of them at the

same time, by the way, everybody.

You don't need to use just one.

Not me,

who had both of them open today on

my computer.

Real quick,

before we move on to the other forum

post, somebody here said,

I use Trivalent on desktop.

I hadn't heard of this one before.

Apparently,

it's a Chromium fork inspired by Vanadium

that is designed to be used on

desktop, specifically with SecureBlue,

ideally.

But that's pretty cool.

I might look into that a little more.

I don't think I'm going to switch to

it,

but I had not heard of this before,

and I'm curious about it.

Yeah, if people are interested in that,

we did do a video on SecureBlue,

and we did talk a little bit about

Trivalent in that video.

Maybe check that out if that's something

that sounds interesting to you.

I think the issue with Trivalent is it

relies on a little bit of

like stuff that is built into the

operating system.

So it's not currently very available on

other Linux distros apart from secure

blue, but you know,

we recommend secure blue.

So I would try that.

Um,

obviously I feel like that's another

thing.

Linux distro is a very personal

preference.

Probably not everyone is going to like

secure blue.

So again, another issue there,

but I think,

I don't think it's wrong to use trivalent

or anything like that.

Um, another person here said, uh,

It's nyalexnj,

what about DuckDuckGo browser?

Bad slash good, brave user here.

I think the main issue with DuckDuckGo

browser is that it's

It doesn't really offer anything else that

existing options already have.

I think it's better than Chrome.

It's better than all of these ones that

are collecting a bunch of your data.

If you have to use it,

then I would say it's fine.

But again,

I think Brave is going to offer better

protections.

Firefox is going to offer better

protections.

uh it as far as i know it

doesn't do anything particularly unique

it's just a browser it's a chromium based

browser made by DuckDuckGo it has all the

tracking that chrome has stripped out uh

it's fine.

Like there's a lot of options in the

privacy space where it's like, it's fine.

Like Vivaldi, it's like, it's fine.

Like it's, you could do better.

Like it's not Chrome.

It's not collecting a lot of information

about you.

But you know,

when it comes down to a lot of

these very nerdy privacy protections that

we talk about,

like fingerprinting resistance and like

all these tracking technologies that are

on the web,

you're going to be better off with

something that is specifically designed

with a lot of those protections built in

by default.

Yeah,

I don't have much else to add to

that.

But we did have, actually,

this is related,

now that I think about it,

in a way.

We had one other forum post that I

kind of wanted to shed some light on,

which is, it says,

best alternative search engine option that

actually works.

So if you guys didn't hear,

which you might not have if you're not

a Google user,

which we don't encourage the use of Google

Search,

Google is basically going to be fully

integrating AI into their search engine.

And it's a little unclear exactly what

that means,

but the general consensus is basically

that like,

I don't know.

This almost sounds hard to believe.

And maybe I'm misunderstanding this,

but it's almost like Google is going to

stop searching you or serving you results.

And instead the whole page is just going

to be AI summary.

And there will be, you know,

of course I don't,

it's weird that Google has defenders these

days,

but the defenders like to point out that

like, Oh,

but you can still like click this tab

and navigate back to the results or

whatever.

But basically now when you go to Google

search and you're like, I don't know,

recipe for cheesecake,

it's not going to serve up the AI

summary and then two hundred and fifty ads

and then a bunch of like SEO optimized

like here's the best homemade recipe for

cheesecake and real quick rant.

You click on it and then it's like

two thousand words of backstory.

And it's like, dude,

I just want a recipe.

Shut up.

So anyways,

now when you go recipe for cheesecake,

it's just going to go.

Here's the best recipe for cheesecake and

start spitting out a bunch of stuff that

will probably include glue and rocks based

on past AI summaries.

So as a result, this person is asking,

because I have not noticed this

personally,

but a lot of people do complain that

when you move away from Google,

a lot of people complain about the search

results.

And I think...

Personal opinion,

I think a lot of that is driven

by the fact that Google search results are

so quote unquote good because they're

tracking you and they know what you're

looking for.

So like, for example,

just now we were talking about Trivalent

and I was like, oh,

I haven't heard of that.

And so I went and pulled up another

tab and looked it up.

And the first like three things that came

up were like something about healthcare or

something.

I don't even remember.

But I remember just thinking like, oh,

that's not what I was looking for.

Like maybe I need to...

Maybe I need to type in trivalent browser.

And then as I was scrolling,

I found it.

So I was like, oh, okay, cool.

There it is.

But Google, in theory,

if I were a regular Google user and

I typed in trivalent,

that would probably be the first thing

that pops up because Google is stalking me

and knows that, oh,

he's probably talking about a browser.

So I don't know.

But I think that's just something worth

noting for people who are maybe frustrated

with some of the other results when they

leave Google is you have to...

I've written about this in the past and

I should probably revisit this topic is

like,

there's almost like two things can be

real.

I know that's,

that's a hard thing that sometimes people

struggle with, but like,

I think there's a balance of like open

source developers should do their best to

build the best product possible.

