Mulvad's co-owner made a controversial

political donation.

A U.S.

court has ruled border agents can search

your phone without a warrant.

And a little bit of good news from

Apple.

All this and more coming up in This

Week in Privacy, number sixty three.

So stay tuned.

Welcome back to This Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

within the Privacy Guides community and

this week's top stories in data privacy

and cybersecurity.

I'm Jonah,

and with me this week is Nate.

By the way,

we're going to be ditching our Q&A section

we normally have at the end in favor

of answering questions just throughout the

stream.

So if you have any,

no need to wait.

Just ask away.

We will be checking the chat here,

of course,

and also

um our forum thread and our signal chat

for privacy guides supporters so any of

those places uh yeah let us know if

you want us to discuss anything anyways

how are you doing today nate i'm doing

pretty good um

Yeah,

I don't think I have much to say.

It's been a surprisingly good week,

I think, for me.

How are you?

Good.

You know, I'm doing good as well.

I was just talking to some people,

I know you know about this,

but this morning I booked all of my

stuff for DEF CON in a few weeks.

Kind of a last-minute booking,

which is how I normally handle things.

But that'll be exciting.

So...

If anyone is going to DEFCON,

it would be very cool to meet up

with anyone,

but otherwise I will be doing that and

I'm looking forward to it.

I've never been to Vegas before.

Have you been to Vegas, Nate?

Surprisingly, no.

I actually spent seven years in Southern

California and Vegas was only a few hours

away.

But for the majority of that time,

I was under twenty one.

And a lot of people told me that,

like, yeah,

there's stuff to do if you're not twenty

one.

But there's like and they're not even

talking about gambling,

which is like getting into places like

there's more stuff to do when you are

twenty one.

So I just never really made the time.

But that is really exciting.

I do want to go to DEF CON

one day.

So I hope you have fun.

Yeah, you should come.

Hopefully we can do it next year or

something a bit less last minute for sure.

Yeah, that would be super awesome.

But yeah,

I guess we'll go ahead and jump into

this week's stories and cybersecurity

stuff that you might be discussing at DEF

CON, possibly.

Who knows?

But we're going to start with our big,

big story, which is about Mulvad,

the Mulvad donation controversy.

So for context here,

this actually came to light a few weeks

ago.

I want to say like a month ago

that one of the co-founders of Mulvad VPN

named Daniel Bernson,

I probably pronounced that wrong, donated,

I believe some sources I've found said

five million Swedish kronor,

which is a little bit north of five

hundred thousand US dollars to,

I'm definitely going to pronounce this

wrong, the Orebro party in Sweden.

According to Wikipedia,

this party has been described as both left

and right wing.

But from what I can tell,

they're largely considered left wing.

And this, unfortunately,

this is relevant to the story.

Despite being considered largely left

wing,

the party apparently also has some

significant nationalist,

populist and conservative views.

And one of the big ones that I've

seen thrown around a lot that people are

upset about is remigration,

which is a term I've never heard before.

The summary I found said it's a policy

aimed at encouraging or compelling

immigrants to leave Sweden.

Another summary said the party's platform

includes strong secularism,

immediate closure of Islamic charter

schools,

and the assertion that Sweden belongs to

the Swedes.

So again, for the record,

these are summaries I read and I have

never been to Sweden.

I am not Swedish.

I don't think I know any Swedes other

than I think I've talked to some of

them all bad people for like two seconds

in the past.

So apologies if I got any of that

wrong, but that is what my research is.

turned up.

So again, this, this story started about,

I mean,

apparently this donation took place in

twenty twenty five,

but I guess it just came to light

about a month ago.

And Moldad has officially commented now

because this has become such a big thing.

And I'm just going to kind of pick

out bits and pieces of this story because

there is it's it's

It's not a huge, huge statement,

but it's a little bit too much to

just read off here.

Basically, they said,

this is a private donation from Daniel to

the individual.

Mulvad or its parent and sister companies

did not endorse and were not involved in

it.

And then they kind of went on to

basically say that, well, actually,

let me scroll down a little bit here

and read one more part.

Mulvad does not condone it nor condemn it.

It was most likely a bad idea.

Most things where there are a multitude of

conflicting opinions necessarily are.

i don't know about that but societies need

a great diversity of ideas initiatives and

organizations who can be tested and sifted

until the best ones remain ideally through

rational debate daniel's rationale and

points of view can be read on his

personal blog um which i'll throw up on

screen real quick just so you guys can

see it uh he has written quite a

bit actually um about a number of his

views both related to that party

specifically and politics um so you guys

can go read that if you'd like to

Just to clarify,

when I said I don't know about that,

they said the part where most things where

there are a multitude of conflicting

opinions necessarily are.

I mean there have been a lot of

controversial ideas in the past that I

would argue have stood the test of time,

but whatever.

Yeah.

So basically they go on to say in

this, this post, um,

to kind of summarize it,

they basically say like Mulvad is

nonpartisan.

Um,

their interest is in making a VPN and

providing people with the, uh,

the tools to bypass censorship and access

information and communicate freely and

privately.

And, uh,

they kind of point out like sometimes,

you know, we, we talk about this with,

um,

we talk about this with like,

like encryption, like necessarily people,

unfortunately are going to use encryption

to do bad things,

but that doesn't necessarily mean that we

break everybody's encryption.

Right.

And that's kind of the same argument that

they're taking.

And let me see if I've got it

all down here.

So yeah, Daniel, like I said,

Daniel's got his own blog post over here.

I'll be honest.

I had a little bit of a hard

time following his launch.

I mean, it is, is a lot.

And yeah,

I tried to read it all.

Again, I'm not Swedish,

so I think maybe some of the context

escaped me.

I also,

if I can be a little bit sarcastic

down here, he says, disclaimer,

the views in this text,

while partially inspired by the two who

founded that party,

are mine and not theirs or the party's.

And it's like, so basically you said,

here's why I voted for the party.

And by the way,

nothing I said is what the party said.

So I don't really understand what he's

saying there.

I kind of do,

but I kind of don't.

Anyways, if I read his blog correctly,

he's basically saying like,

he doesn't really believe in that party,

but he, again,

could be reading this wrong,

but he's kind of like trying to encourage

competition.

Like maybe if we have more viable party

options,

maybe the existing politicians will do

better,

which as somebody living under a two party

system,

I can say I kind of understand that

logic,

but I don't know how well it holds

up.

But yeah, I think that's a,

I think that kind of gets us up

to speed.

I think I'm going to throw it back

to Jonah at this point to kick off

the analysis.

Jonah,

could you maybe start by kind of like,

why, why has this become,

I think it's probably obvious for most

people,

but just in case anybody's wondering,

like, why,

why has this become such a hot topic

in the community?

Do you think?

You know, I think well,

in terms of why it became a hot

topic,

I think that the privacy community in

general is a fairly political community

because obviously we are fighting for

privacy, digital rights.

A lot of that has to do with

not only, you know,

getting privacy from big tech companies,

but also having privacy from the

government and making sure that the laws

of

you know,

where you live are protecting your privacy

rights.

And we talk about privacy policies and law

on our forum and on this channel all

of the time.

And I don't think any of the policies

that this party has are specifically

privacy related,

although there are certainly some privacy

implications with some of the re-migration

stuff that they're doing,

which is a whole separate topic.

But it's not surprising to me that

that people who have an interest in

privacy are also going to have an interest

in a lot of other political topics.

And so

It's definitely controversial because it's

the sort of thing that is going to

blow up on social media.

We've seen a ton of this talked about

on Mastodon and on Twitter,

and I'm sure on other platforms where

Malved is as well.

Obviously Malved was feeling the pressure

because they had to post a full response

about it.

And I think a lot of people just

have questions about what it means

for Malvet,

especially if they don't feel like

supporting these policies.

And so we could take a look at

some of the questions.

We've received questions just during this

show already and some statements.

We could look at Take Out the Lobster

on YouTube said,

it's not really an extreme party.

If that's what you're getting at,

sincerely, a Swede.

I will say, neither of us are Swedish,

obviously.

I mean, maybe ancestrally,

but not living in Sweden.

I have no familiarity with Swedish

politics,

and I assume Nate does not really either.

I don't really know much about this party,

to be honest,

and they seem to be all over the

map.

I don't think the question is how extreme

they are, but they do seem to be,

from what I've gathered and from what

other people have said,

just a very populist party,

which is the sort of thing where...

A lot of the times with these populist

parties,

they will have a lot of policies and

say a lot of things mainly to get

votes and support more than actually

supporting it.

And they might not even believe any of

the things that they're supporting.

Or they only have certain policies that

they care about.

I think that this is a big problem

with some parties,

especially ones that are described as both

right and left wing, like this one is,

like Nate was saying.

Because in a lot of cases,

when a party seems like they are kind

of on all sides of the aisle,

they're actually only supporting one side,

but they want to get votes from anyone

that they can convince.

I don't really know...

where I don't really know.

I guess at the end of the day,

his support for it doesn't make a lot

of sense to me.

He said in his own blog post that

he doesn't really support many of the

policies that this party supports.

So I don't know why.

I think it was at the end there,

if you have it on the screen, Nate.

But

Yeah,

it doesn't make a lot of sense to

me to become that party's biggest

supporter But again,

I don't know how much this competition is

really needed in the Swedish political

space A lot of the questions that I've

seen are more about like Just how much

of Mulved's money is actually going to the

causes that the co-founder supports and

As far as I know,

Mulvad is basically co-owned fifty-fifty

between him and another person.

And they're co-CEOs and they kind of just

split everything down the middle.

And so it's, I don't know, Nate,

you could probably elaborate more on this

a bit,

but in terms of like whether you should

continue using Mulvad or not.

It's less of a privacy or a technical

decision and more of a philosophical or

political how you feel.

At the end of the day, your money,

if you support Malved,

some of that is going to be supporting

these things that one of the co-founders

cares about because he's getting the

profits from Malved, right?

Even if Malved's not directly doing it,

you're...

sending money that way which is something

to consider but at the same time you

know you can separate the art from the

artist and if mulvet isn't directly

supporting themselves it's just one guy

who's profiting off of it maybe that's

less of a big deal to you i

don't know what do you think nate i

think it's um i think it's really personal

preference um real quick just to kind of

go back to uh to what um take

out the lobster said uh what i was

getting at is basically just that i just

wanted to

I don't know if hedge my bets is

the right word, but basically like,

I don't know a lot about this party.

I hadn't really heard of them before.

So it was kind of my, like,

I wasn't trying to insinuate they're

necessarily an extreme party.

I was more just saying like,

I apologize if I'm summarizing this wrong,

but yeah, I think it's,

It's so tricky because I think both of

those takes are true.

You know,

Eteru said here that he said in a

real fight,

nobody drops the best shield just because

they dislike the creator.

But at the same time,

I think it's not quite the same.

Like, I see where you're coming from,

and you're absolutely right.

Like, if I was in a firefight,

I'm going to use whatever protection I

have available to cover myself.

But it's so, like...

I don't know.

I think that's a valid take,

but at the same time,

I think not wanting to – because when

you're subscribing to Moldad,

you are directly putting money in this

man's pocket.

Like, full stop.

You are.

Period.

Full stop.

And so you're giving money to him,

which he then in turn turns around and

gives to a party that –

may have serious like political things

that you don't believe in.

You know, if,

if he's talking about forcibly removing

immigrants from the country and you know,

like,

like maybe that's something you don't

believe.

Maybe, I mean, like my wife is Hispanic.

I don't like people.

I'm just going to say here in the

U S I don't like people who have

that whole, like, Oh,

we need to kick them all out.

Like, you know, it's, I don't know, man.

I think they're both valid takes is what

I'm getting at.

Like, if you're like, no,

it's the best tool we have.

it's his money and i don't think we're

gonna find a better tool i i think

that is a perfectly valid take but i

also think it's completely reasonable that

some people would be like yeah but my

money is directly supporting him which is

in turn directly supporting them so it's

basically like i'm giving money to them

but just through a proxy and i don't

want to give them my money like i

think that's also a perfectly valid take

um

Personal opinion,

I think I would like to see in

the community itself,

I think I would like to see more

appreciation for that.

