00:00 Hello, I'm Seth Simmons and welcome to Season 1, Episode 3 of Opt Out. Opt Out is a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Have you been wanting to learn more about mobile privacy but not sure where to start? This episode, we're going to sit down with Max Tannehill to chat about mobile OSes for those seeking privacy, and CalyxOS in particular.

Welcome on the show, Max. Thank you very much for having me, Seth. Yeah, man, it's good to finally sit down and chat. How's your week been going so far? All good, yeah. I think, like all of us, we're pretty busy at the moment. We've all got kind of day jobs that take our time and various other drama in the evenings and mornings or whatever with stuff happening online. Obviously, the world's a little different, but no, I can't complain. It's overall a good place to be where I am.

Awesome. Well, why don't you just go ahead and jump in, tell us a little bit about who you are, what you do, and we'll get rolling. Yeah, sure. So I'm obviously from the UK. I'm currently living in Singapore. I have been for about the last kind of over 10 years now. And I work primarily at financial services. So that's kind of where I've been, where I've cut my teeth as a career, very kind of varied time in there. Generally, kind of work on kind of systems implementation.

So kind of trade and order execution. That's kind of, I suppose, my bread and butter now. So it's sometimes surprising some people, given, certainly in this space, we tend to talk amongst kind of privacy and certainly kind of on the cryptocurrency space, which is where I kind of obviously have come across you, Seth, and a lot of our mutual acquaintances and friends. But then kind of about a year ago, which is kind of culmination of a number of things, I set up Mamushi Mobile, which is a website for retailing secure phones, essentially.

And our primary partner at that time was Copperhead, who were releasing, who had been releasing for a while, software specifically designed for pixel phones. So, yeah, the business was set up to essentially help them get those devices into the hands of ordinary individuals, such as you and myself, and really kind of bring those kind of devices to people that may not have already been able to get hold of them through customizing their own device in a way that was probably a little less approachable for some people, you know, that are not used to, say, technically loading onto a new operating system onto their phone or potentially can't even get hold of that operating system to put it onto the phone.

And really that, I suppose, came about from kind of many years in the cryptocurrency space, both as an investor and hobbyist. And from that experience, I'd seen the need for that kind of operating system and that service. And so, yeah, set that up a year ago, and quite a lot has happened since. Awesome. So you basically have two full-time jobs. Working in Rishi and then working in the regular world. Yeah, it's been, I suppose it's been easier, actually, funnily enough, since the pandemic.

Normally in Singapore, it's very common for people to travel extensively. It's only just a small city-state. So when life shuts down and you can't travel as easily, you do tend to need to find other hobbies. And that's actually fundamentally one of the reasons why I started it. We've been going through a bit of a lockdown here, and I kind of had extra time. Couldn't go to the gym as easily. So it was kind of something to keep myself focused with at the time and have something to do.

And when you've got a few hours concentrated on the weekend and you haven't got all the distractions of a gym, swimming pool, a social life, yeah, on that plus side, it's amazing what you can get done. Yeah, I definitely understand. I feel like a lot of people started up side projects or side businesses or something like that during this extra time that we have. Or learning a musical instrument or something like that. I'm quite sure of those things.

Everyone needed something. Yeah, I'm curious. I mean, if you don't mind mentioning, what was it that drew you to Singapore? I've been there for work in the past and love the city, but I'm curious what drew you there from the UK? Oh, so funnily enough, actually, it was very much something that I think I was actually not... It was just really just the needs of the job at the time. My boss, when I was the first company I'd been working at, was actually based in the US.

I fully expected to be living and working in the US. I think as a young guy at that time, without any personal commitments, I was very happy to travel, kind of see the world. And I was, you know, felt a little constrained in having, you know, just being stuck still in the same country I've grown up in. I think, you know, if you've kind of got a bit of a travel bug, you enjoy going somewhere else. But really, yeah, it just turned out that there was kind of space in Singapore at the time.

They needed someone to do some particular projects. I got sent out as a young guy. And at that point, you know, I hadn't even been to Asia and I'd already kind of agreed to kind of leave and work out there. So it just kind of happened from there, really. And since then, I've just stayed there. You know, obviously, once you're in a new place and you didn't start putting roots down, you end up suddenly realizing 10 years has passed. So it's very much...

It wasn't planned. Nice. And was it something with that job or with cryptocurrency that woke you up to the need for personal privacy or just something totally unrelated? So I wouldn't say it's unrelated, but I would say the whole kind of personal privacy and cryptocurrency thing kind of came about around the same time. And I actually, funnily enough, I can't even really pinpoint when it happened. There's a few little things, I suppose, that jump out at me.

I think, to put it best, to kind of take a step back, probably around 2010, for example. I mean, I'd never been a particularly technical person I hadn't been interested in. I wouldn't... I'd be very normy, as it would be discussed. I would have had, like, windows on my machine prior to 2010 or 11. And, you know, I wouldn't have really cared particularly about security and devices or privacy as such. But I think a few things change is that once I moved abroad, I was kind of a fairly early adopter of stuff like Telegram, WhatsApp, just primarily for keeping in touch with family and friends.

And so you find yourself, just because of the situation you're in, using that kind of tech because you need to. Because, you know, you haven't got the convenience of just being close by to pop around and see someone near you because you're in close physical proximity. So I was using kind of video calling and all that and, you know, stuff over VOIP, all that kind of earlier than some of my friends. But then I think a few things have kind of happened is that I think the time, I think, Snowden allegations were, you know, some revelations rather had been coming out.

And I think for someone like me, even with the background that I had, I think it was a bit of a, it fundamentally changed who I put trust in. And, you know, regardless of your opinions on Snowden, and I suppose even back then I would have considered myself kind of relatively patriotic, be kind of conservative, you know, with a small C and right wing. It was hard not to have your faith shaken in some of the institutions that we'd allowed. I think, you know, I believe probably back then it was completely fine for an intelligence agency to be able to, you know, to listen in on me should I need to.

Really, back then I would have believed that because I thought fundamentally the incentives were okay. I think that one of the things that happened with Snowden is that he revealed a lot that just showed how, you know, when you have got that kind of power centrally, you know, that power exists in government, those incentives aren't always okay and that what the governments are getting up to doesn't necessarily affect the word of the people if it does, that isn't necessarily morally or justifiable.

So I think as that was coming out, it was making me probably back then looking at more kind of open source type software that I felt could be more trusted and I was beginning again to look into encryption and I do remember around that time diving into reading about public key encryption. So I think I was even using PGP before I even discovered Bitcoin. You know, find that quite difficult to use and complex and so I think all of that was kind of occurring around the same time and that kind of sucked me into a bit of a rabbit hole at that point and really kind of from there that's what brought me in and I think once you start using something like Bitcoin you then find that associated comes with that and enhanced kind of need to look after your own security and privacy just because at that point

10:00 You're obviously managing money that is a bare instrument and you haven't got recourse to a bank. So you really have got to take your security seriously at that point. I think that really that's kind of when it happens. It's nothing to do with a job or anything like that. Yeah, I think one of the biggest revelations for me out of that Snowden stuff, I mean, I think I had somewhat known and there have been little leaks here and there about what surveillance was going on.

But like you, you mentioned that you just kind of thought like, OK, it's worth it. I understand the need for it. Like they're making arrests, they're catching people before things happen, that kind of thing. Yeah, yeah. I think one of the things that jumped out was that that type of dragnet surveillance didn't actually lead to arrests in any large numbers. And in many cases to no arrests. Oftentimes that dragnet surveillance didn't actually prevent any crimes.

It didn't prevent any of the kind of the large attacks. And so it was interesting to see that that dragnet surveillance was being done. And the reasoning was, hey, we're actually making you safer. Then it wasn't actually even providing that. And it was being used to actually spy on US citizens, even though it technically wasn't supposed to. And there was a lot that came out of that. I mean, I feel like that was probably one of the turning points definitely for me and also for a lot of other people to realize maybe this dragnet surveillance doesn't make sense.

Well, I think that was a huge thing as well for me. I mean, I wasn't completely unfamiliar with the kind of the idea of whistleblowing on this type of stuff anyway. I actually studied history at university. I actually done a lot of work on research in counterinsurgency. Big kind of area of interest for me was stuff like the Vietnam War. And so it was kind of, you know, a lot of my kind of original studies have been looking through things like the Pentagon Papers.

And actually, of course, you know, how broken some of how the government was operating during the Vietnam War and how certain things were being hidden from the American people at that time to do with the success of the war. I think even back then, you know, you see the kind of the dangers of some of the central planning going on and people making decisions based on statistics that were, you know, were very kind of removed from people on the ground.

So one of the things I do remember, you know, I'm of that generation where 9-11 still had a pretty big impact. You know, I went to university in 2001 and, you know, fully expecting when I joined the army in 2005 to be going to Afghanistan for reasons that completely tied to everything I'd seen happen at kind of very impressionable age, 18, 19. But I had also read the 9-11 Investigation Commission. And, you know, a big thing comes up there with actually just how overwhelmed, for example, US agencies were, the absolute glut of information they had because of the Dragnet surveillance.