But I also think that

companies aren't entirely wrong when they

say that surveillance does make a more

personalized product.

And therefore I think we have to like

temper expectations within reason.

But when we move to some of these

things, we have to accept that like, yeah,

the search results may not be as good

quote unquote,

because they're not stalking you and they

can't read your mind and they don't know

that you're looking for a browser and not

something else.

And, um,

But anyways, yeah,

so definitely check this out,

because we do have, real quick,

I'll share it,

and then I'll turn it over to you,

Jordan, because I know I'm talking a lot.

I'm sorry.

But we do, oh, where'd it go?

Oh, I forgot to add the tab.

That would help.

There we go.

We do have a page about search engines,

and our top recommendations are

DuckDuckGo, StartPage, and Brave,

as well as a shout out for,

I believe it's pronounced Searching.

which is a fork of search,

which I believe was abandoned or

discontinued or something.

So those are our official recommendations.

But definitely check out this forum post

if you're also looking to get off Google,

because

I mean, I see everything in here.

I see... What's this one?

Obligatory link to the page I just shared.

Someone else has been brave as good for

me except images,

which I totally agree on that one.

Someone else said Kagi.

Another person said Kagi.

Someone said the no AI version of

DuckDuckGo.

Shared a couple links to some other

projects that have been promoted on the

forum.

So, yeah, it's...

Yeah, I mean,

there's a lot of things being discussed

here.

Somebody said Yandex.

I'm going to push back on that one

personally.

But yeah, lots and lots of votes there.

If you're thinking, if you're like, oh,

I've tried Brave and it didn't work,

and I tried DuckDuckGo,

try some of these because maybe they are

pretty good.

So yeah,

that's all I got on that one.

Yeah, I think it is kind of,

I honestly feel like I need a,

I don't know,

maybe my experience is not like that

mirrored by other people's experiences,

but I feel like Google search is so

bad now.

Like if you try and search something,

it'll be like AI slop overview.

And then it'll be like,

an ad, another ad, another ad,

and then like maybe something related to

what you're searching and then a shopping

list.

And it's like,

you have to scroll like five times and

then like, there's not even,

sometimes it's not even something relevant

to what you're looking up.

Um, I think, I don't know.

I feel like, yeah,

I feel like Google is kind of crap

now.

Um,

maybe some of that's due to the AI,

AI slop stuff that every, every single,

um,

search engine is integrating.

I feel like also the AI overviews are,

I don't know, making it,

they're trying to keep people from

clicking on a link.

They're trying to keep people in the

search index.

instead of visiting a website.

And I think it's actually,

from what I've heard,

it actually is impacting website owners

because instead of actually some person

visiting the website,

an AI overview is just scraping it and

then giving the answer to someone and

they're not clicking onto websites.

So

Google is kind of taking away from

websites traffic in that aspect and every

other search engine that does this.

And unfortunately,

basically all the ones we recommend do

this by default.

So Brave Search has an AI overview.

DuckDuckGo has an AI overview.

It's really stop page.

Actually, I don't know if stop page does.

Let's see.

I will say, while you're looking that up,

again, in the thread,

a lot of people were pointing out,

I think it's noai.duckduckgo.com will give

you a DuckDuckGo without the AI summary.

So I think Kagi was another one that

people recommended.

For those who don't know,

Kagi is a paid option.

But I believe that the...

words for a minute there.

The AI summary is optional.

I think it does have an AI summary,

but since you have to log in to

do a search anyways,

because you need to use an account,

you can turn it off in your account

and it'll just stay off.

Yeah.

Kaji, Kaji, Kagi, Kaji.

I don't know how you say it.

I don't know if the name is confusing,

but you know what I'm trying to say.

Apparently it's a Japanese name.

Okay.

That might be why.

I'm just a...

I'm just an annoying Australian.

I don't know how to say anything outside

of my country.

But anyway,

what I'm trying to say is the AI

overview...

It looks like Startpage doesn't have that.

So maybe that's something to look at.

I personally...

I don't know.

I always find start pages kind of slow.

They don't have servers everywhere.

Also,

there's been some scandals with them in

the past as well.

Let's see what someone said here.

Oh, nice.

Thanks for that noai.duckduckgo website.

Yeah, yeah.

That is quite a nice one to do.

I think I might replace my current one

with that because, oh my goodness,

I'm getting so sick of this silly AI

overview thing.

Oh my goodness.

i think also yeah like i said it's

kind of taking away from website owners

when you don't visit their website uh i

mean we're all using ad blockers here so

it's probably not helping but like i feel

like them getting insight and like traffic

is also important it it it affects the

search index as well um with how websites

are accessed

And I would also push back against people

saying like, you know,

I use AI instead of a search engine.

Like,

let's let's try not to do that because

I think, you know, that's bad.

The the issue with these AI

chat platforms is they're kind of a black

box in terms of where the data is

going.

A lot of these websites,

like I know OpenAI, Gemini,

all these websites, by default,

they're using your data to improve their

models.

