Gunther's Guides & More

Resources & Recommendations

Mon, 03 Jul 2023 12:00:00 +0000

This is a list of things I like. Don’t look too deeply into what is/isn’t included here, it’s just a list of things I like and think are cool, with a slight bias toward things I think should be more popular than they are. Presented in no particular order.

Guides/Educational - Blogs - Video Content - Podcasts - Web Apps/Services - Software - Books/Authors

Guides/Educational

Privacy Guides: Probably the best overall guide to digital privacy. Includes an excellent list of recommendations for privacy-friendly software and services.

The New Oil: Nice additional digital privacy resource. Includes lots of good guides, a blog, and video content as well. Strikes a nice balance between technicality and accessibility.

3ds.hacks.guide: The definitive guide for installing custom firmware on your Nintendo 3DS system. Includes a ton of great resources and is actively maintained and kept up to date.

NH Switch Guide: Basically the same, but for the Nintendo Switch.

Blogs

Astral Codex 10: Thoughtful and well-written blog posts on a wide array of subjects. Posts are always well researched and well thought out. I often come away with new perspectives after reading.

Krebs on Security: Mostly a news blog highlighting current cybersecurity happenings. Also has some more in-depth reporting as well as some good guides and advice.

Drew Devault’s Blog: He has recently taken a step back from blogging, but there is a great archive here of posts on various FOSS-related topics. Some are a bit technical and over my head, while others are very accessible and relevant to everyone.

Dhole Moments (Soatok’s Blog): Soatok has a talent for taking complex cryptography concepts and explaining them relatively simply. Includes furry content and general software security content as well.

Video Content

Techlore: Probably the best YouTube channel focusing on digital privacy. Entertaining videos and solid information.

Side of Burritos: Josh’s videos aren’t very flashy, but they’re well-researched and interesting. Focus is generally on digital security, often GrapheneOS and Android specifically.

Defunctland: Defunctland focuses on the history of defunct theme park attractions and TV shows. All of his videos are good, but his Fastpass documentary in particular is nothing short of incredible.

Jenny Nicholson: Jenny makes videos on various fandom-related topics, often with hours-long deep dives. Her videos always funny or fascinating, and usually both.

Podcasts

Surveillance Report: Great weekly roundup of cybersecurity and digital privacy news from Henry of Techlore and Nathan of The New Oil.

Firewalls Don’t Stop Dragons: Switches off between cybersecurity news and interviews. Can be a bit lengthy, but lots of really great content.

Darknet Diaries: “True stories from the dark side of the internet.” It’s good, give it a listen.

Wolf 359: Excellent serialized sci-fi fiction podcast that concluded a little while back. It has amazing writing and an excellent cast.

Web Apps/Services

Pretty much all of the below are FOSS and self-hostable.

Vikunja: Excellent task management and productivity tool.

Mastodon: Federated microblogging social media service. I wrote a whole post about Mastodon and the Fediverse as a whole and why it’s all so great.

Jellyfin: A way to host your own streaming media server. Definitely some room for improvement, but a really impressive and useful piece of software.

Tiny Tiny RSS: It’s an RSS reader. Not too complex, but does its job well. Also has a great Android app in addition to the browser interface.

Bitwarden: I’m not sure how people get by in the modern world without a password manager. While not perfect, Bitwarden is one of the best and has a very generous free plan.

AnonAddy: Email aliasing/forwarding service. SimpleLogin is also quite good, but AnonAddy has a much better pricing structure.

Standard Notes: End-to-end encrypted note-taking app. Simple, but works well and has a good free option.

Libreddit: Frontend for Reddit. Pretty good UI, much less bloated than the official Reddit interface, and no account or app required to browse, even on mobile.

Software

Atmosphere: Custom firmware for the Nintendo Switch. The developer’s knowledge of reverse-engineering video game console firmware is very impressive and Atmosphere is a very cool piece of software.

Luma3DS: Custom firmware for the Nintendo 3DS. Not quite as seamless as Atmosphere, but still very cool and impressive.

GrapheneOS: Custom Android OS for Google Pixel phones. It improves security and privacy substantially over stock Android, with Google Play services being entirely optional. I write more in-depth about it in this post.

Restic: Encrypted backup software for Windows, Linux/BSD, and Mac. Compatible with local storage and a variety of cloud storage services.

NewPipe: An Android app which allows you to watch YouTube videos without ads as well as follow a local list of subscribed channels.

Aegis: TOTP 2FA app for Android. Nothing fancy, but works very well.

Obtainium: An Android app which pulls Android app updates directly from the developer’s Github, Gitlab repo or website. Excellent alternative to traditional app stores.

Signal: End-to-end encrypted messenger. Probably strikes the best balance between security, privacy, features, and polish of any secure messenger.

Syncthing: A simple and elegant solution to a ubiquitous problem: how to easily and securely sync data between devices. No server required.

Books/Authors

Brandon Sanderson: Probably the best fantasy author writing today. If you at all enjoy fantasy novels, you owe it to yourself to read his books.

Naomi Novick: Another excellent contemporary fantasy author. Definitely worth a look.

The Righteous Mind: An exploration of the moral underpinnings of various political outlooks (mostly U.S.-focused). A good read if you want to try and understand why seemingly good people can have such different religious and political views.

The Checklist Manifesto: Excellent overview of a simple, yet powerful tool: the checklist. Possibly the most interesting book I’ve ever read if measured against how boring the book’s title sounded.

Being Mortal: By the same author, a thoughtful work on end-of-life medical issues. A somewhat morbid read, but also a really important one.

Superintelligence: A very persuasive argument on the dangers of superintelligent AI.

The Emperor of All Maladies: A fascinating and somewhat terrifying look at the history of cancer.

Worm: A very long online serialized work of fiction. Excellent world building and was one of the earlier “dark” superhero narratives. No official e-book is available, but there is a fan-made ebook scraper tool you can use.

The Expanse: My favorite contemporary science fiction series. Excellent plot, deep characters, and a novel take on humanity reaching beyond Earth.

The Internet as We Know It Is Dying

Mon, 03 Jul 2023 12:00:00 +0000

This screenshot basically sums up “the internet as we know it”.

For the past decade or so the social internet has consisted of a handful of websites that the vast majority of people frequented. The list isn’t just limited to 5 websites, and the websites themselves have changed over time, but include or have included sites like: Facebook, Twitter, Reddit, YouTube, Instagram, and others. I’m deliberately excluding e-commerce sites and search engines from this list, though those have also been quite popular, they deserve their own discussions. Unlike the early days of the internet (“the internet as it was”), where there were forums with their own web domain dedicated to particular topics, and people had their own websites and blogs, the internet as we know it had a plurality, if not a majority, of its original content confined to one of a few sites.

This has been bemoaned by free web activists for a long time, but most of us, including myself, were happy with it. Why wouldn’t we be? These social websites provided tons of excellent content, made it easy to follow creators who produced that content as well as connect with friends and family over long distances and have conversations. Before Facebook, there was basically no normal way to connect with someone who you knew but hadn’t seen in a while. Sure, you could ask around and try to find their number to call them, maybe send them an email, but what would you even talk about? Sites like Facebook allowed people to not only reach out to people they had lost touch with, but get updates on what was going on in their lives to make it feel as though they were still close.

Similarly, sites like Reddit provided communities that had high-quality discussions of nearly any topic under the sun, while Twitter allowed nearly anyone to follow stream-of-consciousness communications from celebrities, as well as breaking news from journalists, and memes and other fun things from their friends and favorite internet creators.

Sure, most people only visited this handful of sites, but did you really need more? Each of these sites was produced by a big tech company with a huge budget; they were relatively easy to use, they were polished, and they were free. Sure, there were ads on a lot of them, but that was a small price to pay compared to the value you were getting, and if you really cared that much, you could always just install an ad blocker.

So why am I speaking about all this in the past tense? Isn’t this still the state of the internet today? Arguably, yes, but this status quo does appear to be changing quickly. In a blog post back in January, Cory Doctorow described the method by which internet platform die, which he dubbed “enshittification”, quite well.

Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.

We are familiar with this process from Facebook, which is full of ads and sponsored posts, and offers up no content on your home timeline other than what Facebook’s algorithm wants you to see. And indeed, Facebook isn’t doing too well based on their user numbers. And anecdotal evidence says that even those who have accounts aren’t using them as much as they once did. Perhaps it’s too early to say, but it sure seems like Facebook dying.

And other platforms we think of as mainstays of the internet as lining up behind them. After being acquired by Elon Musk, Twitter decided to sell the verified “blue checkmark”, which previously marked as an account as a genuine and noteworthy one, to anyone who would pay a monthly subscription, along with many other controversial changes. They also decided to start charging outrageous prices for their previously free API, killing off many Twitter bots and apps in the process. And as I’m writing this, Twitter has decided that you cannot view Tweets anymore without an account, and that even account-holders are limited to a certain number of Tweets per day they’re allowed to view (with paid subscribers being allowed to see more than the free users).

Not to be outdone, Reddit also recently decided to start charging for their API, sparking the announcement from multiple popular apps that it will not be financially feasible for them to keep their services running. In response, the moderators of many Reddit communities decided to take make their subreddits private for 48 hours, with many extending this to be indefinite after Reddit refused to back down, and others using other creative ways of protesting while avoiding being the victim of Reddit’s threat to take the control of the subreddits away from the moderators unless they reopen.

Right now, Reddit is not backing down and it seems like they will survive the protests. But the good will of their community is not so easily regained. Reddit and other platforms like Discord have carefully cultivated their image to have a fun and friendly demeanor with cute mascots and a nerdy charm. But at the end of the day, profit is what drives these companies, and Reddit preparing for their IPO is almost certainly driving the decisions being made now. Neither Twitter nor Reddit are profitable and it seems the market’s patience for the stage of their development where they gain users, popularity, and influence has grown thin. Even well-established companies like Google seem to be feeling the pressure as they make moves to limit YouTube access for users using ad blockers. The internet as we know it is looking less and less familiar, and not in a good way.

So what’s next for the internet? If the internet as we know it is dying, what will rise from its ashes? One possibility is that the internet as we know it won’t leave, it will just get worse. People will continue to stay on the same old websites even as these websites get objectively worse and squeeze us for more of our cash. Competitors will crop up, and perhaps the list of big websites will see some turnover, but ultimately the pattern won’t change much and these big web platforms will continue putting profit over their users. If this happens, people will probably use the internet less, or at least in a much more passive way than they did previously. Perhaps this won’t be so bad though, as we’ll all finally have an excuse to touch some grass.

Of course, there are more optimistic possibilities. I’ve already written about how the Fediverse and ActivityPub are an excellent example of what a decentralized social media could be. But perhaps the future will look like something different entirely. While the return of a decentralized web sounds like an enticing possibility, with search engines becoming dominated by AI summarizers summarizing AI-generated content, finding relevant content may prove more challenging than ever. But the internet is nothing if not innovative, and perhaps there will be new ways to discover niche blogs and websites, or perhaps recommendations will simply spread by word of mouth. These options may see a future internet with less polish and smaller budgets than the internet as we know it, but they will almost certainly be more user-centric. I’m no fortune teller, so I can’t say where the internet will go from here, but I can say that a shift is definitely taking place. For those who care about what the internet becomes, it would be wise to watch what happens next.

Exploring Reddit Alternatives

Sun, 18 Jun 2023 12:00:00 +0000

If you haven’t heard, there’s a bit of an incident going on at Reddit right now. In its wake, potential alternatives to Reddit are booming. I’ve tried out a bunch of them, and I’ll be giving you my thoughts on each.

Lemmy

I’ve had a Lemmy account (@gunther@lemmy.ml) for well over a year and I mod a small (and honestly, pretty inactive) community there, so I know the platform fairly well. The UI resembles “old Reddit” pretty closely, being fairly simple with the home page showing a feed of posts with upvote and downvote buttons on one side along with a small link or image preview on the other. Lemmy is open-source and federated using ActivityPub, making it part of the larger Fediverse. These are both points in its favor.

