00:00 Hello, I'm Seth Simmons, and welcome to Season 1, Episode 8 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Wondering what alternatives are available for Twitter or similar centralized and censored services? This episode, we're sitting down with Sean O'Brien to chat about the need for decentralized and censorship-resistant microblogging and short messaging platforms.

Welcome to Opt Out, Sean. So glad we could finally get you on the show. I'm psyched to be here. Yeah, glad to be able to sit down and chat. You were one of the first guests that was recommended by a previous guest on Opt Out. Henry from Techlore sent me your name, and I was asking for people who would be a good fit. So I've seen some good work from you on Twitter, and just really excited to chat and hear your thoughts as kind of a professional in the security and privacy space, and see what your personal privacy journey has been through that.

But for my listeners who don't know much about you, would you mind just kind of introducing yourself? Sure. So I'm Sean O'Brien. I'm the founder of Privacy Lab, which is an initiative at Yale Law School. I also am the Chief Security Officer at Panquake, panquake.com, which we'll be talking about. And I've been working, you know, on and off on privacy and security-related projects for the better part of two decades. A big chunk of that has been on free and open source software.

I've done sysadmin work. I've done lots of digital self-defense workshops. And I get to do fun podcasts like this one. Awesome. Thanks. Yeah, I think a lot of the people that I've chatted with in Opt Out previously are kind of like getting into the space as a side thing. Like it wasn't their kind of initial career, that kind of thing. So it'll be cool to kind of talk through that. And I'm curious, what was it that woke you up to the need for personal privacy?

I mean, you've been in the space for a while, but what was it that kind of made that an important topic for you? Sure. So I think my experience being on the other side of technology, meaning the back end, you know, sort of secret world of technology, sort of opened my eyes to the potential for abuse. I think that was a big part of it. As the web sort of transitioned from the web I knew in the late 90s and early 2000s into something very different, something much more centralized, loading a lot of code from all over the place, but especially from entities we now call big tech.

As JavaScript became king and sort of broke down the client-server relationship in a way that was problematic for privacy and security as well in many cases. As a lot of code started getting injected into browsers without the user even being aware of it and executing. You know, working as a sysadmin and a web developer during that time and doing just other programming work, I just sort of felt that privacy was a really important frontier, if not the next big frontier that we needed to be pushing on from sort of a political sovereignty standpoint, actually.

I think it's really important for folks to think about their own lives, you know, self-sovereignty, I guess is what I'm really talking about. Think about their own lives within the context of the privacy they've given up, you know, in their technological transactions as well as, you know, potential, you know, future interactions. This is something now that's intermediating this technology we have that is very much not privacy respecting. It's now intermediating pretty much every aspect of life.

And there's just there's a huge amount of work to do. So, yeah, the writing started being on the wall for me, you know, during that time period when I was working on servers, basically. And I guess I should also say, you know, a lot of the credit for the things that I feel very strongly about it that was just sort of gestating in me comes from the free software movement, open source. You know, I think that's sort of digital rights movement from groups like the Electronic Frontier Foundation and so on.

I feel very strongly that free and open source software is exceedingly important for information to be free on the Internet, for freedom of speech, for, again, self-sovereignty, for people to have autonomy. And also, I think we've lost a lot of the digital commons that we used to have. So I guess if anything's gotten me into this battle, it is partially a longing for the Internet we used to have when I was growing up. Yeah, I love hearing that because I was, I mean, I'm a bit younger and kind of didn't get deeply into the Internet until I was in high school.

So I'm like pretty, pretty late to the game as far as seeing what the Internet used to be. So I always like getting in chat with people who kind of were involved, saw the kind of devolution of the Internet, the removal of the things that made it so powerful in the beginning or the change in the centralization. So it's good to hear from people like yourself on that topic. And I kind of echo a lot of the sentiments around why you got into privacy, because a lot of it came from working as a sysadmin, working in cybersecurity and seeing the tools and techniques that the other side can use.

And obviously, cybersecurity within a company, like it makes sense to surveil what's going on within your company to make sure that there's not obviously nefarious things going on, malicious actors, that kind of thing. But just seeing the toolkits that they have and the ways that they're able to surveil and building some of those out myself and learning those was definitely a key part of waking me up to why it matters that we take action rather than just hope for the best.