And when you put this information in

there,

it's not very easy to get it out

so once the data's been trained into a

model it's kind of impossible to get it

removed which is like another issue that

we're facing right like let's say you were

a minor celebrity for a little while and

you wanted to kind of start a new

life as someone else right um basically

you get everything removed on the internet

about yourself and

But then this AI model that scraped it

at some point,

if you ask the AI model about it,

even though the information doesn't exist

in search engines anymore and on the

internet, it still knows about it.

So, you know,

I think that's a concern that is pretty

massive with these AI models.

And also, I think it's...

Not always very accurate,

but I think everyone already kind of knows

that.

That's kind of obvious at this point,

but yeah.

That's what I was going to point out

is like, yeah, it's still, to this day,

I still,

I do use AI quite a bit for

research just because it's easier to ask

it complex questions.

But I use Braves Leo,

which cites all of its sources and I

double check every,

and it'll cite in the thing.

It won't just be like,

here's a paragraph and here's the five

places I took it from.

It'll be like, here's a paragraph,

but this sentence came from this source

and this sentence came from this source.

And so I will double check every single

source and be like, okay,

did it actually say that?

Or did you make things up?

And it's definitely getting a lot better,

but I'd still say at least about ten

percent of the time I click on the

source and I'm like,

I don't see that anywhere.

Where did you get that from?

Actually,

I posted a screenshot the other day where

just for fun, I told Leo,

I was like,

tell me about the new oil,

the privacy project.

And it completely with full confidence

made up a name that I've never gone

by.

I think it based it off like my

GitHub username or something.

I don't even remember what it was,

but it was, it was just weird.

It was like,

where did you get that from?

And so, yeah, it's just.

I knew it.

Your name was John oil.

I knew it.

No, it said it was like,

it said it was like a,

like Travis no Nate or something.

And I'm like, okay, not,

not the worst name,

but how'd you get that out of it?

Cause my, my GitHub username is TNO Nate.

Cause at the time I made it,

apparently Nate B was already taken,

which is usually what I use, but.

Yeah, it was just like, okay,

not sure where you got that one from,

especially when there's a million posts

online of people calling me Nate and me

calling myself Nate, but whatever.

Okay.

But yeah,

real quick to go back to one more

thing you said about even if you take

the data down,

it can still be in the training data.

We covered a story about that.

There was an adult actress who pays for

the data removal services and everything,

and somehow AI got her real name and

address and told it to somebody on Twitter

completely unprompted.

So yeah, it's...

Not good stuff.

Not good stuff.

Yeah,

even data breaches could be scraped

because we all deal with this.

Anyone that runs a website has seen...

They'll look at their traffic logs and

they'll see a million requests every day

and it's like, what?

Why?

Why?

From China or some random country that's

probably not going to be viewing the

website legitimately, right?

Yeah.

If it's an English website,

then why would there be so many people

from China accessing it?

Or some other country?

I don't know.

Make up whatever you want.

But yeah,

it's causing websites a lot of issues.

And also login pages.

I don't know if I still do since

I switched hosting providers,

but I used to get a lot of

requests for the new oil.org slash cpanel.

like people trying to find the cPanel

login to my website.

And it's just like, oh, OK.

Thank god that page doesn't exist.

But yeah, it's crazy.

One thing real quick.

Somebody said,

put the video in Apple Podcasts, please.

I think we're planning to, actually.

The podcast app we use sent out an

email a couple of weeks ago that said

that video podcasts are in beta.

So I think we're waiting for access to

that.

And that is something we definitely want

to play around with.

We're very interested in that.

But we just don't have access to it

yet.

I think that was kind of all we

had for forum stuff.

So I know we've been answering questions

as people go,

but might be officially time for the Q&A

now.

And somebody actually just asked here,

you're talking about AI.

Have you tried to self-host your own

private AI?

Yes and no.

I don't know if this counts as

self-hosting.

I've used Jan AI and GPT for all,

and they are pretty good.

I do like them.

I just...

The vast majority of things that I use

AI for are based on having web access,

like current web access.

Like if I'm doing research,

I want it to ping

the latest news stories and have the

latest information.

You know, it's not,

I don't typically use it for things like

write a blog post or even like proofread

this blog post or like help me brainstorm

ideas.

Like I use it for that stuff sometimes,

especially if I'm having writer's block

and I just like, dude,

I just need to get out of this.

Like, please help.

But I don't typically use it for stuff

like that.

I mostly use it for researching stuff.

And in that case,

I can't have an AI model that's like,

you know, oh,

my latest information is from September of

twenty twenty five.

And it's like, OK, that's great.

But this thing had a data breach in

April and I kind of need you to

know that.

Or, you know, again,

I'm looking for this specific thing that

happened that I want to reference as an

example.

And that happened two months ago.

And so I kind of I really like

Leo and Lumo for having Leo's better than

Lumo with this, in my opinion.

But maybe it's because I don't pay for

Lumo.