However, Lemmy has pretty basic features either missing or not implemented as fully as one would hope. There are no 2FA options to secure your account, no real privacy options, no way to migrate your account or export your account data, and no way to tag posts beyond specifying a community (Lemmy’s version of a subreddit) to post them to. Additionally, the UI can be a little clunky and unintuitive. As of this writing, new posts often appear at the top of my feed and can shift away or close the preview of the post I’m currently looking at. There is no way to turn off this autoloading feature as far as I can tell. Lemmy’s mod tools are also pretty basic, which will become only more of a problem as the platform continues to grow in popularity. Even now, one of the older and better-known Lemmy instances, Beehaw, has defederated from some of the new and growing Lemmy instances since they say federating with them makes moderating impractical. Additionally, Lemmy’s tools for discovering new communities are pretty basic. The search function never worked terribly well for me for this purpose and there are minimal sorting options on the “Explore Communities” page.

There’s also been a bit of controversy about the Lemmy developers’ political stances, with lemmygrad.ml being a openly pro-Communist instance, which has lots of pro-Russia and pro-China content on it. While lemmygrad is not the flagship instance of Lemmy (lemmy.ml is), lemmy.ml does federate with lemmygrad and lemmy.ml also tolerates similar content on their instance. As it stands, Lemmy is a decent Reddit clone, which as FOSS and part of the Fediverse can be hosted by anyone. However, its feature set has a lot of growing to do before it can be the new home to all the former Reddit users.

Kbin

Kbin is the other Reddit-like platform on the Fediverse, which means that like Lemmy, it is open-source and federated. It is really neat that communities from Lemmy can be subscribed to from a Kbin account and magazines (Kbin’s version of subreddits) can be subscribed to from a Lemmy account. Kbin itself also has a pretty minimalist interface, but it seems much more deliberate and clean than Lemmy’s. The homepage is sleek, and like Lemmy has a feed of posts with upvote and downvote buttons along with a link/image preview next to each post. Kbin also has no 2FA options, though there are a few privacy toggles and more customization for your account overall compared to Lemmy. While Kbin’s general feature set and moderation features in particular are also lacking, Kbin is newer than Lemmy, which gives some more hope that these features will be developed in a reasonable time frame.

However, Kbin’s federation features feel much more “tacked on” when compared to Lemmy’s. There is no way to explore magazines outside of your instance and when posts from other instances appear on your feed, there’s no real indication that they are from a different instance at all. These are issues that will definitely have to be fixed if Kbin wants to make full use of its ActivityPub federation, which is one of its best features! I’m definitely going to keep a close eye on Kbin and I hope it can grow into a true federated version of Reddit, but as it stands currently, it’s not quite there yet.

Tildes

Tildes is not part of the Fediverse, but it is open-source, not-for-profit, and committed to user privacy, so I have little reservation recommending it from that perspective. Tildes is also currently invite-only, and while that does make it a little harder to get in, it also seems to have succeeded in its goal of keeping the quality of discussion high. While invites aren’t particularly hard to find, adding even the little bit of friction to the sign up process does the job of deterring spammers, low-effort posters, and other bad actors. I got my invite by just asking someone on Mastodon who had posted with the #tildes tag saying they had invites, and while I’m too new of a user to have any invites to give out right now, feel free to reach out in the future if you’re looking for one.

Tildes’ UI is very minimalist and stylish, though perhaps a bit too minimalist for my taste. The goal seems to be a focus on text content rather than images, which is laudable, but also a bit more boring. However, as I said, the quality of the discussion on Tildes is high, so they seem to be doing something right. There is also no way to create new groups (Tildes’ version of subreddits) and all posts must be posted to one of the existing groups, though most popular topics are covered and tags can be added to your post to give some more topic specificity. Given all that, Tildes can’t really be considered a full-on Reddit replacement, but it is a really nice place, and may be exactly what many former Reddit users are looking for.

Squabbles

I just joined Squabbles recently and I can’t help but like it. I say “can’t help” because unlike all of the other platforms I’ve spoken about, Squabbles is not open-source and seems to simply be a new, centralized platform hoping to get some of Reddit’s migrating users. That said, Squabbles looks really nice. It has a colorful, yet plain design and is pleasant to scroll through. Squabbles’ feed design makes posts with pictures easy to see and also shows comments in a second column next to the posts in the feed. I have mixed feelings about that second feature since Squabbles’ lack of spoiler tags already led me to having a new episode of an anime I’ve been watching mildly spoiled. Squabbles describes itself as “combin[ing] the best parts of Twitter with the best parts of Reddit.” I think the idea is that like Twitter and unlike Reddit, individual users are easier to identify and follow, though this honestly isn’t too noticeable and seems more or less on par with how Reddit currently handles this.

Squabbles has lots of communities on a variety of topics (I started the Fediverse community) and so far the content being posted seems pretty decent. It definitely felt most like Reddit among the options I’ve tried to far. I’m in the somewhat complicated position of not really wanting to recommend Squabbles because I don’t think it fixes the core problems Reddit has, but also finding it hard not to because it’s a pretty well-done site that is closer to a Reddit experience than Tildes and less chaotic and more polished than Lemmy or Kbin. Squabbles also definitely has a pretty basic feature set, but it’s already doing a lot right.

Conclusion

For the adventurous types out there, I would encourage making an account on Kbin or Lemmy, just be sure to keep in mind their limitations. For those looking for a smaller, tech-savvy community more focused on text and discussion, Tildes is a great choice. If you’re simply looking for something that’s like Reddit, but isn’t actually Reddit, you could do worse than Squabbles, though if you’re trying to move away from centralized, for-profit platforms, I can’t really recommend it.

A Philosophy of Cheat Codes

Sun, 11 Jun 2023 14:00:00 +0000

⇧⇧⇩⇩⇦⇨⇦⇨ⒷⒶ

Cheating in video games is a time-honored tradition. As a kid, I would scour the early internet for websites that would list cheat codes I could use on my collection on PS1 games. Some games had no cheat codes and others allowed you to unlock secret characters, get unlimited extra lives, and get other cool perks just by entering the right sequence of buttons at the start up screen.

Of course, cheating isn’t limited to codes that are built into the game by the developers. A variety of 3rd party cheat software exists to help enable cheating in ways the game developers never intended. “Game Shark” and other similar brands of cheat cartridges were whole pieces of hardware that people would pay for just to allow them to cheat in games.

Nowadays, the world of cheating in video games looks very different than it did when I was a kid. The advent of high speed internet means that many of the most popular games are played competitively online and there is a constant arms race between game developers who are trying to keep their online games fair and cheat developers who are trying to make sure that enterprising players can have advantages over their opponents. This has gotten to the point where providing cheats for online games has in fact become quite the lucrative business.

But leaving aside the online aspect for now, what exactly is the point of cheating? I faced this question recently when I used my hacked Nintendo Switch to do some save editing on a Pokemon game. I had basically full control over the save file. I could edit Pokemon, add new Pokemon, even adjust the flags in the save file to trick the game into thinking I had already beaten it. With a few clicks, I could have a save file where I had beaten the game and had a full Pokedex, including all shiny Pokemon. But what would be the point of tricking a computer into thinking I had beaten the game? Beating a video game is not inherently valuable, it’s only as valuable as it makes you feel good about yourself or perhaps for the social clout of being able to tell your friends that you beat the game.

So perhaps this is obvious to some, but only after thinking it over did I realize: the point of cheating in video games is to have fun. If it’s fun for you to use a save editor to fill your PC in a Pokemon game with every shiny Pokemon, then go for it! If that sounds pointless to you, then don’t bother. For me, I decided that I still wanted the experience of beating the game myself, but I allowed myself a few shortcuts. Basically, I decided that while searching for and catching Pokemon, as well as battling the tough enemies was fun, grinding to get my Pokemon to higher levels or to get more money was not. So I gave myself unlimited money and enough rare candies to level up my Pokemon to a point where I felt the final boss would pose a good challenge. I could have spent hours grinding to reach the same point instead, but I decided that cheating would be more fun. The same principle applies to other games as well. If you think playing a Mario game would be more fun while invincible, then use that cheat code! If that sounds less fun to you, give it a pass. But maybe you would find the game more fun and less tedious if you had infinite lives? In that case, use a cheat code for that instead!

A game developer’s job is to make a game balanced between hard enough that it’s challenging but easy enough that it isn’t frustrating. Sometimes, developers miss the mark. Other times, variance among individual gamers means that what’s fun for one person is too hard or too easy for another. This is where cheat codes can be used to make a game more fun. There’s no reason why the developer’s idea of fun should trump the player’s. Even if you feel that third party cheats are never justified, what about the glitches such as those that speed runners rely on to finish the game faster than the developers intended? Some would call those unfair since they aren’t an intended part of the game, while others would insist it is part of the game as it was released and therefore perfectly fine to use. In fact, one of the most popular competitive techniques in Super Smash Bros. Melee, wavedashing, was technically a glitch. At the end of the day, the only universal principle is what each individual gamer feels will make the game more fun for them.

Even in multiplayer games, the same basic principles apply. The difference is that all players have to agree. This is why, as a rule of thumb, you shouldn’t cheat in online games. Everyone playing the game has agreed to the rules that the developers have set. Without the consent of everyone playing with you online, it would be unfair to use cheats to change these rules. If you can get a private game going where everyone has agreed that use of certain cheats is acceptable, then the story would be different. Absent that, perhaps an argument can be made that cheat codes could be used to give yourself advantages that other rule-abiding players have, such as special items that are locked behind a paywall. Of course, this leads to a whole mess of other ethical and practical questions about stealing, modifying software in ways that violate the terms of use, and other thorny issues, but let’s stick to the issue of cheating here.

Going back to Pokemon, an interesting example of community consensus deciding what cheats are acceptable is the rules regarding “hacked” Pokemon on various Pokemon trading forums. The PokemonTrades subreddit has a very in-depth policy of what Pokemon can and cannot be traded. Some of these rules are not very intuitive. For instance, clones of legally obtained Pokemon may not be traded, but Pokemon hatched from eggs where one of the parents is an illegal Pokemon may be traded. There is a logic to each of these rules, but ultimately, they are the product of community consensus about what will make trading Pokemon more fun for the community as a whole.

So if you ever engage with the time-honored gaming tradition that is cheating, I hope you will remember this: Cheating is about making the game more fun, not just for you, but for anyone else you may be playing with. That said, cheat responsibly, and have fun!

The Internet is Not Forever

Mon, 13 Feb 2023 19:30:00 +0000

Since I was a young, I was told, “be careful what you post on the internet, the internet is forever.” Despite this, I know I’m not the first person to realize that it just isn’t true. Even a quick internet search for the title of this blog post yielded some articles that already document this epiphany. Nevertheless, I feel like it’s worth saying again since the idea that anything on the internet is permanent is just so ingrained in our minds (or at least in my mind) that it will take more than one blog post to shake it out. When I was a kid in elementary school computer class, we were constantly told to click on the little floppy disk often in order to save our work. Of course, even clicking on the floppy disk wasn’t always foolproof. Changes accidentally got overwritten, storage drives got lost, or computers just broke, bringing all of their contents with them into computer heaven (or computer hell, depending on your search history). As time and technology progressed, we were introduced to the advancement that would save us from such pesky physical limitations: the cloud! Back up your files to the cloud and no one could delete them, even smashing your PC to bits would do nothing to damage your data, since it lives on the internet. Of course, the internet isn’t a place, it’s a method of communication. As tech savvy folk remind us constantly, the cloud is just someone else’s computer.