And what is it about privacy that makes it such an important topic for you today? I know that was a big driver for you early on and kind of why is it something that you're still focusing on today? Yeah. So at least since, of course, the Snowden disclosures and what we know about the security state now, you know, all the information that WikiLeaks has divulged and all the big leaks and hacks that we've seen in the last few years. We basically have open warfare on the Internet, right?

We have backdoors being built into operating systems, extremely polluted supply chains, both software and hardware. We have groups of both cyber criminals and state actors and sometimes, you know, working together, setting up botnets, breaking into systems, wreaking havoc across the world, really. And it has a real tangible effect on human beings. So I think as far as security and cybersecurity is concerned, I now is the time certainly to be very much vested in it, because if you're not paying attention, then you're just not paying attention to a big part of what's going on in the world right now.

From a privacy standpoint, I think it's interesting because we have more opportunities in some senses, you know, to have privacy respecting technology and cryptography that does really powerful things for us. And people are starting to use apps with end-to-end encryption and so on and so forth on a level that I had not hoped, right, five years ago, ten years ago, certainly. But we're also seeing a lot of doors being closed to us. We're seeing the information system being locked up, massive amounts of control of those information flows so people can't even find the things they want, you know.

And also, you know, basically misinformation from big tech, right, the apples of the world saying they love privacy and so on. And then you see what they're doing with photo scanning, right? Or I guess they took a step back. We'll remain to be seen if they follow through eventually. But the point being, I mean, that to me also is this thing we call privacy is really so firmly rooted in everything we do now that it really is about autonomy. And if you're not paying attention to that as an individual or as an organization, then you are potentially limiting yourself in very real ways as you move through the world.

Yeah, absolutely agree there. What's a common myth about personal privacy that you've run into? Probably the most common, and this comes up at almost every workshop, but also conversations like this very often, although I suspect you're much more astute and vested in privacy. But the big thing is the sort of don't, you know, they don't care about me-ism, right? Where people say, well, you know, nobody really cares about me, so why don't I just, you know, put all my stuff out there?

Yeah, that's probably the biggest one. Sometimes I call that, you know, privacy nihilism, but those two things are a little different. Folks also feel very disempowered, right? So even if folks are aware that they are being targeted or tracked and so on, they tend to feel that there's nothing they can do about it. So put together those two things are, I guess, a big myth. Yeah, I think those are two of the most common ones. I think the other one that most guests bring up is the kind of, I have nothing to hide, so why should I care?

I think that one ties in really closely to the first myth you talked about of, like, they're not watching me, so I don't need to worry about that. But I think people lose focus on the idea that dragnet surveillance is a very important thing. Like, you may not be targeted right now. Like, I doubt I am being surveilled in a targeted way right now, but that doesn't mean that dragnet surveillance isn't effective and that...

10:00 they're not collecting those things to potentially use them in the future when maybe they do target you and care about you. I think that's an important one. But yeah, definitely some myths that we hear quite often. What's a roadblock that you've seen people struggle with when it comes to personal privacy? I know those two are kind of similar. Often those are roadblocks to people. But is there any other that kind of stands out to you that prevents people from taking the jump into a personal privacy journey? Yeah. So I think the transactional view of privacy, right? The idea that we use technology just to get some specific job done. So install that app to talk to person X or my class requires me to install this crap on my computer. So I just got to install it just to do it.

Those kinds of roadblocks are very big and very real. And the entire privacy conversation, and I've been guilty of this in many instances as well, tends to veer towards this kind of view that there's sort of a consent based conversation going on, like a contract between you and the app developer or contract between you and the operating system maker or the gadget maker and so on and so forth. And I guess that that's sort of now has bled into the IoT world with everybody sticking ring doorbells on their front doors, Nest thermostats in their homes and Alexa speakers, etc, etc. So I think that sort of transactional concept is a real mental roadblock. It's very hard for us as humans to get past it. And in many ways, I think it's quite similar to some of our issues with other big problems, climate change and so on. It's just hard for us to do long term thinking in general. But also we're disincentivized from worrying about, you know, the future impacts of the choices we make today.