I like them for having that that web

access to be able to pull the latest.

I mean, there are times that

just to test it,

I'll see like a headline of, you know,

like, um, kind of political, but sorry,

his first example that came up, you know,

oh,

the U S assassinated this like foreign

general.

And I'll like type it into the, the,

you know, Hey,

tell me the latest about this foreign

general.

And it'll give me right up to the

minute of like, you know,

this happened today.

And I'm just like, damn,

that's really good.

I just don't get that with the offline

ones personally,

but maybe it's because I'm not properly

self-hosting and I'm just using an app.

So that's been my experience.

yeah I think also I think I mean

I've tried out like the gen AI thing

a little bit and other other similar

things just because I was kind of curious

about this uh I'm not really very heavy

AI user I'd say I use it like

every once in a blue moon but like

for something that like I can't find

information on sometimes it's helpful for

troubleshooting that sort of thing

but I think the issue with a lot

of these local systems is they require

kind of a ridiculously powerful computer

to get the same level of quality because

while there is like

models that can run on most computers.

If you don't have a hundred and twenty

eight gigs of memory,

a massive graphics card like a fifty

ninety or something,

you're going to be running a pretty small

model which has issues, right?

Like it's it doesn't have the same amount

of information.

It doesn't have the same amount of

context.

It can't understand what you're trying to

ask it as well.

the answers aren't going to be as high

quality.

I think that's where the self-hosting

thing kind of becomes a little bit

unfeasible,

especially because if you've been looking

at PC prices at the moment,

like you will know that this is like,

it's inaccessible.

Like even for the average person to build

a computer right now,

it is completely inaccessible.

Like RAM prices are the highest they've

ever been.

Ever.

So same with graphics cards,

same with hard drives, SSDs,

all this stuff.

I think self-hosting things is kind of a

bit of a, well, no, self-hosting is fine,

but self-hosting AI model stuff is not

really that feasible.

I would also try and question people on

like,

do you really need to be using an

AI model?

Like,

I feel like we don't really need to

be doing that, like, that much.

I feel like it's,

we're at a stage at least where this

technology is optional.

And I would sort of push people towards

maybe try and work things out without it.

And use some of these, like Nate said,

there's like Lumo, there's Leo,

there's DuckDuckGo, I think has one.

I only think of too many other ones,

but there's all those ones that don't

retain data and don't train on your data.

So that could be a better idea if

you only need it every so often.

But I think generally...

uh, I would avoid it if you can,

cause there's a bunch of issues with it.

Um,

it's kind of making the world a terrible

place at the moment.

So yeah.

Yeah.

Just to back up what you were saying

about the computer,

I have a decent enough, um,

my windows computer has like a,

a Ryzen seven,

I don't remember what kind of graphics

card it's decent.

It's definitely not as good as I'd like

it to be, but yeah,

every time I fire up,

this is another reason I don't really use

GPT for all to be honest is like

every time I fire it up,

it sounds like it's taken off and it's

about to explode on me.

And it's also just super, super slow.

And it's like, okay, I could,

I could get Leo to do this a

lot faster.

So yeah,

But yeah, it's, um, I,

I do try to use it as a

bit of a last resort.

You know, I try to do searches first.

I try to figure it out first.

I've got,

when I talk about writer's block,

I've got a bunch of tricks, you know,

I've got,

I know how to outline things and get

up and go for a walk and stretch

my legs.

And, but you know,

there's some times where it's just like,

uh, I'm I'm lost.

What do I do?

So, but.

I see Sid did ask a while back

when we were talking about search engines

if we had any thoughts on Quant.

I don't have any thoughts on them.

I think they're kind of like the way

you described DuckDuckGo.

They don't really stand out,

in my opinion.

I think there's better options.

But I don't think there's anything wrong

with them, per se,

as far as I know.

Trying to look it up here.

But kind of a...

quiet night.

I think we've been answering questions as

we go.

Yeah, I think with Quant, I think it's...

just doesn't have the same level of

privacy that the other ones that we

recommend have like there's just small

things that other ones kind of edge it

out uh I think there were some privacy

concerns with it again though go check out

the privacy guides forum like I'm I am

almost certain that there is a topic about

this about someone willing to get it out

to the site yep here we go here's

uh here's one uh so it does collect

according to the discussion here they

They aren't open source.

There's some information.

They were initially actually listed on

privacy guides, but it was removed.

I had a feeling that was the case.

So definitely check out that thread.

See what people are saying about it.

It could have changed.

The situation could have changed.

I would definitely recommend if you think

that the situation might have improved,

we're always open to getting things added

on the site.

We're currently working on quite a lot of

changes at the moment.

We're removing apps,

getting things updated again.

So definitely check that out.

And maybe it is something that we can

reconsider.

But as far as I'm aware,

nothing has changed since it was removed.

So yeah,

maybe just stick with the current

recommendations and that would probably be

safest.

It does have its own search index,

if I understand my research correctly.

So that's cool.