To be fair, cloud storage is usually pretty robust, since big tech companies have lots of money and resources to spend on servers, backup servers, and backup backup servers. And if you do accidentally put a piece of information on a public-facing server (or “on the internet” if you’d prefer), it can be very difficult to take it down, depending on who owns the server you put it on, how many people have already seen it, and how many people want to make sure that other people will also have the privelege of seeing it. The Streisand Effect is real. It takes a lot more resources to remove something that has made its way online than it does to keep it around; the Pirate Bay still exisiting in the year 2023 is proof enough of that.

Yet, if no one is bothering to keep a piece of information around, the internet will eventually forget it. There was a time when Geocities was a very solid chunk of what people imagined when they said “the internet”. Despite this, when Yahoo! announced they were deleting Geocities in 2009, internet archivists had to scramble to salvage as much of it as they could and it is unlikely that they got it all. Things being forgotten isn’t necessarily bad, of course. I’m not sure it’s a good thing that between email and messaging apps most people have a record of every written communication they’ve ever had had with anyone in the past 10 years. Letters used to be special things, carefully written and crafted. No one puts that much effort into writing a text, but that doesn’t stop it from being saved on someone’s phone and the screenshots shared on Reddit if you said something stupid.

Some things should be saved at all costs, others are better left forgotten. We feel as though the internet has moved everything into the “remembered forever” category whether it deserves to be there or not, but that isn’t true. We have a choice of what things we want to be saved and which we will let slide into digital oblivion. Make sure to save backups of your personal blogs, social media posts, and family photos if you care about them. Don’t let your hosting provider or worse, Facebook, be in charge of saving memories you care about. But if you don’t care about it? Delete it with confidence instead of just assuming there’s a copy of it somewhere. Use disappearing messages on Signal or Whatsapp. Delete emails that you have no use for. By choosing the things you actually care about keeping, you’ll make your priorities in life clear, and you’ll save some money on hard drives and cloud storage services while you’re at it.

Choosing a Mastodon Instance

Mon, 23 Jan 2023 22:15:00 +0000

I think Mastodon is amazing and it always baffles me when people don’t agree! Now I know that intelligent, reasonable people can have differences of opinion, but it is also possible that everyone who doesn’t like Mastodon is wrong and the only reason why they don’t like it is because they don’t know how to properly choose an instance. In all seriousness though, choosing a Mastodon instance can have a big effect on the actual experience you will have using the platform and it can definitely be confusing to decide which one to choose. I discuss the concept of instances more in-depth in my previous post, but in a nutshell, an “instance” or “server” is essentially your home base on Mastodon and the Fediverse as a whole. Your instance determines the latter part of your username (e.g. @user@instance.example) and also which other instances you will be federating with. In other words, your instance admins decide which other servers can and cannot communicate with yours as well as what content is allowed on your instance. But how to choose an instance? Allow me to guide you with a few simple “dos” and “don’ts”.

One of the biggest common denominators I see between people who tried Mastodon and didn’t like it is that they signed up for an account on mastodon.social. Now, there is nothing wrong with mastodon.social in principle. The admin, Eugen Rothko, is the creator and lead developer of the Mastodon software. He also seems like a genuinely lovely human being. That said, Mastodon is designed to be a federated and decentralized social media platform. It’s strengths shine brightest when there are lots of strong, individual instances and it’s weaknesses are most apparent when everyone tries to join the same instance. Because mastodon.social is a “generic” instance, all different types of people join looking for all sorts of different things. Moderating an instance like that is a challenge even for the best of moderators and keeping an instance with so many users running smoothly on a technical level is also no mean feat. If you join mastodon.social, your initial impressions of the platform will likely be that it is an overwhelming, chaotic, and fractured place. Please don’t judge Mastodon and the Fediverse based on mastodon.social alone.

Don’t Assume that Bigger is Better

So even though you now know not to join mastodon.social, maybe you’re wondering if you should join another one of the big, generic instances? Please don’t. Bigger is not better. Much like mastodon.social, other big instances will be noisy and likely difficult to moderate and keep running smoothly as well. I can already hear your objections: But if I’m not on a large instance, how will anyone see my posts? A good question, but the better question is: If you are on a large instance, how will anyone see your posts? Mastodon is not Twitter, there is no algorithm. People will see you posts in their Home timeline if they follow you or in their Local timeline if they are also on your instance. And the beauty of the Fediverse is that anyone on any instance* can follow your account! Other people can also boost your posts to show them to their followers and add them to their instances’ Local timelines. If you post on a large server, your post will quickly be flooded downstream on your Local timeline by others’ posts. The chances of anyone seeing it are low. If you’re on a smaller instance however, there’s a good chance that other users on your instance will see your post when they browse the Local timeline. Mastodon is not designed for virality like Twitter is. Rather than trying to get your posts in front of as many eyes as possible, you are much better off posting them to a smaller group of people who are interested in the same things you are. You will have a much better chance of sparking engagement this way, or as it used to be called “a conversation”. Of course, being in too small of a server can sometimes be a bit too quiet and lonely. The ideal server size is up to personal taste, though in my personal opinion 1,000-10,0000 active users is a good sweet spot.

*Assuming your instances are federated with one another, which is usually the case

Do Choose an Instance Based on Your Interests

So now that you know to avoid big, generic instances, what kind of instance should you choose? A great place to start is to choose an instance based on your interests. There are so many specialized Mastodon instances, there will almost certainly be one that speaks to you. Animation? Yup. Veganism? You bet. Outdoors-loving LGBTQ+ folk? Why not? Musicians? Here you go. Amazon Web Services for some reason? Indeed. Glasgow, Scotland? You’re covered. And this is really just the tip of the iceberg. You can find an excellent list of instances at joinmastodon.org. If you want to be a little more adventurous you can check out other lists like fediverse.observer. You can even look for a Pleroma, Misskey, or Friendica instance if you’d like for some more diverse interfaces into the Fediverse. Or if that’s too much, just stick to Mastodon. I can basically guarantee that you’ll find at least one instance that fits your interests on joinmastodon.org alone. And don’t worry, you can posts about topics other than those your instance is centered around as long as they comply with the server’s rules. Choosing an instance based on an interest isn’t meant to limit what you post, but to give you a home on the Fediverse with similar people.

Note: I am not endorsing any of the instances listed above. They are some random ones that sound interesting.

Do Ask Your Friends Which Instances They Use

One of the best ways to find an instance is to simply ask any of your friends who enjoy Mastodon which instance they use. Chances are if they like it, you will like it too. And you’ll have a friend waiting for you when you join!

Don’t Be Afraid to Apply for an Account

You’ll notice that some instances listed on joinmastodon.org let you create an account instantly, while others only let you apply for an account. Most instances that require account applications aren’t particularly exclusive. They are likely just being run by small mod teams who want to ensure that they can keep a handle on the number of new users and that new users are good fits for their instance’s culture. In many way, the requirement to apply to join an instance is a positive sign. It means that the moderators are taking their jobs seriously and are manually screening people before they join. Usually, writing a quick sentence or two explaining your interest in that particular instance is all you need. From my experience, you’ll likely get your account approved in a day or so.

Do Research an Instance Before Joining

Now, let’s say you found an instance based around one of your interests. You could just sign up for an account right away, but you should probably do some research first. Firstly, look at the “server rules” on the instance’s home page. Do they sound reasonable to you? Do they seem like a solid foundation for respectful discussion and communication? If so, that’s a great sign! Next, see who the admin of the server is.

Screenshot from Fosstodon showing the location of the server rules and admin information.

Sometimes there is a faceless server account as the admin, but even in this case, a little digging should show the list of server admins and moderators. Have a look at their accounts and public posts. Does the server or the admins/mods have a website? Take a look at that. Do you feel comfortable trusting these people to manage your account and your data? Most Mastodon instance admins are very nice people, so hopefully the answer should be yes! Finally, take a look at the instance’s Local timeline (if it’s public). You can find it by clicking on the Local timeline icon in the sidebar or by appending /public/local to the instance’s url. Do the posts there seem to be ones you would find interesting?

Screenshot from Fosstodon showing how to access the Local timeline.

It should only take a few minutes to look at all these things and ask yourselves these questions. And you should now have a much better idea if this server is right for you!

Do Feel Free to Migrate to a New Instance

Let’s say you didn’t read this before joining Mastodon. Or let’s say you did but chose a server that isn’t for you anyway. Is all hope lost? Absolutely not! You can migrate your account to a different Mastodon server relatively painlessly and keep all of your followers and followed accounts. There’s a guide here on how to do this. In fact, if you don’t want to put in all the work into researching servers before even seeing what Mastodon is like, you’re perfectly free to join one of those open, generic servers I warned against earlier and then migrate to a server more suited to you once you’ve had a chance to see what the Mastodon interface looks like. Alternatively, you can just make a new account without migrating, that’s perfectly fine too!

Do Say “Hi!”

When you do join an instance be sure to make a post saying “Hi!” You can use the #introduction hashtag when you do. Share a little bit about yourself and why you joined the server you did. Mastodon users are generally pretty friendly and you’ll likely meet some cool, new people before you know it!

Mastodon and the Fediverse: A Social Media Revolution

Mon, 19 Dec 2022 19:00:00 +0000

I discovered the Fediverse about a year ago and was blown away. “The Fediverse” is a network of federated social media platforms including Mastodon, Pleroma, Pixelfed, and others. I talked to people in my life about what a cool idea federated social media is and was disappointed when people seemed more confused than excited. For most of its existence, the Fediverse was virtually unknown compared to the more mainstream, centralized alternatives. Recently however, a certain Twitter CEO’s determination to burn the social media platform he bought to the ground has led one of the platforms on the Fediverse, Mastodon, to rise dramatically in popularity. Mastodon’s rise is very well-deserved and I want to take advantage of Mastodon’s moment in the sun to explore what about Mastodon, and the Fediverse more broadly, excites me so much. I also plan to confront some of the obstacles the Fediverse faces on the road to being a true replacement, both technologically and culturally, for centralized social media.

In order to understand the potential that the Fediverse has, we have to understand the current state of social media. Luckily (or unluckily), pretty much everyone with an internet connection is already familiar with our current social media hellscape, so I should only need to cover the basics briefly. Social media as we know it is addictive, dominated by ads and “promoted posts”, tracks its users so it can target ads to them, sells that data so others can do the same, censors benign content while promoting the most outrageous misinformation and hate speech, dictates what we see based on an unknowable algorithm, and much more, all to feed the social media companies’ bottom lines. Despite how crazy that list sounds, I don’t think I know anyone who would say it isn’t true. Yet, when confronted with the question of why we continue to use such toxic platforms, we all (myself included) have our answers. Whether its for our jobs, buying and selling goods, keeping up with the news, or even staying in touch with friends and family, the vast majority of people get enough utility from social media (or at least think they do) that they are willing to put up with the immense amount of garbage that inevitably comes with it. Like victims in an abusive relationship, we stay on these social media sites despite all the harm we admit they cause us, perhaps hoping things will improve, or just because we can’t imagine ourselves living any other way. But what if there was a way to keep the benefits social media provides while getting rid of some, if not most, of the toxicity we have come to associate with it? This is the promise that the Fediverse offers.

Federation and Why it is Good

Federation as a communications technology concept is not new. Email uses it, telephones use it, old chat protocols like IRC and XMPP use it, as well as newer chat protocols like Matrix. Federated communications is really just the ability to communicate with someone else even if you have different communication providers. Gmail users can send emails to ProtonMail users, Verizon phones can talk with AT&T phones, etc. That’s all there is to it. Nevertheless, we are so used to social media being closed platforms controlled by a single, for-profit company, that the idea of federated social media is still mystifying to many of us.

Despite this, social media stands to gain so much from federation, which is a potential solution for many of the obvious problems that the the mainstream social media platforms struggle with. Social media moderation is an absolute nightmare on centralized platforms because you need to come up with a single set of rules that can be applied universally to users of different nationalities, ages, political beliefs, and cultural assumptions. Such a task is nearly impossible and usually ends in some users feeling that the platform is overmoderated, others feeling its undermoderated, and no one being happy. Most users either grumble and continue to use the platform despite its shortcomings or move to alternate platforms with minimal moderation, which often end up being cesspits and breeding grounds for radical ideologies.