And how do you help motivate people to get past those roadblocks? Like how do you help them get past that transactional sense of privacy? So I try to, and this is getting easier, unfortunately, I try to use examples that are a little scary, right? So things that used to be confined to sci fi, which are starting to become very real, that are based upon someone's autonomy, their ability to move or have social mobilities or so on. So I'll talk about, for example, social credit systems, you know, Black Mirror, and other mostly Black Mirror, though, has really helped people understand that these things are possible and possible here in the United States. But also, you know, I'll talk about examples like, you know, a simple one would be self driving cars, right? Based upon what your app says you were doing, who you were with, whether you've paid your electrical bill, or your whatever your water bill, who the heck knows, it doesn't even have to be related, you know, somehow to technology.

You may literally not be able to get around cities if you have to hop in a self driving car and get home, right? You may be banned from these kinds of services the same way you can get banned now from subway systems in many parts of the world, because of facial recognition and other things like the payment scheme and so on. You know, those kinds of inability to move and ability to, of course, fly, we're seeing, of course, the TSA doing crackdowns and all kinds of things, and not just the TSA in the US, but other countries being pretty severely strict about flying, tying biometrics, right? So you're seeing that real sort of minority report reality coming. So using those examples and coming up hopefully with clever ones, a little more clever than I think I pulled from the top of my head. But talking about them, I think does scare people a little bit. And I'm not trying to, you know, I'm not trying to scare people just for the sake of scaring people or, you know, amplify their fear, so to speak. But I really just want to try to shock people into the moment.

You know, and these things are done, you know, not even necessarily in the most high tech ways, right? So car seats now are able to sense whether you're driving a car because of your weight, or the way that you angle your seat and so on and so forth. And profiles are being built on that stuff. Video cameras are, surveillance cameras are, you know, assessing people's gait in the way they walk. So even if they don't get your face, they're able to, you know, within a certain percentage, say that you're going somewhere.

Being able to stop people from living, working, moving, associating with each other, certainly assembling politically is a real serious reality. And, you know, as you said, whether or not you think you're being targeted directly, you know, that's, it's becoming more and more true that mass surveillance and targeted surveillance, there's less of a line between it. Targeted surveillance now can be scaled up so much. And the types of attacks that used to be reserved for specific, you know, quote unquote, risky individuals now are being used on large segments of the population, whether or not you're, you know, leaking documents or whatever.

Yeah, I think that point about the job of getting people past roadblocks is getting easier, unfortunately, is so true. I feel like especially in the last year, year and a half, I've seen so many people, I don't even need to convince them anymore. Like, I don't even need to, to explain some seemingly to them far off scenario of how, how a lack of privacy could hurt them, because they're seeing people hurt by a lack of privacy. I think it's, you know, privacy today in ways that they didn't even imagine. And I didn't imagine coming this quickly. But I think it's, it's been helpful to kind of shock some people awake kind of to show them, to show them reality and show them the potential use of today's surveillance in the future.

And I mean, even like you talked about the restricting of your ability to get around. I know in China, a really big deal is I think it's Alipay. I know they have a couple different ones. But if you can't use Alipay, or I think WePay is the other one, you can't get a taxi, you can't eat at most restaurants, you can't take the subway, you can't get a bus, like there's many systems you get locked out of just because you anger a specific big tech company, which obviously they're also working with the government in China.

But there are very many ways to do that. There aren't even a targeted thing necessarily, but just you upset the wrong person or do the wrong thing online or say the wrong thing in a group chat. And those things can happen quickly. And we don't think that they'll come here, like, for instance, to the US, but things can move a lot quicker than people expect. Yeah, and partially, you know, and I think this is very American, you know, these things are tied to incentive systems, right? You sign up for a GPS attached to your car because you want lower insurance rates, right? You, as the Wall Street Journal said today, the wallet's dead, right? They're talking about digital wallets and the system that Apple has and other digital sort of passport systems and so on.

Having all of your records on your phone while there's incentivization for that. There's obviously lots of people paying with apps because they get lower prices or freebies and so on. And these things are following them all around. When those things become, you know, compelled, and even if it's compelled in a small context, so to speak, so now you can't go around New York City or Boston, you know, it's still a really, really huge deal. And I suppose, you know, one of the things that one of the myths actually, which is not one of the common ones, which is worth talking about, is the flip side of the they don't care about me kind of thing where you have folks who just don't, you know, throw their caution to the wind.