But yeah,

I'll be reading that thread later for

sure.

I guess that's about it.

It doesn't look like any new questions

have come in.

I don't know.

Do you want to give it another minute,

or do you think we should call it

a show?

For some reason,

I'm not seeing some of the questions.

Some of the comments are not coming

through on StreamYard here,

but I did see some people making comments

that maybe we could touch on a little

bit here.

Easy browser for...

Easy browser for boomers.

I was thinking DuckDuckGo for mom.

I mean, yeah, I think it's pretty basic.

It does all the same stuff.

I don't think it's a bad option.

I think, you know,

We kind of always push people towards the

best possible options.

But I think if it works, I mean,

I don't know.

I personally haven't used it that much.

I've just tested it out a couple of

times to see what it did.

But it seems pretty basic and pretty

simple.

It does everything on the tin.

There's nothing too bad about it.

I mean, I wouldn't be against doing that.

I think Brave's also a good option.

Firefox is also a good option.

Again, though, I feel like with Brave,

it's a little bit annoying because they

always add features and then it gets

turned on by default.

And it's like,

I don't know.

Same with Firefox.

They do the same thing.

It is kind of frustrating that, like,

there's no way to be, like... Don't...

Disable all new features by default.

Like, if that was a feature, I'd be,

like, so on board with that.

But, yeah.

I think DuckDuckGo is not a bad option.

But, again, there's, like...

I think if you're getting someone off

Chrome or Opera or these other really bad

ones,

I think anything is better than that.

Even if it's not the best possible option.

Definitely think about it like that.

I think it's really tricky.

On the one hand,

what I would say is something I think

we all forget in the community a lot.

you can always change.

There is nothing stopping you from if you

use Brave and then like you were saying,

oh,

it keeps pushing these features or I just

found out I don't agree with the CEO

or whatever.

so switch, you didn't marry them.

And even then divorces exist.

Like, you know, you didn't, it's, it's,

it's free, like switch to,

to Firefox or whatever else.

Like you can, we can always change,

but specifically when it comes to, um,

you know,

you're talking about like for family

members,

I think that gets a little trickier

because I think there's, um,

there's two obstacles there.

One of them is like a mental block.

Like I've,

I've read so many stories usually on

Reddit of people that are like, you know,

Oh, I like,

I went to my mom's house for Thanksgiving

and I like switched her over to Chrome.

And then I just changed the logo to

look like internet Explorer because she's

still using internet Explorer.

Yes.

Internet Explorer, not edge.

And you know, it's like,

those are the kinds of things where it's

like, okay, I mean, whatever works,

like some people are just not tech savvy

and they're not even going to notice the

difference.

But then also like,

so like where I'm going with that is

like,

I think there's some people where if you

tell them like, you know, Hey,

I switched your browser because you know,

your old one hasn't been updated in ten

years.

They're going to freak out and they're

going to be like,

I don't know how this works,

but if you would never told them,

they'd never even notice.

You know, it's like all in their head.

I think that's a challenge,

but then I think there's also the fatigue

of like, okay,

say you switch them to Firefox and they're

just like,

I don't like this.

Like genuinely, like, I don't like this.

This isn't working.

I don't understand the UI.

And then, okay, well let's try brave.

And it's like, well,

I'm still a little confused and I'm not

really sure.

And it's like, it's,

you don't want to keep switching people

because they'll get exhausted.

Like a lot of people have,

have cited that in the privacy community

where like, you know,

I got all my family on like wire

and then wire went away or, you know,

I got all my family on wicker,

which I miss wicker.

I thought wicker was awesome,

but you know, they went away and,

you know,

and then I got everybody on session and

session almost went away.

And it's like,

you hit a point where people are just

like, I don't want to keep hopping,

like just pick something and let's use it.

And so it's, um, it's definitely really,

uh,

I guess what I'm getting at is like,

I have some sympathy because on the one

hand I would say like, yeah, just try,

try to put your family member on whatever

the best option is,

whether you believe that's brave or

Firefox.

And if they don't like it,

they can switch,

but they'll probably get tired of that if

that keeps happening.

And I do worry about the mental block

of them,

like just being afraid of an unfamiliar

thing.

It's really tricky when you're trying to

help other people like that.

So I don't know.

But yeah, I think at that point,

you kind of have to take the harm

reduction approach of,

like you were saying, well,

at least it's not Chrome.

Almost anything's better than Chrome.

So yeah.

Exactly, yeah.

I think it's...

You've got to put things in perspective,

I think, sometimes.

Okay,

so we've got some more questions here.

What is your opinion about Nosta Protocol,

a new VPN working on Nosta?

I think Nosta seems interesting, but,

I mean, there's...

We kind of push people more towards the

Fediverse over NOSTA.

I know that there is...

I feel like NOSTA has more of a

priority about censorship resistance and

free speech,

which is good if that's what you really

are looking for.

But I think we are kind of big...

proponents of the Fediverse over Nostr.