Enter federation. By making a federated social media platform, each user can join an instance of their chosen social media platform (e.g. Mastodon) based on the type of moderation policy that instance has. This allows all users to join a platform with a moderation policy they agree with while not depriving them of the ability to speak to people who feel differently. Moderators can moderate as they like on their instance, and defederate with instances who they feel are beyond the pale. On the surface, this seems to return us to the exact same situation of different users being siloed into different platforms, but a closer look reveals this is not the case. On centralized platforms, you are either allowed or disallowed to participate on the platform, but federation allows for many more shades of gray. To take a (simplified and fictitious) political example, a far-left Mastodon instance might defederate from any instance that does not have leftist politics, a moderate left-leaning instance will defederate from far-right instances but remain federated with moderate right instances, while a centrist instance will remain federated with all instances. Now instead of a binary choice of users being either “on” or “off” the platform, there is a gradient of what type of instances are available and what type of interactions you will have based on the type of instance you choose to join. And the reality is even more nuanced, since instance moderators have a variety of different options at their disposal for how to federate with other instances besides “yes” or “no” and individual users also have the ability to mute or block entire instances on their own. And if the user decides they no longer like their instance, migrating to a new instance while keeping all of your followers can be done in just a few minutes.

Federation has other benefits too. Instead of being thrown into the sea of social media with millions of other users, federation allows users to start with a “home base.” It makes the task of creating community on social media so much easier. To be sure, other platforms have this as well. Servers on Discord, subreddits on Reddit, and even groups on Facebook can also provide this communal feeling. However, only the Fediverse holds the promise of each user choosing who moderates their entire instance, as well as who is in charge of protecting the data they generate while using the platform and determining how it is used. That is a choice that no one on Discord or Reddit gets to make. In addition, only the Fediverse offers to possibility of different platforms being able to communicate with one another. You can follow a Pleroma or Pixelfed account with your Mastodon account easily, try following a Facebook account on Twitter and you’ll have a much harder time.

Open Source and Non-Profit

Another benefit of the Fediverse is that all of its platforms are open source and non-profit. Open source means that anyone can view and fork the source code for any of the platforms on the Fediverse. You have an idea for a Mastodon feature that the developers refuse to add? Fork the source code and add the feature yourself. The AcitivityPub protocol which powers the Fediverse will ensure that you can still communicate with instances using the “official” fork. There’s simply no way to do that with centralized social media. The Fediverse’s platforms’ non-profit nature also makes them markedly different from mainstream platforms. No ads? No promoted posts? No algorithm determining which posts you can see? All of this makes perfect sense if the platform isn’t trying to squeeze every cent it can out of its users. This is likely the same reason why Mastodon has other excellent features that Twitter lacks, like the ability to automatically delete old posts or the ability to follow hashtags.

Isn’t it Complicated?

If you’ve managed to read this far into this post, you likely have at least somewhat of an idea of how Mastodon and the Fediverse work. And yet, so many people who are interested in trying Mastodon insist that it is too hard to understand. For those who are technically knowledgeable and understand how the internet functions, the idea of federation is very intuitive. But for the vast majority of internet users, understanding how email works well enough to use it does not translate to the ability to map that understanding onto an entirely different context like social media. For most, understanding Mastodon is not intuitive and requires a real learning curve. That being said, the internet as a whole (including centralized social media platforms) required a learning curve for almost all of us. We’ve lived with centralized social media for well over a decade now and have gotten used to how it functions, departures from that norm seem strange and confusing. But for those willing to put in a bit of effort into opening a new door, there’s a real treasure waiting for them on the other side. Hopefully, the problems of centralized social media becoming more and more blatant will motivate more people to open that door. Understanding how Mastodon works can be a bit confusing, but once you actually start using it, you’ll likely find that it is far more intuitive than you think.

Federation Can’t Completely Kill Toxicity

Mastodon is a much less toxic place than Twitter. The benefits of federation I outlined above as well as very deliberate design choices (like lack of a quote Tweet analogue) make it that way. But you’ll still encounter toxicity there. Perhaps it’s just a part of how people are, perhaps its the feeling of anonymity that the internet provides, but a certain amount of toxicity seems baked into social media. Anyone expecting the Fediverse to completely kill social media toxicity might be waiting a while, I’m afraid.

What About the Money?

The lack of a for-profit company behind Mastodon and the Fediverse means a lack of, well… profit. Mastodon depends on the largess its volunteer developers and/or donors. Despite this, Mastodon is an excellent and professional-looking piece of software; it really is impressive. But not all Fediverse platforms can say the same. Many are quite janky compared to the relatively polished feel of their mainstream competitors and even Mastodon has some rough edges when compared to Twitter. It’s hard to compete with companies that have millions if not billions of dollars at their disposal. The question of how to fund development is an open one in the FOSS community and I’m not going to solve it here. My impression is that Mastodon’s new influx of user have been quite generous in financially supporting their instances and I hope that will continue. But centralized social media platforms offering us their services for “free” all these years have made most of us reluctant to part with even a small amount of money in exchange for a similar service. Hopefully, smart people will come up with a business model for the Fediverse that doesn’t compromise on its values moving forward, but in the meantime I can only encourage those who enjoy the Fediverse to donate to their instances!

Lack of Originality

While the Fediverse solves many problems with centralized social media, it has yet to introduce a platform that is truly original beyond the innovation of federation. Mastodon is essentially Twitter plus federation, Pixelfed is Instagram, Lemmy is Reddit, Friendica is Facebook, etc. This isn’t to say that these platforms don’t feel substantially different from their centralized counterparts, they do, but for the Fediverse to truly succeed, creative thinkers will have to think of new social media ideas that synergize with federation and aren’t just derivatives of already extant platforms with federation added on top. Despite being heavily based off of Twitter, Mastodon works very well with federation, while other platforms, like Lemmy, benefit from federation, but not to the same extent. I’m excited to see the first truly original social media concept on the Fediverse and the even greater growth the Fediverse can achieve once that happens.

Try it for Yourself

I hope I’ve been able to convey some of the excitement I have for the Fediverse while still being able to give an honest assessment of the shortcomings and where I think there’s room to improve. If you’re not already on the Fediverse, I urge you to give it a try. I really think you’ll like it! joinmastodon.org is a great place to start.

GrapheneOS: User Impressions

Thu, 06 Oct 2022 10:00:00 +0000

When I first started focusing on moving toward more privacy-friendly software and services, I knew that at some point I would want to install a custom OS on my phone. I’ve always used Android as my mobile OS, and Android, being a Google product, is of course used to gather data on its users. While I was not as privacy-conscious when I bought my current phone a few years ago, by good fortune the model I purchased was a Google Pixel 3a, which is compatible with some top-tier custom OSes, including CalyxOS and GrapheneOS. The phone is getting somewhat old at this point (though it still runs pretty smoothly) and the Pixel 3a reaching end-of-life and no longer receiving software updates (including security updates) from Google was extra motivation for me to consider installing a custom OS. Even so, I was a bit nervous to install a new OS on the phone since doing so involves formatting the phone and entails a chance of bricking the device. I spent quite a while tinkering with various non-Google backup solutions for my phone so that I could import all my data to the formatted device without needing to rely on Google (Syncthing was very useful for this). After I felt comfortable with my backups, I finally made the plunge and installed GrapheneOS on my device. I thought my experiences could potentially be useful to others who are considering a custom mobile OS and decided to write a post about it. This will not be a full review of GrapheneOS, but merely my impressions installing and using the software. I will be writing about GrapheneOS from the perspective of a layman/user, as I’m not qualified to evaluate GrapheneOS from a technical standpoint.

Choosing the OS

While there are quite a number of “deGoogled” and/or privacy-focused custom OSes that were available for my phone, the two that were most often recommended for Google Pixels were CalyxOS and GrapheneOS. Both are based on AOSP (Android Open-Source Project) and are focused on making Android a more privacy-friendly OS and limiting Google’s control over the data stored on and generated from the device. Both also preserve Android’s verified boot feature, a security feature which is often not preserved in custom OSes.

While I was leaning more toward CalyxOS at first, the more I researched, the more I felt that GrapheneOS was the better option. While CalyxOS does preserve the security features of stock Android well (unlike other custom AOSP-based OSes which do not), GrapheneOS not only preserves the security features in stock Android, but improves on them in a variety of ways. Additonally, GrapheneOS has a better track record than CalyxOS of merging upstream updates on time, which is also important for device security.

There were two factors that continued to pull me toward CalyxOS, however. The first was CalyxOS’ support for MicroG, which mimics Google Play Services and allows many apps that rely on Google Play Services to run on the phone even without Google Play Services installed. While having a phone without Google Play Services installed on it at all sounds nice in theory, in practice many of the apps I need day-to-day require Google Play Services to function properly. However, somewhat recently GrapheneOS added support for sandboxed Google Play Services, which allows Google Play Services to be installed on the phone while limiting its permissions and general access as compared to Google Play Services on stock Android. MicroG and sandboxed Google Play Services are two different models of attempting to limit Google’s control over the device while preserving compatibility. MicroG is an open-source reimplementation of Google Play Services, which spoofs stock Google Play Services, requiring all the same elevated permissions that Google Play Services does and communicating with Google’s servers. Sandboxed Google Play Services on the other hand, uses the standard, proprietary Google Play Services software, but treats it as a user app and denies many of the elevated permissions that stock Google Play Services and MicroG both require in order to work. Both solutions still send some information to Google and provide imperfect compatibility with apps that require Google Play Services. Nevertheless, by all reports sandboxed Google Play Services provides at least as much compatibility as MicroG and seems to be a more secure implementation as well.

The second factor that pulled me toward CalyxOS was the drama surrounding GrapheneOS and its founder and lead developer, Daniel Micay. GrapheneOS started its life as CopperheadOS, but after a feud between Micay and James Donaldson, Copperhead’s CEO, Micay left Copperhead and started GrapheneOS. Both Micay and Donaldson claim that they have the rights to the CopperheadOS source code and are currently in a legal dispute over these rights. Given that Micay was clearly the technical brains behind CopperheadOS and the fact that other of Donaldson’s former business associates aren’t very complimentary of him, this dispute alone is not very concerning. However, Micay, and by extension the GrapheneOS project and community, have gotten in feuds with a number of other privacy-focused and FOSS projects. The list includes but is not limited to: Techlore, CalyxOS, F-Droid, Seth For Privacy, and Bromite.

Now, is it possible that all of these projects are in cahoots against Micay and GrapheneOS and have organized misinformation and harassment campaigns against the project as Micay claims? I haven’t seen any evidence of these campaigns myself, but sure, it’s possible. Is it also possible and perhaps more likely that Micay is simply a little paranoid, maybe because of his bad experiences at Copperhead? Absolutely. However, while Micay has been somewhat acrimonious toward many of these projects, he seems genuine in believing that these other projects are looking to damage GrapheneOS and his behavior toward them generally seems to be better characterized as unprofessional rather than abusive. While that is still unfortunate, I don’t think it’s a good reason not to use and even support the GrapheneOS project, especially when many of the projects that GrapheneOS feuds with admit that GrapheneOS is an excellent OS and that Micay is a genius developer. It is still concerning that GrapheneOS has such poor relationships with other FOSS projects since the success and longevity of FOSS projects is often dependent on incorporating code from other projects. However, GrapehenOS has a whole team of talented developers and contributors, so perhaps they can continue making a successful product even without collaboration with other prominent FOSS projects. Ultimately, this drama, while somewhat concerning, did not seem like a good reason for me to choose an alternative custom OS over Graphene.