There are a large number of folks, I think, in the privacy and security world, who still kind of believe that, you know, and, oh, well, you know, you can just get off grid and here's how you're going to do it. You know, and it's like, well, if you want to be completely ineffective and limited and go be a hermit in the woods and not interact with people, then you can get off grid, so to speak, and protect your privacy. But if we're talking about people being able to interact and work and live and go to school and also have political action, right, you know, build social movements and so on, then this idea that we should react to people who, oh, you're an idiot for using WhatsApp or you're an idiot, you know, that's just the wrong approach, you know, and kind of the myth of just being able to drop off the map, I think, is something that I actually combat, you know, I battle a bit.

And I suppose that's fueled by, you know, fiction as well, because there's always these hacker figures that can just kind of automatically drop off and no one can find them. And unfortunately, I don't think that's the world we live in. Yeah, I think that's a big thing I'm trying to combat with this show specifically is just that either that idea that like you can just completely disconnect or that you can, you can only gain privacy, or the only way to gain privacy is to do these insanely advanced, insanely difficult things.

Like there's no way to protect yourself unless you do all of these things that are just unattainable for the normal person. And it's something I've been trying to fight and just say like, yeah, maybe if you have a specific threat model, you need to get there. Like maybe if you are like targeted by multiple states, maybe you need to kind of figure out a way to disappear off the map. Or maybe that's something that fits your threat model. But for most people, they don't need to just disappear.

They need to find tools that can they can fit in and slot into the places in their life that they feel the need for privacy now and just slowly explore and expand their toolkit around that. But I mean, the other part of that is, you know,

20:00 live in an attention economy right so you gain or lose power in a very real sense um by your profile on the internet you know i have a website that you know has all my professional info on it has my resume and my cv and says hey contact me and here's how i've got you know a linkedin profile and you know etc etc it's not that i don't hate having to have a linkedin profile right um but not having a presence in these networks you might as well not be you know existing in a lot of contexts you know and i just um not having a website where people can figure out what i'm about you know and um i do think also you know especially for you know gen z or whatever we're calling this generation um they hopefully it's not zoomers anymore but but uh you know they're they're really facing some pretty stark choices about the kinds of networks they're sort of forced into the kinds of apps they have to use um not to mention the amount of information already given up but like as as those folks move through the end of high school into college into the working world and you

know maybe into the working world from high school um you know they're going to be uh having to really face these bizarre choices about what the hell they're going to do what they're going to sign up for and hopefully you know we can reign in some of these privacy and security issues before that um or before everyone's lost because i am very worried about it yeah especially with how predatory these types of services can be and how they try to kind of slip in seamlessly and and destroy privacy through surveillance through selling data through all of these different approaches it's it's definitely something that i'm hoping more and more people waking up and choosing the false alternative choosing the privacy preserving alternative will help to provide incentive to the companies that are building these tools to find ways to to make money in a privacy preserving and privacy conscious way i'm hoping we can shift the needle enough to at least put some pressure on them so they can't as as blatantly attack privacy at least but

we'll definitely and i want you know i want people to be able to voluntarily also control you know what what they disclose and what they don't you know so a few seconds ago i was talking about schooling in college high school you know ostensibly i don't need to know that from someone unless they want to divulge that information to me you know i mean some of the smartest most capable amazing people i know are high school dropouts you know um and fine they let me know that i don't need to know that from you know some easy search in some surveillance engine basically and uh those types of things too i think i don't know it's going to be really really hard even if big tech sort of um changes its tune which i you know doubt um there's going to be a lot of damage still with all these indexing services and so on that exist out there you know those types of services where stalkers can pay someone to find their ex-girlfriend etc um those things are still going to exist and there's going to be a lot of information