I'm not really sure of the technical

limitations behind Nostr or anything like

that.

Personally,

I am kind of biased as well because

I'm also on the Fediverse.

I'm not on Nostr.

I haven't really seen any benefits over

Nostr.

Like, I had no reason to switch.

So, I don't know.

I haven't seen that they're working on a

new VPN system.

But I think it's...

Nostra does seem a lot more popular with

a very specific niche community of people,

mainly in the cryptocurrency space.

So, I think...

If you're in the cryptocurrency space,

maybe it would make more sense to be

on Nosta because I'll just say I don't

think the people in the Fediverse are

going to like you posting about

cryptocurrency and Web three stuff.

It's just not really part of the community

there, which is fine.

I think it's just a different community.

So, yeah.

Do you have any thoughts on that or.

Not really.

I have never felt compelled to check out

Noster.

And I don't really know anything about the

technical workings of it.

And yeah, I don't have anything to say.

Alex asked about the Opera browser.

I think that kind of falls in the

same.

I mean,

please don't ask us about every single

browser, guys.

But Opera, to me,

is another one of those, like,

it doesn't really offer anything.

Especially from a privacy perspective,

it doesn't offer anything.

Especially compared to something like

Brave.

Okay, especially with Opera.

I know I said especially a lot.

I'm really sorry, guys.

Opera is based on Chrome.

So at that point,

you may as well just go use Brave

and get all the amazing privacy features

that Opera does not have.

And chances are that if you have an

issue with Brave,

it's probably the same issue you're going

to have with Opera in the sense of

like, well,

I don't like the Chromium Monopoly.

Opera is not going to fix that.

So it's kind of one of those things,

in my opinion, where it's like,

I don't see a point in opera personally.

And even I'll,

I'll go out on a limb and say

this.

I think I actually told someone about this

earlier today, real quick.

So opera GX is like this version of

opera that's aimed at gamers.

And it's like, Oh,

you can like restrict how much Ram it

uses and stuff like this and that personal

opinion.

And I'm not as tech savvy as I

used to be.

So maybe I'm wrong here.

I feel like it's all smoke and mirrors.

I real quick,

if I can tell a story.

So I used to I used to be

in the military and a lot of my

friends were not a lot of my friends,

but a couple of my friends were into

like street racing.

And so they would do things like remove

the backseat of their car because that's

just dead weight they don't need.

And I remember another one of my friends

who was a mechanic would laugh at them

when I told him that story because he's

like, that's like, sure,

technically you're getting rid of weight,

but that is so negligible because there's

other components in the engine that like

this one little component weighs as much

as the seats do.

But if you spend, you know, I mean,

granted,

it's going to cost you twice as much,

but if you spend twice as much,

you can get the carbon fiber version of

that little component and

That's going to shave off more weight.

And if you keep doing that,

you're ultimately going to shave off way

more weight,

way faster by getting these components

instead of doing stupid things like taking

out the backseat.

And if you're dedicated enough to take out

the backseat,

then you should probably just be forking

over the money for these components.

And it's like,

that's kind of how I feel about things

like Opera GX is like,

Are you really getting enough of a

performance boost by like limiting the RAM

by one gig or whatever you can do?

Wouldn't it be better to just invest in

like better – okay,

obviously now with AI and everything.

Maybe you can't do that.

But before the AI boom jacked up the

price of RAM,

like wouldn't it be better just to like

spend eighty bucks and buy more RAM or

something like that?

I don't know.

So –

I don't really see a point to it.

I think if you have an issue with

Brave,

it probably applies to Opera and just

isn't worth it.

But thank you for coming to my TED

Talk.

Yeah, I think also the thing with Opera,

I think, is it kind of changed hands,

I think, in twenty twelve.

It was originally like a Norwegian company

that was like focused very much on like

customization and like having that they

had their own browser engine at one point

as well,

which people were kind of obsessed with.

um and then they kind of got bought

by like i believe it was like a

chinese consortium or something uh and

they kind of pivoted directions they were

they were moving towards like chromium

based uh instead of maintaining their own

system um and kind of the developers that

were really passionate about opera i think

they moved to vivaldi so like

But again, though, like Nate was saying,

like... Like, Vivaldi is fine.

Like,

it's not collecting your information

like...

chrome or edge or any of these like

really big big tech browsers but again

there's better options um and there's more

comments about browsers here as well did

you try zen browser how good is that

i like the ui but i don't know

about privacy i think it's just firefox so

we recommend firefox make some changes

adjust the settings i think it's

It's just the same as Firefox in privacy

perspective.

I think it's actually a little bit better

because it has a lot of the Mozilla

stuff stripped out,

which does make connections without your

consent.

I'd say it's a little bit better by

default, but again,

you could be using like Moldad browser or

Brave or something which has better

protections, so...

I know Jonah uses Zen and he speaks

very highly of it for what it's worth.

Oh, it's sponsored by Tuta.

I'm on their website right now.

I did not know that.

So yeah, it's probably not a bad choice.