And it was pretty clear kind of what a lazy way of getting intelligence the Dragnet stuff was. And it actually hindered their efforts to actually, you know, to withstand attacks because of that, because they just simply had too much information. And I think, you know, I think as you get older and you also, you get a bit more jaded, but I'm, you know, I'm sure here we've all been through like the TSA type checks in airports. And we're seeing this now, of course, I don't want to go into too much detail on this, but we've seen this, of course, with probably what you'll have seen with some of the kind of the enforcement of COVID restrictions.

But you're starting to see kind of a lot more of these kind of arbitrary rules put in place, regardless of what you think about threat of international terrorism, regardless of what you think about the threat of the pandemic. And it's quite obvious that some of these things that kind of infringe upon your rights and actually just interrupt your day to day and often fall into kind of quite a heavy amount of inconvenience and have second order effects that you see that may not be the original intention of the people that have put in the legislation in the first place, but happen anyway.

And I think that's become kind of a lot clearer over the last few years to me. There's been a big reason why I've kind of sought greater privacy on my online life and championed it and supported and used that kind of software. Yeah, definitely. Definitely agree. And I'm curious, is there any kind of common myth that you've seen people believe about personal privacy, something that you've run into? I think there's, yeah, I think the biggest kind of myth is, is that, and I think this is quite common one, though.

I think it's the fact that people think that you actually can't stop yourself being listened in on by the government. You know, the people, you know, people have been, have been used to hearing all the successes of the government, agency types and screw ups by criminals and, you know, whistleblowers, for example, where they have been caught. You know, we are all aware of spies, for example, that obviously very kind of best in their trade, potentially, and still get caught.

And this is all out of reach for the ordinary person to do. And I think that that leads to a bit of defeatism in a lot of people. They've already made that Faustian bargain that if they're going to have a trade device, that's it. They need to give up everything anyway, because the large corporations, the government's going to be able to listen into everything you have. So I think that's kind of a big myth. And the reason I think it's a big myth is just because your privacy and your security are all on a scale.

And so, you know, encryption, as Snowden said, works. If you use something like a GPG to compose a message to someone else, I think you can be very, very sure that no one's going to know the contents of that message. I think if you've obviously got someone targeting you and they've invested time and money, you know, other resources into specifically listening in on you earlier, sure, that's going to be far less likely that you're going to be able to stop yourself being listened in on.

But the forces out there, criminal, government, whatever they are, they're not omnipresent. They're not everywhere. And just a few small steps off that are all it needs to do for you to dramatically increase your security and your privacy. And that's well within the reach of ordinary people. So it doesn't need to be using any technology that's particularly different. That puts you well outside the space of other people. You don't need to be a hermit.

You know, you can use fairly, fairly ordinary tech. It's just about understanding, understanding a threat model, although I don't particularly like using that term when I speak to just ordinary folk. But it really is about that. You know, what are you concerned about? You know, what things to you are important from a privacy perspective that you don't want people to know about? And if you think of it from those kind of first principles, it becomes very easy to think about what you need to do to protect against.

And also, I think to think about when you interact with services and people is not to just because it's a nice website that may be presented well, not to abstract that away from the fact that it is being operated by fallible people. When you do sign up to a service, that means that your data is sitting on someone else's computer, someone else is using it. Just to appreciate that when you go and interact with other people and other services. So I think, you know, that's really the biggest myth is that people feel that they need to give up before they can get started and that there's no point really doing some of this.

And that really becomes very obvious is wrong. It's when you start looking into some mitigations that you can do. Yeah, I think that's a really good point about the idea of a threat model. Like you said, that phrase can be kind of daunting or scary or not helpful for normal people. But I think even just bringing it down into two kind of simple camps. One being you want to avoid dragnet, government and corporate surveillance. And you want to avoid data breaches causing you to have personal information leaked.

And I think that's the one that most people will fall into. And that's where the kind of low hanging fruit, the not super advanced techniques are the things that are going to protect you from that. Things like using encrypted messengers, using a VPN, using maybe Tor browser, stuff like that is going to protect you from those general surveillance techniques. And like you said, if your threat model is that you're worried that a government or nation state is going to be targeting you specifically for surveillance, that is a whole other ballgame.

But almost no one needs to worry about that. Most people fall into that first camp of, hey, I just want to make sure my government's not watching everything I do. I want to make sure that corporations aren't seeing everything I do and correlating that between corporations. And then I want to make sure that the companies that I give my data to when they're breached, because almost always they're going to get breached at some point. My personal information isn't going to leak or at least as little as possible is going to leak.

Absolutely. And I think one of those kind of analogies that gets used often is imagine just locking your door, for example, and your door in your house being locked compared to your neighbors. And therefore anyone that is looking to steal from you or grab your information or whatever it is, a target, they'll possibly leave you alone because there's an easier target next door.

20:00 I think although that's helpful to explain the reasons why you might use a better messenger or use a proper password and a password manager and all those things that get spoken about and I think the largest problem people have is that they're not aware of how the internet works and I think that's a tough one to get across and I think that one of the things that of course with these tools is that they're not just offering a single function so for example a key in a door is pretty easy for most people to understand and you have to put time and noise if you're going to go get round that key in a door potentially some physical force as well so people are very clear that a key locks a door it stops getting someone inside and with something like say your Tor browser there's a lot going on there you know the something like a Tor browser will obviously be obfuscating your origination and your IP for example from a website that you go to because it's going through the Tor network and it's also going to have some security features and you know it may not run

JavaScript on the browser and it would also have potentially other other privacy aspects which aside from kind of your network privacy of the IP but it may not make it so likely that there'll be a bookmark sorry an extension or something like that on the browser that could be giving away information to a service that you access so these tools are complex for people and therefore you know if they do see something like or use something like a Tor browser they may know that it's providing some security and a degree of privacy or whatever but they might not know exactly how that relates to what they're doing on the internet because it isn't clear for a lot of people that you know there's transport layer security going between your device and the server that you're going to it isn't clear necessarily how an IP you know a domain name that you enter is resolved to an IP address and that takes you to you know that gets you to the server to get information from you and it isn't clear to people that uh uh that you know when you are downloading information

information from another site that maybe an internet service provider that you signed all that information over to you when you actually bought that service as a customer in your own country to your house and that they're actually able to spy and to what degree on on this on the sites you're going to so i think that's the big thing as well it's just the sheer complexity the multi levels of of just an ordinary activity on the internet these days just how much it involves so i think that's that's intimidating for people i think i think certainly out there but even for my generation i suspect you're younger you're quite a bit younger than me but when i grew up with the internet i didn't grow up really knowing that much in the early days you know it was a relatively mature ecosystem so i wasn't aware of all those kind of layers to it and that's required me to research and dig into it of course most people won't do that i think that makes it harder for them to work out how do they handle their threat model and what's going on what they need to think about when they're looking at all this vast array of products and services that are there available

for them to um to protect themselves um or give themselves enhanced privacy when when they're doing when they're on the internet yeah that's something we talked about a bit in uh the first episode of opt out with henry is he mentioned this idea that we need to make these fast tools and these privacy preserving tools so good that people just use them because they're the better tool not because they understand every aspect of their threat model and understand how uh how ib addresses work and how networks work and how the protocol layer stack works and all this all of this stuff that honestly most people aren't ever going to look at much less understand being able to build those tools in a way that they can approach them and use them even without understanding the details and still be gaining uh an impactful amount of privacy from using those yeah and i think i think that's actually uh it's it's more doable than some of us may think um you know just just as a as another example i mean we've we've spoken about obviously nation state attacks dragnet surveillance

and um for a lot of people right that even even when you go through the snowden type um revelations they're still not bothered uh and i think yeah i i think where where people are waking up a bit more to the idea of privacy is i think you know the early experience for a lot of people with facebook is a pretty significant one and i think one reason i kind of suggest say that is is that and certainly kind of people of my generation um facebook was something that just kind of essentially launched around time at university or within a few years afterwards so we didn't all think about the effects of sharing all your information and putting it out there um but i think for a lot of people uh we've experienced the downsides of sharing that kind of information on services such as facebook and i you know i don't even mean particularly information shared with facebook themselves but if you spend you know several years um uploading holiday photos and all that and you do experience certain types of people snooping through your data in a way that you don't want

and people are also aware that if they for example remarry or get another girlfriend or boyfriend and that they have got a quite large digital footprint of the ex or something like that on social media and that in itself becomes a liability it becomes something else to track and i think what we have seen over the last few years is people do wake up the idea of online private privacy not so much in a way of stopping government or corporations and go into it but actually thinking about well how can i protect my privacy against my from my peers and and not just protect my privacy and stop my you know stop my information being listened to but how do i manage it in a way that um that i actually have a bit more control over it just because from a personal perspective i would feel the impacts of that that much more it becomes hard for me to manage my life because you know what could have just been hear say and rumor is now here logged electronically stored and available for anyone to kind of crawl through as they wish

so i think that's i think we with kind of that point from henry's made this is that products and services that compete on a on a way of sensibly allowing people to manage their privacy do have a good good chance of of of uh being successful just because there's they are actually um offering a valuable service and they can give a better user experience just because yeah they are respecting that thing and it's natural to care about closing the bathroom door closing curtains to your bedroom we do have things that we don't need to or want to share with with everyone so privacy does need to be built into your services and hopefully the kind of increased flood i feel like is happening right now of a focus on privacy even among large corporations but also just people like Techlore people like katan from last week myself putting out this podcast just all of the educational content that's being put out i'm i'm really hopeful that a lot of this is getting and filtering down to people who haven't thought deeply about it