trails that just can't be cleaned up so yeah hopefully hopefully we can slowly improve on that but definitely important that people wake up and take things into their own hands like you you talked about earlier um one of the questions that i love to to get an answer to from from all my guests is kind of one out of left field but it's just what is something that you feel like almost no one agrees with you on there's a few things i'm sure uh i would say at least in the tech world um i think almost no one agrees with me that um the advertising model for the internet is a bubble and an effective bubble and it needs to be um the advertising model needs to be dismantled basically um before it bursts um so and i know there's a few folks a few academics and so on who are talking about this but um you know it's a dual sword where i say well you know all these ads on the internet they're part of the apparatus that spies on you they fuel these you know multi-trillion dollar companies now um but at the same time i don't feel

like uh there's honesty there um in these markets uh it's very clear to me that these uh monopolists basically are controlling both the price of the ad and the effectiveness of that ad um or the perceived effectiveness of that ad um and it seems like the whole thing is built you know it's a castle built on sand so um i guess that is something that very few folks agree with me on and there tends to be unfortunately a tendency to reinvent the advertisement we're seeing it now on streaming services we're seeing it now with inside of big tech services where podcasts are making money by doing old you know almost like terrestrial radio style plugs for a product you know uh and so on in the middle of their show um all of that to me is is just a bad direction to keep moving in and i understand why everybody's doing it um i understand why folks say things like people need to take control of their information so that they can personally make money off of it in the ad economy um but in the long run you know that sort

of mindset is going to be very destructive for the internet and i do think a reckoning is someday coming there yeah it's been interesting to see just kind of following along with the google flock attempt where they kind of tried to to rebuild and centralize advertising and cookie tracking that that seems to have failed catastrophically and i'm curious to see where where things go because it seems like more and more people are realizing that there's just there's too much wrong with the current advertising system but i don't know that that they have figured out a way to to fix it without giving up all of the money and the the data that they're able to collect and sell from those things i'm curious where that goes i mean i haven't seen an ad in a very long time because thankfully most ads are really easy to block these days but i know that they're a they're a serious issue and it's something that most people are having to deal with and not even just seeing the ad but like you said the the tracking that that goes

into all of those things i'd say well two things about that which i think are worth mentioning the first one is that um you know flock uh was basically an outcome of gdpr being at least effective in um raising awareness of cookies um and in raising that awareness and you know all these sites having to or at least thinking they have to in some cases because they just don't implement them very well but having all these pop-ups in your face asking for you to accept all the cookies that they have for the trackers um you know in that um sort of uh awakening for the consumer where there's like where the hell are they all these pop-ups coming from um you know google tried to come up with this solution um but really what that solution is doing is it's normalizing um using your browser users as part of a so-called anonymous uh test base and um unfortunately i think that that model is going to continue and continue to be leaned on you're seeing a lot of the trackers inside apps also moving to this model because folks like me will reveal something about an app or a tracker and so on

um and uh they get flack for it so they move to this model where they say well we have this you know pseudonymized they usually just use the term anonymous of course um a pool of users and that we study them we don't actually take real information and um that is becoming normalized and we're going to have it seems like both now so google gave up on flock but they kind of didn't give up on flock and and hopefully it doesn't end up being the de facto standard across the board um and i guess uh the second thing i'll say about the advertising issue um it's almost more a problem for the independent creators now than anyone else um because if you are trying to start a podcast as you did um or you're trying to you know launch a product or something and you have to pay for let's say facebook advertising um you might as well throw your money into the trash at this point um it's very hard to tell if you've reached anybody um the amount of money you have to spend to get any real reach is exponentially higher

than it was a few years ago and the entity that you're relying on for these statistics is facebook controls the marketing controls the price and controls the placement of those ads um so it's a real mess for folks who are actually trying to reach people um so i don't know i don't know where things are going but we've got to get away from this model so yeah that was that was something i very briefly explored when i started off the podcast was if there was kind of a good avenue to to advertise through and and hopefully kind of spread the net a little bit wider but from the research i did and from prices i looked at and just listening to other podcasters who have dealt with advertising and it seems to be incredibly ineffective at least for podcasting specifically i mean that's the only arena that i have any experience at least digging into advertisement i've never never advertised anything else or really been in that world but it seems to be a an odd space where it doesn't seem very effective but it just continues to keep going somehow and the traditional wisdom is you have to meet

people where they're at right and so i understand why people use these services um of course as advertisement tisements feed the surveillance machine that facebook is so you know there has to be a

30:00 sort of that ethical thought process. But yeah, I mean, you know, if folks want to sell cookies or something, I don't know how the heck they're going to get that information out there. And I hate to use that example to kind of like, you know, discredit creators, there's a lot better examples than cookies. But still, I just I don't know how we're going to have a world where anyone but a gigantic conglomerates control, you know, flow of products. And we could go on and on about Amazon, I guess. So I'll just leave that there. Yeah, I think I mean, it's been interesting to see with the podcast, specifically, it's been all all word of mouth and all using the small personal brand that I'd built up on Twitter. But I don't know, there's something to me incredibly powerful and more tangible about that approach. And that's kind of the old style of relying on word of mouth advertising and just relying on the people who appreciate the thing that you're creating to share it. But it's it, it kind of leads to some really cool stories. And it's just cool to see people kind

of trickle in and hear who they heard about the show through and kind of why they dove in and what pulled them in. And it makes it a lot more interesting and useful and like, engaging to me as the content creator, to hear people coming in through word of mouth rather than like, Oh, I just saw an ad pop up in my Twitter, my Twitter feed, and I ended up in an opt out pod. So it's an interesting, like, it's the only alternative I know of, I don't know of another way to do kind of spreading a podcast specifically, but it seems to have worked pretty well so far for opt out. But I also just kind of love the stories that come out of going back to the roots of advertising and just relying on word of mouth. So let's go ahead and dive into Panquake, which I know is a a project that you started working on and advising for. There's a lot of kind of I mean, there's been a lot of talk over the past year, year and a half about Twitter censoring people about Facebook, obviously, has had large censorship problems. And there's been a lot of, I think, renewed interest into decentralized or censorship

resistant platforms for I know, like the language uses like micro blogging or short messaging, but just a way to be able to get thoughts out there that people can read without having to worry about widespread censorship. And with how important those topics are today, you mentioned you just started working at Panquake and your intro and would you mind breaking down what Panquake is and why you why you're choosing to kind of dedicate some time to that? I'd love to. I'm very excited about this project. So Panquake, which is panquake.com, you can check it out, what we have up there so far.

It is, as you said, a short messaging service. It's also a next generation short messaging service. And I know that gets tossed around quite a bit. But we really mean that we are trying to break the paradigm. We want to not just replace Twitter. We want to make the Twitters a thing of the past. So in that respect, we're doing a lot of innovative things around not just the interface and the way in which people interact and cool new features that allow people to amplify content more easily and on a more level playing ground.

But also we're building a different network topology. It's a real decentralized network. We're making sure that the user information stays on the user's device on the client end. We're compartmentalizing the payment process and having a number of different choices for payment, including different crypto services. We're compartmentalizing that completely from the user information on the device again. We're not collecting email addresses and phone numbers and those kinds of things during the signup process.

We're still having a situation, even though it's a subscription service for $5 a month. We're having an architecture that allows people to just drop into the network and start participating without a subscription. And then if they choose to subscribe, then of course, there's other features that they can use. But we're not, you know, paywalling the thing up front like some other social networks do. We are coming up with some cool stuff that basically is pushing power back to the edges of the network, which is something I'm very passionate about.

And making sure that, you know, we don't want the information in the first place. You know, we don't we don't want to be surveilling people. We're not manipulating timelines. We're not having any advertisements. We're not allowing paid placement or boosting of posts. All of that stuff is anathema to a healthy social world. So basically, I and the other folks who have been working on this, many of them who are freedom of information activists, have been thinking a very long time about these problems, the problems with current social networks, and trying to solve them.

So it's pretty cool stuff. Yeah, it sounds like a pretty fascinating approach and different than just a federated social media platform, which I feel like is kind of the other approach that's been taken with things like Mastodon. Would you mind kind of comparing Panquake, maybe from a user perspective or just kind of from an architecture perspective, to what Panquake to Mastodon, kind of how like those may be similar as alternatives to shorter? Sure. So I have a long history with the Fediverse.

I've been setting up Fediverse nodes for a while. I used to have a rather large node or large for the time in 2009, 2010, 2011. That was a Frendica node. And Frendica is lesser used, but it's also part of the Fediverse sort of family. Mastodon, which is the one I think people are primarily familiar with, is federated, meaning that you have it installed on an individual's or organization's infrastructure. It could be a Raspberry Pi somewhere or, you know, some server somebody has in their basement, which is a very big virtue.

I'm not saying that to like, you know, say it's a bad thing. But it does mean that it requires sort of a individual or group or tech minded folks to set the thing up, to set the community norms for that community and to make sure that everything's running smoothly. But in essence, it's still a basic client server, right? Architecture. You still have, you know, Sean dialing into someone's Mastodon server to set up their profile to, you know, post their toots, which is what they call their short messages.

And those are then federated between other Mastodon nodes or other parts of the Fediverse based upon the settings that the provider of that Mastodon service has decided, you know, which servers to talk to, etc., etc. So it's a cool model. It's really important. And it is decentralized in that way. And federated, that's what that term is used, because it's sort of all these little federated sort of nodes or, you know, little kingdoms that people are, you know, running on their own for specific purposes or, you know, running for an org, which is cool. What we're trying to do with Panquake is different.

We are really, really pushing the application to the client end. You're going to be executing code on your computer, on your client. You're going to be keeping your profile in an encrypted user store. Sorry, not your profile, but your specific personal information in your encrypted user store. We're not going to be ingesting that information and putting it on disk somewhere, basically. And we can do that because we're using a blockchain model. So we're using a proof of authority blockchain that's not proof of work.

So it doesn't have these environmental issues that you may have seen about proof of work where machines crunching numbers and so on. Although I do believe some of those problems are a little overstated in many cases. We don't have that issue with Panquake. Basically, your public information, the information you intend to be public, right? Your quakes, as we call them. That's why it's Panquake. Your quakes go into this blockchain record. And then that's spread throughout the network.

Nodes decide in a federated way, actually. So different machines decide that are distributed around the world what to commit to the blockchain record. There are different levels of trust for those machines. We are starting our network with 5,000 users who are going to be the core of that trust network. So if you folks are interested in applying for the beta, you can check that out. It's very cool. And we'll be releasing a lot more information about the blockchain implementation specifically this month.

We're working on that very hard. But, yeah, having that sort of publicly available information in a blockchain record allows us to have that distributed throughout. And then have all the other information that's required for things like payments and so on and so forth. Smartly compartmentalized wherever we can, just stored on the user device. And then we ingest on our infrastructure for the Panquake organization. And also we're going to be working with partners, primarily digital rights groups, who will be mirroring content around the world and so on.

40:00 as little as possible just to get the conversation started. So it's a real peer-to-peer model using blockchain, whereas Mastodon and some of these others are federated, centralized software basically running on a specific machine that talks to other centralized software. I should add, sorry, we are going to be making sure that we have compatibility, broad compatibility with ActivityPub and the Fediverse. So we will be having some information exchange back and forth with Mastodon and these other Fediverse nodes.

And we hope to be a pretty large node in the Fediverse world. Exactly what information flows in and out, we haven't decided yet. But ActivityPub is the basis for the structure of the information that flows through the network. Yeah, I've definitely got a few questions that flow out of that. They're a little more technical, but I'm just kind of curious to hear your thoughts. The first one is pretty simple. Just will anyone be able to run a node? I mean, I know with proof of authority, that's normally a limited set of trusted people that are able to run those and actually be the ones deciding on inclusion or exclusion from blocks.

But is that something where anyone can? Or will there be like an application process? Or how will the actual proof of authority nodes be decided? Yeah, so we're using a variant of Byzantine fault tolerance BFT. And we're figuring out exactly the answer to a lot of these questions right now. We are very much leaning towards implementation of BFT that allows smartphones and low power devices and so on and so forth to participate. But we're still going to have trust levels.

And how exactly that plays out, we haven't yet published, but we will. We're planning on doing, of course, a white paper on all of that. We want to have as many folks participating in the consensus process as possible. So, and I think it's really important for the health of the network for that to be true. But of course, there's also going to be situations where that's not possible. Specifically, there's going to be certain types of operating systems and devices where it's just not going to be feasible.

iOS is a good example. But we'll see what solutions we come up with. Everybody is going to be able to go to Panquick.com across a broad, you know, number of operating systems and devices, Windows, Mac, iPhone, etc., etc. Linux devices, of course. But how much participation you have in the network is partially going to be up to you. And as I said, we will have this trusted core. So we at least do know that the first users who are in the beta and also the 1.1 release of the network are going to have a specific trust status that is very likely going to be, you know, have more weight than people who join with the public release.

Yeah, that definitely makes sense. And around that, is there going to be a token that's used for kind of spam prevention or something like that on the network? Yeah, so we are not doing anything with tokens with this. Yeah. A big part of it is not having financialized blockchain as far as, you know, the records of information on the network. That's going to mean we, and we do very much rely on our donors and rely on people supporting the network directly.

But yeah, we won't be incentivizing with a token. Awesome. That's good to hear from my personal views on the topic. And last question around that is, I mean, blockchain is something that normally is pretty averse to privacy. Blockchain as a technology can be fairly dangerous just because you're creating an immutable record of whatever is occurring on the blockchain. And I know that obviously privacy is a central thing that you're considering when you're building out Panquake.

But messaging services, in my mind, just in my thinking, and obviously I'm not building a messaging service, but should be normally as ephemeral as possible. What's kind of the reason, I mean, you mentioned the reasoning behind having a blockchain, but kind of how are you balancing that with not putting too much metadata or information that could be used to kind of create correlations or track users or something like that from the blockchain itself since it will be a public ledger?

Yeah, so it is a seemingly contradictory concept, right? But what we want is for people to voluntarily disclose information and have conversations as much as they feel comfortable. So part of the impetus for having a blockchain and an immutable record, as you say, for folks who aren't that familiar with blockchain, you can think of it as a ledger or a spreadsheet where you add entries and the veracity of each entry is based on the previous entry, right?

So, or the previous entries, I should say. So anyway, you know, in this world where we have folks who are being censored or shadow banned or their follower counts are disappearing overnight or fluctuating wildly, or they can't figure out the reach of their messages and suddenly there's some change in their network. You know, I know an individual, for example, who changed their gender and then suddenly was forcefully unfollowed from all of the people that they were following.

So the count of people they followed went to zero by Twitter. That sort of thing is scary. And, of course, shows how much power networks like Twitter have over the online conversation. Having an immutable record is the way to make sure that we respect our users and they can check that we respect them, right? So if there's any moderation done or banning and so on, of course, we're going to ban abuse and, you know, atrocious imagery and things like that.

You know, we want that moderation to be in the blockchain record as well. And we want to make sure that that persists. Having a closed, centralized database that we sort of keep under lock and key and then just saying, trust us, is not good enough. And we've seen why that's not good enough. We see why, especially these big tech corporate conglomerates, how awful they've been at being stewards of their networks. So the blockchain is a must from that perspective.

However, I do worry very much about the OSINT, right? And the kinds of social graphing that you're talking about of social networks. One of the things we do is we make sure that the user handle is the only information that persists linked to your conversation, if you so choose. So you can have an ephemeral identity in our network. And in fact, we're building in some very cool tools to make it easy for your browser, for example, to forget your identity if you so choose.

We also have an encrypted data store, which is on your machine. And that's controlled by you. Of course, we are thinking through recovery and recovery keys and the ability for people to recover that information if it's lost or deleted or so on. But hypothetically, you can just make that go poof, right? You can just delete that and then grab another identity and put information on the network. And that's part of the requirement for us, the threat model of a whistleblower or a journalist trying to get information out or activists, you know, especially during these big events like we saw in the Middle East, you know.

God, it's 10 years ago now. But the Arab Spring and so on. These types of events, you really need to make sure that folks can get information out, can have ephemeral identities, as you said. But also that the information will persist, will be shared between the network, can't be forcibly blocked, right? And that's really important to us. So, yeah, I mean, we can't solve the problem of the NSA, right? We can't solve the problem of the CIA. What we can do is empower individuals themselves to have the tools they need to sort of to communicate online and to protect themselves as much as possible.

So, we will do our best to keep the NSA out of your computer, out of your information, give you your encrypted data store and so on. But if you share info in the blockchain record that you don't want people to know, well, it's going to be in the blockchain record. