Ubuntu is adding AI,

a major new security vulnerability in

Linux that's making headlines and writes

con chaos.

All this and more coming up on This

Week in Privacy number fifty one.

So stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we've been

working on within the Privacy Guides

community,

and this week's top stories in data

privacy and cybersecurity.

I'm Jordan,

and this week I'm joined by Nate.

How are you doing, Nate?

I'm good.

I'm a little tired.

It's been a busy day for me,

but I'm excited to jump into these stories

and talk about some privacy stuff.

Yeah, me too.

All right.

Now let's dive into the biggest news in

privacy and security from the past week.

So the top story here is Ubuntu's AI

plans have Linux users looking for a kill

switch.

So if you haven't seen already,

Ubuntu is basically planning to integrate

AI features into the operating system.

People have been moving away from Windows

because of the AI features,

So this is definitely an interesting move,

but I do think this is definitely a

move from the corporate side of Linux.

For example, this is pushed by Canonical,

the company that owns Ubuntu.

So Canonical's plan to add AI features to

Ubuntu has some users asking for a version

of Ubuntu that does not include these

features,

while others say they'll stick with older

versions of the Linux distro or even

switch to a different one.

So basically the canonical VP of

engineering, John Seeger has basically,

uh,

already stated that they're not going to

be adding a global AI kill switch,

but users will be able to remove any

AI features they don't want.

So if you're kind of curious, like,

you know, what is this,

what is this going to look like?

So basically he followed up on that and

said, it would be, you know,

stuff like accessibility tools,

like AI speech to text and,

and text-to-speech,

along with like agentic AI features,

which I think we at Privacy Guides are

definitely much more skeptical about this

sort of feature.

We've definitely talked about that before

as a sort of privacy and security risk

in a lot of ways.

So that's also kind of a concern.

And he also followed up that by saying,

the plan is to introduce AI features as

a preview on a strictly

opt-in basis in Ubuntu version twenty six

point ten.

So I believe that is not an LTS

version.

That's actually just a standard release.

But yeah,

this is going to have a step in

the initial setup wizard that basically

asks you if you want to use the

AI features.

And he also clarified that these features

will be added as snaps to the operating

system.

So if you're not really familiar with

snaps,

they're basically a package format that

Canonical has moved forward with.

And that is...

sort of their proprietary package format.

So I guess to sort of move on

from this,

there was also another organization that

has a Linux distro.

So this was the CEO and lead developer

of Zorin OS.

And because, you know,

this is kind of becoming a sort of

controversial topic because a lot of

people are quitting Windows specifically

because they don't want all the AI garbage

like Copilot and

these agentic features, Artyom Zorin,

who's the CEO and lead developer of Zorin

OS,

said in a statement to The Verge that

his distribution, Zorin OS,

is AI agnostic,

and that any potential AI features must

adhere to our values of keeping Zorin OS

secure, privacy respecting,

and performant.

So he also said that Zorin OS might

adopt these features as they do appear to

meet the requirements of respecting

people's privacy and security.

So a lot of these features that he

talked about were like local AI models.

So that is a benefit.

And I also wanted to cover another thing

here.

that this article didn't actually show.

There was an interview done by Fosforge

FOSS Force,

and this was by Christine Hall.

And basically they interviewed John

Seeger, who's the, as we said before,

the VP of engineering at Canonical.

And he did state in this interview,

we're not, sorry,

we're not setting shallow metrics on token

usage or percentages of code written with

AI,

but rather incentivizing engineers to

experiment and understand where AI tools

add value.

rather than force a single early choice AI

stack.

We're incentivizing teams to each pick

something different and go deep,

so we learn more as an org in

the next six months.

He also said that Ubuntu workers will

never be replaced by AI.

So that is a good thing, right?

Whether that stays true or not is up

for debate.

You know, you can say, oh, we're just,

you know, we just didn't need you anymore.

Like you can make up kind of any

excuse you want to lay someone off.

So I don't know if that's entirely,

you can't really, you know,

follow that but anyway that's kind of my

personal opinion on the matter um and i

think this i'm going to hand it over

here to nate because i feel like i've

talked on this quite a while i do

have some privacy and security concerns

with some of this but i kind of

wanted to hear what your thoughts are nate

well um let's see i think uh

Well, first of all,

I want to clarify a couple of things

just in case you did mention this,

but just in case anybody missed it.

So these are allegedly these are going to

be opt in features.

They're not going to come pre shipped with

the operating system.

He did explicitly say that in future

releases,

like if you install Ubuntu from scratch,

that the install wizard will ask you if

you want to enable any of these features.

Um,

they also said they're going to be rolled

out as snaps, uh,

which for better or worse,

you can remove snaps.

So this is not going to be baked

into the, the, I mean,

not the kernel isn't the right word to

be technical, but you know,

they're not going to be baked deep into

the operating system where, um, you know,

it's, it's a pain to remove them,

but yeah,

So, um, overall, I mean,

I'm not a huge fan of canonical.

They've definitely done some not great

stuff in the past.

Like I think one of their releases came

with like the Amazon app pre-installed or

something, which was super weird.

Um,

but I think it would be fair to

say that they're not quite as bad as

Google in this sense, or not Google,

like Microsoft, um,

these other big tech companies, um,

I can't say I'd be terribly surprised to

see them change course for now and to

watch them become opt-out features,

but I also wouldn't say it's inevitable,

personally.

But I think, yeah, I think...

One thing I will applaud is that I

think there's kind of two sides of this,

right?

There's like the user facing side of it

where it's like, hey,

we're going to offer you AI features.

And I think at least the features they're

offering are things that I personally

think could be useful for people who want

them, like accessibility features,

speech to text, also troubleshooting.

Like Windows used to have a

troubleshooting tool and back around

Windows...

Seven, eight, maybe ten as well.

But in the early days, it was amazing.

It was actually really, really good.

You could go down and it was in

the taskbar.

You go down and you like right click

it or whatever.

And you're like, hey,

I'm having trouble with accessing the

Internet or whatever.

And it would go through the steps and

nine out of ten times it would fix

whatever the issue was.

And then for some reason,

Microsoft made it terrible to the point

where they eventually killed it off.

And I remember the last few times I

tried to use it, it's like, hey,

I'm having an issue.

And it's like, sorry, I can't help you.

Maybe try these pages that are completely

useless and don't answer your questions at

all.

So the reason I bring that up is

because if they're going to use one thing

that AI is really good at,

at least in my experience,

is troubleshooting things.

It's really good at feeding error codes

and you tell it like,

I'm using this version of a browser.

I'm using this operating system.

And it's really good at being like, oh,

this error code means this.

Try this.

And I have personally found that to be

very useful.

So I guess what I'm trying to get

at is at least I feel like these

are features that could potentially be

useful for people who want them.

I'm not saying that everybody has to go

get them.

But again,

compare this to something like...

windows recall, or, um,

I think they even rolled AI into like

Microsoft paint now.

And now you can do like generative image

stuff.

And it's like, I don't want that.

Nobody wants that.

This is stuff that's actually useful

somewhat.

But, um,

I think those are kind of my initial

thoughts.

I think, um, I think unfortunately,

you know, somebody, uh,

bam here asked like,

what are the alternatives then?

Um,

because a lot of beginner distros are

based on Ubuntu.

I think, um,

a lot of this really remains to be

seen in my personal opinion,

because I mean, things like men, um,

there is a Debbie inversion, uh,

like sees here pointed out,

there is a version of Debbie or mint

that's based on Debbie.

And because honestly,

men ended up making so many changes to

Ubuntu anyways, they were like,

it's easier to just,

just go back to Debbie in and start

from scratch.

Um,

You know, Zorin OS,

like you said here with the interview with

the CEO of Zorin, he didn't say no.

He didn't say we're never going to roll

out AI features.

He said we're going to be thoughtful about

it, which, again, like,

I fully respect there are some people that

are just hardcore, like, no,

no AI ever for anything, no matter what.

And if you feel that way,

then you have no guarantee that Zorin

won't do this.

I love Pop.

My wife uses Pop, but also...

Honestly,

they'd be the first one I would expect

to add AI,

except maybe like Red Hat because of their

corporate...

Like you mentioned at the beginning,

a lot of corporate pressure from the

companies that really put a lot of funding

into these operating systems or these

particular distros.

So I don't know at this time,

to be totally honest.

I don't know who would be safe from

the AI stuff.

I think, unfortunately,

and feel free to correct me if you

disagree because I could be wrong on this,

but I feel like what we're going to

see is kind of like...

There's a lot of,

like in the browser space,

we see a lot of forks

that remove stuff.

So like, um,

like water Fox or like Libra wall,

for example, you know,

like Mozilla will roll this thing out and

Libra wolf will take the AI out or,

um,

helium is not really a fork of brave

per se,

but I found out recently it does actually

incorporate some of brave stuff.

They didn't include Leo, for example.

So I feel like we're going to end

up in the same thing with, um,

I feel like we're going to end up

in the same vein with these Linux distros

where we've got, um,

the main players, the Fedora, the Ubuntu,

and unfortunately they're adding AI and

it's going to fall on the people

downstream of them to strip it out.

Except for, I will say Debian.

I would be very shocked if Debian adds

this,

but also historically Debian does not

always necessarily keep the repo super up

to date.

And I personally have had that come back

to bite me in the past.

So yeah, I don't know.

Did I,

did I miss anything on that one or

any further thoughts came to mind while I

was saying that?

Not really anything to add on the

integration stuff.

I think it's kind of like someone said

here in the chat, I'm not against AI.

Bam Owen said, point is,

I'm not against AI if there's a reason

for it.

The reason now is it's fashion.

which, you know, I don't see,

I just don't see a lot of the,

like I can see for accessibility,

like I could see maybe if it's like

a local system,

like I'd need to know more about how

it, what data it's trained on,

like how it's, what, how exactly it works.

But I think a lot of these agentic

systems are

it's very like fashionable.

Like we did have a story that we

were going to talk about this week,

but it ended up getting the chop,

but there was, you know,

we're seeing a lot of, uh,

people using this agentic system to shop

online, do all sorts of things,

use their computer.

Um, yeah,

it's like handing over control of your

computer to some massive AI company.

It's not really the greatest thing to do.

I would say on a privacy perspective,

at least.

Yeah, for sure.

And I'm actually glad you mentioned that

because that was the other side I kind

of forgot to mention very briefly.

I feel like it's very... I do...

Personal opinion, and I could be wrong.

Thankfully,

I'm a fully able-bodied person,

so I could be talking on my ass

here.

But I feel like accessibility is one area

where open source historically lags

behind.

And I'm making that claim looking at my

wife,

who I'm very open about is extreme ADHD,

like severe ADHD.

And, um,

a lot of the times she struggles to

use a lot of open source tools for

things that most of us don't really care

about, but for people like her are like,

it's her brain struggles to adapt to these

tools because of just the, the menus,

the user interface,

just the way they look.

And it's not even that she's trying to

be picky.

It's just the way that her brain responds

to this stuff is if it doesn't grab

her,

then she forgets to use it or she

has a hard time like using it properly

and stuff like that.

And so I feel like open source software,

I think,

has come a really long way in some

accessibility tools.

Like I know on Mastodon,

people are really pushy,

respectfully in my experience,

but they're really pushy about adding like

alt text to your images, for example.

But I feel like we've lagged behind in

a lot of other ways with like...

like I know, uh, when,

when brave was trying to fight off recall,

they had to take into account making sure

the screen readers still worked and stuff

like that.

So, um,

I think where I'm going with this,

I think the AI could be useful if

it improves some of those accessibility

tools.

Like maybe if it can automatically pick

out a better color scheme for colorblind

people,

or if it can do the whole like

speech to text thing really well, um,

not to get too far on that tangent,

but I've,

I've mentioned in the past somewhere in

the past recently that, um,

people used to recommend to me that you

could use your screen reader to listen to

news articles while you're working.

Because I used to work a very physical

job where I couldn't just sit and look

at the screen and read an article.

But they're like, yeah,

use the screen reader and listen to it

while you're working.

And I just cannot listen to that monotone.

It doesn't get the pauses right.

It runs right through periods.

And it's just like, oh,

this is impossible to listen to.

I can't do it.

But I would love an AI where it

can more or less get the cadence and

it can kind of

I think that could be a good use

for it,

but I am really confused where he talks

about developers.

We're trying to get developers back on

Ubuntu.

I don't know, just that whole thing.

It was one of those things.

You had me right up until that part,

and then I'm like,

what is he talking about?

I don't know if it's just them trying

to stay competitive or something,

or like Owen said,

it's the fashion right now.

It was really weird to me, personally.

Yeah.

Yeah,

I think the biggest concern is Canonical's

developers are now using AI tools.

This confirms that they're using AI tools,

which I think for developing software,

I think AI can be kind of dangerous,

right?

Because there's people submitting...

pull requests,

there's people's developers working on

certain parts.

We know like these systems are based on

a dataset and the dataset can be poisoned.

Like we've already seen it before,

like even just a couple of

even just making a bunch of spam websites

with malware on it.

And the AI just scans it and then

acknowledges that as the,

as being part of its dataset.

Like it kind of is a bit risky,

especially because this,

these AI systems don't really know what's

right and what's wrong.

They just kind of are spitting out an

answer that will please you basically,

which in a lot of times means it's

just lying to you.

So I think,

It's a little bit of a dangerous choice.

I think them so openly admitting that they

like this,

they're considering allowing their

developers to do this or acknowledging

that they are is definitely going to push

a lot of people away from Ubuntu because

in the past there's already, like,

people who are, like,

very against it because if you remember

originally it was a very long time ago,

but they had an Amazon shop integration

and people were like really sus of it

because, you know,

it's sending data to Amazon.

It was a whole big thing.

They removed it.

They haven't done something like that

since then,

but it kind of burnt the bridges that

a lot of people had with Amantu.

So I think, um, it's, it's kind of,

uh,

not a great look for them.

And I think a lot of people are

going to be deciding to actually go with

a different distro instead of sticking

with Ubuntu,

which I think a lot of people already

have because Ubuntu

people really don't like snaps.

Like, oh, snaps are disgusting.

Like, why?

The loopback devices in the disk thing,

like, I don't know.

I just don't like,

I think snaps are probably the worst

containerized package.

But, you know,

I think a lot of people find Canonical

to be pretty controversial.

So I don't think this is going to

impact that much, but I think it's,

it has some knockdown impacts, right?

Because like you said,

there's so many distros that base their

distro on Ubuntu.

So like the changes that they make,

like allowing their developers to use AI

to develop the software can have a

knock-on impact and introduce security

issues, like I was saying.

For sure.

I don't have too much to add to

this.

But real quick before we move on,

I would be remiss if I didn't point

out, over at Privacy Guides,

our official recommendations for an

operating system are Linux.

You may be not surprised.

We recommend Fedora Linux.

I don't know if these are in order,

per se.

But I will say I've used Fedora a

few times.

I'm pretty happy with it.

It's really good.

Yeah,

so this is our recommendation for people

who are new to Linux.

We do also recommend OpenSUSE Tumbleweed.

We do recommend Arch Linux,

which I can already hear all the Arch

users in the audience.

If you want an atomic distribution,

we do recommend Fedora Atomic, which...

Um,

it looks like we don't recommend silver

blue specifically,

but I know silver blue is one of

the more popular ones there.

Nick's OS is another one.

And then, uh, you know,

who nicks and tails aren't really kind of

the things that you would use day to

day, but, um,

they are the best for anonymity.

And, uh,

I will say as a cubes user,

it is super, uh,

there's a very high barrier to entry,

but you know, it's, um,

It's very secure, I will say that.

SecureBlue, KickSecure, again,

those may not be right for everybody,

but definitely go check that out on our

website if y'all are thinking about

jumping ship from Ubuntu.

I would say start there as your

recommendations.

Real quick,

I do see a question from Lucas,

and I think we will take questions a

little bit later,

but I just wanted to let you know

that we did see that, so thank you.

Do you have anything else to add to

this story, Jordan?

I think you're muted.

Oops, sorry.

Yeah,

so there's a comment from Peaceboy John.

So they said, sadly,

to answer the video title question, yes,

sadly, it is.

It's definitely becoming less popular.

I remember back in the day,

Ubuntu used to be basically like the

pinnacle of Linux like it used to be

like the distro that everyone would like

choose and now it's sort of becoming like

uh yeah they made a lot of controversial

decisions um but yeah I don't really have

much more to add here

Yeah, I think I will real quick,

since it's relevant.

Bam Owen said few grandma-friendly distro

recommendations there.

And you were talking about,

you're thinking about not only what can

the tech-savvy people do,

but also everybody else.

And I think that's really valid.

I am always championing that mentality

myself of like, hey,

that's great that you use this thing and

you're not affected by this age

verification law or whatever,

but what about everybody else?

So I really applaud that.

But one thing worth mentioning

noting is uh you know privacy is a

spectrum and personally i think fedora is

pretty user-friendly um i mean obviously

there's always going to be certain people

that do struggle more with technology in

general but uh i mean like i mentioned

earlier my wife uses pop os she doesn't

have any issues with it at all she

never almost never asks me for

troubleshoot i think she asked a few

months ago and that was the first time

in literal years that she's like needed

help with something on that so

Um, I mean,

pop OS is not an official recommendation,

but my point is like, it's a spectrum,

right?

Like Fedora is not as secure as cubes,

but I don't think we're telling everybody

to go out and get a cubes computer.

Cause that is quite a bit of a

lift.

So it's, um, it,

I think even moving to something like

Ubuntu, even if they do add the AI,

even if it's not perfect,

I would argue is way better than using

something like windows or, you know,

moving somebody to a Mac instead of

windows.

So,

which I know there's a price problem there

for the record, but point being,

I see you, I do agree with you.

Like some of these,

some of these recommendations might be a

little bit out of reach of the less

tech savvy,

but I think there's still a lot of

good options that do move the needle.

So it's not always about being perfect.

Sometimes it's,

Sometimes it's about outrunning the other

hiker, I hate to say.

Yeah,

and I do think it's important to know,

like, you know,

you don't have to use the recommendations

that Privacy Guides has, right?

We specifically chose those because they

offer the best, like,

privacy and security stuff.

You need to, you know,

look at other sources,

find what you need for your situation,

like...

Cause that's the most important thing,

right?

Like if you're not tech savvy,

then maybe those recommendations aren't

going to be good for you.

And there's no point in it being more

private and secure if you can't use the

operating system.

So, um, yeah,

just definitely don't feel pressured into

using any specific distro.

You need to think about what, you know,

your needs are.

And if your needs are to use something

that's a little bit easier to use,

then definitely don't feel like you're,

uh,

added like you know you have to use

what we recommend for sure well said

All right.

On that note,

we're going to move into some sad news

coming out of Europe,

which is Europe is attacking,

not as a whole,

but a couple of European countries are

attacking anonymity right now.

Well, arguably,

Europe in general has got some problematic

laws they're proposing right now.

But we're going to focus specifically on

anonymity.

And first up, this came in first.

On April twenty third,

Turkey wants to ban anonymous VPNs.

And I mean, honestly,

it's pretty straightforward.

They want to require VPNs to basically

keep logs.

I don't think it's specifically said to

keep IDs, but basically,

they don't want anonymous VPNs anymore.

They want all VPNs to be able to

be tied back to a user.

Oh, man.

OK,

so the headline is pretty straightforward,

if I remember correctly here.

I mean,

I just read this a couple hours ago.

I should remember pretty well.

But there's a – yeah, let's see here.

So the licensing proposal would add a

legal ceiling.

Right now,

Turkish users can route around blocks.

A licensing regime would close that door.

So yeah,

there's a lot of concerns here about –

the more veteran listeners in the crowd

will know that just being under

surveillance changes people.

When people know they're being watched,

they behave differently.

So not having somewhere that people can go

to –

to, to freely research and explore,

you know,

that's one of the reasons we're such big

proponents of anonymity on the internet,

but also just it's, it's a,

It's another way to help try to keep

government in check, right?

Like censorship is one of the first signs

that something is not right in your

country.

I don't know about one of the first

signs, but it's up there for sure.

It's not a good thing.

So, you know,

when a country can require VPNs to keep

logs like this,

then even if they never actually say, hey,

block this website,

they can de facto block it because they

know everybody who's done it.

Yeah.

To the surprise of no one,

this is being described as a measure to

help protect the children.

I haven't seen this argument in a long

time.

They said that this has something to do

about attackers reportedly drawn to

violent mobile games.

So we have now regressed back to nineteen

ninety where we are blaming violent video

games for all our problems.

um you know i play boatloads of

civilization and i have yet to try to

take over the world i play quite a

bit of lately i've been playing a lot

of stardew valley i have yet to move

to a farm trying to think what else

um i've played tons of jurassic world i

have yet to bring dinosaurs back to life

so i don't really know where they're

getting all this from but you know we're

like i said we're back in the

separate but part of the same law they

said that they also wanted to add a

parent control child sim cards which i'm

not necessarily opposed to that but i i

would have to see what the implementation

looks like and also a cap on how

many mobile numbers a single person can

register which is

I don't know,

that just feels unnecessary to me.

But yeah, so, I mean,

that's kind of the thing there is Turkey's

trying to,

they interviewed ProtonVPN for this

particular article.

So, I mean,

take it with a grain of salt.

We also recommend Mulvad.

We also recommend IVPN.

But one of the things that I like

is Proton didn't even try to appease

Turkey.

They were basically like, yeah,

now is the time to sign up.

Now is the time to download the app

because once you have it, they can't,

technically,

they can't really go in and force you

to remove it.

And things like Proton, for example,

do have built-in censorship resistance.

MOVAD probably does too.

I think it requires a little bit more

manual configuration though.

But yeah, so I mean...

And if you have an Android,

you can always go to their website and

download the APK.

So yeah, that's a thing there.

And real quick,

we'll also move over to Greece who wants

to ban anonymity on social media.

And specifically, interestingly,

I'll give them credit.

They didn't go for Think of the Children.

They went for Toxicity.

And I mean this is basically – again,

the headline is what it says it is.

They don't want people to be able to

make anonymous social media accounts

because they're tired of people being

crappy online.

My first argument would be I think there

are a lot of people who are willing

to be garbage without anonymity.

We see plenty of people on Facebook using

their real names and their real faces,

and they're still being terrible.

I also – I thought this was such

a weird –

This is one of my personal things,

quoting the minister who spoke to this

article.

He said, in ancient Greece,

everyone could express their opinion

openly and by name.

They would raise their hand and share

their view.

This should inspire us as we shape a

new digital democracy.

Yes,

but the thing that people always forget

with this stuff is like back in ancient

Greece,

That wasn't written down.

They didn't sit there and take a roll

call of everyone who was in the audience.

They didn't sit there and write down every

single thing a person was said.

And more importantly,

they didn't sit there and sell it to

advertisers.

And they didn't sit there and put it

in this database that you can access from

anywhere in the world.

Like these are not one-to-one comparisons

because even like court records, you know,

as I say,

like they didn't sit and write everything

down.

Like, yeah, court records,

they sit and write everything down.

But again,

those are not sold to advertisers.

A thousand years ago,

that stuff wasn't kept in a data center

where you could, again,

pull it from anywhere in the world.

Back in the day,

if I lived in California and I wanted

information on somebody from New York,

I had to fly to New York and

get it.

And the internet has removed all these

barriers.

That's not really a one-to-one thing.

I will say that they do make some

good points about – they talk about how

with elections coming up,

Greece has a real problem,

which I think everybody does these days.

There's a real problem with fake news,

disinformation, trolls.

We know that is a thing.

Governments around the world on –

Every end of the political spectrum are

very heavily engaged in propaganda,

trying to sway public opinions, trying to,

you know, spread certain narratives.

And I will say,

not that I'm encouraging it,

but I do think it was funny that

when Twitter suddenly decided to start

saying what country everybody was based

out of,

it's amazing how many American accounts

were suddenly based out of, like, Moscow.

But...

I don't think that's a uniquely American

thing.

I don't think that's a uniquely left or

right thing.

I also don't think it's enough to really

justify this.

I think that's a very dangerous road that

they're headed down.

But yeah,

that is unfortunately what's going on in

Europe right now.

Did you did you see anything in these

articles that I missed, Jordan?

Oh, no,

I think that was a really good recap

of what's going on.

I mean,

Peace Boy John for twenty four said in

the chat, you know,

violence in video games is the biggest

excuse by far for fascism control over our

freedom and privacy.

Yeah, I think like, you know.

it's an easy, it's such an easy scapegoat.

I think what, what we used to see,

I wasn't around back then,

but I'm going to assume this is what

I'm going to, from research,

I guess I can say, uh, the, uh,

people used to say that about television,

like, oh, like, you know,

you're watching all this TV.

It's going to turn you into a violent

criminal if you're watching all these like

violent shows.

Um,

And as far as I know,

like there's no,

there's actually no evidence that that's

even true.

So, you know, there's like,

there's always these extreme cases where

there's like someone who's like a serial

killer and they like enjoyed GTA five.

And it's like the correlation doesn't

equal causation there.

You know, like it's irrelevant, right?

Did you have something you wanted to add?

No,

I was just going to back up what

you were saying.

It's funny because I do listen to a

lot of true crime,

and they actually know when there's a

serial killer that it's like, yeah,

he was really – like Jeffrey Dahmer

historically was really into – I think it

was The Exorcism III.

And they know that because it is so

unusual.

It's like normally they're not the

stereotype.

I mean there's several different serial

killer stereotypes,

but it's not always like the person who's

like super into horror movies and stuff

like that.

It's like – I mean look at Dennis

Rader, BTK.

Dude was a freaking Boy Scout leader.

He went to church.

I think he was a deacon at his

church.

Like it's – I mean slightly off topic,

but it's not an indicator.

And especially when you think of like how

many –

this past year has been like a huge

year for horror movies.

How many people went and saw bring her

back and then didn't go home and like

kill somebody, you know, it's just, it's,

it's cherry picking the things of like,

I know I don't want to downplay it

or anything,

but there was a shooter recently who like

made a simulator in Roblox.

I think how many millions of people play

Roblox Roblox and don't do something like

that.

And I'm not trying to let Roblox off

the hook.

I know they've got other problems,

but yeah, it's,

it's just like you're saying,

it's like selectively cherry picking like,

Oh, this makes it look bad.

And it's like, yeah, but that's,

doesn't it?

they're not necessarily related like that.

So.

Yeah, a hundred percent.

Um, I mean, this is just like, uh,

I think with the,

with the VPN thing as well, like,

I think this is where we see a

lot of these,

the issues of these centralized platforms

like Google play and the app store, right?

Because like you said,

people are kind of rushing to download

this because like the Turkish government

is kind of

they can kind of compel Apple or Google

into banning a lot of these things.

Like we already saw that.

I think there was,

when you did your interview with, uh,

Cindy Cohen,

she mentioned there's an ongoing legal

case in the U S about the U

S government forcing, uh,

a app that was used to track ice

agents, um,

to be removed from the app store.

And, you know, it's a tool,

it's a tool of censorship really.

Um,

And maybe there were legitimate reasons

for that being removed,

but it's clear that it's used as a

method to control the access to things

people can run on their devices,

which

seems not great.

So in this case, I think, you know,

it's good that ProtonVPN is,

they're kind of like one of the only

companies that are sort of actually

putting their money where their mouth is

and providing a free VPN service.

Like I'm sure there's loads of people in

countries where there's a lot of

censorship using their

using their free VPN to bypass the

firewalls.

And now it's like,

you don't even need an account.

You can just use it as a guest.

So it is,

it's really good to see that they're doing

that.

But yeah, I think it's,

unfortunately there's been a couple,

I think it was the UK that kind

of has pushed this whole like social media

anonymity ban thing.

And then Australia,

and then there's US states that are doing

it.

And then there's,

you know,

all sorts of countries that are doing this

stuff now, which kind of sucks.

But yeah,

it feels like every week there's like a

new story for age verification or like

something like that.

Yeah.

Yeah, for the record,

I think Australia was first and

everybody's been copying them.

But yeah, the UK has definitely, I think,

taken it a lot further.

They've openly floated the idea of banning

VPNs and yeah.

Okay, I think it was the, yeah,

the UK did, it was,

I think the UK was blocking...

uh, adult content.

And then Australia did the social media

ban.

Yeah.

I think that might be what it was.

Gotcha.

Social media is probably worse though,

because that kind of affects a lot more

people.

Right.

Um,

Yeah,

I don't know what our government is doing.

Help me.

Please help me.

Same.

Lucas here said,

I used to live in a sanctioned country

and paying for a VPN was not possible.

Yeah, I mean, I know there is Tor.

Tor, I think,

is sometimes a little bit easier to block,

but also has more...

It also has the openly available proxies

and workarounds, but...

Yeah,

he said it's great having ProtonVPN for

free.

So yeah, that's super awesome.

It's also not to like get this too

far off topic,

but we are big fans of things like

Monero to try and pay for things

anonymously because those are

significantly harder to sanction by

governments who try to do this kind of

stuff, so.

Yeah,

I think it's actually quite bad when

there's, you know,

the sanctions like that because a lot of

times it's like, you know,

even if your account is detected from

originating from a country that's

sanctioned,

it basically –

your account is immediately blocked on a

lot of services and stuff.

So it is definitely a problem.

It's good that like ProtonVPN has a way

for people to do that.

I think it's definitely an issue.

Like people don't really think,

cause like a lot of us,

at least on the privacy guide team are

from, you know, countries where there's,

No sanctions,

no major internet restrictions.

Well, anyway, you know,

sometimes it is good to understand there's

other people that also have different

needs.

Yeah,

it's definitely good what Proton is doing

for those countries.

For sure.

All right.

On that note,

I think that's all we have to say

on that story.

So I'm going to turn it over to

Jordan here to tell us about this exciting

new Linux vulnerability that I've seen pop

up in quite a few of the headlines.

So Jordan, why don't you take it away?

Yes, thank you.

So this one is kind of been floating

around and just to like,

I guess for people that have been

following a lot of Linux vulnerabilities

in the past,

this is sort of a continuation of

you know,

vulnerabilities in Linux that local

privilege escalation vulnerabilities in

Linux that have been basically using a

specific vulnerability in Linux, right?

So before there was dirty cow and dirty

pipe.

So if you have seen those before,

this is a similar thing.

I'm going to kind of read from their

press release because, you know,

I'm not the most – I'm not a

security researcher.

I'm not the most knowledgeable about this.

So I'm going to kind of just quote

a lot from this article here.

And you can take – we can kind

of discuss after.

So basically this is a –

local privilege escalation.

So that means it's not a remote privilege

escalation, which is much more damaging,

right?

So you need to have local access to

the machine,

which could mean that

It affects more shared hosting

environments, for instance,

where there's multiple users on a single

system.

And when we talk about local privilege

escalation,

we mean going from a regular user,

unprivileged user, to a privileged user.

So going from a user account to a

root user account.

And now I'm just going to quote from

the press release here, uh,

who is affected if your kernel was built

between.

And the patch,

which covers essentially every mainstream

Linux distribution,

you are in scope copy fail requires only

an unprivileged local user account,

no network access,

no kernel debugging features,

no pre-installed primitives and the kernel

crypto API.

AF underscore ALG ships enabled in

essentially every mainstream distros

default config.

So the entire twenty seventeen to patch

window is in play out of the box.

And they also discussed here that

distributions we directly verified.

So twenty four point oh four LTS Ubuntu,

Amazon Linux twenty twenty three,

RHEL ten point one.

Yeah, RHEL ten point one.

Sousa, sixteen.

So those were like kernel six point twelve

to six point eighteen.

So that is, you know,

it affects quite a lot of things.

And it also specifies which users are most

impacted.

So multi-tenant user Linux hosts.

So like, you know, shared dev boxes,

basically where there's

multiple users on the same system that are

unprivileged um which basically multiple

users are sharing a single kernel that

could be a user could use this exploit

to basically gain root user privilege

kubernetes and container clusters so uh if

you're running a kubernetes cluster then

it's possible that one of the containers

if it had this exploit it could

gain root access, and access the host,

basically.

And that is kind of concerning.

CI runners and build farms.

So basically,

CIs are basically the system that

developers use to automatically build

packages based on their code.

So these automatically run after merge

requests are made.

So basically, it can possibly...

you know, insert malware into the,

it could basically, you know,

have a PR request that basically allows

the user to gain root access to the

runner,

which can affect

If the runner is, you know,

shared by other systems,

cloud software as a service running user

code.

So like notebook hosts, agent sandboxes,

serverless functions.

And then they also talk about like

standard Linux servers,

single tenant production is not really as

popular.

much of a concern because you'd need to

have stolen credentials to do this.

And single user laptops and workstations,

which is probably the majority of privacy

guides users here,

is a low risk because you're the only

user, basically.

So you would need, basically,

if someone gained access to your system,

they could do this.

But that's not very likely.

That's not very in scope for a lot

of people.

So I guess we can kind of go

into the write-up of how this works.

I'm just going to read...

sort of how this works.

So AF-ALG,

which is the exploitable kernel module,

is a socket type that exposes the kernel's

crypto subsystem to unprivileged user

space.

A user can open a socket,

bind to any authenticated encryption with

associated data templates,

and invoke encryption or decryption on

arbitrary data.

No privileges required.

And basically it uses the splice core to

transfer data file descriptors and pipes

without copying,

passing page cache pages by reference.

So splicing a file into...

So it says when a user splices a

file into a pipe and then into AF-ALG

socket, the sockets... Oh my goodness,

this is like extremely...

extremely complicated.

So I think if you want to read

a little bit more about how this

specifically works,

then definitely check out the press

release,

because I'm not going to read the whole

thing here.

But last I checked,

this is still effective in basically all

the stable Linux gestures,

like Debian and RHEL.

Red Hat Enterprise Linux.

So yeah, this is like slightly concerning,

but I think for a lot of our

users,

I don't think this is particularly of an

issue because, you know, it does allow,

it does need one user to basically have

like local account access,

which is not really

not really that useful it's also good to

mention that this is like we kind of

talked about this last week but um with

the claude mythos stuff um this exploit

itself was actually found using an ai

assisted method so we're kind of seeing

that more and more um basically it was

able to identify and audit the whole

crypto subsystem and find this

vulnerability basically

so you know i think that's interesting i

think we're going to see more and more

of these like ai assisted exploits because

you know it's definitely able to analyze

the code a lot more easily than you

know because you kind of have to be

a pretty pretty uh

experienced, uh,

pen tester and security researcher to like

find these exploits.

So, you know,

if someone's not looking that carefully,

then it's definitely possible that

they'll,

it really needs like someone to look quite

closely to find these things.

So using an AI model definitely allows

that.

I think what I've heard though,

with these AI audit systems is that they

do cost a lot of money.

Like they cost a lot of basically, uh,

They cost a lot of tokens, I believe.

That's what they called in the AI sphere.

Like you need to basically use tokens and

that costs a lot of money to basically

analyze every line of code.

So this is probably not the cheapest way

of doing things.

I feel like if you're spending twenty

thousand dollars on like an AI assisted

audit, it's like.

Why don't you just like pay someone to

do that?

But I mean.

I guess it's easier because you don't have

to deal with another human, so maybe.

But I'm not really sure.

This is kind of an ongoing thing with

page cache corruption.

So this was the same issue that Dirty

Pipe and Dirty Cow had.

But in a lot of those cases,

it was...

There was a lot more specific

requirements, basically.

And where this is different is that

there's no conditions.

It's basically any system.

And there's no things like that.

So someone here sees LF.

I think the issue for workstations would

be a phishing attack that could get a

local user to execute the exploit on their

own or a chaining of an RCE with

copy fail to achieve root access.

I think that's definitely a possibility.

Yeah.

It's like,

it is possible to be for that to

happen.

I'll also say like this,

I was looking at this yesterday,

so I'm not sure if it's super up

to date,

but I saw Debian stable still hadn't fixed

this issue.

And it seemed like people were

I don't know,

not taking a very proactive approach to

fixing this.

And I think maybe it's because there's

not, you know,

there's not that much of a risk to

workstations.

Maybe there's a limited attack surface

because this does only sort of affect

shared hosting instances.

I'm not sure, but yeah.

Do you have anything you wanted to add

on this one, Nate?

I just had a couple of quick thoughts.

I mean, for one,

I wanted to drive home.

I know you already said this,

but I really want to drive home that

this requires local access,

which C's is absolutely right.

I mean,

that was my first question because this is

also too technical for me to fully

understand.

So I was asking about this the other

day when it came up.

In theory, yes,

somebody could get a hold of your...

For example,

I use SSH to manage my servers and...

theoretically,

if they somehow got a hold of my

private key,

then they could log in as me and

now they're in there.

But it's not one of those things that,

you know,

typically when we talk about a remote

access thing, it means that you wouldn't,

you wouldn't need to take any additional

steps like that.

You wouldn't need to fish somebody.

You wouldn't need to like plant.

I personally,

I used to laugh at these as surveillance

report all the time, not laugh per se,

but like there would always be these big,

like, Oh man, there's this really crazy,

like your phone can turn into a microphone

while it's sitting on your desk.

So the first thing the researchers did was

plant malware on the phone.

And I'm like, well,

no shit at that point, dude, come on.

And, and we saw that every single time.

So yeah,

That's not to like downplay these and say

they don't matter,

but just to kind of put it in

perspective of like, this is important.

This is something that they should

definitely fix if for no other reason than

the fact that it can break out of

containers.

And I don't know about you guys,

but I think a lot of people who

host self-host, I think the vast majority,

if they're using a VPS,

they're using shared hosting.

Very few people I think are willing to

pay for a dedicated server for any number

of reasons.

So it is important to patch,

but it's definitely not like,

like something that's just going to,

you know,

randomly start getting exploited.

There's some additional steps to take

there.

And then for the AI one,

like not to defend AI too much,

but you were talking about like,

I don't know why they wouldn't just pay

a normal auditor at that point.

I definitely think human auditors need to

be in the loop.

I think it was...

Oh, I don't wanna slander anybody.

Was it Entei recently?

Somebody,

one of the smaller projects we like that

kind of had an impromptu audit.

There was like an AI company that

approached them and they're like, hey,

we did this audit and we found these

things.

And like,

I hesitate to call it an audit because

it didn't sound like it was super formal

and it didn't sound like it was really

sophisticated.

But at the same time,

I do have respect for the idea that

it is, in a way,

it's another set of eyes.

It's another perspective.

It might notice things that you miss,

either just through, like, you're tired,

your eyes are glazing over from looking at

five million lines of code all day.

It can move way, way faster.

So I'm not trying to say it's perfect.

I know it's probably going to miss things

here and there.

But...

I don't know.

I guess where I'm going is I could

see value on it.

Again,

I would hope people are not relying solely

on AI for their audits, but yeah,

I don't know.

But yeah,

there probably is a point where it's like

we're spending twice as much on this when

we could get a human audit that's just

as good.

I don't know.

I could see arguments both ways,

but that just kind of came to mind

while you were talking about that.

Yeah,

so that is a good point to bring

up.

I definitely think it's kind of a little

bit silly to have everything be,

you can't only rely on AI, I guess.

There has to be some human input,

but I guess an update to this as

well.

Debian has released fixes on Bookworm and

Trixie.

Forky and Sid both had it fixed earlier,

so that's fine.

But yeah,

they both released fixes for Bookworm

stable releases.

If you're on Bullseye,

it's still vulnerable,

but you should probably update at this

point.

Bullseye is going to be phased out soon,

so probably look at updating to Bookworm

or Trixie at some point.

But yeah,

I don't think this is going to affect

most desktop users.

I think this is like you said,

it's concerning because people have VPSs

on

these like shared hosting platforms and I

think that's a bit scary that there's a

possibility of being able to break out of

a container or I'm not sure if I

guess it depends on what software the

hosting provider uses but yeah basically

anything that uses a shared kernel which

I'm not sure if it actually would affect

VPSs.

I think it would more affect shared

hosting,

like WordPress hosting sort of thing.

Cpanel and stuff like that.

Yeah, stuff like that,

where it shares a single kernel.

Because I think, yeah, the kernel,

it maybe would allow you to get root

access of the VPS,

but it wouldn't allow you to break outside

of that.

Yeah.

Yeah, definitely an interesting story.

This one was brought to our attention by

Freya,

who's also in the process of doing a

write-up on this.

So if you probably want to get some

more insight,

definitely check out privacyguides.org

slash news if you want to keep up

to date on some of the latest privacy

and security news and kind of get Freya's

thoughts on this.

And they had a little bit more

time to look into this so they've probably

got some more condensed thoughts but i

haven't really seen too many people

talking about this so i was kind of

surprised that uh that no one was talking

about it um so i thought it would

be good to at least mention um i'm

also kind of in the boat where like

this kind of goes over my head a

little bit um

I'm just reading what the press release

says.

So hopefully I did at least a decent

job of explaining it.

Definitely check out the article if you

want to learn more.

But yeah.

I feel like I've seen it pop up

in my newsfeed a little bit over the

last couple of days,

but I think it's still pretty new.

So, I mean,

it's already got a Wikipedia page

apparently, so that's cool.

That's our Wikipedia page.

What's that?

Oh, yeah, I know, right?

Man,

we have this conversation all the time.

This is crazy that we don't have one,

but...

Anyways, I actually did want to,

one thing that you said that somebody else

said,

and I meant to bring this up in

the first story,

but Bam here said that it's hard to

patch an old kernel such as Motorola on

Android X that stopped releasing security

patches.

Number one,

I think Graphene OS posted a big thing

on Twitter or Mastodon about how this

doesn't really affect Androids in the same

way, because I mentioned this before,

and I actually got this from Kerry Parker,

one of his guests that he interviewed,

is from a security perspective,

when we made mobile phones,

we as a society,

we kind of took all the lessons we

learned from desktop computers and fixed a

significant number of them.

So things about like,

I believe phones use like immutable

updates,

things about like app permissions,

things that phones do really well from a

security perspective,

but desktops have still not caught up.

So, I mean,

it probably wouldn't affect Androids in

the same way,

but

Going back to what she said and also

this and also the first story,

the first story mentioned that people were

saying like, oh,

I'm just not going to update Ubuntu

because of this AI stuff.

I don't mean to sound arrogant,

but y'all are absolutely insane with those

kind of takes.

I still see people commenting on old

YouTube videos where we talk about like AI

coming into Android and they're like,

well, I'm just gonna stay on Android nine.

And it's like, cool.

I hope you're not gonna touch the internet

with that thing because all of these

updates, yes,

they do often come with crap that we

don't want like AI,

but they also come with really important

security fixes.

And I don't know, just my personal take,

I think you're really gambling there,

especially the longer it goes on.

If you're like,

six months out of date like and you

don't really use your phone that often or

use it for anything sensitive okay fine

whatever but the longer it goes on the

more and more severe vulnerabilities

they're gonna find uh the easier they're

gonna become to exploit it's just to me

that's extremely uh i wouldn't do that if

i were you personally but um not my

phone so i guess y'all do whatever you

want but

I don't know.

I just, I wanted to address that.

I think people who choose not to update

in protest of features,

I think you're personally,

I think you're not getting a good trade

off on that one.

I think you should look into just a

completely different solution.

Like on Android, for example,

go to graphene where there are no AI

features.

So, yeah.

I think, you know, uh,

people have definitely very specific, uh,

decisions for choosing things.

And I don't know,

I think a lot of times a remote

execution vulnerability is probably not

too likely if you're being careful.

But I mean, obviously, I don't know.

You have to kind of know what you're

doing.

Otherwise,

I could say it's definitely probably not

the greatest, I mean, idea.

Yeah, I mean,

and I know there's always situations,

right?

Like there's definitely a lot of people

who live in countries where like they

don't sell pixels and an iPhone is too

expensive and stuff like that.

But I just, it's,

I'm more addressing it to the people who

are doing it strictly out of protest.

Like, I just don't want these AI features.

Well,

then you should probably move to another

operating system.

Like if you have the resources to,

I don't know.

That's just weird to me that it's like,

I could update to something else,

but I'm not going to,

I'm just going to stay on this release.

And it's like, okay,

but the longer it goes on,

the more vulnerabilities and in time,

like things are going to stop being

supported, you know,

eventually a lot of services you use or

like even who wasn't recently,

I think Firefox recently was like,

we're going to stop supporting this old

version of windows that I didn't know

anybody still used, but yeah.

So yeah.

I don't know,

just feels like the longer you go on,

the more you're opening yourself up to

risk, but that's my opinion.

Yeah, I definitely think it does depend.

Uh, I was using, I guess I'm gonna,

well, I'm not using it anymore,

but I was stuck on using an older

phone for like quite a lot of years

and it only back on Google pixels only

had.

like two years of updates.

Like that was so abysmal.

It was so ridiculously expensive as well.

Like it was like an a thousand dollar,

I guess like six hundred USD phone.

And, you know,

it only had two years of updates and

it was like,

I ended up using that phone for like

six years.

So, you know,

like four years of not getting updates.

Probably not the greatest idea,

but still like, you know,

I never got hacked.

So I don't know.

Maybe I was lucky.

Yeah.

I don't know.

I think we'll leave that one there.

I think we could argue this one all

night.

okay um so i did see there was

a question here from i'm wondering and is

there any sign that other companies will

adopt the privacy screen feature samsung

has introduced and what do you think of

it i mean i think it's interesting i

think the the issue that i've had with

like the privacy screen protectors is

they're like they kind of

make your screen look awful and they are,

I guess,

a strain on your battery because it's

basically covering the screen with like a

film, a dark film.

So, you know, I think it's,

it's interesting.

I think it's a better alternative to a

privacy screen protector, but I think,

you know,

there are trade-offs like there was

clearly trade-offs with the,

with the Samsung, uh,

with the Samsung galaxy S twenty-six, uh,

ultra, like there was,

there was trade-offs for having that on

the screen.

And I'm not sure if the trade-offs are

worth the

benefit,

especially because not everyone needs that

feature, right?

So like people were buying it because it

was a novelty,

but once it stops being a novelty,

it's just for a lot of people,

it's just a downgrade.

Like a lot of people don't care about

this feature like maybe you don't go on

public transport like if you don't take

public transport or you don't you know

open your phone in public then this

feature is not really that useful for you

so I don't know I think it's an

interesting I think it is sort of a

gimmick like it is like oh whoa look

at this cool new feature that we added

like it's really cool like everyone was

kind of obsessed with it for a while

because it's we've never seen anything

like it right and

but I think it's not very likely.

It's like how the Google Pixel added like

a temperature sensor.

It's like cool, but like no one's like,

I've never used that feature ever.

Like I don't need that.

Like it's a gimmick.

Like it's a thing that's like there as

like a selling point for the phone that's

oh,

look at this extra thing you can do

that you might want.

But I think for a lot of people,

they're like, oh,

the screen brightness is not as good

because it has this feature.

It's like, it's kind of just not,

people just want the best,

the biggest and the best.

And, you know, really,

you kind of have some trade-offs to that

feature, I think.

Yeah, I mean,

I don't know if I'm the best person

to weigh in on this because I'm a

notorious Samsung hater,

which for the record, no, for the record,

I finally addressed this.

I've had several comments over the last

year or so where people ask like, Nate,

why do you hate Samsung so much?

And to be fair,

I've said it over the years,

but I don't expect people to go back

and watch like every single podcast I've

ever been on.

So I finally wrote a blog post over

on my personal,

over at the new oil where I outline,

it'll be public on Sunday.

Right now it's like early access where I

outline all the reasons I I'm so angry

at Samsung.

And for the record,

this is not an official endorsement from

privacy guys.

It's my personal blog post.

But I did mention the privacy screen.

And basically, I'm with you.

I think it's privacy theater because

Samsung has had so many other things where

they could provide actual meaningful

privacy and security to their users.

And instead,

I don't want to go off on too

much of a rant here,

but Samsung's whole thing

is flash.

Like there is no substance to Samsung

phones in my opinion.

And their whole thing is like celebrity

endorsements and flashy features.

And like, don't get me wrong,

I've known people that have Samsung phones

and they love their phones.

It's almost like a cult.

It's like browsers.

People love their Samsung phones.

And don't get me wrong,

like some of the features, they're like,

oh, I can do this thing.

And I'm like, okay,

that sounds pretty cool.

I get it.

But once you dig under it and you

look at what's the privacy policy,

look at some of the history of

vulnerabilities they've had,

look at how they've responded to some of

those.

I don't remember all of it.

That's why I wrote it all down.

But when you look at all that stuff,

it's like, wow.

And then on top of it,

at the very end, I talk about this.

I'm like,

what really takes the cake is they are

the seventh most valuable brand in the

world.

Like there's Google and Apple are in like

the top five or whatever.

And then Samsung's in the top ten.

And then the next phone maker is freaking

Huawei all the way down to like fifty

something.

And so it's like you have for all

intents and purposes as much money as

Apple and Google.

And yet you can't make a phone even

remotely as secure as them because you're

too busy spending your money to pay for

BTS.

So, yeah, I am.

I hate Samsung.

Yeah.

So, yeah, I mean,

if you want to see all the reasons

I hate them again,

that'll be public on Sunday.

But that's what I think about it.

Like, sure, it's a cool feature.

And like, I don't mind it.

Like, I'm not mad that it exists.

But to me, it's just it's it's theater.

It's like, oh, look, it's cool.

Privacy feature we gave you.

There's no actual privacy built into the

phone.

There's no actual security built into the

phone.

Certainly nothing on the level of of

Google and Apple.

And don't ask about Knox.

I address that in the blog post, too.

And so it's like, it's just the,

the example I used was Oreos.

Like Samsung is like Oreos.

It's tasty.

It's delicious.

I love Oreos.

I do.

They're one of my favorite junk foods.

Nobody would eat a box of Oreos and

be like, I had a great dinner.

I mean,

you might need a box of Oreos for

dinner anyways,

but you're probably not going to feel

great.

You know what I mean?

Like, it's just, it's,

there's no substance there.

Nobody would eat that and be like, yeah,

that was a healthy meal.

Like, and that,

that's how I feel about Samsung.

So the privacy screen feature, um,

I wouldn't be against other companies

adopting it because again,

I don't necessarily hate the feature

itself.

It's just coming from Samsung

specifically.

It's like,

You know, it's – unfortunately,

this has happened before.

It's like serial killers that get caught

and then they complain about like, oh,

movies depicting my life are disrespectful

to my victims.

And it's like you killed your victims.

I don't care.

Like that's not disrespectful that we're

making fun of you.

Like don't pretend you care about this

stuff.

So that's just the same vibe I get

from Samsung.

It's like, oh,

look at this cool privacy feature.

You don't care about user privacy.

So anyway, sorry.

Yeah.

Yeah, and they'll be like,

we're protecting your notifications from

prying eyes.

Meanwhile,

we're sending all of your notification

content to Facebook or something like

that.

It's like, yeah,

it doesn't really make sense.

But I get it.

I get what you're saying.

I definitely think that's a good point to

bring up.

I mean, I don't know.

I wouldn't be opposed if Google was like,

we're going to add this.

I wouldn't be opposed to it, but like,

yeah, same.

I just,

I don't think it's going to happen though.

Cause like, it's kind of a gimmicky thing,

but it would be cool.

I mean, I would wouldn't mind it.

Yeah, that's fair.

And like you said,

it really depends on who you are.

Like if you travel a lot or in

your, in a lot of,

cause I know though it's, I mean,

part of it I think is probably to

protect against the whole,

there was that thing a couple of years

ago that's probably still going on where

we saw a real rise in like the

people snatching your phone at like a bar

or something.

And it's like, okay, cool.

Apple and Google also address that with

their like stolen phone protections.

And it was probably a little bit more

meaningful than a privacy screen.

Why don't you roll that out?

Especially because it's built into AOSP as

far as I understand,

I could be wrong about that part,

but like, it's like, why,

why don't you just do something like that?

So I don't know.

I think it might be part of like

Samsung's proprietary, like one UI thing.

Is it one UI?

I can't remember what they call that.

No, it's one UI.

When you add eight point five,

that is now like eight months behind

schedule.

Yep.

Oh, OK.

I'm excited for you.

I'm excited.

I saw you were working on that.

I'm excited to see what the what the

what the what you say,

because I honestly don't know that much

about Samsung.

Yeah.

So definitely.

I don't know if you want to link

it or.

um i i can't i'll ask jonah if

that's okay but um i will say for

the record i i found myself corrected on

a few things there were a few things

like i um i was gonna bring up

the one ui eight point five thing because

i thought it was they were like a

year behind on android sixteen turns out

i'm wrong on that they have pushed out

version eight already had android sixteen

eight point five is just like the next

like major build

And they have been pushing out security

updates.

So there was that.

And I swear to God,

I remember a story where their source code

got breached and people looked at it and

said it was really bad.

But I cannot for the life of me

find that anywhere.

So I dropped that part too.

So I just want to make the point

that it's not me just like making up

things and looking for reasons to hate

Samsung.

Like I did my research.

And if I'm like, okay,

that wasn't how I remembered it.

I didn't include it because clearly I was

wrong.

So yeah, I don't know.

Hey, fair enough.

No, no, no blind hatred here.

Just, uh, just facts, you know?

Hopefully.

Yeah.

Uh, so, okay.

Um, what do we, let's, uh,

I think we'll move into site updates now.

On that note,

we are going to talk about RightsCon in

a little bit,

because that is an unsettling and chaotic

story.

But first,

we're going to talk about what's new over

at Privacy Guides.

And it's actually been a little bit of

a slower week, at least in terms of...

visual progress uh there's been a lot of

work going on behind the scenes um we

have a new video coming out that um

i guess jordan's been editing so i don't

know how far along you are but i

i'm imagining probably pretty far along by

now um hopefully we'll have that out to

you guys what do you think next week

or is that too ambitious

Um,

I'm hoping to get it finished this

weekend, so we'll see.

Okay.

We'll see.

So potentially next week,

we'll see how far we get.

Um,

I'm already scripting the next video with

a lot of help from Jonah.

Um, and I think that's,

that's going to be a good one.

I'm excited about that one.

Um, we're going to revisit,

we're going to revisit some, uh,

some basic topics,

but also it's one of those topics that

has had a recent update.

Um, you'll,

you'll see what I mean when it comes

out, but.

Yeah,

that's kind of all that's been going on

on the video side.

Like I said, not a ton to share,

but it's been good, solid progress,

I think.

Cool.

Yeah.

Is there anything going on on the site

side of things, Jordan?

Yes.

So there's, like I said before,

like Free has been working on news

articles as usual.

There was another,

they're currently working on one here

about the copy file one,

the one that I mentioned before.

And there was also another one that they

posted where apparently Firefox has

quietly added Brave's Rust-based ad

blocker.

So, oh,

they're taking some inspiration from Brave

there.

That's interesting.

So if that sounds interesting to you,

you can check it out at privacyguides.org

forward slash news.

Do you have something you want to add

on that one actually?

I was just going to say,

I'm super excited for it personally.

I would love to see Firefox ship by

default with an ad blocker.

So we'll have to see what kind of

lists they enable,

the block lists and stuff,

and what it's going to look like for

the end user.

But yeah,

I'm definitely going to try to keep an

eye on that myself.

So definitely read that article if you're

a Firefox user.

I'm a big fan.

I like it.

Yeah, definitely.

I think Brave is, like,

that's the one thing that I think Brave

has absolutely nailed.

Like, it should be included.

Like, come on, Firefox.

Like, it'd be really good if, like,

you know, there was two different, like,

we had, like,

we didn't have to rely on uBlock Origin,

right?

Like, if there was, you know,

Firefox had its own inbuilt ad blocking

system similar to, like,

what Brave is doing, it'd be pretty cool.

And I think, you know,

it would give people better privacy by

default,

which is what we're here for that.

Like that's exactly what we want.

And it's also just,

it makes it such an easier sell.

Like right now,

usually when I try to get people to

switch browsers, I'm like, yeah,

just switch to Brave.

And, you know,

I get why some people may not like

that.

And I'm with you on that.

But also it's like, yeah,

because I can tell them just switch to

Brave and it's got the ad blocker.

It's got good defaults.

It's like, everything's good to go.

Not that you can't make it better for

the record,

but it's pretty much good to go.

Versus if I tell somebody, I'm like, yeah,

switch to Firefox.

But also you have to download uBlock

Origin.

And when you start adding in steps,

people are just like, oh, dude, I don't.

And I know it's ridiculous because it

takes two seconds, right?

But for some reason,

it's a mental block for people that

they're just like,

I already have to switch browsers.

Now you're telling me to do more stuff.

So if it comes built in with an

ad blocker,

I think that's going to make it so

much easier for people to just like...

Yeah, switch to Firefox or Brave,

whichever one you prefer.

And it's just that one click.

And then maybe later they can go change

some settings, but yeah.

Yeah,

I think that also the thing that I

think is important with Brave though is,

or any browser that comes with an ad

block included is,

if you give people the choice,

people are going to use the ad block.

I feel like not many people would be

like,

Yeah, I like ads.

I like seeing garbage all over every

webpage and I like watching YouTube ads.

It's like not many people really enjoy

that.

So I agree.

It's definitely an easy sell.

Like Brave isn't a super easy sell to

people.

I think I will say,

I don't know if people enjoy that,

but I know a lot of people will

just default.

Like,

I met so many people that are like,

oh, yeah, the ads don't really bother me.

But then once they start seeing life

without an ad blocker, they're just like,

wow,

this is a completely different internet.

So, yeah.

Yeah.

I mean, I don't mind...

ads per se,

like if it's like a non-intrusive one,

but we've gotten to the point where the

internet is like,

do you want to accept cookies?

Do you want to join our newsletter?

Do you want to watch this auto-playing

video with audio?

Like, like, no, I don't.

Like if it was less intrusive,

like maybe I would be somewhat more okay

with it.

Right.

Like I'm not completely against it,

but it's just,

we've gotten to a point where it's just

so irritating.

Yeah.

I know I've told this story before,

but my brother was one of those people

that was like, yeah,

the ads don't really bother me.

They got to make money somehow.

And even he at one point texted me

and was like, hey,

what's that ad blocker you always talk

about?

Because like these YouTube ads are just

out of control.

So it's hitting a point where even the

people who say they don't mind are getting

sick of it.

Yeah, for sure.

Yeah, like a three-minute video ad.

Oh, YouTube, what are you doing?

Anyway, kind of refocusing here.

So Nate also put together,

so if you don't know already,

Nate puts together a data breach roundup

every week so you can kind of keep

on top of what is,

if your information is being breached.

It's not every data breach, obviously,

because I feel like that would be

A lot to cover,

but it's like basically the biggest ones

that were this week.

So kind of giving a quick overview.

Vimeo had a third party breached.

Hackers have threatened to leak over nine

million Amtrak records.

Medtronic confirms a breach after hackers

claim nine million records theft.

And ADT confirms a data breach after shiny

hunters leaked.

leak threats so check out that um if

there's like stuff you want to kind of

know about those specific things or if you

want to see if you've had a breach

or not um that'll be good uh to

check out and i'd also recommend if you

do enjoy these podcasts you can go to

privacyguides.org slash live streams and

you can subscribe to get those into your

inbox and you can also um

find this news updates section.

You can also subscribe to that to get

that to your inbox as well.

Basically gives you an option to choose

what you'd like to get to your inbox.

So if you do appreciate that,

definitely check that out.

All right.

So I just want to mention, oh,

do you want to,

do you want to add something?

I was just going to say it's, yeah,

it's whatever data breaches I find.

So that's the caveat I give people is

there may be more that didn't come across

my newsfeed.

We always find out about a lot of

them after the fact.

So I wouldn't rely on it as a

Bible,

but hopefully it'll let you guys know if

something you use had a breach.

So.

Yeah,

especially because not every company,

sadly,

is disclosing this to their users

properly.

We hope that most companies are doing the

right thing,

but a lot of companies will try and

minimize the damage.

So it is kind of important to keep

up to date on that stuff.

But I do want to mention all this

is made possible by our supporters,

and you can sign up for a membership

or donate at privacyguides.org or pick up

some swag at shop.privacyguides.org.

And you can see that Nate's got one

of those water bottles you can check out.

And basically,

Privacy Guides is a nonprofit which

researches and shares privacy-related

information and facilitates a community on

our forum and matrix where people can ask

questions and get advice about staying

private online and preserving their

digital rights.

Now,

let's dive into this story about

Talkspace.

Alrighty, yes.

So Talkspace.

Ooh, I hit a button.

Talkspace,

many of you have probably heard of

Talkspace or similar apps to Talkspace.

It's a...

It's an online therapy app,

kind of like BetterHelp or one of those.

I have mixed opinions on those personally.

I'm a big proponent of therapy, very open.

I have depression.

I've been in and out of therapy.

I've been on and off medication over the

years.

It's been really great for me.

And I also,

growing up as a teenager in the days

of instant messaging and stuff,

I understand how sometimes it can be a

little bit easier to open up to a

screen instead of a person.

That is actually a known psychological

phenomenon where like,

When, ironically,

when there's not a face in front of

you, it goes both ways.

Sometimes having a face humanizes it and

makes the emotional connection better.

Other times it makes it a little more

anonymous so it's easier to open up.

But unfortunately,

a lot of these apps are riddled with

privacy concerns.

And I mean,

the headline of this article kind of

really says it all.

So this woman, I believe there was a,

is this, let me double check here.

Was this the same story I was thinking

of?

I believe this woman was let go from

a job.

I'm trying to scroll down and find that

part to make sure I have the story

right.

But basically,

I'm trying to explain why her stuff came

up in a court case.

But...

I'll find it while I'm talking, but yeah,

I think she, she was, um,

she was involved in, uh,

she was let go from a job and

she tried to sue for discrimination and

basically say that she was wrongfully let

go.

Yes.

Okay.

Um,

so she tried to sue for pregnancy

discrimination cause she was almost nine

months pregnant.

And, um,

ultimately the judge decided that that

wasn't what happened here.

The company said they shut down her

location just for financial reasons.

Um, which is really unfortunate, but, uh,

as a part of this court case,

for some reason, uh,

or backtracking a little bit when she was

let go, she turned to talk space.

Cause again,

she was like almost nine months pregnant.

And, uh,

she was opening up to this therapist about

like how worried she is that she may

not be able to find a job when

she's so close to going into labor.

And for some reason,

this was considered part of the evidence

that was entered into court.

And, um,

I think – I mean as far as

that story goes,

it's very straightforward.

But what this article really – and I

don't mean like – there's no story here,

but let me explain.

What the article really explored a lot

more and focused on was the idea that

these online chat apps are really –

kind of dangerous, unfortunately.

Because, you know, one, one,

one therapist that they talked to found or

kind of pointed out that it's like most

therapists don't keep transcripts.

Like when you go in person and talk

to a therapist,

they might write some notes.

And a lot of them,

like after the session will, again,

they'll summarize what happened,

but they don't keep a word for word

transcript of everything that happened.

And there is a lot of like,

Kind of branching out from there,

you know,

actual therapy is protected by a lot of

legal things.

And obviously,

like when it comes to a court order,

a lot of these legal protections in any

situation kind of go off the table.

But the problem is a lot of these

these apps are.

Don't even offer that basic level of

protection.

This article does mention HIPAA,

which is the worst thing in the world

that we could possibly cite when it comes

to these kind of stories because HIPAA

does not have really hardly anything to do

with privacy.

They said that it requires people's

information to be de-identified,

but that's probably about it.

HIPAA is not really about privacy.

It's really a lot more about privacy.

I don't know.

It's just, yeah.

So anyways,

a lot of these apps have it in

their terms of service that basically once

you start using them,

they can do whatever they want.

And I mean, that's how all apps are,

right?

Except I think a lot of people don't

realize that going in.

And so this company specifically,

Talkspace,

they're very proud of the fact that they

have one of the largest mental health

databanks in the world containing a

hundred and forty million message

exchanges.

And they're going to use that to build

an AI therapy chatbot.

And I'm sure that'll go great.

And we have definitely not seen any

extremely tragic stories in the news,

thanks to chatbots.

So I'm sure that'll go awesome.

But I mean,

these things are just riddled with

problems.

We have seen, there was,

I believe in the UK,

there was a very similar app that got

caught selling actual transcripts to

advertisers.

So like not even the inferred data,

like the actual chat logs to advertisers,

not even to the court.

I know this app,

because I checked them on Wikipedia very

briefly, this app and BetterHelp,

I think BetterHelp was accused,

but I could be wrong.

This app was, or like BetterHelp,

we proved it.

This app, I don't think we proved it.

But they had both been accused of

Not using licensed therapists and playing

really fast and loose on like maybe you're

talking with a volunteer or something like

that.

And I don't know how they get away

with that one because there are very

strict rules,

even in between states here in the US.

Like when my wife and I moved out

of state,

she couldn't keep her old therapist and

they were very upset about that because

they had a great relationship and they

were doing really well.

But yeah, it's like...

It's just crazy stuff.

And it's, it's really unfortunate.

I don't know if we have too much

to say about this story,

but I think it's really important to

highlight.

Cause again, I,

this frustrates me because therapy is

freaking expensive, right?

Like I think everybody knows that it's a

form of healthcare and at least here in

the U S our healthcare system is

incredibly broken and it's,

it's so expensive, but it's so valuable,

especially in today's day and age.

And it's really unfortunate that this

stuff is not being protected.

There's no laws around this.

It's, it's not,

I mean, I guess there's HIPAA, but again,

that doesn't have anything to do with

privacy.

So it's really unfortunate that this is

being abused the way that it is.

And I will say, in my personal opinion,

if your choices are...

I'm not going to go to therapy and

I'm probably going to suffer or I can

take advantage of one of these apps.

I would say it's still probably worth

taking advantage of the app,

but unfortunately it's, you know,

me personally,

I always give the advice of like,

don't lie to your doctor, right?

We talk about like data breaches and, um,

how do you keep your,

your data from being swept up?

And in a lot of cases you can

use PO box, which for the record,

you should still do this with your doctor.

You can use a PO box,

you can use a forwarding email address,

but

But when I order something on Amazon,

I can get it sent to a locker.

I can use a fake name,

something like that.

When I talk to my doctor,

I kind of have to be real about

what's going on.

They have to be able to treat me,

whether that's a medical doctor or a

therapist.

And so it's really unfortunate that these

things are just not being treated with the

level of protection legally and

technologically that they deserve.

And I think that's just –

It's unfortunate because again, you know,

we talked earlier about when you're being

surveilled, it changes your behavior.

And so if I had to use one

of these apps, like again,

if I'm in a situation where it's like,

I can either not get treatment and things

are not going to go well,

or I can go get treatment through one

of these apps,

just using the app is going to change

how I talk and what I open up

about.

And that's just, it's so tragic,

but unfortunately it's something we have

to let people know about because this is

something you have to be aware of.

So yeah.

Um,

I don't think I have much more to

say about that without going in circles,

but that is a,

that is what's going on with these apps

there.

Um, if you can go to in-person therapy,

that would probably always be better,

unfortunately, or even telehealth,

even if it's recorded or not recorded,

but even if it's takes place over zoom

or something,

that's still probably better than these,

unfortunately.

So.

I think one thing that's also kind of

like an issue with these telehealth apps,

like we've seen in the past,

I don't know if anyone remembers,

but BetterHelp was also an online very,

it's actually extremely,

like it's promoted a lot everywhere on

podcasts, on YouTube,

basically everywhere.

Like I've seen like probably hundreds of

ads for BetterHelp at this point where,

you know,

they were sharing sensitive health data.

And I think they were fined.

Yeah,

they were fined seven point eight million

by the Federal Trade Commission in the US.

So, you know,

I think it's I do have some questions

about this article in particular, though,

like how how exactly like it's it's

How is it allowed that these records could

become public, though?

Like, isn't there some sort of, like...

I don't think so,

because according to the article,

really one of the only stipulations that

HIPAA has is that the medical information

needs to be anonymized,

which is one of those things that, like,

We always point out it doesn't take a

lot of information to de-anonymize

somebody.

Like location is a really good example.

How many people in the world spend eight

hours a day at one location and then

eight hours a day at another location?

Probably not a lot.

So it's the same thing with like a

lot of therapy.

Like how many people have that specific

backstory,

have that specific combination of

symptoms, have this specific...

And I mean,

also like when you're going through the

log, like...

or like when you're talking to your

therapist,

you're not gonna use like made up names

most of the time, right?

You're not gonna be like, yeah,

so my ex, let's call her,

I'm trying to think of a name, Alice,

right?

Let's call her Alice.

You're not gonna do that.

You're gonna use the actual name.

And so it's just, yeah,

I don't understand how,

I think it's just one of those cases

where like legislation has not caught up

to the situation that we're in right now

is what I think it is.

I think it worked back,

in the nineteen eighties,

but I don't know if it would work

now.

Yeah,

I don't think they I don't think they

thought we'd all be seeing therapists on

our glass slabs and typing everything our

entire life into it.

So HIPAA was passed in nineteen ninety

six.

Yeah,

definitely before any sort of it was not

when The Matrix came out.

When did The Matrix come out?

Oh, nineteen ninety ninety ninety nine.

But yeah.

I don't pay attention to this stuff.

Yeah.

Anyway,

so I guess the thing with this is

I think it's kind of – this is

kind of a clear breach of people's

consent, right?

Because when you're talking to a

therapist,

you consent to sharing very sensitive,

sometimes things you would never tell

anyone else, right?

You're –

This is information and things you're

telling somebody that you would never want

to be public.

So I think this is basically a it's

breaching the trust of everyone that uses

the platform, I think.

Obviously, there should be more.

protection, like, I mean,

I think that if there's these sort of

telehealth apps, right.

I think they shouldn't be saving the

conversations.

It should be end to end encrypted.

It should be.

deleted after a certain period of time.

Like, you know,

there should be more stuff than that.

And apparently according to this,

it was saying there was, you know,

a hundred and forty million message

exchanges.

Like that is a ridiculous amount of

information.

And even if it was like,

like Nate said, de-anonymized,

like if I'm talking about something

specific to my life,

I think it wouldn't be that hard to

find

that person.

Like if you're,

if you're talking about something pretty

specific to you, right.

So, uh,

this is just kind of disgusting and yeah,

it's, I think that, yeah, you're right.

The,

the laws definitely haven't caught up to

this globally even.

Well, and just to, to, um,

to add onto one thing you said, you,

you mentioned like,

this is a

it's quote unquote not because it was in

the terms of service, right?

The terms of service that nobody reads and

that are also like super vague anyways.

Like we will share your data with trusted

business partners for legitimate business

reasons.

And it's like, Oh cool.

That's, that's really specific.

Thanks bro.

So yeah, it's, I mean,

that's another major problem that

everybody's identified for years is just

these,

these terms of service are so broad and

so vague that they allow the company to

do basically anything they want.

And, um,

It's just, yeah,

unfortunately that's another, I mean,

there's so many things that need to be

fixed about our system,

but that's a big one, I think so.

Yeah, no,

it's definitely someone said in the chat,

wait, what is happening?

Yeah,

there's kind of a random time to join.

Yeah,

so there was this app called Women's

Talkspace, which is like a therapy app,

which breached a bunch of people's

information.

I guess if you want to learn more

about it, check out the articles about it,

because we did kind of talk about it

already.

Yeah, coming,

so there was another person whose name is

T, thank you for your podcast.

And then they said,

coming from mental health,

a lack of privacy absolutely destroys the

therapeutic alliance with the client.

Pretty much, yeah.

Like if my therapist or psychologist

started telling random people what I was

telling them,

I would be kind of disgusted and I

would never see them again.

Yeah.

That's exactly what I was thinking.

Like,

imagine you walk in and your therapist is

just like chatting with the receptionist.

They're like, yeah.

And then they said this and they said

this and it's like, what the fuck?

I'm never coming back here.

Like that's basically what they're doing.

It's crazy.

Yeah.

But apparently because it's a digital

platform, it's suddenly,

it's suddenly acceptable.

But yeah, this was really awful.

What were we...

We're talking about something.

Oh, I think it's coming up still.

But we were mentioning some of the issues

with the laws in America as far as

privacy is that a lot of them are

really solid in the real world but haven't

moved online.

So things like the third-party doctrine

where it's like, oh,

when you hand your data to a third

party...

you lose control of that data.

So like if you,

trying to think of an example that would

have applied under the third party

doctrine, I don't know,

if you bought something at a store, right?

Then of course they're gonna have like

that transaction, the receipt,

they're gonna have you on the security

camera or whatever.

But that one hasn't really translated very

well into the digital world where you're

handing over data to like everybody all

the time.

There's all these advertisers and

analytics and your ISP counts as a third

party.

And it's just like,

but that's not the same.

So yeah, it's crazy.

Yeah.

There's definitely, uh,

some interesting discussions that we're

going to have to work out a lot

of things to fix this.

Cause, uh, yeah,

this shouldn't be happening, but, uh,

I guess we can move on here to

the next and final story today.

And, uh, so this one is about RightsCon.

Um, if you're not familiar,

it's basically one of the largest like

digital rights conferences, uh,

And last year it was held in Taipei,

Taiwan.

But this year it's being held in Zambia,

which I'm not exactly sure where Zambia

is.

I'm going to sound like a silly Australian

right now.

I want to say Southern Africa, but oh,

yeah, I'm not too far off.

Yeah, I was going to say South Africa,

but okay.

Okay.

Okay.

Yeah, there we go.

Sorry, sorry.

I'm not too familiar with that part of

the world.

But yeah, RightsCon,

a global conference of thousands of

advocates, technologists, academics,

policymakers,

and others concerned with issues at the

intersection of human rights and

technology,

was scheduled to kick off at Wasaka,

Zambia on May fifth.

But with just days remaining and with many

participants already en route,

the Zambian government officials announced

that they would postpone the conference in

order to, in quotes,

ensure full alignment with Zambia's

national values,

policy priorities and broader public

interest considerations, unquote.

So that does sound slightly red flaggy.

You know,

this is like a conference where they're

discussing

people's right to free press,

people's right to free speech,

people's right to privacy in their own

home.

Like this is definitely like a human

rights conference, right?

So this is like extremely sus already.

And basically on Wednesday,

after attempting to negotiate a solution,

rights con organizers announced that the

event in quotes would not proceed.

So yeah, basically the event is,

Not going to happen according to what our

latest information is.

On Thursday,

the Zambian news site News Diggers

published a report citing well-placed

sources that told the outlet the summit

has actually been cancelled because the

program involves Taiwanese delegates who

would potentially speak against China at a

venue donated by the Chinese government.

Ah, I see.

So there's like some political...

There's some political issues going on.

So I guess that could make sense.

Yes,

so there was a statement issued Thursday

by the advocacy organization.

Article XIX noted, we are aware of claims,

many of them well-founded,

that pressure from foreign governments

contributed to the Zambian government's

decision.

So, yeah, this is...

I guess not great that there was like

some pressure to get this canceled

because, uh, I guess we can know that,

you know,

China is sort of one of the largest

countries in the world that has a pretty

elaborate censorship scheme and, uh,

I guess, opposition to digital rights.

They have, you know,

the Great Firewall of China that's

blocking a lot of traffic outside the

country,

which does limit the free flow of

information.

And also the large scale camera systems

that they have in the country, which,

you know,

they have like a ridiculous amount of

cameras.

So I can see how, you know,

there might be some friction there.

And there was also this update here.

The Tor project actually did a little toot

on Mastodon and they said basically they

are standing in solidarity with RightsCon

and AccessNow local organizers basically

to

they wanted to highlight it because the

circumstances behind the cancellation

underscore the urgent fight against

censorship,

surveillance and restrictions on civic

participation.

And they also released like this blog post

along with that.

And yeah,

so RightsCon is basically about the right

to assemble, associate and speak freely.

And this conference being cancelled is

kind of like a slap in the face

of that particularly.

I think

everyone in this community is kind of on

the same page when it comes to this

stuff.

Uh, people should be able to assemble,

associate and speak freely and, you know,

people's digital rights are important.

So it's not great that this is being

canceled.

Um, because, you know,

human rights are important like online and

offline.

Um, but yeah, that's sort of,

what I thought of this.

I think this is just concerning.

We can see like the control that foreign

governments have over stuff like this,

but it's unfortunate to see this

conference cancelled.

Yeah,

I don't think I have much to add

to that.

It's very – it reminds me a lot

of – well, I mean, first of all,

I think it's important to note that this

first article that we quoted from said

that according to the nonprofit watchdog

Freedom House,

Zambia ranks as partly free,

and they know – and that's on digital

rights and free expression.

The government has imprisoned individuals

for online speech critical of the current

government,

and journalists are experiencing increased

harassment.

Okay.

So to me,

for any sci-fi fans in the room,

this reminds me of a few years ago

when they decided to host the Hugo Awards

in China.

And one specific author who my wife really

likes – I have her book actually,

and I need to read it –

I think it was the book Iron Widow.

I could be wrong.

I can't remember the author's name.

I'll look it up.

Um, but, uh, she was like shortlist,

like everybody knew like this, this woman,

actually, I may have their gender wrong.

I'm sorry.

This person, um,

everybody knew that this person was like

guaranteed, uh,

to be at least nominated and did not

so much as get a nomination.

And then it turned out later that the

government had pressured the Hugo Awards

not to nominate this person or like pay

any attention to this person because they

were of Chinese descent and the government

didn't like whatever their political

positions were or something like that.

And I remember when that happened,

I remember I sat there and I'm like,

so whose genius idea was it to host

the Hugo Awards in China?

Like if we knew this was a possibility,

like not even this specifically,

I'm sure they didn't know that

specifically was going to happen until

like a week before or something.

But also like,

why would you willingly choose to host a

convention in a country that is

notoriously critical of anything that

casts it in a negative light?

Just knowing that

literature and sci-fi included is like one

of those things where you,

you kind of push the envelope.

Sometimes you present new ideas that may

not always be popular.

And I just remember thinking, I'm like,

why would you do that?

Like,

why would you even tempt fate like that?

And this feels the exact same way to

me.

It's like you,

you decided to host a human rights

convention in a country where the

government has currently imprisoned people

for online speech,

critical of the government journalists are

experiencing increased harassment.

Like, why would you do that?

I don't know.

That just blows my mind, but yeah.

That's kind of my only thought is I,

I don't, I don't,

I don't like want to like victim blame

anybody here, but like,

I feel like the organizers should have

known better than to do that.

That's kind of my main thought.

Yeah.

I mean,

that is one way of looking at it,

but I think, you know,

this could have been a good platform to

discuss a lot of these issues in the

country, right?

Like, you know, there's obviously,

I think we didn't really know,

you don't really know what is going to

happen.

Uh, I think reading down to the,

to the end of this, uh,

of the article here from Tech Policy

Press.

China has significant leverage in Zambia,

according to a database of Chinese foreign

investments maintained

by at the college of william and mary

china donated thirty million dollars for

the construction of the mulangashi

international conference center where

rights con was to take place it represents

just one of hundreds of investments in

zambian infrastructure totaling nearly

thirteen billion over the past decade

according to the william and mary

researchers so i think this was less to

do with uh this was more like a

political thing right like they're

I think just so you know,

like the last conference was held in

Taiwan.

There was clearly people that were,

you know, supportive of, you know,

people's right to a free assembly,

which isn't always guaranteed in China.

So I think it kind of goes against

the values there.

And I think that's kind of the reason

why this was cancelled.

But I think, you know,

I definitely see your argument that like,

why would we host it there?

Like if it's going to get,

if there's a possibility that the Chinese

government isn't going to like that,

is it really a good idea to like

do it in the backyard of them?

Like, is that really like there?

Is that really a great idea?

I mean,

I think it would have been interesting

though, because like,

You know,

maybe it could have been a good time

to discuss a lot of those issues,

but I guess they overestimated the

allowance of that to happen.

Yeah, and that's a really good point.

You do make a solid point where it's

like, why not go...

I grew up in the church,

so I know a few Bible verses.

And one of them is where they were

criticizing Jesus for hanging out with

sinners.

And he's like, well, yeah,

the healthy people don't need a doctor.

So I kind of see that argument of

like, yeah,

why not go to the country where these

are happening?

And User Zero made a good point too.

Is there any country where this stuff

isn't happening?

And I mean...

objectively, yes,

there's places that are much more open and

free and accepting of that kind of stuff.

But I hear your point.

It's not exactly like, yeah,

just throw a dart and anywhere it lands

is good.

The choices are relatively limited.

So that's a fair argument.

Yeah.

I do think it's also important for people

in the global South to have these

conferences there as well, right?

Because not everybody can

afford to travel all the way to the

united states or well i guess europe or

any any sort of country that's in the

west i guess or like the global north

um so a lot and even a lot

of those countries i would be i probably

wouldn't travel there um so you know

there's there's all sorts of things like

that um but yeah this was just like

an important little one that we wanted to

cover um it's unfortunate but uh

It is surprising that this was,

it happened so like this seemed like it

was going to go forward and then it

suddenly was canceled,

which I think if it had just been,

if it had just been like immediately they,

the Zambian government said, no,

that would have been fine.

But since it happened so close to the

start,

it was like kind of a big story.

Um, at least on Marston,

I saw a lot of people talking about

it.

Um, so yeah.

Yeah.

And, um,

four Oh four wrote a couple articles about

it.

They actually just published another one

right before we went live with like the

latest update.

So.

Yeah.

Oh, okay.

Interesting.

Was there any,

did you notice there was anything to add

or?

I didn't really have a chance to read

it,

which is why I didn't include it in

the links, but I'm sure it's good.

It's, you know,

four or four does great work.

So.

Yeah, cool.

I guess go check that out then if

you're interested in learning more about

this story.

Also, just in case anyone is curious,

it's Zhiran.

I'm totally going to pronounce this wrong.

Zhiran Jiao.

I don't know.

The book is called Iron Widow.

But yeah, in twenty twenty two,

twenty twenty two, twenty twenty three,

they were a finalist for astounding award

for best new writer.

They received enough votes to be a

finalist,

but were declared ineligible and removed

from the ballot.

It later emerged that this was due to

self-censorship by the Hugo Award

administrators,

which was held in China in order to

appease the Chinese government.

So, yay.

This kind of stuff happens.

Anyways,

just in case anyone else was curious for

me to wrap that earlier thing up.

So I think in a minute,

we're going to start taking viewer

questions.

I know we had somebody leave a question

earlier,

and we'll definitely go back to check that

out.

If you're holding on to any questions,

go ahead and start leaving them in the

chat.

But for now,

we're going to head over to our community

forum where there is always a lot of

activity.

This week,

there was a lot of activity when I

sorted by the latest chats this week.

Busy week in the forum.

But specifically,

I think we were going to focus on

a post here that...

again, was almost a finalist for the news.

It's just,

there's so much happening this week.

But there's a rumor that Signal is working

on a standalone version of a desktop app

that does not require a mobile phone.

Now, to be clear,

it will still require a phone number.

That's not going away.

And I know that's a very controversial

requirement, but let's see here.

So there's,

I'm gonna switch over and show this

article on screen real quick.

Oh,

if I can remember to share my screen.

But yeah,

somebody spotted this in one of the latest

Git commits on GitHub.

There we go.

Oh, come on.

This is a very difficult program to work

sometimes.

There we go.

So yeah, going back to the top,

this comes from a website called About

Signal.

And it says that it was on the

latest Signal Desktop commit history and

makes several improvements to the

registration flow.

The feature has not been officially

announced,

but since we saw it in the commit

history,

I'm not going to say it's official,

but it's kind of one of those, like,

you know,

there's always rumors going around, but...

I think since we, again,

since we see some evidence of this in

the gate commits, it's like, okay, let's,

uh,

let's maybe pay attention to this a little

bit more than usual.

And it says that, uh,

users may soon no longer be forced to

use a smartphone such as Android or iOS.

And, uh,

instead you will be able to sign up

on signal desktop and you can use just

a regular mobile number or a landline,

which includes basic mobile phones or dumb

phones.

Um,

which I think is kind of new and

old.

Um,

In the sense that I think Joseph Cox

or somebody wrote a blog post one time

about how they managed to sign up for

Signal without using a smartphone.

And basically they found one of the last

pay phones in America and had Signal call

them and deliver a sign-up code over the

phone.

I don't think it was a person from

Signal,

but I think this was a feature they

used to offer.

So it seems like it's kind of coming

back now.

And then I think they go on to

talk about some of the other updates

coming into that app.

But yeah, I mean,

that's kind of the exciting part that I

think we're super interested in.

Did you have any thoughts on this one,

Jordan?

I mean, I'm excited about it.

I know the phone number requirement is

very controversial in general,

but I think anything we can do to

lower that barrier to entry and give

people more access to secure

communication, I think is good.

What do you think?

Yeah,

I think like a lot of times I

think having a mobile phone requirement is

a bit frustrating.

Like, for instance,

I've got two Signal accounts.

Like I have one that I use for

work and then another one that I use

for personal stuff.

And now I have to have a second

phone that just has to be on to

like...

has to have the account on it.

So it is kind of annoying that you

have to have like a,

or I guess if you had an Android,

you could maybe use a different profile.

But it's kind of frustrating that that's

been a requirement when, you know,

I think you could do that with an

iPad.

Yeah.

You could do that with an iPad.

You could have an iPad as your main

device.

Um,

so it kind of makes sense that they

would allow this on desktop,

but it's kind of been an ongoing thing.

Um,

and I think when it comes to these

like source code leaks as well,

like we saw like, Oh, username, uh,

username support.

leaked through the same way, right?

We were like looking at the source code

and we saw, oh,

there's like this mention of usernames in

the source code,

but they're not added yet.

So,

and we did end up getting that feature

eventually kind of took a while, um,

which is.

kind of the usual with Signal.

I kind of appreciate Signal's slower

rollout of features though.

Whereas, you know,

I feel like a lot of projects or

I guess products are sort of taking the

move fast and break things approach,

which

isn't super great, uh,

from a stability standpoint.

Um, but yeah,

I'm kind of excited to just be able

to use this instead of having to have

a second phone.

Um, because yeah,

it's kind of been an ongoing issue.

I know that a lot of people are

going to like this, uh,

once it finally releases, if it releases,

which all signs point towards yes,

but there's always a possibility of it,

uh, not coming.

Okay, so someone in the chat said,

is X the only way to watch the

stream?

It feels uncomfortable.

Yeah, so I think,

I'm not exactly sure because I don't have

a Twitter account.

I don't know what it looks like,

but you can also watch this on StreamYard,

which is basically a platform agnostic

way.

You can also watch this on YouTube.

You can watch this on

TikTok, wouldn't recommend it,

but you can.

Twitch.

Twitch, Kik, LinkedIn.

Yeah, all those platforms.

So it's across all those if you want

to switch.

But if you want to find our YouTube

channel, it's just Privacy Guides.

It's an easy way to find that.

It's whatever platform you prefer.

We just find that there's at least some,

we get quite a decent amount of traction

on Twitter.

So that's why we broadcast there.

It's important to get this message out to

as many people as possible.

Cool.

Yeah.

Sorry.

I'm going through some of the comments

here.

Cause some people were like, Oh,

I wish it worked with voice over IP.

And I'm like, Hey, did they change that?

But then further down, people were like,

yeah, it does.

Okay.

So yeah, it does.

It definitely does.

Yeah.

I was like, did they change that?

Cause I definitely signed up with voice

over IP, but, um, yeah.

And,

and real quick on the topic of other

places to watch,

if you go to privacyguides.org slash live

streams, I think, um,

I think that'll take you, well,

it'll take you to the latest newsletter

and that'll take you to the, uh, the,

the stream yard link.

Um, the forum, we usually pin, um,

once we pick the headline story,

we pin a post that has all the

other places that we stream for sure.

So, Oh,

somebody went and posted them all here.

So cool.

Yeah.

Probably Jordan.

That was me.

I think it's time to move on to

viewer questions.

I have the forum post up here.

Let me take a look.

Not really a question,

but somebody on the forum mentioned when

we posted the headline story, which is,

you know,

is Ubuntu becoming the new Windows?

They said, speaking of Ubuntu,

they are the first Linux OS option to

come preloaded onto framework laptops.

So if you are interested in framework or

you are a framework user,

definitely be aware of that next time you

go to buy one.

I'm checking through here to see any

other... Oh, somebody posted here.

They said,

I don't know if this will still be

relevant by the time the live stream

happens,

but at the time of posting this comment,

much if not all of Ubuntu and Canonical's

infrastructure appears to be down via a

DDoS attack.

Yes,

I discovered that this morning when I went

to do...

So I have automatic updates on all my

servers,

but Fridays or weekends are kind of when

I sit down to manually make sure I

didn't miss any updates,

run my backups and stuff like that.

I know I shouldn't do it manually.

I haven't had time to get around to

making them automated,

but I had that issue too.

Cause like all my servers were like not

hitting.

And then on cubes,

I went to do snap refresh and I

couldn't connect to the snap store.

And I literally posted in the group chat.

I was like, is FOSS broken today?

Like what's happening?

Yeah.

And then like immediately after I asked

that I opened up my next cloud with

my RSS feeder.

And as I saw,

like Ubuntu has been having like a DDoS

attack for the last like,

hours or whatever.

And I'm just like, ah, okay.

That explains it.

So need to read more often.

Definitely.

There's definitely been,

it's been causing quite a lot of issues,

I think,

but I think one awesome thing about like,

at least when it comes to the apps,

like,

and when we talk about Linux package

managers is, you know,

they have mirrors.

So, you know,

I personally don't use the official like

repos.

Like I would prefer a local one, right?

You can, you can do that instead.

You can still get updates that way.

You could even set up your own, uh,

local, uh,

mirror on your own server in your home.

Uh, if you're, if you're nerdy like that.

Um, but yeah,

Yeah, it is kind of a random,

unfortunate thing, the story.

I think people kind of got a little

bit confused by the title.

I was kind of not really sure what

to put as the title to give away

the entire thing.

I thought it was good.

I liked it.

But yeah, on that note, in the thread,

I thought it was actually kind of cool.

People started talking about what distros

they prefer,

and a lot of people talked about gaming.

A lot of people said they like to

game on Linux.

So if you're a gamer, I'm told...

um i'm told that gaming has come really

really far on linux and is kind of

almost at the point where like unless

you're like a pro gamer or like there's

certain uh like i know a lot of

uh the anti-cheat games won't work very

well but if you're just like a casual

gamer um definitely look into linux

because i've heard it's really come a long

way and it's a lot more gaming friendly

than it used to be and it's almost

a one-to-one so

Yeah,

it's really frustrating with the

anti-cheat stuff,

and it doesn't really seem like the

industry is moving in the right direction.

If you remember,

Apex Legends did allow Linux Easy

Anti-Cheat to work on Linux,

and

they eventually just threw the towel in.

They said,

we've had too many people cheating.

So we're blocking Linux.

And that was it.

You can't play it on Linux anymore,

which is really unfortunate because,

you know, I guess, you know,

games have got to balance the player

experience with that sort of stuff.

So I have seen NVIDIA performance is bad

compared to

AMD, that's what Lusso One said.

I mean,

I would say Nvidia cards are generally

more powerful,

but there's a bunch of issues with drivers

in Linux,

which is a whole nother can of worms,

which you probably won't have as much of

an issue with if you're using an AMD

GPU.

um because basically i have to install

proprietary drivers um i think it's been

remedied somewhat now that we do have like

open source kernel drivers but there's

still a proprietary part to it which is

another you know it's another barrier to

getting people to switch because it's like

oh why isn't my graphics card working

correctly it's because you didn't install

the drivers which is a whole process right

um

So I think that's also another issue,

I guess, that NVIDIA causes.

This is not an official recommendation

from Privacy Guides.

But if you are interested in gaming on

Linux,

I highly recommend The Linux Experiment.

I listen to his weekly podcast.

And he focuses mostly on open source

stuff.

Every once in a while,

there's some privacy overlap.

But for the most part,

he talks about open source specifically.

And at the end of each episode,

he specifically talks about gaming news.

And he digs into like the drivers and

there's this new driver being released and

this one versus this proprietary one and

the benchmarks.

And so, I mean,

if you're really into that stuff,

I would say definitely check him out.

He's a really good source of information

for that, in my opinion.

Yeah,

I think Linux gaming is like we saw

like even recently that like Linux is like

cracking five percent on the Steam

hardware survey, which is.

quite substantial like when we talk about

the amount of users on their desktop it's

it's a lot of people i think it's

largely driven by the steam deck because

the steam deck i believe is based on

arch um but i mean it's super user

friendly my wife has one she loves it

she put brave on it so she can

use it like a desktop now if she

wants to but yeah it's uh

I think I'm going to get one of

those.

I've got a Nintendo Switch,

but I'm so done with Nintendo.

Oh my goodness.

I think I can give up some Nintendo

first party games and switch to something

that's a little bit better.

I'm very casual,

so I mostly stick to PC games,

especially because then I can take them

with me when I travel,

but I do have my wife's...

So my wife bought a Switch Lite back

when they first came out,

and then years later,

she decided that she wanted to start

streaming Switch,

so we upgraded to an actual proper Switch,

and

i like inherited the hand-me-down switch

light so technically i have a switch light

i think i have like star wars knights

the old republic is the only game i

bought for it so far because i just

you know a lot of the time i'm

either at this point when i do have

downtime i'm trying to get caught up on

like tv shows and movies and stuff so

like i just i think i just finally

watched the latest season of wednesday

like that's how backlogged i am on stuff

but

Oh, geez.

Yeah.

I'm backlogged.

I'm backlogged on video games and I'm also

backlogged on TV shows,

like obscenely backlogged.

I've got so many things to get through.

So I am going to make time for

silo though.

I'm so excited for that, but yeah,

Anyways,

getting back to questions that people are

asking.

Nobody's asking about silos, sadly.

So Lucas said,

what's your view on sharing personal

information with companies when applying

for jobs,

knowing that third parties are building a

database for marketing?

I mean, unfortunately,

I think personal opinion,

I think this is just kind of one

of those things where we don't have a

lot of choice.

Like, okay.

So the best way to get a job

still remains who, you know, right?

Like if you know somebody who's working in

a company,

they can put in a good word for

you,

but you still have to go through the

official process, which means applying.

And a lot of companies do have like

a first party portal.

So I guess that's pretty good.

But even then that like first party portal

really is like administered by someone

like, and my last job,

I think it was day force, um,

i just i just had a co-worker who

was like hey i need a job are

they hiring uh or a friend who was

a co-worker so we were in the same

industry and i sent him the link and

i texted my old boss i'm like hey

you know you should give this guy an

interview he's a really hard worker but i

still noticed when i sent him the link

i'm like oh this is just day force

so it's um unfortunately i think it's what

i try to do is i try to

minimize things so like i use a voice

over ip number i have an email dedicated

specifically for work

I do still use like Brave and,

you know, all my usual privacy browsers.

I try to use VPN.

I think, I don't know.

I think it's also like how sensitive is

this data really?

Like, yes, it identifies you,

like how many people have worked at that

same specific set of jobs, but it's,

I guess it's like a threat model thing.

Like, okay,

they're going to build it for marketing.

I mostly block ads anyways, right?

So I'm not super worried about that.

And also like in terms of a data

breach, again, voice over IP number,

I use a PO box.

I actually,

one thing I do is I don't put

in, at least on the resume,

I don't put it in an actual street

address.

I just put in like a city,

state and zip.

And then if they want to hire me,

I'll give them a PO box.

So I think it's like anything,

it's about threat model, right?

Like what are you trying to protect

against?

For me,

I'm mostly trying to protect against data

breaches,

And I think there's only so much you

can do to be totally honest.

I mean,

unfortunately we still need to pay the

bills.

So that's kind of my take.

yeah i mean i think it's also interesting

i mean i come from uh i come

from like not working for companies i come

from like being a contractor and working

for myself so i mean i don't know

not everyone has that opportunity like not

everyone can do that um but i think

that does give you somewhat more control

because you are your own employer like i

guess um which you know not every job

has the ability to do that but i

think that is one

area that you can have slightly more

control I guess um but yeah I don't

really have I've never really had a a

real job question in quotes like whatever

you know what I'm talking about but yeah

um so I don't know maybe that's something

else to consider but it's obviously it's

very applicable it's very depends on your

situation

Yeah.

I, um,

I was a freelancer for a lot of

years and ideally that's the way to go,

especially once I got into privacy.

Cause originally I was a freelancer before

I was into privacy.

And then once I got into privacy and

I realized I'm like, oh yeah,

I could totally like put my PO box

on all these invoices and set up a

separate email.

And, um, like it's,

it's pretty cool how much flexibility you

have as a freelancer in that regard.

But, um, yeah, not everybody has that.

Unfortunately.

And the taxes are awful.

Oh, my God.

My other project, the new oil,

for intents and purposes,

the government treats it,

the company that I structured it as for

privacy reasons,

the government basically views it as my

personal money.

So I have to pay taxes every year.

I haven't gotten a tax return in years,

which to be fair is a good problem

to have.

But boy,

do I have an attitude every time I

have to file taxes because I'm like, damn,

I don't remember Uncle Sam filing any pull

requests or writing any blog posts or

editing any videos.

Yeah.

don't get me started on the taxes i'm

so pissed but anyways yeah i mean yeah

that's uh that's definitely a downside of

that um kind of happy that i'm an

employee now i don't have to worry about

all the ridiculous tax structures um but

yeah there's uh there's

There's ways to do that.

Oh, someone in the chat has asked, Tam,

seven, four, eight, asks,

what's Silo about?

I was going to get to that one.

Not to get off topic.

Silo is a post-apocalyptic sci-fi show.

Think of it kind of like Fallout,

but a lot more serious.

It's humanity is now living in an

underground silo and they cannot go

outside and they don't know why.

That's kind of the elevator pitch I would

give.

I love it.

I got my sister into it.

My sister actually watched it twice,

which was wild.

I forget what it was,

but I texted her something one time and

she's like, Oh yeah, I'm rewatching silo.

And I'm like, wait, what?

So my next goal is I want to

get my wife into it next, but yeah.

Well,

that does sound pretty interesting

actually.

Stairs and more stairs.

Yeah.

Lesser one has seen it.

He's not wrong.

Lots of stairs.

i guess we'll uh we'll go back to

we got one more how private are messages

on signal i heard people had their

messages leaked or something like that um

so every single story i've ever heard

about somebody getting their messages

leaked on signal has come from the end

point being vulnerable in the sense of

like um several i think it was during

the first trump administration somebody

had their their signal hacked quote

unquote because the fbi sees their phone

and unlocked their phone and looked at

their messages like obviously there's no

amount of encryption in the world that can

save you from that

Um,

I know there have been right now in

Europe,

there's actually been a lot of phishing

attacks on politicians to get access to

their signal and their WhatsApp.

Um, so if they manage to,

and a lot of the time what they'll

do with,

in the case of signal specifically,

I don't know how WhatsApp works, but, um,

a lot of the time what they try

to do is basically try to trick users

into linking the attacker's device.

Like basically it's a really clever way to

get them to scan the QR code without

realizing it.

And so now the attacker over in Moscow

or Beijing or wherever

has a Signal desktop linked to your phone

and they get a copy of all your

messages.

And so those are the kind of things

like Signal has rolled out some things to

try and slow down those kind of attacks.

But those are things that are not

vulnerabilities in the Signal protocol.

Those are like phishing attacks.

And again, like your phone was unlocked.

Like those are things that we would expect

to see with anything.

So at this time,

as far as we know,

Signal is the most private and secure

messenger out there.

or at least like top five,

like point blank.

I mean, there's really no arguing that.

There have been so many experts from so

many different political leanings,

countries,

fields of expertise who have looked at the

code and been like, yeah,

this looks amazing.

This is really solid and secure.

So-

They don't log any metadata.

They're designed to be trustless,

where it doesn't really matter if the

server is compromised.

I mean,

I guess you could argue maybe the server

would be able to record some metadata in

real time,

but they won't be able to get access

to your messages.

They've had multiple court cases where

they've had authorities request data,

and the only data they ever have is

when the account was created and the last

time you connected to their server.

So...

I mean, yeah.

How private are messages on Signal?

Governments around the world rely on it.

And then Roy caught what I said.

What about SimpleX?

I'm less familiar with SimpleX,

to be totally honest,

but we do recommend it on Privacy Guides.

It is very secure as far as I

know.

I think they are

also working on post-quantum encryption.

So I mean, SimpleX is also really secure.

It's a harder sell for people because

there's less users, there's less features.

I hate to say it,

but when we're trying to make these tools

accessible to people,

people really care about the features.

Signal got a lot of flack when they

rolled out GIF support,

but that's what gets people around.

The group chats, the attachments,

the GIF support, the user friendliness.

SimpleX is great.

I have a SimpleX account,

but it's just a hard sell.

If you can find people to use it,

go ahead and use it.

I'm not saying not to.

You're just probably going to have a hard

time getting your friends and family on

it.

I don't know what I would do without

my stickers.

I'm slowly getting more and more into

gifts.

I hate to say it,

but I'm really getting into gifts.

I'm starting to use a lot of gifts.

And then the last thing that, you know,

you don't even need a phone number for

simple X.

I think now we're kind of getting into

like privacy versus anonymity.

And I think it's also worth noting that

signal does,

they save a hash of your phone number,

not your actual phone number,

if I remember correctly.

So like in theory, the, the cops can't,

I mean I guess the cops could give

them a phone number and be like,

do you have this user?

But they're not really going to get much

from that.

So I don't know.

I think personally I see the complaint.

We just talked about this.

I think I see the complaint with the

phone number requirement.

I think –

Most people make it a bigger deal than

it needs to be.

Are there people who absolutely cannot use

their phone number?

Yes.

I'm not going to argue that.

Is that ninety percent of people?

No.

I'm glad that tools like simple X exist

for people who are in that situation.

But I think for people to just like

completely throw away signal and be like,

oh, it requires phone number.

It's trash.

Like,

I think that's a really strong

overreaction in my opinion.

But I'll be honest.

I'm a little bit of a signal fanboy.

So maybe I'm just biased.

Yeah, I mean, I think as well,

like I don't want to throw simplex chat

under the bus or anything,

but it definitely seems like it's

technically sound.

It's got a good foundation, right?

I think the main thing, and again,

this is my experience.

I tried it like probably a year or

two ago maybe and my, yeah,

maybe a year ago.

um,

the setup process wasn't quite as smooth

as, uh, as Signal.

So, you know,

I think Signal does kind of have an

edge in terms of usability,

but I think SimpleX does seem to be

more of this, uh, like you said, uh,

privacy first solution, right?

They're not requiring, uh,

They're not requiring user identifiers at

all.

Yeah, and I think if I remember correctly,

the founder of SimpleX said that one time

is basically like when they started,

they were really putting all their focus

on security.

And now they're at a point where like

we feel comfortable with security and

they're trying to put more emphasis on

usability.

And he's acknowledged that.

He's acknowledged it's a shortcoming.

That's just the particular roadmap that

they decided to take.

Um, so I think,

I know we've already seen a lot of

improvement in simple X in terms of things

like battery life, for example.

And I think in the coming years,

we're probably going to continue to see

more improvement.

They actually just rolled out channels,

um, similar to like telegram channels.

So I'm really, um,

interested to check that out personally,

but yeah, I mean, I,

I think in the coming years we're going

to see, hopefully we're going to see some,

some real improvement on the user

friendliness side of simple X, but yeah.

Yeah.

We got one more question from Tim.

Should we be using post-quantum

cryptography?

I feel like I've been talking a lot.

Do you want to tackle this one first?

We already did a video about post-quantum

encryption algorithms and what the threat

actually is.

If you want to check that out,

you can.

I can give you the TLDR here if

you don't want to watch that.

Basically, it's

A concern in the way that if your

information and data is being collected,

it could possibly be decrypted in the

future.

So, you know,

we're not at a point where quantum

computers are at a point where they can,

or even if we don't even,

and we also don't even know if quantum

computers will ever reach a point where

they will be able to decrypt data.

these encryption algorithms,

because I think there's it's kind of like

AI, like there's so much hype behind this.

It's like it's just hype everywhere.

So I think, you know,

take it with a massive grain of salt

when when companies are saying, you know,

we've made our encryption quantum

resistant or quantum safe.

I think it's

It's useful.

It's a good thing that most people should

be doing at this point.

This is like a positive step in the

right direction.

But I think the main thing you should

be focusing on is using tools that respect

your privacy that aren't going to be

having the information in the first place.

Like we were talking about with Signal,

right?

Like it would be better if the service

wasn't collecting the information at all,

if the connection,

it didn't even matter if the connection

was encrypted or not because they're not

collecting the information in the first

place.

So I think it should be in every

privacy tool's best interest to implement

it, and we've already seen that now.

Molvad and Proton,

and they've been rolling out these

post-quantum encryption tunnels.

And, you know,

it's good to see that this is being

adopted more widely,

but I think it's not a major concern

at this point.

But I think it's definitely something that

we need to see pushed forward in the

next couple of years.

Yeah, I agree with all of that.

There's a lot of debate even among experts

about whether or not quantum computers

will ever achieve their promised

potential.

I think right now it's one of those

things where like,

we have the capability.

So let's do it out of an abundance

of caution, which God,

I wish more companies would do that.

Right.

We'd have so many fewer data breaches and

we'd have so much better privacy if

everybody was just like, well,

technically we can do it this way.

So let's do it just to be safe.

But, um, yeah,

I don't think it should be a deal

breaker.

Like,

I don't think you should avoid a tool

if it's not post quantum encrypted, but,

um,

I think if they've got it on their

roadmap or they've, um,

they're expressing an interest in it or

they're working toward it,

or they've already implemented it.

I think that's definitely a plus for sure.

True.

Yeah.

So Roy actually gave another comment here.

It's so cool and super fast to open

account,

an account with simple acts very handy

when you have many profiles on Graphene

OS.

Yeah.

So yeah, I mean, I could be wrong.

I could actually be a hundred percent

wrong on that.

Maybe they've re they've re they've

rejigged their, their setup flow.

Um, so yeah,

take what I say with a massive grain

of salt.

I haven't used it in a long time.

Uh, maybe I guess Nate,

you haven't set up a new account probably

in a long time.

So it's probably not helpful either,

but not, not super recently, to be honest.

Um,

I think a few months ago I set

up a,

cause one of the only things I don't

like is, um, they don't,

there is no like cloud sync of your

database.

So if you, um,

Oh,

I don't know if you have a phone

that literally explodes or something like

that.

You might accidentally lose your account

and all your contacts and everything.

So it's on you to keep really good

backups,

which I don't always keep as good of

backups as I should.

Actually,

I'll tell you exactly what happened.

When I left Surveillance Report,

I think we shut down our...

We had a business account and I was

trying to shut that down and I

accidentally deleted all of my accounts on

some on Siblex.

Um,

so I had to make a new one,

but yeah,

that was like end of last year,

beginning of this year or something.

Um, so not recent,

I don't remember it being like crazy

difficult,

but it's certainly not like something like

session or signal where it's just like,

yeah,

basically just keep clicking and

eventually you'll get there.

Like you do have to put a little

bit of thought into it, so.

Okay.

Yeah, that's cool.

Alrighty,

I think since that was all our questions

so far,

I think we'll go ahead and call it

a week.

So all the updates that we talked about

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

Don't forget that if you sign up for

that newsletter,

that also acts as a reminder because it

goes out right when we start streaming and

there's a link to the StreamYard stream in

there.

So super handy.

For people who prefer audio,

we also offer a podcast available on all

platforms and RSS.

This video will also be synced to

PeerTube.

Those last two are not in real time,

but if you prefer audio or PeerTube,

those will definitely be there.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website

by going to privacyguides.org.

You can also go straight to the website

and click the red heart icon located in

the top right corner of the page.

You can contribute using standard fiat

currency via debit or credit card,

or you can opt to donate anonymously using

Monero or your favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content

and priority during the This Week in

Privacy live stream Q&A.

You'll also get a cool badge on your

profile in the Privacy Guides forum and

the warm,

fuzzy feeling of supporting independent

media.

So thank you all for watching,

and we will be back next week with

more news.

Thanks, everybody.