I think not to like kind of be

judgy and call people out, but you know,

this whole, like you said, again,

this comment,

this MOVAD drama shows how people confuse

politics with engineering.

No, like technology is political.

I'm kind of, I don't know.

I'm one of those people who thinks that

everything is political when you dig deep

enough and there's really no such thing as

being non-political or apolitical.

And so it's like,

I think understanding that for some

people, this is really important to them.

And I think that's valid.

And just having that kind of patience that

for some people,

they care for some people, they don't.

And this is something that comes up a

lot.

I think most of the time when like

people say that they're not going to use

something that's widely recommended,

like MOLFAD, we see it with Graphene OS,

for example,

we see it with other projects.

We see it with Proton all the time,

where I think

When somebody says they're not going to

use something for some non-technical

reason,

there's a group of people who get mad

that they're doing that and that they're

not using it,

which is a reaction that doesn't make a

lot of sense to me.

If somebody isn't going to use Malved

because of this,

I don't think there needs to be a

whole argument about why the politics and

how this doesn't actually matter because

Malved is still secure.

It's fine if you don't want to financially

support this sort of thing.

But yeah,

just kind of an annoying thing that I've

seen in the community beyond Malbed's

stuff.

I would say the other thing I wanted

to point out really quick,

I did see a lot of comments in

the community basically talking about the

potential privacy implications for some of

these policies.

The re-migration one in particular,

it does call into question

A lot of privacy concerns about how those

people would be found in Sweden,

for example,

and how they are determining who needs to

stay and who's going to leave,

what metrics are they using.

Obviously, here in the United States,

we've seen a lot of news about ICE,

for example,

and how they're using facial recognition

everywhere,

and they all have these apps on their

phones that they can scan people with,

and all of this data is being collected

into databases.

All of those immigration policies and some

of the stuff that this party is supporting

can directly have privacy implications for

people living in Sweden.

And obviously, we've seen already,

maybe it's not obvious, but in the US,

people who are not targeted by these

policies,

like American citizens who were born here

in whatever,

are are also swept up in in these

privacy invasive things that the

government is doing and it's very possible

that if policies like this were

implemented in Sweden a similar sort of

thing would happen where you know it's not

only going to be targeting illegal

immigration but also it's going to sweep

up Swedish citizens into this this whole

immigration system and a lot of people I

think

Will probably be opposed to that just from

a privacy perspective as well.

I did see a lot of comments about

that on the forum.

So I did want to bring it up

because I do think a lot of people

are saying like, well,

there's no privacy implications at all.

So if you only care about privacy,

it doesn't matter too much, right?

Um,

Yeah, I mean,

there's so many questions and comments on

this one.

Let's take a couple from Jordan's been

relaying some from the Signal chat.

Yeah.

Let's start with some of these.

So how is the co-owner?

I think you answered this.

How is the co-owner invested in Mulvan

financially?

If I pay for Mulvan,

in what way I pay him?

Well, first of all,

I think you said there are fifty fifty

owners.

But also, like, I want to point out,

he draws a paycheck.

That's my understanding.

Yeah.

I don't know how that aspect of it

works because, you know,

when you own a company,

and Movit is a private company,

so all of this stuff is not going

to be, it doesn't have to be disclosed,

basically.

But when you own a company,

you can take a paycheck or a salary

for all of the actual work that you're

doing.

But then if you're an owner,

you can also take profit sharing,

which is usually quite a lot more.

It's why you see all these billionaires

who are like,

my salary's a dollar because they just get

all of their...

money via other means so they don't need

to pull an actual salary.

So I'm sure he takes a salary and

like normal income,

but in terms of what he could be

getting beyond that,

I would imagine it could be up to

fifty percent of the profits.

I don't know who else is entitled to

to get that money outside of Malved,

but could potentially be quite a bit of

support.

Yeah, I know this isn't really the point,

but just to throw that out there,

that's also – it goes the other way

too.

Sometimes you'll see like, oh,

this CEO is making like fifteen million

dollars a year, and it's like, well,

they're actually making less than that.

But when you include all the stock options

and this, that, and the other,

which for the record,

they're still making a disgusting amount

in –

Not literally disgusting,

but they're still making a crap ton of

money in raw liquid cash.

But yeah,

it's usually it's not fifteen million

dollars in liquid cash.

It's like some million in liquid cash and

then the rest is stock options and stuff.

But I don't know if all that works

the same way, but I digress.

Um, so yeah, uh,

here's a fun one from Signal again.

What were the relevant statements and

actions the Mulvad company took to

distance themselves from that and prevent

it in the future?

Uh, none really, to be totally honest.

If you, I mean, if you read this,

this, um, statement, it,

it very specifically says that like,

I don't even know how to summarize it

to be totally honest,

but they didn't condemn it.

They didn't endorse it.

They just basically said this happened and

we don't care and we're just going to

keep doing our thing.

Yeah,

their position is definitely that they're

not going to police what their owners are

doing or what their employees are doing or

what anyone is doing in their personal

time.

It's just going to be...

You know,

Malved themselves are not going to support

things like this,

but what people do with the money that

they earn from Malved is kind of their

problem, is Malved's position.

There's a question on the forum,

and Jordan asked a similar question

earlier in the chat,

so I can kind of cover it.

both of them.

Jordan asked if there should be

restrictions on executives making

political donations to stop this sort of

thing.

Somebody on the forum thread asked at what

point is it acceptable for an executive or

lead developer to support something that

could be deemed controversial.

You know, at the end of the day,

I think all...

executives of companies that have

customers like mall fad are public

figures, whether they like it or not.

And so all of their the things that

they do in their personal lives and the

personal choices that they make,

they're gonna have business impact.

And obviously,

this has had some business impact at mall

that because they had to speak out about

it.

And a lot of people are saying that

they're canceling because of the co owners

personal decision here.

So

mean it's always going to have an impact

at what point is it controversial or

should there be restrictions it really

just depends on the company i think you

know it's not unreasonable i i was

explaining this on the form uh in the

form thread about this to somebody but

like it is fairly normal when you're

dealing with public figures whether that's

an executive of a company or if you're

like hiring an actor for a movie or

something to have clauses in their

contract or morality clauses that kind of

restrict them from

doing controversial things like this

because it does have an actual impact on

the business itself.

It's not just a personal thing.

So like that is something that well that

could do but whether they should do that.

is another question entirely and it kind

of comes down to what the company thinks

is an acceptable risk i mean it's not

like you can mandate this and make like

make it a law or anything um it's

just it comes down to whether malvad wants

to accept that uh it's gonna have an

impact on their business and it seems

clear from their statement that they are

just going to accept that as a as

just the fact of life for their business

A similar story,

I don't know how many people,

maybe not a lot of people know about

this,

but I've read a lot about it because

I've been looking for merch and stuff for

privacy guides and I see people talking

about it on Mastodon,

but a lot of people used to really

like Sticker Mule for stickers and then

their owner turned out to be a big

Trump supporter,

so now a lot of people don't want

to support that company mainly based on

that.

So it's kind of a similar thing.

the personal leanings of the owners of

these companies is going to have a

significant business impact,

whether you or they like it or not.

It's just how it is.

Yeah, I don't know.

I don't know.

I don't think I have much to add

to that because I'm with you in the

sense that I don't really know where that

line should be because on the one part,

they are public figures and you're right

about that stuff.

And people are going to have those

reactions either way, right?

I mean, like,

it happens on both sides of the aisle.

Look at, you know,

Bud Light had like a trans person as

their spokesperson at one point,

which was really weird to be honest for

Bud Light.

That was definitely off brand for them.

But you know,

it happens on both sides of the aisle.

And, but at the same time, it's like,

as a person,

like I remember when I was in the

military, that was the rule there is like,

you don't do anything public,

especially in uniform.

Like, yeah, go vote, go do whatever.

But like,

you are not allowed to speak out publicly

as a uniformed military member and be

like,

I support Obama or whatever publicly.

um so yeah it's it's it's i think

that's where this whole like i think

that's where a lot of the controversy is

coming from is where is the line between

like this person is an individual who has

the right to support whatever ideas they

want even if they're garbage ideas and you

know where is the line between that and

like well your your customers have an

expectation of you and i think you made

a really good point that like the company

definitely depends a lot i think if you're

in like um

If it's like some kind of nonprofit that's

like providing legal assistance for

immigrants and then they go out and donate

a bunch of money to Trump,

that would be super weird.

But yeah, I don't know.

It's tricky for sure.

Kind of related that we had a comment,

kind of an opinion from either you,

hopefully I'm saying that somewhat

correctly,

who said that voting with your wallet is

valid for personal ethics,

but in threat modeling,

prioritizing political alignment over

technical robustness is a trade off.

Kind of two things I want to unpack

here.

The first thing is simple.

I think with VPN companies in particular,

we got to understand that these are not

zero trust technologies like you're

talking about,

you do have to trust your VPN provider.

And so this kind of thing does come

into play because a VPN provider is

basically like an ISP.

You're just shifting your trust to that

VPN.

You're not eliminating the risk involved

with an ISP seeing all of your data.

That's what we're pretty clear about on

our site is the main use case for

a VPN.

So if you don't trust the VPN,

there's literally no point in using it.

And this is a trust question.

but when it does come to zero trust

things or things that can be more

technically cryptographically proven uh

you know i think there is a solid

point here going back to what i was

saying about um graphene os for example or

proton mail with with these sort of things

there are guarantees there's

inspectability so people can um like

see what code is running on Graphene OS.

It's open source.

People can see, like,

Proton is using end-to-end encryption,

so they can't read all of your messages

at rest.

That sort of thing is important,

and it does eliminate trust,

and I think when you can eliminate trust

whenever possible,

which is ideally how all privacy products

would work,

then this kind of thing does become less

important over time,

and it is more of just a personal

morals thing at that point.

I don't feel that bad about it in

this case,

because there are perfectly good

alternative VPN providers you can choose

from.

We have other recommendations on our site.

Whether this is going to cause us to

change our recommendations on our site and

stop listing Malvet,

I don't think it's going to.

And in fact,

despite how controversial this topic has

been and how many people are posting about

it,

I haven't seen anybody really suggest that

we do that.

You know,

you can definitely separate it a bit.

But in the case of a VPN,

I do think it's valid to be concerned

about this at the very least.

Yeah.

On that note,

I did want to make sure that we

pointed out that, um, not,

not trying to tell people what side they

should take,

but this is not something that at this

point in time,

we have any reason to believe is impacting

mold ads, actual technical product.

So again,

going back to that argument of like,

some people are like, I don't care.

It's his money.

It's his business.

The product is solid.

The product is still solid as far as

we know at this time.

And, um,

I think that's something worth noting.

And kind of related to what you were

just asking, somebody in the forum asked,

I'd like to know from the staff what

they think of Mulvad versus other

companies in terms of what they contribute

overall.

Are they offering unique benefits,

not just in their current VPN where we

know there are other good options,

but in terms of what they bring to

development, research, privacy,

advocation, et cetera?

And honestly, yeah, kind of.

I don't know how I feel about sticking

up for Mulvad because I'll make it clear.

I don't agree with the policies of this

party that he supported.

But they ran a huge campaign all around

the world to try and bring privacy more

to the mainstream.

I remember seeing Mulvad buses when I was

in Seattle for something last year.

And I saw the Mulvad buses and I

tried to grab a picture,

but they went by too fast.

I was like, oh, that's cool.

There they are.

But they ran this big ad campaign.

I think they've been...

I could be wrong,

but I think they've been pretty vocal

about being against chat control.

I mean, you say research and development.

They do a lot of innovative things,

in my opinion,

like these RAM-only servers and

their data service, things like that.

So like, yeah,

I think they are really innovative.

And actually there was one other thing I

was gonna point out.

They're not unique.

I'm gonna share this tab real quick.

Jordan brought this to my attention a

while back when we were chatting.

There's a Medium post.

After Andy N went and like made some

kind of pro-Trump comments,

somebody kind of pointed out, and to me,

for the record,

I take this post with a little bit

of a grain of salt because this person

has never posted anything before or since.

And, but, you know,

they point out that like,

Proton has historically donated to a lot

of organizations that are not necessarily

aligned with stuff like that.

And so anyways, my point being is like,

yeah,

MoVAD is not the only company that's out

there donating to good or to,

I shouldn't say good organization.

MoVAD's...

Putting this issue aside,

there are other companies that are out

there doing good things in the privacy

space for advocacy and research and stuff

like that.

And I wanted to tie that back into

what you said with that question.

It mentioned threat modeling.

And yeah, you could go with,

I would feel pretty safe saying that I

think Moldat is probably the best option

right now in terms of privacy and security

and a VPN.

But at the same time,

what is your threat model?

Like,

if your threat model is so high that

you cannot afford anything less than

MoVet,

you probably shouldn't be using a VPN.

You should probably be using Tor or

something like that.

But, you know, Proton is still good.

IVPN is still good.

Like,

I think there are still good options out

there where for your threat model,

you don't have to sacrifice privacy and

security to also still be ideological.

So, yeah.

Okay.

I will add though, on the other hand,

while there are companies that are doing

innovative things just like Mulvet,

I think there are probably companies where

their leadership or employees are doing

controversial things that you don't know

about and haven't heard about.

Some of these things are kind of

unknowable.

And so that's what makes it hard,

I think,

to base your decisions around this.

I mean,

now it's kind of proven that if you

don't agree with the ethics of the

situation,

now you have proof that Malved is

unethical in your eyes.

But you can never really prove that a

different company is any more ethical than

that,

because they could be making very similar

donations behind the scenes that you just

have not heard about.

So it's why it's the sort of thing

that it's hard to...

take as a huge factor when you're making

a purchasing decision, for example,

in my opinion.

Yeah, for sure.

I don't want to be too defensive,

but I do want to point out Gaethje

said, both sides of the aisle.

Bud Light, as we support people,

be yourself.

For the record,

that's not what I meant when I said

both sides.

What I meant is that both sides do

things that alienate their fan base.

No,

I do not believe that both sides are

the same, personally.

So...

I just mean they both do things that

alienate people, but I digress.

Wow.

We spent a lot of time on that

story, but that is,

it's such a complicated story.

It's just, and it's, again,

I want to reiterate in my personal

opinion,

like I think both arguments are valid.

If you're like, well,

that's the best VPN and you want to

stick with it, go for it.

But just be aware where your money's going

and vice versa.

If you're like, nah, screw these guys.

I want to take my money somewhere else.

Like, I think that's cool too, personally.

So.

Was there anything else we wanted to add

to that one before we move on to

the next story?

Yeah,

let me just look at the questions quick.

I don't think there's any remaining that

we haven't answered,

at least about Malvad.

So we can kind of move on.

But if we missed any or if we

missed one in Signal,

feel free to send it again and we

can look at it.

otherwise i think it's probably a good

time to move on to our next story

here uh before i talk about that one

though i want to go back to some

defcon questions we had from earlier

somebody on youtube dragon black knight

asked about hope i'm not going to go

to hope um there are so many conferences

that i would like to go to uh

carrie parker from firewalls don't stop

dragons is in the uh

is in the chat and explained why he

wouldn't be going.

And it's pretty much the same reason for

me.

That's kind of a lot to be doing

right now.

But there are a lot of cool conferences

to go to and there's cool ones in

Europe that I would like to go to

maybe next year.

But at the moment,

no i have no other plans for for

any of that uh somebody else uh in

our signal chat uh in jordan shared this

here um as if we're doing any kind

of meetup at defcon and no privacy guys

isn't doing anything at defcon but if

anybody does want to meet up um send

me a message because i would love to

say hi to people who watch this stream

or or

are familiar with privacy guides in any

way so i will be there i'll be

there uh six through the ninth so yeah

come say come say hi

I didn't put two and two together that

that was about the DEF CON thing.

I just saw his privacy guides doing any

kind of meetup, and I'm like,

that's kind of out of left field.

Why would we be doing a meetup at

DEF CON?

That makes sense.

Yeah,

there was a bit more context in the

signal group than in the chat shared

there.

Yeah,

I need to add the signal chat to

this computer so I can read it during

the streams.

I'll have that in time for next week.

Alright,

I think that's kind of that for now.

We'll move on to this story posted by

the EFF.

The headline is,

An explosion of surveillance towers is

coming to US borders,

costing over one billion dollars.

A new report from the Government

Accounting Office reveals that the

Department of Homeland Security, DHS,

plans to nearly triple the number of

surveillance towers along U.S.

borders from the current eight hundred

thirty to twenty three hundred by twenty

thirty four.

EFF says here that the IST program

operates autonomous surveillance towers

consisting of

AI-based systems using radar, thermal,

infrared,

and optical systems to track targets over

long distances,

integrated fixed towers which are

optimized for surveilling foot traffic and

vehicles,

and remote video surveillance systems

which can often be found very close to

the border fence in Arizona,

including residential neighborhoods where

cameras are capable of spying on homes on

both sides of the border.

They say that DHS expects to purchase more

long-range autonomous towers and to

upgrade existing towers with autonomous

capabilities.

The one billion dollars comes from the

so-called One Big Beautiful Act,

a massive tax in spending law that

President Trump signed into law in twenty

twenty five.

They point out that the technology isn't

exclusive to U.S.

federal agencies.

It's also deployed by state and local law

enforcement,

and it's also deployed by governments on

the Mexican side.

So yeah, a lot to unpack there.

Nate,

what are you thinking about all that?

Yeah,

I think the big thing that stuck out

to me, I mean, first of all,

I think we kind of wanted to share

this because like, yeah,

that's a lot of surveillance towers.

I'm assuming they're

relatively cheap in the sense that a

billion dollars probably buys quite a few

of them um the the thing that stuck

out i guess we know how many it

buys right what's the twenty three hundred

minus did they say oh yeah eight hundred

thirty fourteen one thousand four hundred

seventy yeah i mean to be fair that

probably includes like install costs and

stuff yeah yeah but um no so the

thing that jumped out at me is um

I have driven cross country multiple times

and driving through El Paso,

like if you're crossing from El Paso to

New Mexico or vice versa,

is a really wild experience because you

can literally look out one window and see

this like beautiful,

I think it's like a university or

something,

literally sitting on a hill and it's huge

and it's gorgeous.

And then you look to the other side

and you can see the,

what do they call them?

The like,

the little sheet metal shanty towns in

Juarez, literally across the...

I'm not kidding.

It is a very surreal experience.

And I know that in towns like that,

where there are towns that literally butt

up against the border,

some people cross back and forth for work,

but a lot of people don't.

And my first thought is like,

there's no way that these cameras won't be

catching people

who are just going about their business

you know it's it's it's designed to

monitor the border right and people

crossing the border but there's no way

it's not going to catch the people when

the towns are literally that close it's

not going to catch the people driving down

the highway walking their dog going to

school going to work on their side of

the border like it's just it's going to

catch everybody and that um that very much

uh was kind of my first thought of

like there's

I guess the privacy concern is how it

catches everybody,

even if they're not crossing the border.

Yeah, and kind of famously,

the border control agency,

they have authority, what is it,

like a hundred miles inland or something

like that?

People talk about that when they're

talking about airports all the time,

but it's true here too.

It's not just like towns that butt up

right against the border, right?

They can potentially install these quite a

ways into the United States,

and it could potentially impact a lot of

people, right?

Yeah,

I think any international pretty much any

international port,

whether that's a border, a seaport,

an airport.

So, yeah,

it's honestly there's not a lot of the

U.S.

that isn't covered when when you expand to

that definition,

because there's a lot of like

international airports in the middle of

the country and stuff like that.

So, yeah,

I don't know if that legal theory that

airports are included has been like tested

in court or anything, but like in theory,

it's possible.

But certainly when we're talking about

like a physical border between countries,

it's definitely true.

So it would apply here.

Yeah.

I think the other thing that jumped out

to me is, you know,

I always want to know that like we

were just we just spent thirty minutes

talking about a story of nuance.

Like there is nuance.

Like obviously we want to protect our

borders.

You know,

there are cartels and there are people

crossing illegally.

And but it's just I don't know, man.

It's it feels like one of those things

where it's like a.

Some military general said something about

killing a fly with a sledgehammer.

It feels like this might be overkill,

I think.

Yeah,

Draken said here that most of the US

population lives within that hundred mile

buffer zone, which I think is true,

actually.

Yeah, I was just fact checking that,

but I believe it is true.

Yeah, it's pretty wild.

Yeah.

Vonnegut said,

sounds like the West Bank where there's

settlements that go right up against

refugee camps.

And honestly, yeah,

it's kind of like that.

It's at least the El Paso thing I'm

thinking of.

It's pretty wild, but... I wonder if I...

I think I don't live in that zone.

I think I'm a hundred miles away from

Canada.

I guess I don't know for sure.

I'm pretty sure we live in that zone.

I know there is a map I found.

I think it was from the ACLU did

a map one time of that hundred mile

zone and it's...

Yeah.

It did not include airports or anything.

It was literally just a hundred miles

around the country.

And it's,

it's pretty shocking how far in it goes.

now I kind of want to go see

if I can find it but I digress

yeah real quick I also want to say

I know I'm going to try not to

be political because we've already been

plenty political enough but I think there

are a lot of people I mean we

just covered that with this last story

where it's like oh it's you know it's

all about the tools it's all about the

encryption and they kind of ignore the

politics but like this was directly funded

by the one big beautiful bill act so

it is kind of important to remember that

there are impacts on this stuff and I

would encourage you to try to

to be politically aware,

at least to the extent that you can

handle.

I know it can be really depressing

sometimes that your mental health does

matter, but this stuff does have impacts.

That's all I'm going,

or all I'm getting at.

John in the chat said that the Great

Lakes are considered part of the border.

Yes, that's true.

I do think Minneapolis is more than a

hundred miles away from

any of the Great Lakes,

if I remember correctly.

So I'm pretty sure I am safe,

but I'd have to find that map.

But definitely if you're in probably

what's around the Great Lakes, Wisconsin,

Michigan.

Ohio, Indiana, New York.

The entire Northeast, basically.

Yeah, because when your state is so small,

there's probably,

I don't know how wide

all of those states are but they might

not even be two hundred miles wide in

some cases and so that's gonna cover the

entire state and some of those are quite

large because you'd have to like if you're

in Vermont or something you know you got

the Canadian border on one side you got

the ocean on the other which is also

a border so that hundred miles goes both

ways so yeah does not surprise me that

two-thirds of Americans live in that zone

i'm trying to find this map i found

an interactive one from arc gis that's

kind of cool oh here we go i

think this is the one i was looking

at from the aclu uh as soon as

it'll load carries in the chat saying that

he interviewed nate wessler who had some

points about that so i guess we can

uh show his podcast a bit go check

out that episode i'll have to listen to

that i have not i have not caught

that one

I am still way, way behind.

I think I'm still in April on my

podcast.

So it's fun, though,

because it's almost like a little low-key

nostalgia.

They'll be like, oh,

this incident happened in the cyber world.

And I'm just like, oh, I remember that.

I will say, yeah,

Vonnegut Rosewater said that they haven't

seen a border patrol officer.

Yeah, I mean,

I don't really see them except at the

airport.

There's probably some on the actual border

of Canada,

but it's not like driving from Arizona to

Mexico.

I've done that once and there were border

checkpoints and stuff along the way.

It's definitely not as much of a thing

up north here between the US and Canada

as it is by Mexico.

That's actually what I was about to say.

I thought you were going to say, yeah,

you don't really see them that often.

And I'm like, no, I've, again,

driven in the south a lot.

I've been through the border checkpoints.

Don't see them often here specifically.

Fair.

Which I think kind of removes people from

the whole question a bit because they

think it's not a big deal.

It's a huge thing down there.

It took forever,

but I finally found a map.

Let me throw this up real quick.

yeah that's that's just the coastal border

or like that's not including airports so i

mean like every major city los angeles new

york um those two are almost like ten

percent of america's uh population right

there miami houston seattle buffalo

chicago so fun times yeah

the entire state of Michigan,

the entire state of Maine.

Oh, man, that sucks.

Almost all of California.

Man, that sucks.

Anyways.

Yeah,

that's a map you can go look at

if you do enough digging, I guess.

I think...

Let's see here.

I'm checking the thread.

We're keeping an eye on that as we

go.

All of Florida.

Yeah.

Delaware.

Yeah,

the forum thread had some comments about

this news story,

but I don't know if there's a question.

Let me see here.

Yeah, I didn't see a question.

Yeah,

just some more comments about Molotov

Head.

On that note, though, again,

we're trying some new stuff.

And one of the things we're going to

try is we're going to check in with

the forum periodically and see what's

going on there.

So our forum is always very, very active.

And this week has been no exception.

Lots of chatter going on there,

lots of cool questions and stuff.

and uh this was a a question that

i had a lot of thoughts on but

i i think you did too because uh

you kind of flagged this one in the

show notes is there space for another

private messaging app um do you want to

uh take that one first yeah let me

let me pull it up here um sure

thing this was basically a thread it was

posted a couple days ago asking about um

whether another privacy-related private

messaging app is needed,

whether this version should build one.

And there's a lot of comments about here.

A lot of people saying...

It's probably not the greatest idea,

which,

and I didn't even realize that you posted

a comment about this,

so you can go into some of the

things you were saying after this.

But it doesn't make a lot of sense,

especially with things like the network

effect, for example,

meaning that everyone has to get on board

with a messenger for it to be useful.

It's why we kind of tend to only

recommend Signal,

because it's a net positive if everyone is

on Signal.

this best all-around messenger instead of

using ones that might be technically

better but are less likely for a lot

of average people to use.

The main thing I saw at the beginning

of this

FormThread,

this person said that the biggest walls

are infrastructure cost if it becomes

popular and getting people to join the

network.

And I just mainly wanted to say that

that second point is like way,

way bigger of a wall than the first

point.

Like massively, massively larger problem.

And so if you're only solving the first

problem,

you're not getting anywhere close to like

building a viable messenger.

And I think a lot of people...

even when presented with perfectly good

options are not going to switch so yeah

unfortunately I just cannot encourage

going down this path I think like I

think signal is a very good messenger

obviously I think if you're very concerned

about centralization I think simplex is

also a good one to look into and

between those it's kind of hard to imagine

why you would use

other ones there are other ones that i'm

interested in um personally i really like

what delta chat is doing but a lot

of people that's a very controversial one

on the forum a lot of people really

really do not like delta chat which is

why we only fully recommend it for

everyone right now it's kind of being

debated but like they're at least doing

interesting things that i'm following

There's obviously Matrix and other ones

that have been around as well.

I think at present we kind of have

too many messengers.

The problem isn't needing more messaging

software,

it's getting people to use messengers that

are more private than Telegram and more

private than WhatsApp and more private

than normal SMS and whatever.

So yeah,

maybe you can talk a bit about this

post that you wrote here.

Yeah,

the messenger thing is one of my pet

peeves in the privacy space.

I feel like, like you said,

we have too many messengers.

And for the record, yeah,

none of them are perfect.

I will give you that.

And I think there's even pros and cons.

Because Signal, for example,

a lot of people are upset that Signal

is centralized.

And that has come back to bite us

before.

Signal has, on very rare occasions,

become overwhelmed and crashed.

And I think that...

I think that's valid,

but Signal also makes the point of, like,

we're centralized because, you know,

there's abandoned Matrix servers and

Mastodon servers that are, like,

ten versions out of date and stuff like

that.

So there's literally pros and cons to

everything.

And, um...

I think my thing,

and I kind of went off on a

big tangent here,

but my thing is I feel like people

are focusing,

and I feel like this original poster said

it really well.

Basically, he was like,

I'm a software engineer,

and I've been diving into messaging apps.

And to my surprise,

it's not that difficult to build a

messaging app.

So apparently that's why there's twenty

billion of them.

But the problem is people are focusing on

messaging apps too much, in my opinion.

And I feel like it's one of those

things that like it's sexy, it's exciting,

it's not hard to do apparently.

But, you know,

there are so many apps and I like

I've listed so many here where like there

are no really good like budgeting apps,

especially for phone.

I know we've got like a new cash

or something.

There's like one calorie counter that

looks like it's from nineteen ninety.

Um, as, as a married person,

I think about things like grocery lists,

like right now,

me and my wife have a shared note

in Bitwarden that we use as a grocery

list,

but we don't have an actual dedicated like

grocery app where you can check things off

as you go.

Um, and for the record, like, yeah,

you can't make it like a one-to-one

replacement with the grocery stores app,

because that one will let you do like,

here's the exact item and here's the row

it's in.

And here's a picture of it.

Like, I,

I'm not expecting it to get that good,

but yeah.

I mentioned, you know,

where's a consent based location tracker

so that when the single ninety five pound

girl goes on a blind date,

she can let her best friend track her

location for the next twenty four hours

for safety,

which I think somebody did actually post

something like that recently.

I meant to bookmark it and keep an

eye on it.

But, you know,

I think later on I mentioned some other

ideas that

What else have we got out there?

I don't know.

Maybe I deleted them all.

I reworked some of these messages, but I,

and another thing,

cause I went and I asked my wife,

I'm like,

I know you have to have opinions on

this.

And she's not even that into privacy as

much as I am, but you know,

it's like,

what do you think she's missing?

And in her opinion,

it's like the appearance of these apps.

Like a lot of these apps are very

bare bones and they look very dated.

And some people don't mind that.

Like personally, I don't mind.

I think old Firefox was fine.

I definitely realized that the new fire or

not Firefox Thunderbird,

the old Thunderbird, like,

the new one definitely looks better,

but I didn't mind the old one.

But then there's some things that look

really, really dated and really outdated.

And, you know,

a lot of people want something that looks

visually appealing,

that captures their attention.

And a lot of things nowadays just don't

look like that.

Like they're designed to be lightweight.

And, you know, like,

I feel like some people are just so

hardcore.

Like if you had one extra line of

code that doesn't need to be there now,

all of a sudden it's bloated and it's

completely unusable,

but

But the looks do really matter for some

people in the user interface.

And I think just making things,

bringing them into the twenty first

century and and making them look good and

making sure they're updated like some

things just never really get updates,

which I mean, granted, you know,

things for like a note taking app probably

doesn't need to be updated that often.

But again,

if we had one that looked modern and

stuff like that, so.

I don't know.

That's kind of what I would focus on

is I think we already have too many

messengers and I would like to see people

dedicate their attention to other things

that look good, that work well,

that have the features we need.

I think we need more options in those

spaces personally.

So yeah,

I kind of went on a couple of

posts about that,

but hopefully I wasn't too rude.

Yeah, I absolutely agree.

I think that kind of sums up the

forum thread.

I'll take a kooky side look at some

comments in the chat again.

Yo, yo, yo, Fred Kong,

welcome to the stream.

Eteru said,

thanks for addressing the comments and

having the debate.

Yeah, absolutely.

We can't spend hours and hours talking

about mulfad, right?

But a lot of these discussions we also

have on the forum pretty often,

and I would say if people have follow-up

questions or want to continue posting

about it, go into the forum,

discuss.privacyguides.net.

It's a great way to discuss all of

this stuff if we can't discuss it all

live here on the show.

But of course,

we're happy to answer any questions that

we get here.

So yeah, keep sending them in, everybody.

Yeah.

Yeah.

I know Anand said there are good apps

out there.

I mean, yeah, I'm sure there are.

And some of them are hard to find,

but they're, they're getting better.

But like one of the examples I use

that I really like is like NT,

you know, NT has that really cute.

It has like the duck logo and it's

like really user-friendly and it looks

good.

And it's got all the features that the

normal people want,

but they're all opt in.

Like you can enable machine learning

that's done on device.

So you can search photos and it's,

you know, if you don't want it,

you just don't turn it on and you

can have the memories that, you know,

on this day, five years ago,

and you can have the,

the like all kinds of cool stuff.

Like I think NT is a really good

example of what I'm looking for,

but I don't know.

I'm sure there are some good apps.

I'm just saying instead of making a

Messenger,

make literally anything else because we

need more other stuff.

Yeah, I think if that's all we got,

we can move on to this next story.

Yeah,

do you mind if we do site updates

now and then go to that story?

I mean, we're in Avarin.

Let's get some stuff to talk about.

Before we talk about yet another border

story we have, let's...

go over some quick updates that of what

we've been working on at privacy guys this

week we finally were able to publish uh

a new site update so we have the

changelog there a lot of things um have

been updated a lot of these have been

published on the site for a while but

they weren't like released to the web

server so they weren't live and now now

they are so everything should be up to

date um we're also working on some stuff

so I'm working on

New recommendations for security keys,

kind of changing that up,

and also recommending cryptocurrency

hardware wallets.

I have literally so many of them on

my desk now, just...

messing with them.

And we're discussing those on the forum.

So there's a lot of forum threads about

that.

If you have opinions about cryptocurrency,

hardware wallets, or security keys,

you can go to GitHub.

There's a pull request open that's a draft

right now.

I think it's just titled hardware keys,

security keys.

And

In that pull request,

there's links to all of the forum threads

because there's like five different forum

threads about different things that are

being added.

So yeah, if you have opinions,

definitely let us know, obviously.

But that is something that will be coming

soon.

In other news,

Fria continues to publish news articles,

privacyguides.org slash news.

Nate has also, of course,

published the weekly data breach roundup.

So there's all sorts of...

stuff out there for you to stay up

to date with.

We try to post some of the biggest

stories that we see,

especially ones that we can't talk about

here on the show,

on that page throughout the week.

So that is a good place to stay

informed in addition to the news category

on our forum.

A couple other things we're discussing.

I think the only other thing we're

considering right now is

a new nested reply format for the form.

There's a sticky post on the form right

now called defaulting new post to use

nested replies.

It's kind of a Reddit like format for

posts.

Right now,

we're definitely not going to be switching

to it.

I'll just tell you because it is kind

of

buggy in some ways.

And there's some improvements that I want

to make that I've shared with the

discourse team to see if they decide to

implement any of them.

However, I mean, assuming it does work,

I think that there's probably some reasons

we might want to use it at least

for some threads in the future.

So if you want to check it out,

see what it will probably look like and

how it works.

And see,

let us know about any feedback you have

definitely check out that thread because

In some ways, I like it a lot,

but I'm a big Reddit user,

and there's a lot of ways that the

current form system is also very nice as

well.

So a lot to think about there.

I think that's kind of it in terms

of site updates and things I'm involved

with.

Nate,

why don't you talk about some of the

video stuff that you and Jordan have been

doing?

yeah unfortunately um jordan got sick this

week uh so they are recovering and uh

they were hoping to have the next video

done by now but uh you know things

happen health is more important obviously

so um once they recover they'll be

wrapping that one up and uh yeah i

mean i've already got one video filmed

after that and just reached out to

somebody today about an interview

which I am excited about.

I, uh, I don't think we,

I don't think anybody has had an interview

quite like this one.

Um, maybe Carrie in the, the like,

like ten years he's been doing firewalls,

no stop dragons.

But, um, I,

I think it's going to be a good

one and I'm excited to share that with

you guys.

But, uh,

that's kind of all we've got going on

right now.

So, um,

Yeah,

all this is made possible by our

supporters.

So if you want to help support our

work,

you can sign up for a membership or

donate at privacyguides.org slash donate.

We also still do have the merch shop

that Jonah mentioned earlier,

shop.privacyguides.org.

Privacy Guides is a nonprofit which

researches and shares privacy-related

information and facilitates a community on

our forum and matrix where people can ask

questions and get advice about staying

private online and preserving their

digital identity.

rights.