I don't think so.

I think like when we talk about privacy,

it's fine, but I think, yeah,

it's missing some of those extra

protections.

I don't think they have as much of

a focus on,

on like fingerprinting protection and all

this stuff like Brave and Morbad and

Firefox have.

Um,

there was another comment here from

Purring Pudding,

general thoughts on Thunder Mail Pro.

Um,

I think I've been testing it out a

little bit and I kind of put together

some thoughts on the forum about it,

which I found.

So I'm just going to read what I

wrote.

I got access to the closed beta.

I've just been kind of putting together my

thoughts about it for a while for some

issues that I had with the service.

So I'm just going to read what I

wrote here.

Servers are hosted on AWS,

so Amazon Web Services in Germany though.

So it is that they have

Kind of a new thing that Amazon's been

doing is they have European servers now,

which I think is good.

I think it's still better than being

hosted in the U.S., in my opinion.

No two-factor authentication.

They said they're working on it, though.

It'll be out this year.

No inbound PGP email encryption.

It's on the roadmap for this year,

but it will be released soon, TMR.

No DNSSEC or Dane,

which is basically a way to verify the

authenticity of an email.

DMARC reports were being sent to

Cloudflare, which is like, you know,

it doesn't contain the message data,

but it's like a lot of metadata,

like IP addresses and

sent and received addresses and all that

sort of stuff.

You don't want that going to a third-party

company if you can avoid it.

What else was there?

They had the mta-sts setup,

which basically it's a way of allowing

email servers to know whether a server

supports TLS encryption.

Same thing with DNSSEC and DEAN.

It's like sort of how that works.

It verifies the certificate

to see whether the TLS certificate that

you're connecting to

is valid and stuff like that.

So are they also using payments through

Paddle,

which Paddle isn't particularly privacy

respecting.

I would have expected them to do something

self-hosted or something a bit different

like Tudor and Proton are currently doing.

Again, though,

I think this product is not really aimed

at the same audience as Proton and Tudor.

I think it's more of just like a

product of a product of

Thunderbird it's like if you use

Thunderbird you like your email being

hosted like outside of big tech you can

sign up to them instead again it's better

than Google it's better than Outlook it's

better than Apple but I think this it's

still very much a very early project and

I'm kind of

wanting to get in touch with their team

a little bit to see more specifics about

if they're going to address any of these

concerns that I had.

Because I think it's only going to benefit

users of this service in the long run.

You can check out the thread.

There's a thread on the forum on

discuss.privacyguides.net.

Thunderbird Pro and Thunder Mail

announced.

So check that out.

There's more discussion there if you're

interested.

I also think it's very expensive.

It was...

six dollars a month paid yearly USD so

that was about a hundred a hundred

Australian which is quite a lot compared

to Proton who offers similar service for

like half of that so it's a little

bit of a tough sell

There's also some additional services that

it includes, such as Thunder Mail Send,

which you can send files and then encrypt

it to other people.

There's also a calendar scheduling service

included as well.

I think both of those are quite

interesting in

I think they definitely offer a unique

service,

but I don't think it's really something

that we can recommend switching from

Proton, at least at this stage.

It definitely has the possibility of being

really good, though,

because one of the really cool things

about this service is it's based on

stalwart email server,

which is one of these self-hosted email

server software that we recommend.

It's written in Rust.

They have a big focus on privacy and

security.

They have a lot of...

quick development they've really built

this product up quite quickly and they've

had a focus on privacy and security from

the start which and just making it easy

to self-host your own email server which

I'm really a big fan of because I

think the more people that are taking

control of that data the better and if

we can make it easier because originally

like I can remember setting up email

servers like

five or ten years ago it was like

not fun it was like kind of a

time-consuming process it was not very

clear if you were setting it up with

secure defaults and stalwart kind of

automates that whole process for you so i

don't know i think it has a potential

to be quite good but i don't think

it's going to compete with proton or tutor

at least currently right now

I think we had a quick one from

Swiss kill Euro office.

What are your thoughts?

Do you have any thoughts?

It's not even out yet.

And not really.

That's a fair point.

Yeah.

I don't really have any thoughts.

I don't do,

I guess I do some online collaboration

just because, you know,

like these notes and writing the script

and everything.

But I honestly, like for myself,

I just use LibreOffice and,

It's not the prettiest UI,

but it's definitely gotten a lot better,

and it works.

It has everything I need.

Everything is more or less where I expect

to find it.

For online collaboration, again,

we don't do too much of that.

It's mostly just updating the show notes

and writing scripts every week or every

other week or whatever.

So yeah, I don't know.

It's not too much of a concern to

me, to be totally honest.

Yeah, same.

I use LibreOffice.

LibreOffice Calc is kind of great,

actually.

I think it's,

I would say it's like in some ways

better than Microsoft's one.

But some of the other ones like Writer

and I don't know,

definitely leave some things to be

desired.

But I think, I don't know,

I think it's better to have more options

than not.

It's kind of annoying, though,

that that keeps,

everything keeps forking over and over

again.

I'm pretty sure OpenOffice

It's open office was like a fork of

something else.

And then now there's a fork of only

office.

Was it only office?

Yeah, only office is a fork.

Yeah,

I think it's I think LibreOffice was first

or maybe open office was first because I

used to use the Apache open office one.

And then yeah,

I think only office was a fork of

something.

And now Euro office is like a fork

of only office.

I don't know.

It's it gets hard to keep track.

Sorry, I didn't mean to cut you off.

I didn't really have anything else to add.

I was just, yeah,

it is kind of confusing to keep track

of things.

Yeah, I think you're right.

The only office is different to

LibreOffice, like a separate project.

But yeah, yeah, kind of weird,

kind of confusing.

I don't know.

I like LibreOffice.

It works fine.

It's fine.

It's not that pretty, but it's fine.

Yeah.

The, the, the PowerPoint one presentation,

that one leaves a little bit to be

desired.

I agree with you, but yeah,

writers fine for me,

but I also don't do a lot of

writing.

Like ninety,

ninety percent of the writing I do now

is like in the browser, you know,

like I'm writing a blog post and it's

going to stay in the ghost drafts or

again,

like I'm writing the scripts and the show

notes and those stay in next cloud,

which I know is,

is a fork of something.

I think that one is only office.

I can't remember, but it's a,

I don't feel like I open Writer very

often these days.

But I was going to say, for me,

it's a case of like, I think,

so there's this concept,

for those who don't know,

called Dunbar's number, which is,

it's basically like,

they say it's around a hundred and fifty

people.

There's only about a hundred and fifty

people that you can have a meaningful

connection with.

And everybody else is kind of like

background noise.

And I know that sounds really harsh,

but it's just the way humans are wired.

Like we're not wired to keep track of

thousands of people and care deeply about

their lives.

And it doesn't mean you hate them or

anything.

It doesn't mean you're rude.

It just means like if you run into

one of those people who's not in your

one fifty, you might forget to ask them,

be like, oh, hey,

how's how's your job going?

How's that thing going?

How's your friend that you were telling me

about?

Like you just it's just hard to keep

track of people.

And I feel like it's the same way

for causes.

Like everybody has a certain number of

like

philosophical causes like the environment

or privacy or, you know,

digital sovereignty or whatever.

And I think it's hard for people to

care passionately about those things.

Like, again, you know,

even if you're not an environmentalist,

you probably still turn the light off when

you leave the room.

Right.

Or something like that.

But, you know,

you may not necessarily go to a protest

or something.

And that's,

that's how I feel about open source and

licensing.

Like there's so many people that like, Oh,

like,

organic maps for example to be totally

honest like comaps is a fork of organic

maps because there was like some kind of

like licensing thing or something or other

I know there were other issues too but

like that was a big part of it

was like something about that and I'm

sitting here like I just don't care and

and like I'm glad that people do because

that is important stuff that does have

repercussions but like I just I have so

many other things already that I care

about that when it's like oh there's this

new like whatever office suite because the

other one was AGPL instead of MIT or

what you can tell I don't even know

what I'm talking about right now and I'm

like I just don't that's so above my

level I don't care if it's good

It's, you know, we,

we talk about this with like signal,

for example, like if it's good,

if it's got features I like,

if it looks good,

if you make a good argument,

I'll switch happily.

I don't mind, but it's just like,

I'm not going to switch on that grounds

because there's only so many things I can

care about.

And for me,

like that kind of stuff is not one

of them.

So yeah, that's,

that's kind of why I'm on LibreOffice

because it's free and it works and it's

intuitive and yeah, but I don't know.

definitely i think we are definitely

hitting almost the two hour and thirty

minute mark here i think we need to

start closing out the stream but thank you

to everybody who's been leaving questions

and stuff um it's been it's been great

um to chat with you all and thanks

so much for again the donations that we

had that was really nice um but yeah

i think we're definitely gonna have to

start closing out the stream here um just

to respect everyone's time

Agreed.

Yeah, I'm at a standing desk,

so I'm getting a little tired.

So all the updates from This Week in

Privacy will be shared on the blog every

week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

For people who prefer audio,

we also offer a podcast available on all

podcast platforms and RSS.

And this video will also be synced to

peer to privacy guides is an impartial

nonprofit organization that is focused on

building a strong privacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

then you can make a donation on our

website, privacyguides.org.

To make a donation,

click the red heart icon in the top

right corner of the page.

You can contribute using standard fiat

currency via debit or credit card,

or you can opt to donate anonymously using

Monero or with your favorite

cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content

and priority during the This Week in

Privacy livestream Q&A.

We also released some subscriber-only

content recently that Jordan mentioned,

and hopefully we will continue to do so

in the future.

And you'll also get a cool badge on

your profile in the Privacy Guides forum

and the warm,

fuzzy feeling of supporting independent

media.

So thank you all so much for staying

with us, and we'll be back next week.