and they just kind of get a wake-up call to say like hey maybe i should care about this and maybe i should start taking taking care of some low-hanging fruit that i can that i can knock out to achieve some some better level of privacy um and just yeah just a quick question of left field but just kind of curious uh what's something you feel like almost no one agrees with you on oh um i think on that one um i i think the closest one to that is is that is that i believe there's a there's a there's a there's a general kind of rule out there that people can't manage their own keys and that sounds potentially a bit random um but uh a lot of services are built here you know the the idea that you imagine passwords that someone always does need a way to reset an account um and that people can't necessarily store a password correctly and they can't the kind of kind of look after that technical kind of uh uh level of expertise is beyond the reach of most ordinary people i.e you know you need to be someone that does care and you need to be

someone that is technically proficient to store them appropriately and manage that and and and also that we necessarily need it to be mainstream that um services are out there to provide a lot of that security for you and the reason i say that is just that you know yeah we can look on a daily basis and see some proper you know real stupidity from from humanity and you know i i you know i do understand that and know that but at the same time it is amazing what uh even even what the absolute lesson average of intelligent class can achieve and i think kind of a really good example of that is look at how many people go out and get a driving license and we operate something as complex as a as a vehicle for most people on a day-to-day basis and and do that and everyone has to pass pretty much in the world has to pass some form of test and have to manage kind of quite dangerous piece of equipment if it's used incorrectly so i think that it's just essentially just needs people to care you know and it um and it needs to

be kind of part of culture if you turn that aspect on its head that people can't

30:00 can manage their own information. And of course, that ties with something like cryptocurrency as well. The consequences to that are kind of far more far reaching. The idea of a custodian for your data or for your money suddenly becomes a lot less of a prominent piece of people's lives than it does now. And I believe that is something that, if the right tools are available, if the right things happen globally, culturally, and all that, then that kind of switch can happen.

Because sure, we are very used to the idea of people not taking personal responsibility for things, especially in the welfare type states that we live in. But people can take responsibility if they're allowed to. And if there isn't something unnaturally manipulating the incentive otherwise, it's a very core part of an individual to be able to hoard something for themselves. Squirrel will bury its nuts. It's not an advanced thing to be able to plan for the future, to take some personal responsibility, and to do those kind of things.

And I think that we do baby people, baby our users, substantially in our expectations. And actually, all it is, is a mindset change. Yeah, and corporations have been more than happy to fill that role. I think that's something that, as we've moved further and further into the digital age, they've loved the chance to be able to be full custodians of everything. I mean, everything. Everything. Passwords, photos, every status update, every location, everything that you do, you're trusting with them.

And there are definitely benefits. I mean, the biggest one is you don't have to worry about losing it because some central party is hanging onto it for you, assuming they still decide that you're worthy of an account or worthy of having that data. Obviously, you could get kicked out at any time. But there is that big upside. But I think once you realize what you can do on your own, like you mentioned, it seems complex at first when you actually dig into it.

It's really not that crazy. And there, again, are people putting out good content. There are lots of great tools. And it's something that once you kind of fall down that rabbit hole, it just leads you to so many other things because it can start out with something as simple as switching to a password manager instead of switching to something like key pass, instead of leaving all your passwords in your browser sync, something like that. Absolutely.

I think you kind of also, you just come into an interesting point here as well, in which you talk about the whole de-platforming. And I think that's the other thing that is becoming a big aspect to all this focus on security and privacy is that often when you first look at this, it is the default, right? That you sign up to certain services and then you look at a way, you know, we are social beings. You look at a way to interact with others that preserves your privacy, preserves many security when you're doing so.

What we are seeing a lot more, I think now is because these are such huge tools in our lives, whether it's video conferencing, whether it's sharing media and all that. The idea of being kicked off a platform is that much more likely these days. I know Kitan would have covered this in the episode as well. It's something me and him speak about quite a lot. But I think, you know, getting an expert, you know, a level of expertise in your privacy and in security does help you, of course, if you are going to start hosting some of this yourself.

And, you know, properly tailored privacy and security practices actually helps you with your censorship resistance and your ability to withstand BNT platforms because it stops you over sharing information, for example, that you may not be willing to or you may not realize you wanted to. And companies, of course, have less liability if they're not got necessarily information that incriminates you or causes you problems. So, you know, these were all kind of heavily related.

And I think that's another part, obviously, we'll get into when we speak more about kind of phones is that it's not just about security and privacy. It's also about producing that need to have an account with someone. And I think that's a kind of, certainly in the last year, something I've kind of noticed is much more a driver requirement for customers as well. Yes, let's get into that a little bit more. What are some of the tools you use regularly to opt out that you'd recommend others to take a look at and why?

Sure. So I think kind of, I think kind of, you know, basic ones would be like, you know, encrypted messengers. I think, you know, thankfully, like it's kind of far more of a default thing now. You know, WhatsApp adding end-to-end encryption there is kind of far more normalized that. So I think Telegram, even if it was end-to-end encryption, you know, for all chats, certainly kind of pioneered for instant messenger. It's for that encryption for people.

So, yeah, I mean, you know, those kind of chats. I'm a big user of Threema. I've kind of, you know, obviously you've got to kind of handle the network effect substantially here. So it's not always easy to do. But really anything that kind of gives me a default level of privacy in terms of, you know, encrypting my data from the provider. I do use emails such as ProtonMail. And I've, you know, actually been for a while now hosting my own Nextcloud instance, which, you know, doesn't necessarily encrypt everything.

You know, it's a bit more experimental, that support there, but at least stops me putting my data, I suppose, in a very structured way for a company like Google or Microsoft, for example, to do structured analysis on and pick up data. And I tend to put on data that is encrypted onto something like Nextcloud. So it's something that I can self-host. I have under control of my own domain name. And it's something, of course, that's backed up. So if I lose devices or whatever, it enables me to use tools without being at the invitation of someone else.

And obviously, you know, in terms of on the cryptocurrency side, things I speak about a lot, but I, you know, I use Bitcoin and Monero wallets. And they enable me to do transactions, of course, that don't require permission. So it's kind of a huge part of my life now. And it does give you a huge amount of power and benefit, right? You know, your savings and your ability to transact aren't always at the whims of third-party control. I'd be a big user of ad blockers on my internet browsers.

And, you know, I have to say, I really don't get bombarded with many adverts or anything. And, you know, for me, that's a big part of opting out as well. It's that I think a lot of the information that people are consuming at the moment is a result of a lot of nudges from corporates, from governments, etc. And that affects your ability to kind of research and arrive at those conclusions yourself independently. So for me, that's a big part there. And from social media, you know, don't do a huge amount, but I started using Matrix a little more, federated messenger there.

And the associations I have have been willing to do things like hosting things like a Matrix server or something like that. So you can go out and socialize with someone on that without the same kind of fear of room being sick, you know, breaking a policy of some sort for, you know, for whatever is being discussed and then being shut down. So I think that's kind of a very powerful connection to kind of make there. Awesome. I'm surprised you didn't mention CalyxOS or any kind of mobile OS there, but I definitely mentioned a lot of thoughts around that.

Yeah. Yeah. The funny thing is, right, is that I think the mobile OS aspect is an interesting one because it sits so much behind all this, like still the applications of what you tend to see on a day-to-day basis. And I think the other thing as well is, is that, you know, even the browsers I use now are kind of different to what I already used before. I mean, I'm using Pop OS more on a day-to-day basis now. And that's kind of got the benefit of an actual separately run store.

So, of course, you can still go to a website or a repository and install the software you want. But it does also make things like un-Googled Chromium Super ET2 to run and install. I think that's kind of a huge thing. And in an ideal way, your operating system and your browser, of course, there's a bit of crossover in those two anyway. In an ideal way for me, you shouldn't even really notice them that much. They shouldn't kind of be at the forefront because they should just be essentially a window for you to run applications on.

So, I mean, it's actually never at the forefront of my mind, something like Alex or Pop, because I just don't tend to see it too much. And I think one of the things I've realized is if I ever do use another OS, such as a Windows or even Mac, and unfortunately even iOS, more so these days, is that the OS does get increasingly in your face when you're using it. There are things that pop up and push you into stuff that you may not want to do and you find yourself being increasingly restricted by it.

So, yeah, it's never first on my mind, funnily enough. Around that topic of you're talking about iOS and macOS there, how would you say something like CalXOS compares?

40:00 to iOS for privacy and security. I know iOS is kind of generally touted as being private and secure, and there's very conflicting kind of stances on it, but generally it's kind of widely viewed as an okay option. So I'm curious if you have any thoughts around kind of iOS versus CalyxOS or other false Android versions. - Yeah, so there's actually, this is actually kind of a really huge piece, and I think it intimidates a lot of people, but I think this is probably the most useful thing we'll probably end up discussing here today, and because it's a subject that for a lot of people is most difficult to get hold of, I think for a few reasons, is that just by its nature, a phone tends to be a more expensive piece of equipment, so people don't always have the luxury of trying out a whole number of different phones and operating systems, and they're very personal devices, once you are set up and running, and there's a, you're kind of kept to it, right?

So I kind of forget the best kind of term to use there, but there's a friction to migrating between devices unless you're particularly ruthless with your own information and your ability to move between the two. So I think for a lot of people, there's an inhibition from just experimenting with another OS, especially on mobile, where you are baked into a bit of an ecosystem. And so I think one of the things that's happened over the last few years is that I've really forced myself to use multiple OSs, and actually I think like you, for years before getting started with Calyx and Copperhead and all that, I was a big iOS user, and the reason I was was because, one, I respected the security and privacy guarantees, and I think they were always pretty good, but also I like to see in this experience.

And I promise you, although some people always doubt this, it has nothing to do with the prestige or the, you know, the wish to be seen with a fancy Apple device or anything like that. You don't have Apple stickers all over the back of your car or anything like that? No, I never had that. I actually, I found the, I found the, I found the, the conferences pretty cringe, and I really liked the, the culture around it. I just, I just like stuff reliable and to work.

So that was a big reason for me using the, you know, for being, being involved in your ecosystem. And I mean, they have a reputation for expensive products, but actually when you do look at it, for example, on the Android side, not the kind of, what was kind of known as an ultra book type laptop, you're actually looking at similar prices, I think to those products anyway. But anyway, back to your question, how the two compare. And I think it's kind of, there's so much to separate.

So for a start, when you, when you're comparing iOS and Android, and iOS is a far tighter ecosystem, you know, devices are less disparate. You've obviously got one manufacturer there, Apple, largely, obviously they're subcontracted, obviously amongst kind of other companies there. And, you know, but Android's got far more kind of open, you've got large companies like Samsung, Motorola, those types. And so you've got big difference in the actual available hardware.

So it's always easy to say that something like an iOS device is, is more secure, especially if you're fitting it into a bite size article, because it's very hard to, to write an article and have all these exceptions. Yeah, sure. Android's great if you use the very good device, but of course, other people aren't using devices. And when security incidents happen, it can often be other devices that aren't some of the necessary, the, the higher end that are being exploited.

The other thing, of course, is because it's a far smaller range, iOS is pushing out updates, and security updates, and, and, and, those devices aren't getting them, and they're upgrading that as much sooner. Whereas Android is very much kept the individual, original equipment manufacturers to do so. So I think there's a, a huge variation there. But I think, I mean, uh, from, kind of our perspective is, can you get that same level of security and privacy with an Android device, as you can with an iPhone, or an iOS device?

For me, it's becoming clearer and clearer. Uh, really since the, uh, the, the, probably about the pixel three and the, uh, the three a, uh, you, you now can, and that's been the case for kind of quite a few years. And the, the, the Nexus line of devices, then followed by the pixels are devices that Google's got control over and that Android is being tightly built towards, um, the, the, the, the flagship devices, the ones that do get quick updates.

So they are not the same as the other devices that you're seeing, um, uh, in the Android ecosystem. Um, also Android itself over the last few years, um, has had an increased focus, um, on security and privacy. You know, now it's like Android 11, or I think it's actually from Android 10, you've got individual, uh, uh, toggles and, um, trolls over what, what, what apps will have access to your location, to your microphone, all that. The, those, that power is within the software and that all plays right into an overall assessment of, uh, how secure a private devices.

And those, those, those, those things have to be included when you pair those. So, I mean, the other thing that happens is, is that you've got something like, you know, uh, iOS had a big thing with secure enclave and including a secure chip. I think that came out around the time of iOS five, but don't quote me on that. Um, and then with the Google, they, they, um, with Google, they, they built the Titan M chip and you've now got in flagship device, such as a pixel, unlike even the Nexus, although there was some, um, there's some, uh, not so much as a secure chip, but there were, there were other aspects of the model there.

And you, you, you, you, you, you now got the kind of the benefit of your, your actual password being stored in a specific secure chip. You've got the ability to withstand brute forcing attacks. I, you know, people, you know, getting your password or running software, you know, a device, like a kind of celebrity device. You've got lots of mitigations now on like the kind of more modern pixels, um, like you have with an iOS device, the stop at rest, your device being broken into.

So I think kind of on those levels, without going into too much detail, your top of the line pixel, or actually even your, not top of the line pixel, but your pixel being a top of the line Android device gives you a physical security, um, perspective, very similar security to some of my iOS device. Now there's obviously small differences within, um, the actual Android software has different degrees of sandboxing, um, um, you know, with, with actually the user space of the app occupies, how, uh, data is held in memory, all those things.

But I think by and large, you're looking at a broadly equivalent, it can trade blow for blows, um, like top Android with iOS device. Um, but I think you've also got to factor in is what is user behavior with those devices. And even then with those devices, what kind of products and services do they sign up to? And obviously with something like Apple, the iCloud services baked into that. And as we saw with, um, the celebrity hacking of photos is, is that, you know, when, you know, when you've got a service such as Apple that encourages unencrypted information on their servers and a huge amount of metadata, that all affects your security and privacy.

With something like a Google Android device, if you've got Google Play services, you've got a huge amount of data being shared there. Um, and I think that's the, yeah, to kind of summarize, one of the great things about the de-Googled Android is, is that you're getting very much the best of what Google offers, um, because they are building excellent hardware and they are building excellent software. You're able to take out the, the Google service offering, which isn't particularly respected with your privacy.

Um, um, and you pull it out and really get the best of both worlds. And I think, you know, the great thing with, uh, with, uh, the, these custom OSes such as Calyx, such as GrapheneOS, and such as like the Copperhead OS that I have some experience with, is, is that this isn't taking an operating system and hacking it onto your device. Devices are fundamentally, the, the pixels are designed to be able to be installed on device like a pixel and actually use it.

You can use the secure element to enforce the integrity, uh, of the software on that device. And you can even do that with a third party signing key. Uh, so if you, you, if you are one of the Calyx developers, and you will actually sign software, you trust it, the chip will be used in that. And that's incredibly powerful because now you've got something that gives you similar control. Um, so something like an iPhone device, but you're not just dependent on Apple to be able to do that.

And I think that's really what I, um, you know, the big thing. And that was a, a big, that was a big pull for me to move away from iOS was when I realized that with the latest devices and the type of software that combination was bringing me to something I was used to getting with iOS, but without the dependency of Apple. Yeah. I think that's something that has become so much better with the release of GrapheneOS, Copperhead OS, CalyxOS. And the, the concepts behind those is I've, the trade-off used to be kind of, do you want the security and reasonable privacy of iOS, or do you want the control and flexibility of Android while sacrificing security and sometimes sacrificing privacy?

There's a lot of nuance there, depending again on the vendor of the phone since they customized the OS, but, um, yeah, you could also flash something like lineage or like cyanogen mod way back in the day, but then you greatly sacrifice security. And there were a lot of issues around that, but with, with these types of OS's you're able to not only verify that it's, it's actually what you want to be,

50:00 to be running, but you still have that ability to be flexible in the services that you use, to be flexible in the tools that you use, to easily connect to self-hosted things and change defaults. And it gives you that flexibility, but without sacrificing the security in most situations. Obviously, there's a lot of nuance, and you did a great job of covering the majority of that nuance. But I think that's the important thing for me is you can finally opt out of the walled garden of Apple and not sacrifice, at least in a big way, the privacy or the security that comes with that.

And in almost all cases, you can get even better privacy now as well. So that's why it's a really important step forward for me. And I've loved that experience so far. Absolutely. I mean, the thing with the Lineage device as well is the Lineage OS developers have done some really incredible work. And a lot of those apps you actually see included in stuff like CalyxOS now and Copperhead as well. Less on graphene just because it is a far tighter and smaller app ecosystem by default that goes on that device.

But a lot of people that are experimenting with something like Lineage will actually be doing it on devices that don't give you that ability to flash the device in a way that unlocks, locks the bootloader and uses the secure alignment of the device to enforce that. So, you know, while some people, you know, they actually may be fine having a relatively insecure phone physically because maybe they just, you know, they don't actually take the phone with them now.

And for some people, especially if you're saying the city, you're in a coffee shop or you're worried about theft, you might not be worried on a day to day basis of your device being stolen and being exploited. But of course, if that all that needs to do is happen once, and then someone's got a device that potentially opens up to your entire digital life and more. And I think that's a really, for me, that was always a big, it was just a big inhibitor for me to ever experiment with doing things like custom ROMs on an Android device.

It had no interest because why would I want to experiment with all that if I was going to potentially really open myself up to a lot of security problems? I think that was the kind of, that's a really big thing with Pixel devices and, you know, with what they offer. That's incredibly empowering. Yeah, for sure. And we've talked a bit about GrapheneOS, Copperhead OS, and Calyx, but I wanted to talk a little bit about the drama that's gone on in the privacy OS ecosystem.

I've just watched you go through it. Obviously, you were working with Copperhead OS in the past and just really respected your approach. You feel like you were very slow to pass judgment and very cautious in how you handle things. And I really respected that. And I just wondered if there were some key takeaways that you had for listeners and for me, honestly, on how pro privacy and false communities can better handle these types of conflicts. Okay.

Well, firstly, thank you. It's very kind of you to say that, especially as well, certainly when I look back on some of my communication, I do sometimes think, my God, I lost my temper there. So, you know, I don't think I've always handled things the best way. But I mean, in terms of how to handle kind of all these conflicts and all that is, is that I think the biggest part here is actually empathy. And you've got to look at kind of what everyone's trying to achieve.

And also, I think you've also got to think about like, especially if you're involved in the kind of drama, especially online, you've got to think about what someone else is going through when you're discussing with them. I think, you know, certainly in the last year or so, we can also think of some of the mental health issues some people may have had just because of some of the experience of the government reaction to the pandemic and all that. So you've got to take a deep breath sometimes with some of this.

And but when you are kind of arguing with someone online and stuff, I think one of the most important things is to have a to actually agree on the definitions of certain things. And that may sound like super obvious, but some people will speak about that thing. And when you are having an argument, make sure you're at least starting from the point of agreeing what certain terms mean before you're discussing other stuff. And I think that always puts you into a good position to at least get the most value out of any discussion that you have.

So I think that's the thing. I think the other thing as well is, is that you've got to try these things fundamentally yourself anyway, to really get a good idea of what this is all about. You're not going to be able to fully understand the nuances of all this by just picking stuff up from an internet argument or seeing what's on a YouTube video or what someone said. And you do need to test some of this yourself and go through it. You've got to, you know, what people see as their threat models could be super different to what you do.

And for something like, I think it's very interesting, something like graphene. It is actually fundamentally a science project. And I don't mean that in a bad way. But for some people, right, they just want to say, I want my secure phone. I want a really good phone. And it may be that something like graphene is really good for that purpose. If you're not going to necessarily use it because the trade-offs are too much on a day-to-day basis for you to use, then maybe that's not really the best device for you.

I see that a lot. People don't necessarily think that just because on paper a certain device can achieve certain things. It means that that's necessarily going to translate into how they're going to use it. I think here, if you are using a device which is really engineered for maximizing security, I think you owe it to yourself as well to also, you know, going back to what we discussed before with all the apps, you need to think about very carefully what software you run on that.

And if you are the kind of person that's not going to give up opening attachments on an email, you're not going to give up running maybe software from companies like Facebook and Microsoft, then really how much is it benefiting you to use a device that massively locks down the OS and systems there for your protection? If you just go ahead and do it anyway and you bypass a lot of the protections in place. And a good example of that is something like Graphene, for example, won't even come with F-Droid.

I think the last time I used it. So it does actually demand a higher amount of awareness of the user that they've got to go out. And if they are going to install any more apps, they've actually got to be, at least from the get go, go out, go onto a browser, which in itself is a risk, find an APK, the type of download file for Android, install that, actually verify that that app is valid before they start actually downloading a whole bunch of other apps.

And I find that kind of quite amusing aspect to Graphene because it's pretty much impossible to use Graphene privately and securely on its own as it comes. I mean, there's no encrypted messenger that comes by default onto the phone. So actually from the get go, you've got to go out and you've got to know what you're doing with installing that. Funnily enough with Kallax, although there is arguably, you know, I'm not a hundred percent sure, there's arguably less security built into the operating system in terms of hardening the memory and the access that applications have to one another.

You've actually got privacy and security defaults out of the box right from the get go before when you actually have the software installed. You've already got the F-Droid repo on the phone. You've even got the Aurora store, which enables you to get apps from the Play Store without requiring an account. You've got a VPN or a VPN storage. You've already got actually a lot that means that you're not on your own when you're out there navigating for the first time, set up for an operating system to actually start using the device in anger and actually being able to do what you need to do.

And I think that's also incredibly important because a big part of security, privacy and sensitive assistance is what an operating system actually empowers you to do by default and how it encourages you to, with its UX, to actually not make mistakes. Yeah, it's a great breakdown of the comparisons there. And this is something I know you've written a blog post about it and we chatted quite a bit in some smaller groups indirectly, but a listener wanted to know, Tecler specifically, why the transition for Mamushi from Copperhead to Calyx?

So I think the first thing is before I answer that question, I've got to say why did Copperhead in the first place? And like at a very high level, a lot of this, a lot of the kind of the interest and fascination with alternative ROMs on Android came from my reluctance to have anything to do with Google on my device. It just was, it was honestly a no go for me. And it was a huge frustration that certainly in the kind of the cryptocurrency space, the better apps, you know, something like kind of Samourai came out there and the Monero, you know, there was a Monero wallet on Android long before iOS.

It was actually feel it, it made my whole use of cryptocurrency more, you know, I was behind because I was on a more restrictive operating system, but it was never, I never, I wanted to use Android because I just disliked the Google. so much and so when there was the opportunity to use an alternative

1:00:00 OS and I did use you know we was being discussed and graphene was the popular one and to be used because it was the only one that was really like available and known as a secure and private one and it was really another Samourai user that had actually highlighted me to it and amongst ourselves we had kind of used it in the first place and you know kind of long story short like we tried to reach out to Daniel McKay and the graphene project to try and give him some support and donations and I won't pretend this was entirely altruistic on my part I was also hoping that you know if you actually like you do in the bitcoin space in the aerospace is that if you actually develop a relationship with the people that are building these tools and you actually can have a part to play as well as a user raising issues you know there's often a two-way dialogue that comes through certainly I feel that when I've used bitcoin software and I've used a huge amount from mobile software to desktop software I've been able to raise bugs issues feature requests and all

those happen and one of the great things about this space right is being able to actually get involved and and even as a non-developer have your wishes and your you know obviously it's up to the developers themselves to build but you have a role to play in writing some of that information I think that McKay's attitude towards that you know obviously people can go to the blog post to see the real details is that we were all rebuffed very extensively it's clear you know he wasn't interested in it having anything to do with us partly because of we'd actually even entertained having discussions with his former partner James Donaldson at Copperhead where they'd broken up so they were just fundamentally not someone that we could even discuss or work with or do and I wanted there were very important things I wanted to see on Android and that I felt needed to be there I felt that having used graphene and that there needs to be better support for applications for example that that were dependent on Google

dependencies in the Play Store and that actually couldn't be run I had a huge frustration that things like backup software didn't work properly on on non-Google Android and even the Googled Android were all very dependent on losing privacy and security there I wanted something kind of closer to iOS on being able to backup your software to another device that's important for me from a business and a personal perspective you know having that ownership of data and there were a few few other things as well that I wanted to kind of see developed in Android for me from a censorship resistant perspective certain stealth features that have been known in the Samourai Wallet that Google policies for example had stopped being implemented so the reason we the reason I actually got involved with Copperhead was because I thought that that company offered a way for if I could market for them in a way of selling devices I could one get devices that were you know the people that were reluctant to use something that was associated with Google into their hands

but also start bringing money for a company and make it more normalized so we could actually then start getting real paid for resources to actually work on some of those products and really like the kind of complete disappointment over of course several months of Copperhead being not really having the best software development life cycle actually not really releasing features that we'd asked for like just really making zero progress and the features that were released it was becoming clearer to me they were actually just taken from other open source projects made me realize is that we weren't really getting much out of that and I certainly wasn't feeling that customers were beginning to get value for money with the extra cost that they were paying for an operating system when there was no discernible difference to what they could actually be getting at from using free and open source software I also hope that I could actually influence Copperhead themselves given that they were previously open source into actually going and adopting a different license to

what graphene were doing but still an open source license that they could work with from a business perspective as I would fundamentally believe that was very possible and the complete reluctance and head in the sand attitude from those guys kind of showed that that wasn't the case that they weren't going to do it I think it all came to a head in where I was able to secure close to securing a corporate deal and the way I was being I'd been treated by Copperhead and the dishonesty of which I documented on the blog post meant that for me that was the kind of the final nail in the coffin with that relationship we hadn't been getting value for money I felt as a as a reseller and my customers weren't and also dealing with someone that I'd have fundamentally couldn't be trusted in business and it really ended that I think the other thing that made it possible to actually move from Copperhead to another operating system was also your involvement which was one of my customers through their own exploration from

seeing some of the drama that had been discussed actually you know adopting an operating system that hadn't had a large um um meet you haven't really had any kind of media attention to it and realizing that wow this software is actually super usable um digging into some of the security claims from the from the graphene the Copperhead projects and realizing that actually that yeah sure they're they're they do have a security focus but actually even a regular android pixel as out of the box security and privacy enhancements anyway and a lot of that is available in ordinary android open source project so if you've got another project that's actually focused on usability having a good UI including software that makes notifications possible supports more apps without actually having to surrender still to google that still comes out with pretty much for your ordinary user and actually even for quite um security and privacy conscious users then you've now got like a winning product and for me also it was the fact that it was reliable um I've been told by Copperhead that you know really oh you know you

it's very difficult to support as a reseller customers using android from just an open source project because it's not a company you know it's not they're not yeah they're not yeah they're not full-time employees but actually what I discovered from from using Calyx along with you know with friends and former customers from Mamushi is that what we discovered was that the software was more buck free on CalyxOS than it was on Graphene and Copperhead and overall it was a smooth user experience and also because of myself and the other guys that work with me on Mamushi we were actually very very capable of supporting users using that software any problems that they had it was easy to actually support because the OS was stable the kind of the problems that people get into just from usually years of supporting how it uses an android here amongst like say the Samourai community for example had meant that we've pretty much seen everything before in terms of issues that users could get I didn't need Copperhead as a as a company to help me support that

operating system and it was well within and I actually felt that the users got an overall better experience so certainly the the business relationship was a was probably the the kind of the final push but this had been an overall kind of decision I've been probably leaning towards um over the kind of over several months as I was very carefully watching what the Copperhead team were producing a software and comparing contrasting that with what was else was available in the market yeah thanks for thanks for walking us through that I know that was definitely a uh a tricky time for for everyone involved but definitely thankful for how you handled it and um good to hear a little bit more a little bit more detail behind it and the the rational rationale there um and uh one quick question that I just thought of was what like what is the person that Mamushi is targeting so like who who are you envisioning as customers who do you think would be someone who would who would benefit from purchasing a phone through Mamushi that's pre-flashed

yeah sure and so this is this is actually a big oh this is a big kind of thing for me when just as I spit out from a copperhead it took me a few weeks to decide exactly how I was going to pivot the store and um I did think very carefully about whether Mamushi was even still required uh to be honest um and a couple of reasons for that is is that the Kalex OS devs have actually done a really good flashing tool and one thing I'll say for the graphene project as well is that they have a web installer so compared to a few years ago um where you used to have to use the terminal and command your command line on terminal and be a bit more familiar with uh you know flashing phones and the difficulty there is is that really if you do want to flash an operating system including Kalex to your pixel it really is within the reach of a lot of people now so I did actually wonder kind of you know how much point is there to do this and who are we targeting because if the OS is that much easier to support like do we really need to do that and I think

a few things I've kind of you know I realized when I spoke to a lot of people about it is is that they're still actually believe it or not even though the flashing exercise is still a lot better and it's still actually outreach for a few people and and and in what way like it's not technically really difficult to flash your phone but it does take a bit of time and it's not something you're going to going to do on a day-to-day basis.

1:10:00 getting that familiar with on the first time does take a bit of time. A lot of people just don't really have time or the interest to do so. You know, it may take someone maybe even an hour to do it. For me, it'll probably take 15 minutes. I mean, it's a very quick process, but for someone for say following instructions, checking the phone, getting familiar, we have to use buttons. There's just a few things to do. The other thing as well is there's actually quite a number of pitfalls with flashing a phone.

And this is certainly not to scare people from doing it, but if you do something like say, flashing the wrong image to your phone, you really can't break your device and make it completely irrecoverable. So if for example, you're one of those kind of slightly sloppy people that don't check, you know, whether it's a 4A in brackets, 5G image or a 4A image, and then you've got that against your phone, you will actually render your device to completely inoperable.

If you, for example, during a flashing process, unplug your USB, or you know, there's an accident there, or you're using a poor USB, you can also end up with problems in the flashing. There can be driver issues. So if your main, say, operating system is Windows, you've got to fight the antivirus software a bit to sometimes kind of get through that. So, I mean, long story short, there's actually quite a few technical hurdles for even the average person that we get past and enable by doing, both with MAMishi doing that, and who we target as a customer.

And the other thing, of course, is that we're actually helping people acquire an actual device. And that's actually pretty important. If you're, say, in, say, the US, UK, or even, you know, and a lot of countries in Europe, that may be pretty straightforward. But if, for example, you don't really want a device IMEI associated to your name, and we also know that, like, in a lot of places where you buy Google Pixel phones, especially if you buy it from the Google store, you need a Google account, they're tying that IMEI to your name and your number.

And you actually may want to use MAMishi to abstract your own personal purchase from your name, because you can use something like Bitcoin or Monero to purchase a device. And also, we've started getting customers, say, in South Africa, where South Africa's not actually a market for Pixel devices, but MAMishi can import in, you know, grab one of the devices we've got in the various places our guides are, and actually take a device, flash it, and send it out to you there.

And then you're actually going to get really good value for money for your device. In fact, I've actually, I actually kind of saw that we're selling pixels cheaper on MAMishi with flashed with Kallax, than you can actually get, in some cases, somewhere like South Africa, where we just Google on your Pixel, because of all the import duties and all that. So, you know, there's a big benefit there from what we do. The other thing as well is, is that the kind of people we're targeting, and starting to get people that are maybe a little less technically proficient, or just haven't got the time, are people that actually want a bit of help once they get going.

And this has actually been less required, since with Kallax, because Kallax is a better starter for an OS, to a cop-ed. You've got a better installation tool, you've got more out of the box applications, you can get started with. But at the same time, it's not unusual for me to have, like customers who off the phone say, "Look, I'm a bit stuck with which software, which would you recommend?" And they know that they've got an actual right to kind of get in touch with me, and have me walk through with them, you know, a software to get set up with.

And none of that's really much skin off my nose, because it's what I've been doing kind of, as really just from a voluntary thing, with helping people anyway. So it's been a nice way to kind of combine all that. I think lastly with Mimushi, and this is kind of, this is less about what we're doing now, but more about how things are going forward, is that really the future for Mimushi is to look at hosting a form of Android open source project ourselves.

And that's not to say that we're going to turn into full-time Android developers, or anything like that. But I think one of the things that we've noticed, and one of the things I kind of saw actually, from my experience at the Copperhead as well, is that it's not again just about using secure and private software. Companies may, or certain individuals, or groups of individuals, may want software that they feel that they have better control over. And if they can, say, go into a contract with a company such as ourselves, where they've actually got an agreed amount of support, they can actually, and maybe even being tested, they've actually got a legal counterparty to have a relationship with, as opposed to, say, someone running on a not-for-profit or open source project, that they can actually have for support.

And given that, you know, the people that are at Mimushi now, we're all pretty capable of doing that. And, you know, we've experimented with hosting Android open source projects ourselves. One of the things that we'd probably look for in the future is actually helping, say, another company install their own flavor, either of, you know, just core Android open source project without any of the extra stuff that Calyx do, something like that, and actually having the Mim to manage their own keys and doing that software.

Because for them, maybe, they don't want another set of developers, even an open source ones, controlling the keys to their software. And what I mean by that is, is that just because software is open source doesn't mean you're necessarily going to get always the software that you want to see on the phone. Now, I can't remember off the top of my head, but I think it was a few years ago, there was an April Fool's joke, suddenly enough, that happened.

I think, I've got to be careful now, just in case I'm wrong, so big disclaimer here, I think it may have even been Lineage OS, years ago. They ran some kind of, I think it was them, I think someone, it was like, they ran an April Fool's joke, which, I can't remember if it made the phone, like, as a joke, look like it was bricked, or something like that, but whatever it was, it was super bad taste. I can't remember what it was. And it freaked out a lot of people.

And if you're a company, and you've actually got business critical software, you can't necessarily have, like, open source apps. And this isn't to say, obviously, that Calyx guys do that. They seem to be super professional in how they do. But it could be something like an April Fool's joke. It could be, maybe, imagery, that you, or certain default apps, that as, you know, if you're, you know, if you're politically, in a certain way, inclined, that may just not be appropriate for your people, or the organization you want in.

You may want, like, another company to do that. And I think that's probably where Mimushi will, Mimushi's future lies, is actually running Android open source, taking forks of projects, helping companies, or providing that service ourselves, to host that, and enabling people to have a bit more ownership, where they'll still have, obviously, a full view of the coach they need to, still provide, like, software, but they don't have to actually rely on open source projects, for the hosting of that software.

Thanks for that picture, into kind of the future. I wasn't aware of that, so it's good to, good to hear what some of the future plans are. And one of the things you mentioned, was that Mimushi accepts Bitcoin and Monero for payments. And honestly, that's one of the things that drew me, to actually purchase a phone through Mimushi, I don't know, it was a while ago now, six months ago, was that I was able to pay in Monero, and that throughout the checkout process, and the process of actually getting the phone, you all had very good privacy preserving practices, and just made it clear that you handled data well, that you cared about the customer's privacy.

And I love to see that. But focusing specifically on the cryptocurrency part of that, where do you see cryptocurrency fitting in, with the other tools that you've mentioned? And then maybe, what are some recommendations that you have, around using cryptocurrencies, like Bitcoin and Monero? Sure. So, I think the cryptocurrency tools fit in, in a way that, like, is that if you are going through, say, the whole self-hosting thing, I would actually say, as an individual, I really encourage people, to actually do what I've done, and set up a store, and actually look to accept Bitcoin, and Monero, I really would recommend it.

It's, you know, what I did, you know, I'm not a web developer, I'm not even a developer of any sort, and it's, it could be a pain, at times, in terms of configuration, but, you can be, without any kind of coding skill, you can set up a WordPress site, and, and actually, I had some super helpful pointers, from people on Twitter, when I was about to lose my temper, with the struggles, of some of the early, kind of WordPress, themes that I'd use, and, I've got kind of helpful pointers, we've got themes to, to install, to kind of make the site, easier to kind of manage, and all that, and there's some great, like, open source, plugins, that go with the WooCommerce, which is the, the billing, and the, the kind of, the shopping cart aspect, to a WordPress site, that can all get baked in, is, I mean, this thing is, I genuinely recommend, like, you know, as a kind of online community, especially kind of, you know, in what I call our communities, Seth, like, you know, you're far more, kind of, closer to the Monero community,

and I'm kind of, closer to the Bitcoin one, is, is that, I really think we should become, like, a nation of shopkeepers, in a way, kind of, like, kind of, probably, you know, back 50 years ago, you know, like a small town in England, or something, and it's something, I think we should all look to do, we should be proud of, and in an ideal way, like, everyone would do, and I'm sure everyone's got something, that they can kind of sell and do, and certainly in the early days, for cryptocurrency, it used to be a big thing, you know, being able to, to go to, you know, online stores, and all that, but like, even if you're selling, you know, stickers, if you're selling, oh, you know, hardware, or even groceries, or anything like,

1:20:00 that and you can do it as a little side gig and you've got to be the first ones to do that and there's nothing right you don't have to even set up like an international site or try and be as ambitious as i have to try to sell phones all over the world or problems that come to that but even if you offer like an ability to sell something for cryptocurrency monero you're kind of playing that part in in building a circular economy so i think that's kind of that's a really huge part it's a big part about you know opting out and it doesn't need to be especially if you do it in your part time you don't need to actually live off that job it can be your way of earning cryptocurrency and you're actually reducing some of the analytics that go against you i mean for a long time we were purchasing phones and with bitcoin i was very kind of keen to continue that at the moment slightly separate discussion i'm actually struggling to and to actually acquire phone to the bitcoin and having to use fear payment rails at the moment and but that's certainly no point to me

because all those purchases i'm doing are under a legal entity at the mooshy it's a corporate business account that does that and all those phones and i in the eyes are associated with with my name or my company and then the people who are getting them are still getting those uh you know using um the cryptocurrency to help preserve their privacy um and to uh you and then preserve the privacy from me and to uh and and and and obviously to kind of you know protect it from kind of corporate and government surveillance as well uh i think you know in terms of recommendations um i mean i say obviously plenty but um i think you know i i use obviously Samourai for my bitcoin wallet and but i've also been you know i have used Cake Wallet and i'm i'm using monero Monerujo um an awful lot as well now i find uh sinking a little faster at the moment um uh and um i kind of like the cleanliness of that wallet um in terms of you know not being not having other coins i certainly know why um vic sharma uh the guy behind Cake Wallet has incorporated other phones but for me personally i'm not looking to say use debit cards or credit cards to acquire cryptocurrency so i kind of like a wallet that just has um the crypto

Bix Sharma the guy behind Cake Wallet has incorporated other phones but for me personally I'm not looking to say use debit cards or credit cards to acquire cryptocurrency so I kind of like a wallet that just has crypto in it because I don't really need fear purchasing methods in there and those work great on like a kind of Kallax OS or a standard Android open source project type device and there's no kind of dependencies on Google Play Store and there's other ways to install the software through F-Droid and so it makes it really easy to not be to be baked into the kind of the larger Google ecosystem when you use those apps I think it's just it's great from the personal sovereignty perspective and you can spend and you can use those tools in in conjunction with a website to manage those kind of you know quite well and it's one thing I'll say though is is that I think the other thing I learned from all this is actually that there's not been a great development as good a development in the app ecosystem for merchants in the Bitcoin space in my opinion as

there has been in Monero and one of the great things I think I've realized is is that Monero is super super good for setting up as a merchant it really makes it easy to accept the currency in in a way that you don't really depend on any third party provider so I use a wordpress plugin I remember the name that's essentially the the main uh Monero WooCommerce one and you can kind of include it I suppose in show notes offers um but uh you know I can have like a single view key uh which gets hosted with a third party block explorer and that enables me to generate obviously an invoice on the site and I give up a bit of privacy uh to that that that that third party block explorer to accept payments but then every payment I get from Monero after I receive that I then send to another wallet um which with a kind of combination of Monero protocol benefits the ring ct self-address is there is is that that helps off the skate and the transactional um privacy loss from just kind of hosting my view key and with third party and really makes for a great

trade-off where I can still validate uh receipts of Monero through my own node um but I can also still kind of you provide a fairly seamless experience on site and and and also provide a high high degree of privacy for both the customer and myself and for bitcoin it's a bit more challenging I use a another third party provider but I host a what we call a public key or an x-pub um but there I have to actually you know I you know I I then take those UTXOs that I receive for the uh the purchases there and I generally put all of those through whirlpool and mix them and then you know because of the nature of bitcoin mixing and when you're doing equal input output mixing you end up with change outputs that are kind of quite difficult to uh or quite you have to be careful in managing because they can they can give away um some of the privacy those then get I always switch into Monero through an exchange there um so it's become kind of a you know a big kind of learning experience for me to really put into practice rather than just say trading cryptocurrency in actually using it in

an e-commerce environment and and using that in a way that really you know protects customers privacy but also protects my privacy in terms of for the store um but it also stops me should I interact with say someone else um that I don't get my any accounts that I have shut down if I am to deal with like say a third party provider um and they look at the say the history specifically in bitcoin of my UTXOs because you know for some of my customers I've had um I've had payments come you know I can check the blockchain I've had payments come from some pretty significant clusters and um and size of uh of coins that if I didn't mix them first um could put me on on kind of quite a high degree of um surveillance just in terms of um my own personal activity for example um that I'd be doing not say there's anything inherently suspicious but you know how it is with certain services you operate that they yeah they are going to be they're going to be doing flags based on your risk profile and user behavior so it's been a really good way to

put into practice some of the tools that I've used and particularly those two mobile wallets and the and and the associate kind of desktop uh use on on WordPress and putting those together has been a really good way of for me kind of actually putting all that into practice and actually doing a circular economy bag I love that that focus I think that's such a good such a good point to bring up that a great way to not only help drive that circular ecosystem within or that circular economy within cryptocurrency by setting up our own little shops selling whatever you're good at or whatever you have access to physically or I mean it can be a service it could be anything but selling that through cryptocurrency is a great way to help that circular economy grow and like you mentioned it really helps you to learn the tools as well so it's a great opportunity for you to dive in and better understand like how do I manage my privacy how do I run a node how do I integrate these things into like you mentioned WordPress and WooCommerce and

there's lots of other options of tools that you can use and how you can integrate and it's a great opportunity to to support the cryptocurrencies themselves by helping drive a circular economy while also really just forcing yourself to learn I think that's that's one of the the things that you gain gain so much from is learning how to use the tools that way and then like when you're doing education it's a similar effect when you're writing blog posts and teaching others huge you're really learning how the things actually work you may think you know what you're doing but once you actually go to try to teach someone else how something works that's when you learn whether or not you really have a grasp of it that's enormous and there's a big difference between you're using the tools in a way just to say save money and speculate on it which are obviously perfectly fine use cases but to another one where you're actually balancing obligations you know obviously every time someone purchases a phone from me not only yeah

I'm earning that money but I've now got a liability so I've got to manage fx rate risk and with actually purchasing a device and so there's kind of mark to market trade happening there but also like for any phone that anyone purchases out of the EU or the US and that's where we I've got excuse me I've got guys supporting me so they get paid to do that and they're always they only get paid in in cryptocurrency as well I mean actually bitcoin and I think they're bitcoin bitcoin maxi although they have used monero and but yeah the um uh you know I'm obviously paying those so I've got to manage that and um yeah I think there's a couple things I've also kind of say about this whole experience and it's a big part of opting out is is that the two guys that I use and Diverta being um one of them in the US and and I have another guy in Europe and I don't know their legal names uh it this has actually been something that's been put together through completely through trust and um you know that can only be done with that's only enabled through something like bitcoin and monero

um I can pay them without knowing their legal name because you don't need to know that um incentives are aligned you know they know that it's not worth you know these are relationships that have been forged in FOSS community specifically and I effectively recruited them because they had you know charitable instincts in any way to help people out and pretty easy to actually work out character online in a way that's far easier than say doing an interview in meet space uh someone that just say walks through the door and and it's been a fantastic experience and a fantastic experience and a fantastic experience and a

1:30:00 feel kind of you know I just couldn't have done this without them and in actual fact Diverter himself is being researching how to host say F-Droid repos and he's he's done forks of apps and in fact even like we use a really good PGP tool called TessaCube and it wasn't running on my Android device he just compiled himself using a kind of an up-to-date version of like the Android and his platform tools or the Android studio that was it and just yeah that worked you know I mean all you needed to do is effectively compile again but I've got an APK I can use just because that software at that time wasn't being maintained so kind of you know we've got a lot of support from these guys and none of that would have happened could I have not actually entered into some form of commerce with them the other thing I say that's been a big bit of a learning experience from all this is actually and yeah is really how how much much the fiat world really sucks and and particularly credit cards you know I've

done a lot of experience in in broking in institutional investment management even some private banking and all that but I don't have any experience in the retail side of things I've never worked for a credit card company or anything like that and it's really awful the way credit cards work and there's a reason I think that merchants are consolidating and you've got large companies like Amazon doing so well is because if you are accepting funds from say using say something like stripe as a payment process or PayPal like it cannot be stressed enough that we got we can't forget some of the narratives from say 2014 and 2013 that were very popular in the cryptocurrency space about not having chargebacks where someone does a transaction you send out your your merchandise and then someone afterwards says oh I didn't receive it and you just have to deal with fraud it's an absolute joy to deal with cryptocurrency and as a merchant because you know that there is no recourse I think that we forget about that especially in this kind of age on Twitter where everyone obsesses over sound money

and you know the joy of saving and even while we're kind of still looking at incredibly nascent cryptocurrency and kind of experience 50% drops or whatever is it still there's a fundamental use case of Bitcoin of an arrow is like is good e-commerce it's the fact that I can take a payment I can use my own node and validate and verify it and then I could you know I know that that can be trusted and I can then go ahead and do my job and I'm not having to pass costs on to customers and for for that for managing fraud yeah I mean my my only real exposure to kind of using cryptocurrency as a merchant quote unquote is accepting donations and that's been incredibly freeing and and simple compared to using the traditional financial system but as someone who likes to pay in cryptocurrency literally whenever possible and I'll pay more because of how freeing it is from a privacy perspective how simple it can be and quicker it can be and just how much uh I don't know you you avoid so many of the pitfalls of using credit cards and all of the issues that go around that

and there are definitely drawbacks compared to that you don't get your reward points or whatever but um it's it's a it's incredibly freeing and it's a whole nother side of opting out that the more you the more you do it the more you just I don't know I've fallen in love with cryptocurrency more and more the more I actually use it to pay for things like it really it's home I really love paying with it I mean I'd say the only thing that kind of comes close to the user experience of paying with crypto is is using something like I haven't used apple pay because I've literally never had an android device with google on it but I've used apple pay and that's that's pretty good um in terms of you know you get presented with like a check and in fact for a while we supported stripe payments and they usually see if you use apple pay and to pay there and you know that's one of the reasons I actually went with stripe in the first place um was to uh because I thought my my actual expectation was is that we're going to be selling some iphone users especially iphone bitcoiners

who will be buying this phone to get an actual proper bitcoin wallet and won't have a way of privately doing this um and actually it was also another reason I even kind of although I've obviously been a long-term fan of monero having used it for years I also kind of it was another big reason for me putting monero into the store it was because well if you're an ios user and you want to move to android like how are you going to pay for a mimushi device and get privacy from me so you know you just cannot really do it uh easily um using uh using ios bitcoin wallets so your only choice you know thanks to uh to the k-quality guys was was actually to pay monero so it was actually a very pragmatic reason I went with monero um funnily enough since then um you know I think it was a good thing for me to install because um I think we're probably in the position now of actually having more customers that use monero than bitcoin and I mean you know we're not doing kind of volumes of devices that kind of merit kind of releasing stats or anything like that

but I've noticed a substantial uptick I think you know certainly when we pivoted away from copperhead is that we're selling more devices now than we were and I think obviously being open source helps that a lower price point helps that but um I think you know there's a stronger ethos in the monero community towards open source and then we've seen the bitcoin community unfortunately big watering down the culture in bitcoin which has been enormously frustrating to see and it's been really heartening to see kind of how well received and the lushi stuff has been by kind of an era users I think the narrow users are also there's a there's a pragmatism as well in the fact that that you know if you're using the area there's probably a good chance that you don't want to spend time managing utxos and really tinkering with your privacy so they like the idea they can just kind of go to a site and put in you know maybe a fake name in a mailbox you know flash a qr and you know off you go you know a few days later you get

private phone coming in the post I think I think there's a you know there's a reason that they're kind of a they they they're responding to it more bit kindness I love to hear that yeah I think I've seen a lot of people in my circles on twitter who are monero users jump jump at the opportunity to to use mumushi and hopefully hopefully we'll see more and more of more of that monero usage actually increase in these merchant use cases I think so and I think even I think it's interesting as well is is that um we're at kind of interesting juncture now where lightning use is picking up a bit in bitcoin and I you know we're people are managing the ux challenges with that you know um although it's kind of got the benefit of some instant payments um you've got to manage you know channels um you can do with kind of payment failures but also I think more people more people are concerned about potentially the privacy implications of um of running lightning um and and obviously the security and the the overhead uh to that so I think

it's kind of it's an interesting space to see is is that where you are getting merchants is ones that are offering lightning seeing kind of what what usage they're getting on lightning and especially if they're offering monero as another option whether people kind of opt to go one or the other I certainly know um the Silent.Link um site they sell kind of e-sims um like anonymous e-sims and they offer uh lightning and they don't do monero but I also know that one of their payments that they kind of said to me was the example of lightning usage being paid picked up and actually out of band they've used something like fix flow or something like that that they've used monero to pay for a lightning transaction to go to that site anyway so uh take that as you will awesome well last question I wanted to get to here was uh just real quick what advice would you give to someone who's just starting to realize the need for personal privacy um I think you've got to think about like I think if it don't get

intimidated uh with trying to be anonymous that's the first thing there's pretty much no need to be anonymous these days and for a lot of people for in most kind of walks of life and obviously it's kind of fun to to think about the idea of being anonymous and yeah using some of these tools and I think you just kind of I think you need to be mindful of what you sign up for so you know if you are going to be starting off with these tools don't just assume that you need to use something so for example if you're starting a new job maybe you're being a real estate agent or you're starting up a new shop and there's always that temptation right okay well I'm going to have to have a page on Instagram or Facebook or whatever like that you know because everyone else does it and it's important to my job think through do you actually need that you know how much more effort is it just a couple of weekends to get a pretty basic site up there where you own your own data and you can kind of not have to sacrifice too much just make those choices think about when you're you know in terms of

privacy perspective when you are signed up to service what are you signing away you don't necessarily need to read all the terms and conditions and everything you sign up for but think about the information that you're you're giving out there and just what would it be like if someone was to kind of to actually see that in person and you know we give out our addresses way too much these days as we're seen with things like the ledger hack and things like that and a lot of people think oh well you know everyone has my address and all that but when you start getting your addresses say tied up with certain purchases that that moves on to a whole other ball game and I think you just need to pause a bit and not rush into necessarily all the new fans and be aware of kind of companies that are specifically marketing in a way that's engineered to to get engagement and I know kind of when clubhouse you know the the chat room thing kind of came out they were kind of big on making exclusive and only going

to ios users and those type of things and

1:40:00 Like be aware of like the techniques that the company is using. And I think also just in terms of just general principles is if you've got an app that provides a function, find people that use these as a day to day basis. Go on, whether it's Telegram or Twitter, you'll always find plenty of people happy to dispense advice. That's one thing that's not they're not sure of on Twitter. But, you know, look for an open source alternative if you can. And look at kind of people that have got maybe similar risk profile or similar life to you when you're getting their advice.

Think, be aware of friendships in the place. You know, people will shill products, not always kind of for the wrong reasons. But, you know, people like to help friends out. You know, you see it with Mamushi as well. There's guys that I've helped in the past that then, you know, I'll see them on Twitter dropping. You know, I'll buy a device from Mamushi Health now. You know, yeah, they've used it maybe and maybe they're a happy customer and that's great.

But also be aware that probably a mate of mine. That's kind of why they may be doing it. And that's happening all over space. You know, journalists that are shilling certain kind of software, they may be doing it because they've got a personal relationship with the developer. I think, you know, there's good reasons why, if you look at GrapheneOS, the attention that that project got was because of certain journalists that had maybe a relationship with Edward Snowden and that then caused a tweet and then suddenly everyone rallies around.

So just be a bit cautious of some of the, you know, what gets championed just because some thought leader or whatever says it. You know, really kind of go and use it yourself. And I think the other thing I just lastly I'd kind of caution is that open source is known as Panacea for everything. One of the reasons I recommend something like software like Signal and Threema is not just that they're open source, is that there's actually been audits on that software.

And, you know, for me, that's really like that's the kind of the gold tier of software that you can get is that if you can find software that not only has got like obviously active use, but if there's actually, you know, the Monero core team are great for this, is actually paying someone to kind of go in and interrogate their software and test it and really put it under the microscope, that can kind of, that can really reduce your risk factors hugely because there's a lot of software out there that's open source that just really isn't getting used or is not getting contributed to anymore that still exists as recommended on old blogs that really just may not cut it anymore.

So I think you just got to be aware of that when you're using it. Great. Well, thanks so much for coming on. I mean, we went probably double the length so far of episodes, but I feel like it was super easy. There's just so much to chat about. So thanks for jumping on. It's been great. No, I'm sure. Thank you ever so much for your time and hope it's not too late for you. Yeah, no, it is. It's definitely late, but it's been great. So last thing, where's the best place for people to find or communicate with you?

I think probably like the best place is where I'm kind of most around just because the larger communities are Twitter and Telegram. So they're kind of pace and certainly don't feel afraid if you've got specific questions. There's a contact form on the site to drop into. I would also say is that if you're an open source developer, specifically like a Java dev, and you've got something that you say wanted to see on Android or something like that, that kind of that you think kind of belongs in our mission.

And you're either looking kind of safe for some funding or you kind of want a platform to kind of get your software out on. Definitely drop a note. Even if we can't help specifically, there's plenty of people that we are in touch with that may do. Yeah, absolutely. And don't be afraid to try and source yourself. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week.

As always, you can check out the links to Max's content and contact info, as well as links to all of the tools we discussed in the show notes for this episode or at optoutpod.com. Now get out there and opt out this week. For this week's project to help you opt out, I'd recommend you take a look at Standard Notes, an encrypted by default notes app that is free and open source, but does offer subscriptions, while accepting Monero, to Standard Notes Extended.

For those that choose to support Standard Notes via subscription, extensions add a lot of power features, including encrypted attachment uploads to your own web dev server, like Nextcloud, as well as many text editors. However, the base-free version is still extremely powerful, has great encryption defaults, and is an excellent choice for moving off of closed source and surveilled solutions, like Google Keep or Evernote. For more info, check out the links in the show notes.