Before we jump into that, actually,

we did get a couple of questions.

I don't want to say off topic.

We got a question in the forum that

is not related to any of the stories

we've covered so far.

Khaled says,

what are some good ways to spread

disinformation about yourself?

I've heard this talked about in the past

to protect against data brokers and other

places,

but don't know what's the best way.

Do you have any thoughts on that one?

I use a little bit of disinformation.

I don't know if you do.

This is a good question.

Good ways to spread it is hard because

I mean like whenever possible it's good to

use fake information when you can or to

use like email aliases and stuff like that

so things can't be tied together and so

like if data does get released and like

data breaches or whatever it won't be

accurate information but like

intentionally sharing

False information.

I have definitely heard people talking

about this.

I don't really do this myself,

so maybe you can talk a bit more

about it.

But I've always leaned towards more just

kind of trying to eliminate as much as

possible from being out there,

whether that's through data broker removal

services or just putting out minimal

information out there in the first place

or what have you.

So I guess the answer is I don't

really know the best way to go about

this,

but it is an interesting thing to think

about.

Yeah,

I don't know if I know the best

way because I'm kind of with you.

I focus more on removing the data that's

out there.

But I will say that one of the

things I do is I am really militant

about using a PO box.

And that has worked so well that I

know for a fact that in the past,

LexisNexis has thought that was my actual

address,

which is funny because I'm not even going

that hard to like, oh,

I don't put my real name on my

lease or whatever and somehow still fooled

the data brokers.

Yeah.

Drake in here said best way is to

lie about your birthday city where you

live, et cetera.

Yeah.

I mean, little things like that.

Like if I, if I buy anything,

that's not going to a PO box,

I try to use like a,

like a hotel downtown or library or

something is my mailing address.

Um,

LinkedIn, I know I've said this before.

I, when I got into privacy,

there was a specific address that kept

showing up on all these people's search

sites that was like,

ten years out of date.

And I could not figure out where it

was coming from until I realized I had

a LinkedIn account I had never deleted and

never really used.

And that's where it was coming from.

So, uh, yeah,

sign up for LinkedIn and put the wrong

information on there and it'll get out in

about ten minutes.

Um, I'm trying to think what else.

Uh,

I've heard that rewards cards,

like signing up for – it kind of

depends on what you want to do.

Like some people – this mostly comes from

Michael Basil,

but he's recommended like get magazines

shipped to your house in the wrong name.

Some post office people are kind of

militant about not delivering magazines.

mail that's not like if they know that

name doesn't go to that address they won't

deliver it because they think it's wrong

um so some people have had that experience

you could sign up for uh again like

rewards cards at the grocery store using

the wrong name but your actual phone

number like things like that um

I don't know.

Yeah.

I think it's kind of a subtle mix

of things of just kind of figuring out

where, you know,

does this person need this information?

And if they don't,

what information can I give them instead?

Especially if it's required,

like a lot of the time, you know,

if you go to buy something online,

sometimes it won't say, you know,

it won't like the phone number will be

optional,

but then other times it will require a

phone number.

And at that point it's like, okay,

you're never going to call me.

So what fake phone number can I put

there?

You know, things like that,

I think are kind of how I think

about it.

Yeah, I don't know.

I think that's kind of all I got

on that one.

It's more of an art than a science,

I think,

and just kind of looking for those

opportunities.

Sweet.

Well, let's move on.

Why don't you cover this next story also

from EFF here?

Yeah.

So this one is, um,

a little bit disappointing, unfortunately.

And, uh,

it says that the fourth circuit says

border agents can search your phone by

hand.

No suspicion required.

So, um,

for those who don't know here in the

U S um,

borders or searches of your phone are

really kind of a legal gray area that

are, uh, kind of, it's kind of patchwork,

I guess I would say it's very, um,

Like at this place, this rule applies,

but at this place, this rule applies.

And here you need a warrant,

but here you don't, blah, blah, blah.

And it's very confusing.

And so basically there was a case called

U.S.

versus Belmont Cardozo,

who unfortunately does not seem like he

was a cool guy.

Seems like he had CSAM on his phone,

according to some stuff later down here.

But either way,

they tried to argue as a defense that

–

The police should have gotten a warrant to

look through his phone,

and this made it up to the circuit

court, which I forget how circuits work.

I think a circuit –

includes several states like it's kind of

like a regional court i think if i

remember correctly um okay but yeah so the

the uh this went up to the fourth

circuit who decided that border agents are

allowed to search your phone without a

warrant or really any reason as long as

it's a quick manual search so again

there's there's um

I don't want to get too bogged down

in the weeds of context here,

but basically there's different reasons

that people can perform searches.

Cops, I should say, can perform searches.

There is going and getting a warrant.

But obviously, if we assume good faith,

there are still times where it makes sense

that they can't get a warrant.

If they're at the airport and somebody's

acting real shady and their suitcase is

oversized or whatever,

they've got some reason.

Something suspicious is going on here.

Then, you know,

if they can prove if this ends up

going to court or whatever and they can

prove to the judge like, no,

here's why I flagged this guy and here's

why I thought this was suspicious,

then that evidence is allowed in court.

And there are certain things,

according to the EFF, that at the border,

you don't even need a reason.

You don't even need to say like this

is suspicious.

It's just you can do the search.

And as an example,

they gave like your luggage,

even if there's nothing suspicious,

even if there's there's no evidence of

wrongdoing, the cops can be like,

I'm going to search your luggage.

which they do even on domestic flights.

I can tell you that from experience.

And so basically the court has said cops

are allowed to do a search for any

reason, without a warrant,

without any suspicion,

without any probable cause,

as long as it's a quick manual search.

And where did it go here?

So they said that it has to be

a person, not a machine.

They said that the breadth of the search

depends on the officer's time and energy.

They, uh,

while forensic searches are comprehensive,

uh,

manual searches only reveal what a user

can typically access while forensic

searches can uncover deleted files,

cash fragments, metadata, and more.

And manual searches are subject to an

officer's fading memory or imperfect notes

while forensic searches create a permanent

copy.

So basically this is not permission for

them to hook your phone up and run

celebrate and copy your data.

It's, you know,

the cop saying at the border, like,

let me see your phone,

unlock your phone and looking through your

phone.

Okay.

And EFF argues,

and I think most of us watching would

agree,

that that's still not really great because

your phone is so much more sensitive than

like even your luggage.

Like, okay, sure,

your luggage might have some stuff you

don't necessarily want everybody seeing,

but your phone has your messages,

your photos, your banking apps, you know,

Grindr, like religious apps,

like whatever it is.

Like your phone has so much more data

than your luggage would.

And it's so much easier,

at least in my opinion,

it is so much easier when you're packing

your luggage to... I mean,

even as a real example,

when you're packing your luggage,

you can choose to leave out things that

you don't want to put in there,

but you might still have medication

reminders on your phone or a doctor's app

or something like that.

And it's just... Yeah.

The EFF was basically like,

this is really not the same.

And it's kind of disappointing that

there's no real actual...

Anything.

Again, they don't even need suspicion.

They can just go ahead and say,

here's all the –

Yeah.

I don't know.

I'm tripping over my words,

but I think I've kind of made my

point there.

It's really disappointing, unfortunately.

I will say at the end here,

they did point out that in this particular

case, the search only lasted two minutes,

which means that there's a possibility

that even if it is a manual search,

if it goes on longer,

it could require more time.

a more in-depth search.

So like if this guy took the phone

and just opened photos real quick and saw

CSAM, then it's like, okay,

you're under arrest.

But if he's like sitting there with your

phone for ten minutes,

like reading every single message and

checking your browser history, it's like,

come on, man.

You got to be a little more reasonable.

So I think that's probably the good thing.

But I don't know.

I don't understand how a time limit would

work, but I don't know.

I'd have to look more into that.

I wanted to go back to the reason

that you said Belmont Cardozo was

arrested,

because I think it's an important point to

remember that I think people need to

realize when we talk about cases like

this.

Obviously,

he was arrested in this case for having

CSAM,

which led to his arrest in criminal

prosecution.

And I think...

When we see court cases like this,

what you have to remember is that the

things that are happening in this court

case are almost certainly things that the

government does all the time.

Like,

this isn't the first time that they've

done it and now they're trying it in

court.

This happens and...

If it gets challenged in court,

which a lot of people probably won't even

do in the first place,

but if it does, you know,

if it's not as controversial as this,

where he has CSAM on his phone,

the US government is just going to drop

it because they want these court cases to

create precedent for them to do this sort

of thing in the future.

And so they have to find the most

extreme possible case that they can find

because they want to use, you know,

illegitimate reasons, I think,

to kind of justify this instead of looking

at the letter of the law as it

is right now and realizing that this sort

of search is illegal under the

Constitution,

but they want people to overlook that

because of the nature of the crime in

this case.

I just think that's important for people

to remember because a lot of people do

get outraged about this and they'll see

stories like this and they will say like,

well, yeah,

we want to catch people like that.

But how many, you know,

criminals is the government letting go

before we can get to a court case

like this?

And also,

how many times has the government done

this before it reached any court at all

and before it was challenged?

Probably quite a bit.

They're just invading people's privacy

illegally and often it doesn't

get policed at all so yeah I think

I just wanted to remind people that keep

it in mind when you read stories like

this because I think people get too caught

up in what the crime was instead of

what the government is doing and remember

that we kind of have a duty to

police the police officers and make sure

that this sort of thing isn't happening

and isn't legal yeah because that's my my

main point

I don't know if there's anything else I

wanted to add.

You kind of covered a lot.

Sorry.

I mean,

it's kind of a straightforward story,

but it's I also wanted to include it

because like I said,

this

you know the the rules surrounding phone

searches it feels like they're changing by

the day and it's highly contextual and

dependent on things and so it's the more

information we can get about how to to

or like what's going on what the current

landscape is is helpful and also like both

this story and the previous story about

the border we just did it's another thing

sort of similar to what i was saying

about the government where like the

government is doing these things on the

border specifically

because they know that people get really

mad about border-related issues and will

support things that they otherwise

wouldn't support in any other context.

So that's why I think that's why we

see a lot of very extreme stories like

ones dealing with CSIM and that's why I

think we talk about a lot of border

stories like a disproportionate amount on

this show because that is it kind of

seems like in my opinion where the

government wants to test out a lot of

these privacy invasive things first before

we see them

get that out on the streets everywhere in

America.

I think that, I mean,

really like the stuff we were talking

about on the border in terms of

surveillance towers,

that's the sort of thing that they wanted

to test on the border.

And now we see flock cameras on every

street corner in America.

It's just, it's kind of a pared down

cheaper version of all of that

surveillance stuff but it's more

ubiquitous and it's not about protecting

the border it's about surveilling american

citizens um and everywhere they go and

what they're doing so yeah you just gotta

keep all of that in mind it's all

like this has more impact than just like

the specific thing that we're looking at

right now you um you may have heard

of this but it does not get as

much attention as his other phrase and

shitification but uh have you heard of

corey doctor's shitty tech adoption curve

No, I have not heard that.

It's basically what you're arguing.

Do you remember that that winter soldier

drone that Baltimore tried to roll out

like sometime shortly after lockdown,

I think?

Yeah, I believe so.

Yeah.

For those who maybe missed that story,

basically Baltimore,

the city of Baltimore,

I think it was Baltimore,

wanted to fly a surveillance drone like

twenty four seven in the sky that would

just record all the time.

And, you know,

civil rights groups fought back and they

were like, this is surveillance.

This is illegal.

This is a violation of the Fourth

Amendment.

And real quick, I thought it was funny.

They tried to argue.

It's like, well,

it's not really twenty four seven

surveillance because we still have to land

it for a couple hours a night to

refill.

it and stuff so technically it doesn't get

and thankfully the government was like no

this is illegal you can't do this so

they weren't allowed to do it but um

somebody pointed out that that technology

began in afghanistan like it was literally

a modified version of the predator drones

the same surveillance drone we fly around

in war zones and uh cory doctorow coined

this term called the shitty tech adoption

curve which is exactly what you're saying

is like they roll it out in these

situations where unfortunately people

aren't really paying attention in like

wars and prisons and places like that

where it's it's easier for people to

ignore it.

And then they kind of use that as

a testing ground to hone the technology

before rolling it out to surveil the rest

of us.

And unfortunately, ever since I read that,

I see it everywhere.

Corey was very, very right about that.

But yeah,

that's that's basically what you were

describing.

So I know I can never have an

original thought.

Corey's had all of this.

Corey has all of the thoughts.

He is so smart.

I mean, yeah.

None of us can compete with him.

I think before we dive into the next

story,

I think we had another forum post we

wanted to look at,

and I think this one actually came from

you.

about the FCC comment yeah trying to pull

it up again yeah I did just want

to highlight this uh really quick the we

we I think we did you talk about

it on the show I don't think I

was on but I'm sure in one episode

it came up um I think we gave

it a brief mention because this does ring

a bell

The FCC is proposing a plan to require

government ID, your physical address,

and an alternative phone number for every

phone line in the US.

So yeah,

if you sign up for a new phone

line,

you're not going to be able to get

it as anonymously as you currently can.

We've talked about a number of ways to

get phone lines anonymously here on the

channel, and I'm not really sure how...

any of those methods would really survive

a rule change like this.

The deadline to comment on these proposals

is July twenty-fifth,

and so if you are an American,

I think it is really important to submit

a comment to the FCC about this because

they will take this into account in these

hearings,

especially genuine

Personal accounts are going to be very

compelling in terms of pushing back

against this.

Don't just submit an AI-generated comment.

But you can go to this form post

that I've stickied it on the form,

so you should be able to find it

because I have a link to where you

can file an express comment.

And the two docket numbers that you're

going to enter in the top field of

that,

you're going to enter

And just submit a comment for both of

those.

You can do both of them on the

same form, so it's very easy to do.

And I think it's very important that this

sort of thing doesn't get passed,

so hopefully you can speak out about it.

There are some comments in this

forum thread that we could address here.

Expert-FortyEightSeventy asked if KYC

would help with spam.

And the answer is no.

None of this is going to help with

spam in any way.

Because this isn't the reason that spam

calls exist.

Spam calls currently mainly exist due to

technical failings of these telecom

providers and there are systems in place

or they could make systems that would

prevent

Pretty much all of this stuff from

happening,

they just choose not to do it for

a variety of reasons.

But there are different authentication

protocols,

and there are technical ways that they

could just prevent cell phone number

spoofing, which would be a huge...

improvement um that that they're not doing

and it's not clear to me uh how

kyc is going to help this because all

of those exploits and flaws in the current

telecom system will still exist for

spammers to take advantage of however this

is going to make it much much harder

for regular people to get phone lines

which are pretty much mandatory given how

many services require a phone number

nowadays so yeah this is this is

definitely not the solution um

All of the expert opinions that I've seen

on this and all of the people in

the telecom space that I've talked to have

no idea how this is going to improve

the spam situation either,

because it's not.

But yeah.

And also, as Kerry just pointed out,

it doesn't prevent offshore phone

accounts.

Yeah.

Like, this really...

I can't even imagine how they are

justifying that this could solve the

problem that they're trying to address

because there are so many ways for all

of that stuff to continue while this

policy is in place to really take away

privacy from Americans.

So just wanted to put that out there.

Check out the forum thread.

I'll leave it in the...

I can leave it in the chat here

if people want to check it out.

But... It's also in the newsletter.

Oh, it'll be in the newsletter.

It's on the site.

You can go to the forum,

discuss.privacyguys.net.

It'll be at the top.

So I think that'll be... Yeah.

Consider it because...

Public opposition and especially like

grassroots opposition does actually have

an impact on these political decisions.

We've talked about that before,

like in the EU with chat control and

like pushing back against that.

And it's the same here where we got

to nip this in the bud before it

happens, because if it happens,

it's going to be so hard to undo

it.

Yeah, I haven't clicked on this link,

but I said the same thing in the

forum that, you know,

that Kerry kind of hinted at, which is,

you know,

a lot of spam callers come from outside

the US.

They spoof US phone numbers.

And somebody replied to me and said that

they quoted this link here.

The commission further proposes to require

voice service providers to implement

measures to ensure that consumers know

which calls originate from outside the US

and to prohibit spoofing of US telephone

numbers for calls that originate from

outside the US.

Again, I didn't click the full link,

but I'm assuming it doesn't say how

they're supposed to do that.

And to me,

this strikes me as one of those things

that it's like,

do you think they don't want to do

that?

Like,

do you think they're not already trying?

Like everyone hates spam.

There's – they already don't want these

spam calls.

Like, I don't know.

It sounds to me like one of those

things where it's just the politicians

that don't understand how to check their

email on their iPhone are telling us just

nerd harder and find a solution.

And it's like this just – yeah,

I don't see how this is supposed to

actually solve anything other than just

creating a bunch of, like,

legal liability that's just going to make

everything worse.

And –

I think the first time we covered this,

we mentioned this is going to kill

whistleblowers, journalists,

which I'm sure the current political

landscape would be thrilled about all

that, domestic abuse survivors.

All these kind of people that have

perfectly legitimate cases for needing a

burner phone are just up a creek now,

and we're not actually going to fix

everything.

We're just going to make everything worse

for everybody.

So yeah,

I need to leave a comment on this

too.

Before we move on to the next story,

I want to grab another question in the

chat here.

VPN question.

If I change my VPN server regularly a

few times a day or more often,

does it strengthen my privacy or not

significantly?

Thanks.

This is really going to depend on who

you want privacy from,

but in general I wouldn't recommend doing

this.

It could possibly make sense to do this

if you're visiting different websites and

you're using one VPN on one website and

a different VPN with a different one,

but if you're just rotating VPNs

constantly and using the same sites,

this is probably going to have little

impact and this

will make you less private on your local

network, for example,

because it's just more fingerprintable.

But when you're doing things that are kind

of out of the norm,

especially manual things and things that

aren't built-in features,

you're pretty much just standing out from

other users who are not doing that.

And so typically it is best for privacy

As a general rule,

to not take things into your own hands

and implement additional security measures

if it hasn't been fully proven that this

is going to improve your privacy in some

way.

I think that's just a good philosophy in

general, which is the less you can do,

the better.

And this sounds like a lot of extra

work for no proven gains.

So yeah, I wouldn't...

I wouldn't do this probably,

but I think that answers that.

Yeah, I just want to add on that,

in general,

I think VPNs are really over-exaggerated

for privacy.

I think somebody commented this during the

Mulvad story too.

And they have a place.

I use a VPN.

I'm sure Jonah does.

Most people do use VPNs because they're

helpful.

But VPNs really only do two things.

They change your IP address.

and aside from okay three things because

they also do the whole encrypted

connection thing if you use i mean most

modern vpns nowadays come with dns based

blockers that block ads and trackers and

malware but um you know the dns based

things they're only going to block known

things right and they're only going to

block dns base so like if you're if

your ads and trackers are being served

from the same place as the website itself

they can't block that without breaking the

website

if it's a, you know,

a new web address, a new domain,

they can't block that cause they don't

know about it yet.

And, um,

As far as the IP address thing,

I'm firmly convinced we don't actually

know how common fingerprinting is because

companies don't really rush to tell the

world.

And those who do are marketing companies,

so they're probably over-exaggerating it

anyways.

But I'm willing to bet that fingerprinting

is extremely common nowadays.

And in the context of fingerprinting,

your IP address is such a small part

of your fingerprint because a lot of

residential places rotate IP addresses

anyways.

And if you're going from your phone to

your computer to the library to the coffee

shop to work,

IP address is just not a very efficient

way to track people.

So VPNs, I'm not anti-VPN,

but I don't think in the context of

privacy, like I'm with Jonah,

I think rotating regularly would just be

so much overkill for so little gain.

And I think you'd be better off just

focusing on

using a good privacy-respecting browser,

using things like uBlock Origin that are

not blocking purely based off block lists,

things like that,

I think are going to get you way,

way more privacy than rotating VPNs.

All righty.

On that note,

I think we're going to move on to

our next story about OpenAI.

This is kind of a big story this

week,

the whole OpenAI and Hugging Face debacle.

Yeah, this is reported by Wired.

OpenAI models escaped containment and

hacked Hugging Face.

Describing the incident as unprecedented,

OpenAI said its AI models broke out of

a sealed testing environment last week and

hacked into Hugging Face's production

system to steal the answers to a test

they were being graded on.

The models,

the publicly available GPT-Five.

Six sole and an unreleased reported me

reportedly more capable one,

were being evaluated on their offensive

hacking skills with the safeguards that

normally block high risk cyber activity

switched off.

They go on to say,

according to OpenAI and Hugging Face,

the models escaped through a package

registry cache proxy software that allows

developers to install outside code without

connecting to the internet.

The proxy was the only component in

OpenAI's isolated testing environment

permitted to reach the outside world.

In normal use,

that reach extends only to public code

repositories.

Rather than stay contained in the sandbox,

the models exploited a zero-day

vulnerability to gain access to the open

internet as they hyper-focused on finding

a solution for the AI cybersecurity

benchmark known as Exploit Gym.

Such experiments involve prompting that

pressures the models to find solutions,

essentially egging them on.

They say that the flaw that the models

exploited was previously unknown,

as would be implied because it's a

zero-day exploit,

but flaws in this kind of software are

not unusual.

Companies have been patching serious

vulnerabilities in artifact repositories

for a decade.

A bug disclosed in twenty twenty four let

anyone who could reach the server ask for

a file by URL and get it,

which would include configuration files,

passwords,

access tokens without logging in.

Others have let attackers take control of

the server itself.

So a lot to unpack there.

I kind of take a little issue with

a lot of these stories about AI and

security and like their capabilities,

because honestly,

like when Anthropix Claude Fable was

banned by the US government,

we talked about that a few weeks ago

when it happened.

And I kind of had a similar opinion

then, which is that like,

all these stories do is really boost the

impression that like these models are

extremely capable and they're totally

worth paying a lot of money for because

look what look what they can do right

um but at the same time uh it

is it is true that they're finding like

zero-day vulnerabilities and they're

discovering

new vulnerabilities that didn't previously

exist,

and there obviously are cybersecurity

implications there.

Yeah, Nate,

I could talk a bit more about this,

but do you have any thoughts,

or was there anything you saw in the

article that I didn't talk about?

Not too many.

I think your take is definitely accurate

that this is kind of a little bit

marketing for these companies.

Like, oh,

look how super powerful our AI model is.

But it does also kind of point out

that...

I think it's one of those,

it's kind of like when Kerry guessed it

on the podcast and he said, like,

you know, this stuff is coming.

Like, regardless of how you feel about AI,

I think there are some impacts here that

are happening regardless of whether you

use it or not.

Because, you know,

I think when we think about agentic AI,

at least me,

I usually think of stories about like, oh,

some morons AI agent went and erased their

entire inbox.

And it's just like, yeah,

what idiot is using these things to begin

with?

But now we're seeing it's like it can

go beyond that, you know,

and it's unfortunate that it's one of

those things where I think it's privacy

people.

We all kind of relate to, you know,

people will be like, well,

if you don't like Google,

just don't use it.

It's like Google Analytics is on seventy

percent of websites.

How am I supposed to just not use

that?

Like, come on, man.

And it's kind of the same thing where

like now they're starting to use these

agents for like pen testing and hacking.

And it's like,

how am I just supposed to not use

it when this is impacting me?

And

Another thing that occurred to me was we

covered a story a couple episodes ago.

I think I forgot to go –

find that episode.

But, um, we,

we covered a story a while back about

how, uh, with the mythos thing,

I think it may have been,

may have been the episode Carrie was on

where, uh, you know,

there were unauthorized users that were

somehow gaining access to mythos.

And I don't think they ever resolved how

that was happening,

whether it was like some kind of insider

giving them access or something,

but it kind of points out that it's

really delusional with all these tech

companies.

You know, it's like, Oh,

only the good guys are going to have

this.

We're only going to sell it to good

guys,

which is definitely what clear view AI

said right before selling it to

authoritarian regimes.

But it's also like,

even if they are acting in good faith,

you

Clearly,

these people are finding access somehow.

I think the last thing I wrote down

here is towards the end of the article,

They talked about how this is really an

infrastructure problem.

Let me see if I can go find

it.

In recent months,

top AI companies have been raising

concerns about the expanding cybersecurity

capabilities of upcoming frontier models

as the platforms increase in both

expertise, creativity,

and agentic autonomous operation.

But researchers emphasize that this is all

the more reason the fundamentals should

still apply.

Where was it?

It was like the last quote that he

made.

I wish,

this is a veteran security engineer and

researcher, Niels Provost.

He says,

I wish the Frontier Lab spent as much

time on teaching the models to write

secure infrastructure as they're spending

on exploiting vulnerabilities.

And it's just kind of showing that whole

like move fast and break things mentality

is still here.

You know,

they're still out there just trying to

make money,

trying to like push out this newest,

shiniest model.

Like you were saying, it's, you know,

like how scary our model is.

And, you know, yeah,

it's just it's unfortunate that we do not

ever seem to learn our lesson.

And we just keep repeating these mistakes.

Well,

and that quote is especially relevant here

because

When I'm reading this, I'm wondering,

how was this vulnerability found?

What was the vulnerability?

And was there a more standard

configuration for this proxy server that

would have prevented them from doing this?

Maybe if they had configured it

differently when they installed it?

Because I would have to imagine OpenAI

probably is just asking AI

to set up this secure environment and to

set up this proxy server.

Like, I'm sure they use AI super heavily.

And so the idea that like, oh,

these models should be taught more about

like doing things securely in the first

place rather than spending so much time

like exploiting vulnerabilities,

which again,

I think is mainly a marketing thing.

It's much more, I guess,

clickbaity to say like OpenAI hacked this

thing versus OpenAI

made security improvements to this open

source software or something like that.

So unfortunately,

I think like a lot of it is

very

attention-driven.

This sort of story creates a lot of

attention for OpenAI.

Obviously, we're talking about it now,

so it's working.

And that attention is the main thing that

these companies need right now,

just to survive.

They're obviously not making money,

so they have to exist on hype and

vibes alone until, in theory,

they can make money.

I don't know if they ever will,

but that's their hope.

So yeah, I mean,

I don't know if I have much more

to say beyond that.

The AI stuff is just nuts to me.

Yeah,

I don't really know if I have any

more to add either.

I agree with you.

It does make me wonder what you were

saying about like,

did they have the AI configure this?

It's yeah.

I mean, if,

if you have the AI spit out code,

you're just going to skim it.

You're not going to sit there and audit

every single line of code.

You're just going to like, yeah,

it looks good.

Let's run it.

And as opposed to like,

if a human wrote the code, I mean,

maybe the human would just by instinct,

write it in a much more secure way,

but since it looks mostly right,

they don't catch it when the AI does

it.

And I don't know.

Yeah,

I just can't imagine like anyone at OpenAI

is really just doing things on their own

anymore.

Like that would be unbelievable to me.

I don't know, man.

They're probably not even like, yeah,

hopefully they're not.

But I would imagine they have not taken

that advice to heart.

Yeah, who knows?

We had one more forum update that we

were going to cover before jumping into

our final story about Apple.

this one was pretty close to my heart.

Is there a point in supporting projects?

I don't know whose turn it is.

Is this my turn?

You can take it.

Do you want to take this one?

Okay.

So yeah,

this person here says that this is

something that's been on their mind for a

little bit.

And basically,

is there a point in supporting small

projects?

And they talked about Session,

for example.

And they say that, you know,

they want to support projects and they're

happy that they exist,

but at the same time,

does it actually matter?

You know,

if you give five dollars a month,

does that help?

And, you know,

they might still go bankrupt or disappear.

How do I know they won't go into

financial trouble?

So on and so forth.

So.

Here's here's my take based on my

experiences

With the new oil,

with surveillance reports,

and a little bit here at Privacy Guides.

Privacy Guides is a little bit different

than what I was doing at those

organizations.

So the first thing that I want to

reiterate that we always say is your

safety comes first.

We don't want you to donate if you're

going to lose your house,

if you're not going to have money for

food or for the baby formula or whatever.

Definitely take care of yourself first.

But if you have...

disposable income,

I think I actually wrote a big,

long response here.

And I mentioned that at New Oil and

Surveillance Report,

depending on when you measure and how,

only one to five percent of people donated

money.

And I've said many,

many times in the past that if half

of the people who visited the new oil

donated a dollar,

I could have been doing privacy full time

years ago.

And so I think a lot of the

time, like, yeah,

if you look at it as an individual,

like donating five dollars, ten dollars,

even one dollar as an individual, yeah,

is really not going to do anything.

But it becomes – it's almost like a

– this is a problem we have with

voting, right,

where a lot of people are like, oh,

my vote doesn't count, and therefore,

forty percent of America doesn't vote.

And it's like those millions of votes

could have potentially changed the outcome

of the election, either – any election,

either way.

And so it's kind of the same issue

in privacy,

where it's like if everybody goes, yeah,

well, my five dollars,

all I have is a dollar.

That doesn't help.

Yes,

but if a thousand people give a dollar

a month –

That's a thousand dollars.

Like it, it adds up.

And so, um, I would encourage people and,

you know, obviously I have incentive,

but I would encourage people that, yeah,

if you do have money donate and,

and there are so many projects out there

for the record,

I know it's kind of impossible to donate

to all of them.

So.

I would recommend starting with the ones

that, like, if this went away tomorrow,

could you live without it?

Like, I use Signal religiously.

I use, well, now I use Fresh Tomato,

but I used to use DDWRT and, like,

NextCloud.

And, like,

these are all things that if they went

away tomorrow, like, yeah,

I'd be kind of screwed.

Yeah.

Things like – or another thing that's

really common is rotating.

This month I'm going to give five dollars

to Signal.

Next month I'm going to give five dollars

to Fresh Tomato.

Next month I'm going to give five dollars

to Cubes, like that kind of thing.

So I don't know.

I just – yeah,

this is really near and dear to my

heart.

It definitely – if you do have a

disposable income,

I strongly encourage people to donate

because it does help.

It adds up.

Even a dollar.

Like I said,

if a thousand people give a dollar,

that's a thousand dollars a month.

I don't know if I can add much

more to that without repeating myself.

Yeah.

It's hard to say.

I think people are bummed when they

support projects that eventually do go

under or can't continue running.

You need a lot of money to do

all of these things,

and some projects tend to get all of

it, and then most of them don't.

But I think the first reply on this

forum thread...

is a pretty good point,

which is they basically said there's a

fairly strong chance that if no one

donates,

then there's going to be fewer projects

available overall.

I guess you're sort of betting on which

ones are going to succeed,

and sometimes you're going to lose those

bets.

But if you can support all of these

projects, the more you do,

the more likely it is that one of

them will

make a big difference.

And I think if nobody is supporting the

small, tiny projects,

then there will never be any new ones,

because it'll just be too hard to get

it off the ground.

I can definitely tell you all for sure

that probably not as many people donate to

PrivacyGuides as you would think,

so we can always use donations as well,

but there's a ton of projects to support.

can't remember if we do this currently i

should look i feel like yeah for for

a lot of our um recommendations on our

site if they have like a donation option

we we have a button to hit where

you that'll link like directly to their

contribution page so you can find like

where to support all the projects that you

use if you search for the tool on

our site so that could be something to

to look into but i definitely would

recommend supporting anything that you use

and just think of it like you know

if you're using it now and you like

it um and you can afford it you

should you should pay for it i think

yeah if it goes away it's a it's

a and if it disappears it's a shame

but then you can just move on to

supporting something else um and hopefully

uh it doesn't go away

I think it's also one thing I wrote

in my comment here is, um, again, it,

this should be disposable income.

Like this should be money that is not

going to, you know,

keep your kid out of college or something.

But, and the example I use is like,

I am, I'm a sugar addict.

I actually,

I finished a Mountain Dew right before we

started recording.

Um, you know, I, I love sugar.

I'm constantly buying like fraps and sodas

and, and, um, all kinds of sugary stuff.

And, um,

Those things cost, you know, two dollars,

five dollars,

depending on what I get and where I'm

at.

And they last me, what,

a couple hours tops.

And then even the high of the sugar

rush eventually goes or not sugar rush.

But, you know,

the dopamine hit of the sugar eventually

goes away, too.

And so it's one of those things where

it's like, yeah,

I'm spending five dollars and it's going

to last me half a day tops.

the reward of that,

whatever word I'm looking for.

And whereas something like this,

it's kind of one of those things where

it's like,

if I knew for sure that skipping one

coffee a month would keep Signal around,

would I do it?

Yeah, absolutely.

And so to me,

it's kind of that same argument.

It's like trying to reframe that attitude

of like,

I can afford to go without one soda

to help this project stay around, I think.

Yeah.

You know, uh,

Carrie said it to the diffusion of

responsibility.

A lot of people assume that other people

are supporting, uh, like you said, it's,

you know, I, I was surprised real quick.

One, one more quick story.

I went to the cubes.

Uh,

what is it like open collective one time

and their annual budget is like,

and I'm like, hold on, what cubes?

There's like seven developers and

literally not a single one of them could

afford to do this full time.

And they put it out an amazing operating

system.

Like they're probably making a lot less

than you think.

So

Yeah,

I was going to point out that exact

same comment from Carrie.

Because that is the case when I talk

to people about privacy guides as well.

Mainly people who are thinking about

donating and they're asking about how

everything works currently.

And I think there's generally surprise

about how much we're getting because they

assume that we would be getting a lot

more, which I think...

is absolutely just a thing.

I didn't know that it had a name,

Diffusion of Responsibility Phenomenon.

So now I know this, thanks to Carrie.

But I think that's absolutely a thing with

a lot of these projects.

It's very easy to assume that somebody

else is supporting them,

so you don't have to.

It's exactly the same as like,

This is classic,

nine-one-one first responder advice,

like you have to be like,

don't just say like,

somebody call nine-one-one,

you have to say like, you,

pink shirt right there,

call nine-one-one right now if you're in

an emergency situation,

because otherwise nobody will do it,

because everyone,

nobody wants to do things.

So I'm telling all of you right now,

you watching this, donate to something.

You with the face.

Yeah.

One more example.

If you go to NT.com slash open,

they share how many customers they have

and how much revenue they only make like

a million dollars a year,

which for a company providing that kind of

infrastructure, it just,

that blew my mind when I read that.

I'm like, that's it.

Like I've historically always worked for

companies that made way more than that.

And they were still small companies.

Like I can't believe NT is running on

such a small budget, but.

I mean,

now you don't work for a company making

more than that.

Yes, that's why I said historically.

This might be the first company I've ever

worked for that makes less than a million

dollars a year.

But just to point out the example, yeah,

like what we were saying is like people

think that they make a lot more money

than they do.

And when I saw that from Ante,

I was like, really?

That's it?

Like, yeah, it's wild.

They're doing a lot for how little they're

making, but...

Anyways, that's all I had on that one.

Terracotta Pie just said, Light,

thanks for the response.

You're certainly welcome.

Again, ask questions, everyone,

in the chat because we will try and

get to them.

In the meantime,

we're going to talk about Apple and how

Apple has finally fixed...

a vulnerability in hide my email after

being shamed by four or four media,

because sometimes that is what it takes.

So we did cover this.

I actually went and looked it up.

We covered this on episode sixty when

Calix OS came back.

It was our second story, it looks like.

So if you want to hear the original

coverage,

you can go back and check that out.

But long story short,

Apple says it is fixed to vulnerability in

their Hide My Email feature,

which let essentially anyone figure out a

user's real email address,

which was supposed to be protected by the

feature.

It's literally your one job.

So they knew about it for about a

year.

And for those who don't know,

hide my email is exactly what it sounds

like.

It's a paid feature and it lets you

create a new masked email address when you

sign up for something that still forwards

to your main email address.

So that way,

if it gets caught up with spam,

you can just turn it off or whatever

and it won't

you won't keep getting spam or they point

out here, uh,

hackers can also have a harder time

cross-referencing your various accounts.

So Tyler Murphy,

co-founder of easy opt-outs,

which is a service we do recommend.

It is a service that I personally have

been using for years and I love it.

Um,

he discovered this vulnerability and tried

to report it to Apple.

Uh,

Apple,

I think if I remember the original story,

Apple started to reply and, you know,

kind of started to work with him and

then just kind of ghosted him and stopped

responding.

And at that point,

Murphy came to four or four,

four or four published a story.

And now the Apple was shamed.

They had to go ahead and respond again.

They said that it was fixed.

And at the time,

four or four was not disclosing how it

worked because, you know, of course,

it's like they haven't fixed it yet.

Anybody can do this.

But now we have some information.

And to put it simply,

it required sending a target and a message

that gets rejected as spam and you

purposely want it to get rejected.

They said,

we don't know how often hidden email

addresses were leaked in email logs.

For many major email hosts,

the leak was triggered simply by an email

being automatically rejected.

Even if it was legitimate,

such emails probably didn't make it to

your inbox.

So you can't review your spam folder to

learn whether you were affected.

which is kind of scary.

But yeah, basically when it got rejected,

the mail transfer logs could contain the

hidden email address,

your original email address,

which would be exposed to the attacker.

I think they have a link to Tyler's

blog post explaining this stuff,

potentially.

I could be wrong about that.

But yeah, I guess that's kind of...

What's going on here now that we know

more about how it works?

Not much of the story,

just kind of a little tiny little bit

of good news to end on.

I want to bring Jonah in to fact

check me on this one.

But I did a little bit of very,

very rudimentary research.

And I think it is potentially possible

that people like SimpleLogin and Addy

might be vulnerable to this,

depending on how they handle spam

rejections.

Do you know anything about that or

anything?

Is that just pure speculation?

There's not a lot of...

There's not a lot of details about how

this works exactly.

I'd have to look more into it.

Because I suppose...

I suppose this is probably more dependent

on how your... Not the aliasing provider,

but how your mailbox provider handles

messages that are sent to spam.

Um...

I would hope that that would get reported

to the aliasing provider instead of the

person who sent it,

which it sounds like is probably the case

with Apple.

But I actually don't know how that works

or how this vulnerability bug works.

It actually is.

If you go to easyoptouts.com,

there's a little banner right at the top

that says CR statement about Apple's hide

my email vulnerability bug.

It is a twenty minute read,

so we probably can't read it here.

But it looks like he does go into

detail.

If you scroll down to the exploit.

So, interesting.

So, yeah, we might look into that.

I'm very... Here,

I'm going to share it while you're looking

at this.

Okay,

it does say that hidden email addresses

were leaked for a variety of mail hosts,

so they saw them not just for iCloud,

which is one thing I was wondering.

I don't really understand why Apple's

servers would do this,

which is probably what EasyOpt does,

and everyone else doesn't understand.

It just doesn't make sense to me.

So I...

doubt this is an issue.

They do say in this post,

there's another email aliasing services

section,

and they tested this vulnerability against

many of the aliasing services on the

market according to them,

and none of them had the same kinds

of vulnerabilities.

I assume at minimum they tested SimpleLuck

and Addi because those are like the two

main ones people typically look at.

Oh,

I see they have a how to tell

if you're affected section here.

Yeah, so I guess you can test it.

I guess we could test it.

But yeah,

I can't imagine why Apple's service would

be configured in that way.

It really does sound like a specific to

Apple problem.

Yeah, I think you're right.

I see the section here now where it

says,

we did limited testing against many of the

major aliasing services on the market,

none of the ones we tested.

And yeah,

SimpleLogin and Addy are definitely two of

the biggest ones.

So at least SimpleLogin, I would imagine,

was probably tested here.

Yeah.

If nothing else,

hopefully now those providers are aware of

this and they can go test themselves and

make sure they're not configured like

this.

Yeah,

it's always a shame that these companies

have to be kind of pressured into fixing

obvious problems,

but at least it's fixed for everyone using

this.

Yeah, yeah, I agree.

I don't know why they have to drag

their feet so much, but.

I digress.

Yeah,

I was going to say the last note

that I had written down here is we

still do recommend services like

SimpleLogin and Addy over Apple because,

for one, they're more transparent.

They're open source.

I think you can even self-host SimpleLogin

for sure, maybe even Addy.

And lack of vendor lock-in.

If one day you wake up and you're

like, you know what?

I'm going to move to Graphene.

Guess what?

You're not locked into Apple if you go

with something like SimpleLogin.

Yeah.

yeah um but that's i think all i

had yeah taken what maybe a maybe a

look at our final chats here uh

In Signal,

somebody commented about the FCC thing.

I'm also informed in our Signal chat just

during the show, speaking of donations,

that Cape has sent a donation to Privacy

Guides.

I don't know anything about that,

but I'll have to look into that.

But thank you to Cape for donating.

Hopefully, we get other donations too.

But yeah,

I will have to check into that after

the show.

Yeah, thank you.

Like I said, every little bit adds up.

It really does.

Even if it's just a dollar a month.

Years ago, last time I checked,

you guys used to have the Umami Analytics

on the website publicly.

And I remember checking one time out of

curiosity,

and it was literally like a hundred

thousand visitors a month.

And it's like literally if half that

number gave a dollar a month,

I'm sure that would go so far.

That'd be sweet.

If all of them did,

then we'd finally be that million-dollar

revenue.

Yeah,

we don't need nearly that much money,

but we could.

There's definitely improvements that could

be made.

I think I just wanted to,

now that you mentioned it,

kind of look at our stats on the

form, and I think we get...

I mean, we get millions of page views.

I don't know if I can see how

many individual people visit,

but whatever.

And that's another thing I think about a

lot too is like, you know, with Umami,

it's like,

it's kind of privacy respecting analytics.

So it's like,

how many of those are individual and how

many of those just have a different

fingerprint now?

Cause their browser or whatever.

So yeah, it's hard to say for sure,

but I mean, it's still a lot.

So that's why you track visits and page

views.

We did get a question just now from

username five, nine, five, four, nine.

There are a few offline privacy focused

navigation apps,

but none seem to have a good interface.

Do you think it is important to stay

away from Google maps or is the privacy

concern insignificant?

I mean, in my opinion, I think the,

the,

I would still have one of those as

a backup in case you ever lose signal

or something like that,

which I've been in those situations where

just the cell signal is not very good

and I'm kind of screwed.

But from a privacy perspective,

if I'm being honest,

I think it really depends on where you're

going and how often.

If you know how to get around town

and you're only ever using Google Maps

once a month or once every other month

when you're going somewhere new, then...

it's probably not that big a deal.

And especially if you're just like, Oh,

I'm checking out a new restaurant or

something.

But if you're using it like constantly,

like I used to use it at my

last job.

Um,

I was constantly working on different job

sites and because we were on the clock

and we were usually going there during

rush hour,

I was constantly trying to find the

fastest route.

So I really relied on mostly Apple maps

cause I had an iPhone at the time.

And, uh, you know,

but I was using it like every day,

all the time to get to and from

places just to, to skip traffic.

And that was probably not great for

privacy, but you know,

I was on the clock.

What am I going to do?

So I don't know.

That's, that's kind of my take.

I think it depends on how often you're

using it and what for.

So your answer is kind of like,

how much do you want to be tracked

by them?

I mean, pretty much.

Yeah.

Yeah.

That is kind of what it comes down

to, isn't it?

But yeah.

Do you satisfy your curiosity about the

analytics?

It's kind of complicated.

We had a weird spike spike in visitors

on the sixteenth for some reason.

I wonder why that was.

Dude, I get the same thing on mine.

I'm really genuinely convinced it might be

like a scraping because it'll literally go

from like a couple hundred visitors a day

to like ten thousand visitors at four a.m.

on a Tuesday.

And then it'll drop back down and it's

just like something fishy is going on

there.

What did we do on the sixteenth of...

I mean, the weird thing is it stayed...

That was the peak,

but it stayed pretty high for the week

following that on this graph.

I have no idea why that would be.

I don't have a calendar open in front

of me, so that is a good question.

Anyways...

I think we want to close this out,

or you got anything else you want to

add?

I'm not seeing anything on Signal or the

form, so...

Did you see the news about Codeburg

banning cryptocurrency projects?

I skimmed it briefly.

I saw the forum post about it and

something about, you said it was,

what was your wording?

It was extraordinarily poorly worded.

Well, I just don't understand it.

I guess I don't have much to say

about it,

but it seems like they're saying two

different things.

And it doesn't really make a lot of

sense to me,

but just a weird thing I've saw in

the forum lately.

Is it just,

they're basically just bamming scammy

crypto products?

Well, yeah, I mean,

like in this banner at the top of

their page,

they just say cryptocurrency projects are

no longer allowed.

And that's also what it says on their

terms of service.

But then like in a random comment on

this thread about the change,

they explain that it's only scammy ones,

which is not what it says.

But I guess if you go down and

read this random comment,

you would know which ones are allowed and

which ones aren't.

Interesting.

I wonder if it's one of the,

what do they call that,

like a silent policy?

Yeah, I mean,

it feels like it'll just be enforced

probably arbitrarily,

which is probably not how I would prefer

the services that I use operate.

Codeburg kind of annoys me sometimes.

It's one of the reasons I don't want

to switch to it.

I know people ask us that all the

time,

and I don't really like Codeburg or GitLab

or

more than i mean i i like him

like just a little more than github but

not enough to switch off of github but

i do like codebook software i i would

love for joe to get to the point

where we could we could switch to it

but i really wish it had federation and

they have and that's taking a really long

time so sadly i don't know i mean

can't complain about it too much i don't

know how to speed it up so but

it it just is

I'm sure that ActivityPub is not

necessarily perfect for everything,

but I do really like the idea of

so many different services being

ActivityPub compatible because then you've

got this ideal scenario where it's like,

I can comment on YouTube, Instagram,

Twitter, GitHub,

all these different things from one

account.

And I don't need to keep making accounts

if I don't want to.

And that is probably one of my favorite

things about the Fediverse.

Yeah.

And it's like,

I hope they can do it soon.

It feels like it actually wouldn't be that

complicated for this use case because Git

is already decentralized.

So you pretty much only have to federate

issues and stars and pull requests is

probably the hardest one,

but Git already has...

ways to work on things remotely and on

different branches and you can just pull

it in from a different site so it

feels like it wouldn't be extraordinarily

difficult like it's basically just

comments and reactions is the main thing

which is which is already done by every

single activity pub platform out there

that's that's how they work it's comments

and posts right um

But I mean, I'm obviously not coding it,

so I can't provide too much input or

complain about it too much.

Because I'm not going to do it myself,

I can tell you that.

Fair enough.

I think that's kind of it then.

So yeah,

I think you can wrap it up.

Nate, you're muted.

I hit the button too many times.

My bad.

All right.

All the updates from this week in privacy

will be shared on the blog every week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

For people who prefer audio,

we also offer a podcast available on all

platforms and RSS.

And this video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that focuses on building a

strong advocacy community and delivering

the best digital privacy and consumer

technology rights advice on the internet.

If you want to support our mission,

then you can make a donation on our

website, privacyguides.org.

To make a donation,

you can click the red heart icon located

in the top right corner of the page.

You could also just go to

privacyguides.org slash donate and you can

contribute using standard fiat currency

via debit or credit card or opt to

donate anonymously using Monero or your

favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content,

priority during the live stream Q&A.

You'll also get a cool badge on your

profile in the forum and the warm fuzzy

feeling of supporting independent media.

So thank you all for watching and we'll

see you next week.