Installation

While I have never installed a custom OS on my phone before, I do have some experience installing custom firmware on video game consoles and by comparison, installing GrapheneOS is an absolute breeze. I used the web installer for the installation process and doing so was very straightforward. Once you have your phone connected to your PC, the process is basically just pressing a few buttons while the web installer does all the hard work for you. I did run into problems when trying to use UnGoogled Chromium as the browser for the install, but the good folks the GrapheneOS Matrix room informed me that while vanilla Chromium is compatible with the web installer, UnGoogled Chromium is not. I ended up using Brave for the install, which worked very well and I didn’t hit any other snags in the installation process. Even if you have minimal technical expertise, using the web installer should be no problem.

UX

After installing GrapheneOS, the setup experience was very similar to stock Android with the obvious exception of not needing a Google account. By default the UI is very bare, but this is by design. The only apps that are installed by default include reskinned versions of some basic AOSP apps (Phone, Contacts, Messages, Settings, etc.), Vanadium (GrapheneOS’ hardened version of Chromium), and GrapheneOS’ “app store”. I put “app store” in quotes since it is only used for GrapheneOS’ first-party apps, most of which are system apps which come preinstalled. The app store also includes sandboxed Google Play Services, though I will discuss that more in-depth in a bit. The general UI of the phone is basically identical to stock Android and should be familiar to anyone who is used to the stock version of the OS. After adding some apps and a custom background, my phone with GrapheneOS looks mostly indistinguishable from when it was running stock Android.

Sandboxed Google Play Services

While I could get some apps running on GrapheneOS as-is, the vast majority of apps require Google Play Services to work properly. Installing sandboxed Google Play Services from Graphene’s app store is pretty simple and can be done in a few taps. While some basic Google Play Services functionality can work without being logged in to a Google account, most apps will need the full Google Play Services suite, which includes the Google Play Store and in order for the Play Store to function, you will need to log in to a Google account. You can of course make a “throwaway” account specifically for this purpose, though it would not surprise me if Google has ways of correlating accounts with each other, especially if you ever log in to your personal account on the same device. You can then use the Google Play Store to install apps, though you can of course also use F-Droid or Aurora Store. Once the full Google Play Services suite was installed and I was logged into my Google account, I was really impressed with the app compatibility. I did struggle a little bit with some apps at first, but after some experimenting and tweaking, I have yet to encounter a single app that I couldn’t get working with sandboxed Google Play Services. This even includes some banking apps, which apparently don’t always work well with sandboxed Google Play Services. You can further limit Google Play Services by installing it only in a specific user profile or a work profile, though I am currently just using it on the main user profile for the sake of convenience.

Security Features

Most of GrapheneOS’ security features are under the hood, but there are some that you will notice. First is the obvious lack of any proprietary Google apps on the phone by default, as I have already discussed. Second, is the expanded permissions capability. While stock Android allows you to control some permissions (such as camera or location access) for most apps, GrapheneOS allows you to control the sensors and network permissions as well. This network toggle in particular is a very powerful tool which can prevent any app you choose from connecting to the internet. This feature made me more comfortable installing some proprietary apps that I enjoy using but have no need for internet access. On stock Android, I have no choice but to allow them access anyway (and likely send data the app collects back to the developers) or else use an imperfect firewall solution like Netguard. GrapheneOS lets me deny these apps network access on the operating system level, which is a far more ideal solution.

These permission toggles are available for Google Play Services as well, meaning you can decide exactly what permissions Google’s apps have on your phone even if you do choose to install them, which is simply impossible on stock Android. While this lessens some of the seamless experience of stock Android (I often have to manually approve requests for access from Google Play Services), the gain in privacy and security is definitely worth it. I can even install Google apps like GBoard on my phone and simply disallow them from using the internet, which they don’t need anyway. I even denied the network permission to the Google Play Store (I either download my apps manually or get them from F-Droid or Aurora Store) and found that app compatibility still works just fine. While the basic Google Play Services apps continue to have network access, I have still greatly limited the number of avenues Google has to siphon data from my phone, which feels really great!

The other security feature you may notice is “secure app spawning”, which will cause a slight delay when opening apps. This delay is noticeable, but still quite short and it didn’t impact my usage of the phone at all. However, if you want to disable it, you can do so in the phone’s security settings and apps will open without the delay.

Conclusion

Overall, I am quite happy with GrapheneOS. I did have to struggle a little bit with getting the sandboxed Google Play Services to work as I like, but at this point all the apps I need run smoothly and I haven’t had any compatibility issues. While GrapheneOS’ web installer is very easy to use, I still don’t think I can recommend the OS to my non-tech savvy friends and family. A fair bit of setup and tinkering with sandboxed Google Play Services was required for me to get it working smoothly and many of GrapheneOS’ best security features would likely go unused and/or unappreciated, while the usability sacrifices would still be noticeable. For me personally however, GrapheneOS is a great fit and when I get my next phone, installing GrapheneOS on it will likely be the first thing I do.

10 Basic Steps to Digital Privacy

Tue, 23 Aug 2022 19:30:00 +0000

Introduction

Though digital privacy is complex and achieving “complete” or “100%” privacy is virtually impossible, that doesn’t mean there aren’t simple steps you can take to improve. Most people’s digital privacy practices are pretty poor, which may be disheartening, but it also means that there is a lot of low-hanging fruit to be picked from the metaphorical digital privacy tree. Even if you have already put all of the steps I’m about to list into practice, consider sending this blog post to a friend or family member who may not have. And perhaps even digital privacy veterans will find one or two new ideas here. The following steps will go in order of those I consider to be relatively easy to actualize to ones I consider to be relatively difficult, but they should all be accessible to the technological layman. Additionally, this list focuses more on digital privacy than digital security and while the two often go hand-in-hand, your threat model may require you to focus more on security than privacy. Make sure to take your personal needs into account and fact check the information here before blindly following it. That said, I hope you find it useful!

1. Change Your Web Browser

If you’re like most people, statistically, you are using Google Chrome as your primary web browser. On top of the open-source Chromium browser base, Google adds a variety of what can only be described as spyware to track your every move on the web. Every website you visit and likely much more is meticulously logged and recorded by Google so they can use the data to target or “personalize” ads toward you. The good news is that there are plenty of privacy-respecting alternatives to Google Chrome. The two easiest desktop browsers to recommend are the Brave Browser and Mozilla Firefox. Both are miles ahead of Google Chrome in terms of privacy and also very user-friendly. Brave is the more private by default and includes a built-in ad and tracker blocker. However, it also includes the somewhat annoying integration of its BAT cryptocurrency, though this can be disabled. If you want a browser that can just be downloaded and used relatively privately as-is, Brave is not a bad choice. If you’re willing to play with the settings, however, Firefox can become a powerfully private browser (using Arkenfox is a great way to achieve this). There are other private browsers out there as well, though Brave and Firefox are the simplest to recommend as drop-in Chrome alternatives. If you want to look into other options a bit more deeply, this article is not a bad place to start. The mobile browser landscape is a bit more complex than desktop browsers’, but I would still continue to recommend Firefox and Brave as solid, private options for both iOS and Android (they are both certainly a step up from Chrome).

2. Switch Up Your Search Engine

Even though you’ve changed your web browser, you are still, statistically, using Google as your search engine and this needs to change. Google of course records every search you make regardless of whether or not you use their browser. While Chrome’s more private competitors are just as good as (if not better) than Chrome, the same can’t quite be said for private Google search alternatives. While many of them are quite good, none of them are quite as feature-rich and intuitive as Google is, and their search results are often lower quality. Nonetheless, the drop in usability is relatively minor and a worthwhile price to pay for the privacy to be gained. The most commonly recommended private alternative to Google Search is DuckDuckGo, which is not a bad search engine by any means, though its results (mostly sourced from Microsoft’s Bing), are often not quite as good as Google’s. If you want privately proxied Google results, then StartPage is a great option, since they simply pull from Google’s results and pass them on to you without Google’s personalization and tracking, but also without some of Google’s fancier features. Brave Search is also notable for having its own search index (rather than pulling from Google or Bing as Startpage and DuckDuckGo do) and its search results aren’t half-bad, though not quite on par with Google’s. There are other private alternatives as well (the self-hostable Searx certainly deserves a mention), but any of the initial 3 I mentioned should serve just fine as a private Google search alternative. Feel free to try a few and use the one you like most.

3. Use a Password Manager

Using the same, easy-to-remember password for every online account you have is easy, but it’s also a terrible idea. It’s not a matter of if a service you use will get breached, but when (check haveibeenpwned.com to see if your information was already leaked). The most viable solution to this is to use a strong (preferably randomized) and unique password for each of your accounts. The only way to have access to all these different passwords while storing them securely is to use a password manager. A dedicated password manager is far more secure than writing the password down or storing them in a spreadsheet and is even more secure than using the in-browser password manager. There are a lot of password managers out there and using almost any of the well-known ones is better than using the same password everywhere, but the two generally best options are Bitwarden and KeePassXC. Bitwarden is a cloud-based solution and is probably more convenient for most people, while KeePassXC will store your passwords encrypted on your desktop. Both of these password managers also have the ability to generate strong, random passwords for you as well as browser extensions which automatically fill those passwords into the login pages of each website you visit. While transitioning to using a password manager can be difficult at first, it will make your life much easier once you get used to it, and make your online accounts much safer as well! To further secure your online accounts, you may also want to consider adding two-factor authentication to the accounts that support it.

4. Get a Better Messenger

Messages between our friends and family contain some of the most sensitive information about our personal lives, so it is important to choose a private and secure tool for sending and receiving those messages. SMS in an unencrypted protocol and your SMS messages can easily be read by your cell service provider or by a intercepted by a bad actor. Some proprietary messengers, such as WhatsApp and iMessage are end-to-end encrypted by default, which means that only the sender and receiver of a message can read its contents. However, these services can use the metadata of your conversations (such as who you message and when) to build your advertising profile. Additionally, both WhatsApp and iMessage back up all your messages unencrypted to the cloud (either Google Drive or iCloud) by default, undermining much of the privacy provided by their end-to-end encryption. While there are a few options out there for private and secure messengers, the easiest to recommend by far is Signal. Signal’s features are on par with competing messenger apps and its privacy and security are top-notch as well. It’s also free to use. While Signal may not be perfect (it requires a phone number to register and is a centralized service), it is extremely well-vetted in terms of its security and in addition to being end-to-end encrypted by default, stores close to zero metadata on its users. While there are other private messaging options out there like Session and Threema, Signal strikes the best balance between privacy, security, and usability. Usability is far more important for a messenger than it is for a browser or search engine, since not only do you have to be convinced that the privacy and security gains are worth any usability losses, but you have to convince your friends and family too or you won’t have anyone to message with!

5. Minimize and Scrutinize Apps and Browser Extensions

Every program you install on your computer, every app you install on your phone, and every extension you install in your browser is a potential security and privacy risk. These programs, apps, and extensions all have privileged access to your device and a compromised device can undo any progress you have made in your digital privacy by sending your personal data directly to bad actors. Even if the app or extension is not inherently malicious, it can provide an attack surface that can be exploited by malware. A simple step you can take to greatly mitigate this risk is to be very selective when installing computer programs, apps, and extensions. The fewer you have, the lower the chances that one of them will be turned into a backdoor into your device. Many mobile apps and PC programs can be replaced with a progressive web application, which is essentially a browser shortcut icon on your phone or desktop homescreen that can provide much of the same functionality as a fully-fledged application with significantly less of a security risk since it runs through your browser rather than as an independent program. While many browser extensions can be deleted without losing much, you should strongly consider using a tracker-blocking extension like uBlock Origin. For the remaining programs and apps that you do need, consider looking for an open-source alternative to the more likely more popular proprietary options. While open source software isn’t necessarily guaranteed to be any more private and secure, developers who make privacy-friendly software tend to make that software open source so that the source code can be reviewed and shown to be as privacy-friendly as its developers claim. All of the programs that have been suggested in this guide so far, like Firefox and Signal, are open source software!

The email protocol is relatively old and not very secure or private by design, but virtually everyone nowadays needs an email address. So while all of your personal and sensitive communications should go through a private and secure messenger like Signal, using a privacy-friendly email provider is still an important step toward digital privacy. Email providers like Gmail can and do read your emails and use their metadata to build your advertising profile. If you’re looking for an in-depth discussion of different privacy-respecting email providers, you should check out my review. In short however, the easiest free, drop-in replacement for Gmail I can recommend is ProtonMail.

7. Eschew IoT Devices

The “internet of things” describes the growing number of household devices that can be connected to the internet. Once upon a time, only desktop computers were able to connect. Then, our cell phones graduated to “smart phones” with internet connectivity. Nowadays, almost every personal and household device has a “smart” version. Smart TVs, smart thermostats, smart watches, smart vacuums, smart beds, smart doorbells, and smart refrigerators, in addition to home media centers, video game consoles, and ebooks, just to name a few. But the internet of things is not good for your privacy. It is an open secret that companies use these devices to spy on their users, gathering more personal data for their advertising profiles. IoT devices often have weak security and can be prime targets for cybercriminals looking to build botnets or gain a foothold in your home network. To top it off, many of these “smart” devices don’t even provide much utility beyond the device’s basic, offline functions anyway. Consider buying devices and gadgets that do not connect to the internet and if you do buy a smart device, consider leaving it offline. If you do require an IoT device, make sure to change any default security credentials and to opt out of any analytics and tracking that you can in the device or account settings.

Social media is a ubiquitous part of modern life, but in addition to its deleterious effects on mental health, it is also bad for privacy. Social media companies are some of the most privacy-violating and Facebook (which also owns Instagram), is particularly infamous for its invasive data collection from its users. But even if social media companies didn’t so nakedly violate their users’ privacy, most social media sites center around posting your personal information on the public internet and trying to get as many people to see and interact with it as possible! The best advice to prevent this is to simply delete your social media profiles altogether, though this is impractical for many of us for either social or professional reasons. If you do decide to keep your social media accounts, make sure you’re not leaking any more private information than you need to. Consider deleting social media apps from your phone and only accessing the services via your browser (this is good for preventing late-night doomscrolling as well). Go through your accounts’ privacy settings and make sure your information isn’t being shared more widely than it needs to be (checking your account privacy settings is also a good idea for your other privacy-invasive services you may have as well, like Google). Finally, think carefully before posting information or adding information to your social media profiles. Make sure the information really needs to be there and check whether it contains any personal details you would prefer to not be public knowledge. You may also want to consider using social media pseudonymously where possible. While keeping your real-life identity and a social media pseudonym completely disconnected can be quite difficult, that’s no reason to add more personal information about yourself that will show up with a simple internet search of your real name. The Fediverse can also be a good alternative to proprietary social media services since many instances of fediverse platforms are open source and relatively privacy-respecting, but even these upsides don’t change the need to be cautious with what information you post!

9. Change Your DNS Provider and/or Use a VPN

Believe it or not, your ISP is another company that is likely mining your internet activity to sell to data brokers. However, there are some simple steps you can take to mitigate this risk. Firstly, you can change your DNS provider. DNS is the protocol by which domain names (like example.com) are translated to IP addresses, which computers use to connect to other servers. By default, you are likely using your ISP’s default DNS resolver, but you can do better. Go into your internet router’s settings and change the DNS resolver servers to a more private provider like Quad9 or AdGuard. Both of these DNS resolvers block domains associated with malware and AdGuard blocks domains associated with advertisements and tracking as well. In addition to changing your DNS resolver in your router settings, you can also change it in your PC or phone device settings or in your browser settings. This has the advantage of working even when not connected to your home network and can take advantage of encrypted DNS lookup protocols. If you’d like to set up a custom ruleset for your DNS resolver to block any domain you’d like, Adguard can do that for you and so can NextDNS. Of course, hiding your DNS queries from your ISP still allows them to see every IP address you connect to. This can be prevented by using a trustworthy VPN provider. Many VPN providers will claim a variety of benefits that come from using a VPN but these are often exaggerated and the main privacy benefits are (1) hiding the servers you connect to from your ISP and (2) hiding your own IP address from the servers you connect to. Of course, by using a VPN service to achieve these goals, you are simply shifting your trust from your ISP to the VPN provider, so make sure the VPN provider you use is trustworthy! Almost all free VPNs, and even many paid VPNs, are collecting and selling your data. The most-trusted VPN services as of this writing are ProtonVPN, MullVad, and IVPN. There are a few free and trustworthy VPN options, such as ProtonVPN’s free tier, RiseUp VPN, and CalyxVPN, but these often have throttled speeds and as a general rule you should expect to pay for a trustworthy VPN service. Another free option that provides the privacy benefits of a VPN (and a lot more as well) is the Tor Browser. Unlike VPNs, the Tor Browser distributes trust amongst multiple third parties and does its best to allow you to browse the web anonymously. However, your browsing speeds using Tor will be quite slow compared to using a standard web browser with a quality VPN, so it may not always be the best solution.

10. Remove Your Data from People-Search Sites

Believe it or not, there are many sites out there which are designed just to collect information about you and sell it to anyone interested. Creepy, right? Well, luckily many of these sites have the option to opt-out and remove your data from the site, but this is a slow and arduous process by design. The potential upside of removing this (sometimes very invasive) data about yourself from the web is high, but will require significant amounts of either your time or money to achieve, which is why it is the last step on this list. If you’d like to request removal of your information from each of these sites manually, you can find a pretty good guide for doing that here. There are also paid services which will do this grueling task for you like DeleteMe (some other paid services are reviewed in this video).

Conclusion

This is hardly an exhaustive list of steps that can be taken to improve your digital privacy, but the steps that are listed should be relatively accessible to a wide audience and have a large positive impact in proportion to how much effort they require. If you’d like to learn more about how to improve your digital privacy, Privacy Guides is probably the best online resource currently out there, but it’s certainly not the only one! I hope the steps I have listed here will help at least a few people start working toward making their digital lives a bit more private as big tech companies work tirelessly to make sure they are anything but.

Tracking Opacity and the Cause of Consumer Indifference

Wed, 27 Jul 2022 00:00:00 +0000

People who care about privacy online are often frustrated by the inability of the masses, often including their friends and family, to see the importance of using privacy-preserving online services. But companies like Google and Facebook work very hard to make sure people reach the conclusion that online privacy simply isn’t that important. The first and most obvious way they do this is by offering genuinely good services. Millions if not billions of dollars are used to develop Google’s and Facebook’s products to make them as seamless and user-friendly as possible. A FOSS, privacy-preserving alternative to Gmail for example, will often have trouble raising even a fraction of the funds available to Gmail to develop their product. While some dedicated and talented developers can make up for some of the lack of funding, even FOSS developers need to eat and they are competing against Google’s engineers and developers, who are well-paid, well-organized, and well-funded. Meanwhile, Google funds its services from selling its users’ data, meaning it can offer these services to them at no (monetary) cost. The FOSS developer has to therefore find a way to fund their project without charging the user at risk of being even a less attractive alternative to Google. Sure, they can proudly claim that they don’t sell user data, but to the average user, that’s likely not enough of a reason to sacrifice features and usability and perhaps having to pay a fee to boot. Many privacy-preserving FOSS products and services overcome these challenges and manage to use innovative monetization to build a niche market for themselves, but these are relatively few and far-between and are constantly fighting an uphill battle in an attempt to compete with big tech.

Big companies also rely heavily on the network effect. How can a FOSS, privacy-preserving messenger beat out WhatsApp or iMessage when choosing the alternative messaging service will mean being unable communicate with the vast majority of people who still use the mainstream services? The decentralized nature of something like XMPP is certainly more the exception than the rule when it comes to modern messengers and even an open-source, private messenger like Signal locks its users into using its servers to communicate. Google’s integration into Android devices is another permutation of the same principle. Why should a user bother looking for a different cloud storage provider or local backup solution that they will then have to configure when Google Drive is already integrated with their Android device, no setup required?

So convenience and price are clearly big motivators when it comes to why people ignore the privacy-invasive practices of big tech. But perhaps the most common reason people give is that they simply don’t care. Mark Zuckerberg infamously said in 2010 that “privacy is no longer a social norm.” And many people are quick to agree. “I have nothing to hide.” “It’s impossible to be private nowadays anyway.” “I don’t really care if Google reads my search history.” These are refrains familiar to anyone who has tried to convince their friends and family of the value of digital privacy.

However, I would argue that most people do care about their privacy. Claiming they do not is only possible because of the siren song of convenient services that big tech offers and the ignorance of what digital privacy really means. One of the strongest weapons that Google and other surveillance companies have in their arsenal is tracking opacity, the opposite of transparency. My impression is that most people are aware that Google stores and sells their “data,” but very few people have a concrete idea of what that means. And that is just how Google likes it. It is very easy to use Google services and forget that they are observing everything you do. They don’t announce it, it happens silently. Even when you open Google Maps and see a list of all of the locations you previously searched for, it is easy to see that information as only available to you. It is only available on your device after all, or only when logged into your account. Google never openly claims that this information is only available to you, but it works very hard to make you feel that way. In the early days of tech, almost all of our personal data was stored locally. This very much habituated us to the idea that only we had access to our data. In the decades since, almost everything has moved to the cloud, but our mindsets have not changed. The obvious differences between writing a digital diary on Microsoft Word in 1995 and on Google Docs in 2022 are the better features Google Drive provides and the convenience of being able to access the file on almost any device. The fact that in 2022 the data is stored on Google’s servers where they are freely able to do what they wish with it doesn’t come to mind. giving its users the illusion of data sovereignty is very much a deliberate design choice on Google’s part.

Tracking opacity generally manifests in two ways: (1) opacity of what data is collected and (2) opacity of how that data is used. Most people don’t realize that their Android phones are nearly constantly sending their physical location to Google because Google makes it very difficult to see that they are in fact doing that. Occasionally, Google or Facebook will slip up and reveal to their users just how invasive their tracking is, but at any hint of outcry, they will claim it was a “mistake” and make superficial changes which make the tracking harder to see without actually getting rid of it. Even if you do realize that your location data is being sent to Google, you have no idea what its being used for. Google and other companies make sure to have long terms of service agreements and privacy policies filled with legalese that most people will not have the time or energy to read and would not be able to understand even if they did. Even after reading and understanding these policies, the exact way Google uses to data is still incredibly vague. Phrases like “improve services” and “shared with our partners” are extremely general and tells the user almost nothing about what their data will actually be used for.

Is it any wonder that so many people claim to not care about their privacy when companies like Google make it so hard to understand what data is being collected and how it’s used? As long as this is unclear, people have plausible deniability. Paranoid, privacy-conscious people will assume Google is collecting all the data it can and using it for whatever purposes make it the most money, while less paranoid people won’t pay the issue much mind at all. Google has specifically designed a system so that they don’t have to.

Unfortunately, I have no real solutions to offer here. The best solution would likely be some sort of privacy transparency law which would require companies to simply, clearly, and explicitly outline what data is collected and how it is used. This would be far better than the current system of dense and opaque privacy policies which are designed to be impossible to understand and impossible to opt out of. Given big tech’s lobbying power, this is a far-fetched solution and would require real thought to implement properly in any event. Many FOSS projects do have simple and easy-to-read privacy policies, but perhaps some kind of standard short-hand for letting users know what data is collected and how it is used could be developed in the FOSS world? At the very least this could provide a template for any potential future data tracking transparency law to use. In the meantime though, we are stuck with using our best guess for how tech companies track us and use our data, which is just how they like it.

Finding a Privacy-Friendly Email Provider

Thu, 21 Jul 2022 00:00:00 +0000

Disclaimer: The following is my opinion based on personal experience and does not constitute expert advice or guidance. I am not sponsored by, supported by, or otherwise financially biased toward any of the services mentioned.

The Problem with Gmail

Like most people, I used to rely on Google heavily for basically all of the core online services I used. When I realized what an invasive and anti-privacy company Google is, it was pretty simple for me to ditch Google Chrome for one of the more privacy-friendly alternatives and switch my default search engine to something like DuckDuckGo. It took me much longer to start looking for a better email provider. Downloading a new browser and switching the default search engine is free, only takes a few minutes and the end result is a user experience that is about as good as Chrome+Google. Email is another beast entirely. Gmail’s features are really quite good and you can get a Gmail account for free. Well, for “free” I suppose, since you are paying with your data and your privacy. Google openly admits that it was reading its’ customers emails to build their ad profiles until 2017 and even now there is really nothing stopping Google (or a rogue Google employee) from reading your emails if they wish. And you better believe that Gmail is still using all of your email metadata (like who you email and how often) to serve you more personalized ads regardless of whether or not they read the emails themselves.

The problem is that privacy-friendly alternatives to Gmail are either paid, lacking features when compared to Gmail, or both. That being said, if you want to take your digital privacy seriously, Gmail and other free email providers like Yahoo! or Outlook are not real options so you will have to get comfortable with either paying for your email service with cash instead of with your data or with losing some of Gmail’s functionality. In my quest to find a Gmail alternative, I looked into quite a few different email providers and tried out 4 myself: ProtonMail, Tutanota, Mailbox.org, and Posteo. Most of the other providers I looked into were either not privacy-friendly, too expensive, or lacking sufficient reputation.

ProtonMail

ProtonMail is probably the first suggestion you will hear when asking for a privacy-friendly alternative to Gmail and with good reason. The service has been around for a while and has a good reputation (despite the more paranoid side of the digital privacy community insisting it’s a honeypot, most of the so-called “scandals” boil down to Proton turning over data to the authorities when required by local law). ProtonMail’s interface is very user-friendly and is somewhat reminiscent of Gmail’s. ProtonMail also encrypts all emails by default using PGP (though see disclaimers below), while also providing the option for users to use their own PGP keys. ProtonMail’s free tier is quite generous and includes 1 GB of storage.

Now for the downsides. The main concern I had with ProtonMail was its pricing. While the free tier is very generous, it is restricted to only 150 messages per day (more than most personal accounts need, to be fair) and does not offer custom domain support, alias addresses, or IMAP support. IMAP support essentially allows you to use 3rd-party email clients and I personally consider it to be a pretty essential feature. I like having a copy of my emails stored on my local machine and I don’t like being locked in to my email provider’s email client. While I think it is perfectly fair to lock these features behind a paywall (they do need to make money after all), the lowest paid tier (as of this writing) is €4.99/month! While they do offer slight discounts for yearly/biyearly subscriptions, this is way too much to charge for an email service. I assume the high price is trying to push people toward the “Proton Unlimited” package, which also includes access to Proton’s VPN and cloud storage services. And while Proton Unlimited may be reasonably priced for what it offers, that doesn’t much help users who are just looking for an email service. Additionally, even with a paid plan, IMAP support is only offered through the ProtonMail Bridge. The Bridge is not available for mobile however, meaning you’re stuck with the ProtonMail client on Android/iOS.

The reason why ProtonMail requires the Bridge in order to support IMAP is because ProtonMail end-to-end encrypts all of its messages by default. This is one of the major draws of ProtonMail’s service from a privacy perspective, but is also not all that it’s cracked up to be. While ProtonMail does end-to-end encrypt all emails sent between ProtonMail accounts (as well as emails which are “at rest” on their servers), any emails sent to non-ProtonMail accounts are not encrypted by default while in transit. This is not ProtonMail’s fault, but is a simple consequence of email’s decentralized nature. That being said, the idea of ProtonMail end-to-end encrypting all emails by default loses a lot of its appeal when you realize that “all” really only includes a small percentage of the emails most people will be sending/receiving. While ProtonMail does offer PGP support to encrypt emails sent to other servers, PGP support has been a standard feature of basically any email client worth discussing for a long time now and supporting it hardly makes ProtonMail unique.

With all that being said, ProtonMail is still a very good option as a Gmail alternative. Its free tier is great if you want a semi-disposable account or if you have modest needs from your email provider. While I can’t recommend the expensive, mail-only paid tier, if you’re interested in going all-in on Proton’s larger ecosystem, Proton Unlimited could be a really good option.

Tutanota

Tutanota is probably the most well-known privacy-friendly email provider after ProtonMail. Like ProtonMail, they place their emphasis on end-to-end encryption and open-source in their attempt to build a trustworthy and privacy-friendly email platform. Tutanota’s encryption is very robust and has some advantages over ProtonMail’s and over PGP in general. Tutanota also offers a free plan, which while not as generous as ProtonMail’s, is pretty decent and is likely serviceable for many users. It includes 1 GB of storage while paywalling features like email aliases and custom domain support. The other feature that is paywalled is “unlimited search.” Essentially, Tutanota allows free users to only search for recent emails. Older emails will have to be found manually and not using the search function. While this does seem like a pretty basic feature to keep paywalled, I suppose they need something to push users toward paid plans, so I can’t really blame them.

Unlike ProtonMail, Tutanota’s lowest paid tier is priced at a reasonable €1.20/month (or €1/month for a yearly plan) and includes unlimited search, custom domain support and 5 aliases. Other features such as extra email aliases and extra storage are offered à la carte. The major feature that is missing from both Tutanota’s free and paid plans is IMAP support, meaning you are locked in to Tutanota’s (open source) email clients. Like ProtonMail, the reasoning for this is Tutanota’s encryption implementation. Unlike ProtonMail however, Tutanota’s email client is pretty basic. Honestly, it worked just fine for my needs, but it is relatively feature-poor and has a few unintuitive UI choices which could alienate some users.

Also like ProtonMail, Tutanota end-to-end encrypts emails between Tutanota accounts by default, but this comes with many of the same caveats. Tutanota’s end-to-end encryption will not work for external email address unless you set a password for the email message. This is cumbersome to do and poses the problem of how to securely share the password to the email recipient. You could send it over a secure messenger like Signal, but if you already have a secure communication channel, why would you need Tutanota’s password-encrypted emails? PGP solves this problem by using public/private key pairs, and while Tutanota’s encryption is stronger than PGP’s (they claim it’s quantum-resistant) and encrypts metadata like the subject line (which PGP does not), its benefits don’t really seem to outweigh the downside of abandoning public/private key pairs for a password. Not only that, but you have no option to integrate PGP with Tutanota even if you want to, meaning that you are stuck using their encryption or nothing (I suppose you could encrypt the message yourself and then put the encrypted text in the email, but that seems like a lot of extra work). While you can of course just insist that any correspondents also use a Tutanota account, a program like Signal seems a lot more suited to that use case since one of the major advantages of email is its wide adoption decentralized nature. ProtonMail also offers password-protected emails and many of these points apply to ProtonMail as well, but they at least give you option of using desktop email clients and/or your own PGP keys, so these problems are all the more glaring with Tutanota.

Despite its shortcomings, Tutanota still has a strong use case. I could particularly imagine its end-to-end encryption implementation being put to good use in a team setting where there would be a lot of sensitive, internal email communications. If you are aware of and comfortable with Tutanota’s shortcomings, its paid tier is reasonably priced and not a bad option overall and its free tier is a slightly inferior but still noteworthy alternative to ProtonMail’s.

Mailbox.org

While not as well-known as ProtonMail and Tutanota, Mailbox.org is another common name you’ll hear tossed around when privacy-friendly email services are discussed. Mailbox.org doesn’t claim to end-to-end encrypt all its emails like ProtonMail and Tutanota do, but instead offers a more “basic” email functionality free of the mailbox snooping and analytics shenanigans Google is known for.

One of the most underrated advantages of Mailbox.org is the fact that it has normal name. While this may sound like a silly consideration, if you’ve ever had to read out your email address to a customer service representative on the phone or a casual acquaintance in real life, you’ll know that having an email address like coolguy69@cock.haha may have seemed like a great idea when you were just typing it online but suddenly becomes a bit of an embarrassment. Even a relatively more normal email address like yourname@tutanota.com can earn you weird looks and questions like “how do you spell that?” when trying to do something simple like share your email address.

In terms of features, Mailbox.org is nothing special but does everything you could reasonably want an email provider to do. Its webmail client is perfectly functional and IMAP support is an included feature with all plans so you’re not forced to use it anyway. Mailbox.org also claims to be fully powered by green energy. It is nice to see services like Mailbox.org that seem committed to social progress generally beyond the narrow (though important) area of digital privacy.

One point of note about Mailbox.org that may be a dealbreaker for some is that it has no free tier. However, if you already planned on paying cash for your email provider, Mailbox.org’s plans start at €1/month, which is quite competitive. Although you can only credit your account with a minimum of €12, they do offer refund options if you with to cancel your account before you’ve used up your balance. The lowest tier includes 3 email alises and 2 GB of storage. The higher tiers (€3/month and €9/month) offer more storage and aliases, custom domain support, as well as cloud storage and an office suite if that’s something you’d want from your email provider. In my opinion, everything but the lowest tier is overpriced and its a shame that custom domain support is not available on the lowest tier. The custom domain support and 25 alias addresses in addition to disposable email addresses do make the €3/month tier somewhat attractive, but it’s still a bit much to pay for an email service in my opinion, especially since there’s no option to purchase these features separately à la carte like there is with Tutanota.

The major concerns I had with Mailbox.org related to security and usability rather than to price. When I went to enable TOTP 2FA on my account, I found that I needed to set a PIN and that I would then enter that PIN followed by the TOTP code into the password box in lieu of my password. This seems totally ridiculous to me. What’s the point of 2FA when you’re basically decimating the security of one of the factors by reducing its complexity to a numeric PIN? I ended up feeling more comfortable leaving 2FA off and simply using my randomly generated password. I’ve never seen TOTP 2FA implemented this way before and it did not instill a ton of confidence in Mailbox.org’s security practices.

The second security-related concern I had was with Mailbox.org’s encryption implementation. Mailbox.org doesn’t claim to end-to-end encrypt all of the emails it sends like ProtonMail and Tutanota do, which is fine from my perspective. As I discussed above, the end-to-end encrypted email claim comes with a lot of caveats anyway. That being said, my emails being encrypted while at rest on my provider’s servers is a worthwhile feature and doesn’t impact email’s usability as a decentralized service. Mailbox.org doesn’t do this by default and finding the setting was a real pain. In general, while Mailbox.org’s webmail client is perfectly serviceable, its settings panel is a huge mess and its documentation doesn’t do a ton to help out. Eventually I did find the setting to encrypt emails at rest, which required inputting a public PGP key to encrypt the emails with. While I guess this is fine, I would have really preferred a toggle where I could simply encrypt my at-rest emails using my password. There was also a totally separate setting called “mailbox.org Guard,” which seems to be used to encrypt emails sent from the account, but the functionality seemed a little overlapping and finding the proper documentation explaining what each setting was for was a bit of a pain. Even now, I’m a little unsure how to implement each of these features and how they overlap. I suppose this is more of a usability concern than a security concern, but it was still disheartening to see what should be a core security feature made so opaque and complicated.

Mailbox.org certainly gets points for its relative simplicity and IMAP support even on its cheapest plans. However, some of its security practices certainly seem like red flags (or at least yellow flags) to me and so I’m afraid I can’t recommend the service in confidence. If you’re not looking for anything fancy security-wise and just want a simple email provider who won’t mine your data (and has a normal-sounding domain name to boot) or need both IMAP and custom domain support and don’t mind paying a little extra, perhaps Mailbox.org is worth looking into.

Posteo

Posteo is probably the email service on this list which I hear about the least and it’s a bit of a hidden gem in my opinion. I first heard about it from DigDeeper’s article on choosing an email provider. I’m a little hesitant to reference the article here since the author is a bit of a conspiracy nut, but I haven’t found a comparable overview of email providers from a privacy standpoint that has the same breadth and depth. DigDeeper actually seems to have bothered reading (or at least skimming) the privacy policy and terms of service for each provider they reviewed. If you give the article a look though, make sure to take the author’s claims of what qualifies an email provider as and disqualifies it from being private and secure with a few grains of salt.

Posteo is very similar to Mailbox.org on its surface. Both services are hosted in Germany (as is Tutanota, by the way), both lack free tiers but offer subscriptions with IMAP support from as low as €1/month, and both have similar-looking, green-colored web interfaces and use green energy. Part of me suspects that one project was a breakaway from the other, but I have no proof of that either way.

So what makes Posteo unique? Well, Posteo properly implements TOTP 2FA for one thing. Even with 2FA enabled, IMAP is still accessible with your password alone (this is more of an IMAP limitation than a Posteo limitation as best as I can tell), but you do have the option to turn off IMAP access for your account if you wish. The settings in general are also much simpler to navigate than Mailbox.org’s (even I did stumble across a German phrase here or there where English probably should have been). While Posteo does not offer end-to-end encryption by default between Posteo users like ProtonMail and Tutanota, they do have a simple option for encrypting your emails at rest with your password and they also have support for encrypting them with your public PGP key if you’d prefer. While the encryption is disabled by default, this is somewhat understandable since enabling the encryption prevents you from being able to recover your previous emails if you lose your password, which might not be something the average user wants. But it is good that it’s there and good that it’s pretty simple to activate. There is also the option of mandating TLS for sent and received emails (not sure how useful this actually is, but it’s an option if you want it).

Posteo’s pricing consists of a single tier costing €1/month for basic email access with IMAP support, 2 GB of storage and 2 alias addresses included. You can pay extra for additional alias addresses (€0.10/address) or storage space. While all of the providers on this list accept some form of anonymous payment (either cash by mail, cryptocurrency or both), Posteo is the only one that I noticed claimed that your payment info will be kept anonymous from your account if you choose to pay by credit card. Not sure how realistic that claim is, so make what you will of it.

So what’s not to like? The biggest shortcoming is a lack of support for custom domains. Posteo claims that this is because allowing custom domains would sacrifice their users’ privacy, but if that is really the reason, I don’t see why they make that decision unilaterally instead of letting their users decide. Additionally, aliases are capped at 20 per account. This is admittedly more than most people need, but it’s curious why they would put a cap on alias addresses per account at all if you pay for each one. And while Posteo does have a variety of domains available for their aliases, there is no .com option (though they do have .org and .net). Finally, their webmail interface works just fine but is nothing special, though this is a moot point if you’re planning to use an IMAP-based email client anyway.

Posteo is a great choice overall and probably the best, cheap option if IMAP support is a must for you as it is for me. It is basically superior to Mailbox.org’s lowest tier in every conceivable way (other than the domain name, I suppose) and has quite a few advantages over ProtonMail and Tutanota as well, even if the overall advantage there isn’t clear-cut.

Conclusion

Unfortunately, there’s really no “gold standard” for a privacy-respecting email service at this point. Each service I looked into was lacking in some way. That doesn’t mean that there are no good options though, just that you will have to make some sacrifices in either price or features to find a privacy-respecting email provider that works for you. I ultimately decided to go with Posteo as I felt it had the best balance of price and features. I did seriously consider Tutanota as well, but its lack of IMAP and PGP support didn’t overcome its other advantages (like custom domain support) for me. If I ever decide to sign up for Proton’s full suite of products I could perhaps see myself moving to ProtonMail, but the price of their email service alone is just too high for it to be a consideration for me at this point. I hope this provided some useful information if you’re looking for a privacy-respecting email provider yourself (or perhaps encouraged you to start looking). Don’t rely on my conclusions though. Try out a few services, do your own research and don’t be afraid to share your conclusions with others when you’re done.

Nintendo Switch Ban Essentials: Q&A

Thu, 30 Jul 2020 00:00:00 +0000

Disclaimer: This guide has not been meaningfully updated since 2020 and may be out of date. Use at your own risk. A (more) updated version can be found on Eip’s website.

Bans are scary and Nintendo hasn’t been shy about banning hacked Switch consoles. However, educated hackers know that bans are avoidable and they know how to avoid them. The Q&A below should answer any questions you may have on how bans work and how to avoid getting your console banned.

If you have any further questions after reading this page, you can ask them on the Nintendo Homebrew Discord server.

1. What is a ban and how does it happen?

Put simply, a ban is when Nintendo decides not to let a specific console or Nintendo account use its online services. Most bans associated with hacking are console bans, meaning that the specific console that Nintendo has banned will be unable to use Nintendo’s online services, including the eshop, game updates, and online play. Nintendo reserves the right to withhold these services per their user agreement.

2. What does Nintendo ban consoles for?

The following actions will cause an immediate ban of your Nintendo Switch:

Piracy of any sort
Homebrew NSPs (installed to the home menu)
Changing user icon through Homebrew
Sketchy eShop behavior

The following actions will not result in an immediate ban, but will still result in a ban:

Modding online games
Cheating in online games
Clearing error logs after they’ve been uploaded to Nintendo (this may extend to using both emuMMC and sysMMC online, due to mismatched logs)

The following actions have not resulted in a ban (so far):

Atmosphere itself
Homebrew (via title takeover)
Custom themes
Custom sysmodules
Mods/cheating in offline games
Overclocking with sys-clk
EmuMMC

(Thanks to Val on the ReSwitched Discord server for this list)

3. How does Nintendo know I did any of the things they ban for?

Nintendo filled the Switch with telemetry systems. Telemetry systems basically monitor what the user does on the console, including what games they install, what games they play, and a bunch of other data too. The Nintendo Switch stores this data constantly, even while offline, and will send these data logs to Nintendo as soon as it connects to the internet and Nintendo’s servers. This means that if a bannable action is performed on the Switch (even while offline) and the console connects to the internet at any point afterward, even briefly, Nintendo will receive the telemetry log and ban the console.

4. How do I prevent getting banned?

There are essentially two ways to prevent getting banned. The first is to avoid performing any of the actions that Nintendo bans for on your Switch. The second is to keep your console permanently offline so that even if you take a bannable action, Nintendo will never be sent the telemetry log and will never find out about it.

5.What is an emuNAND/emuMMC? Can it prevent me from getting banned?

NAND is simply a type of data storage that is used in a variety of electronic devices. eMMC is the type of NAND that is used in the Switch as its internal data storage. All of the Switch’s data is stored on its eMMC, which is an internal component of the Switch. This internal storage is sometimes referred to as the system NAND/eMMC or sysNAND/sysMMC. An emuNAND or emuMMC (emulated NAND or emulated eMMC) is a copy of the SysNAND stored on the SD card.

Since the telemetry logs are stored in the Switch’s NAND, an emuNAND is useful because it allows you to have two copies of the Switch’s internal storage. Your sysNAND can be used for online play and eshop purchases while your emuNAND can be used for CFW and hacking and be kept permanently offline. This lets you have the best of both worlds! If you followed the recommended CFW setup on Nintendo Homebrew’s guide, you should already have an emuNAND set up.

6. So I can’t get banned if I use an emuNAND, right?

Wrong.

An emuNAND is a tool to help prevent bans, it is not a silver bullet. You have to keep your emuNAND permanently offline or it won’t help you very much. It is also important to note that even though the internal storage of your sysNAND and emuNAND are separate, they are still copies of the same system with the same unique identifiers. If Nintendo bans your emuNAND then your sysNAND gets banned too and vice versa.

7. But what if I want to use online homebrew tools like FTP or the Homebrew Store?

If you still want to use your internet connection on your always-offline console (or emuNAND), there is a way to do so. You just need to make sure that even though your console may be connected to the internet, it won’t be able to connect to Nintendo’s servers and therefore won’t be able to send the telemetry logs.

The recommended way to do this is 90DNS, which are custom DNS servers that allow connection to the internet, but block Nintendo’s servers. You can find instructions on setting up 90DNS here.

8. What about Incognito?

Incognito is not recommended for a variety of reasons. It functions by blanking your console’s PRODINFO, which is console-unique data that your console requires to boot. If Incognito goes wrong, it can result in damage to your console, even an unrecoverable brick. Additionally, Incognito is less reliable than 90DNS as it depends on Nintendo rejecting telemetry logs from consoles with blanked PRODINFO and while that is currently true, Nintendo may change this in the future.

As of Atmosphere 0.12.0, a virtual PRODINFO blanking feature was included, which is safer than Incognito, but still not a viable replacement for 90DNS.

(Thanks to noirscape on the Nintendo Homebrew Discord server for the explanation of why Incognito is bad)

9. My console is banned. How can I unban it?

You can’t. Sorry.

10. I performed a bannable action on my offline sysNAND but now I want to go online. What do I do?

Restore a “clean” NAND backup of the system from before you performed the bannable action. You can find instructions for doing that here.

Using the Switch’s stock “factory format” feature does not erase telemetry logs and will not protect you from a ban.

11. What if I lost my NAND backup or never made one?

You messed up. Make sure to make a NAND backup for the future.

There is a method for manually resetting the NAND’s data, but it is not as reliable as restoring a NAND backup and should not be your preferred option.

12. So if I follow the advice here I’m guaranteed not to get banned?

Nothing in life is guaranteed. The information here is based on quite a lot of experience, but Nintendo can always decide to change what actions they consider bannable or add new ways of gathering telemetry. Part of hacking your console means accepting a little risk and taking responsibility for your decisions.

Gunther's Guides & More

Resources & Recommendations

Guides/Educational

Blogs

Video Content

Podcasts

Web Apps/Services

Software

Books/Authors

The Internet as We Know It Is Dying

Exploring Reddit Alternatives

Lemmy

Kbin

Tildes

Squabbles

Conclusion

A Philosophy of Cheat Codes

The Internet is Not Forever

Choosing a Mastodon Instance

Don’t Just Sign Up for Mastodon.social

Don’t Assume that Bigger is Better

Do Choose an Instance Based on Your Interests

Do Ask Your Friends Which Instances They Use

Don’t Be Afraid to Apply for an Account

Do Research an Instance Before Joining

Do Feel Free to Migrate to a New Instance

Do Say “Hi!”

Mastodon and the Fediverse: A Social Media Revolution

The Current Social Media Hellscape

Federation and Why it is Good

Open Source and Non-Profit

Isn’t it Complicated?

Federation Can’t Completely Kill Toxicity

What About the Money?

Lack of Originality

Try it for Yourself

GrapheneOS: User Impressions

Choosing the OS

Installation

UX

Sandboxed Google Play Services

Security Features

Conclusion

10 Basic Steps to Digital Privacy

Introduction

1. Change Your Web Browser

2. Switch Up Your Search Engine

3. Use a Password Manager

4. Get a Better Messenger

5. Minimize and Scrutinize Apps and Browser Extensions

6. Sign Up for a Privacy-Respecting Email Service

7. Eschew IoT Devices

8. Limit Social Media Usage

9. Change Your DNS Provider and/or Use a VPN

10. Remove Your Data from People-Search Sites

Conclusion

Tracking Opacity and the Cause of Consumer Indifference

Finding a Privacy-Friendly Email Provider

The Problem with Gmail

ProtonMail

Tutanota

Mailbox.org

Posteo

Conclusion

Nintendo Switch Ban Essentials: Q&A

1. What is a ban and how does it happen?

2. What does Nintendo ban consoles for?

3. How does Nintendo know I did any of the things they ban for?

4. How do I prevent getting banned?

5.What is an emuNAND/emuMMC? Can it prevent me from getting banned?

6. So I can’t get banned if I use an emuNAND, right?

7. But what if I want to use online homebrew tools like FTP or the Homebrew Store?

8. What about Incognito?

9. My console is banned. How can I unban it?

10. I performed a bannable action on my offline sysNAND but now I want to go online. What do I do?

11. What if I lost my NAND backup or never made one?

12. So if I follow the advice here I’m guaranteed not to get banned?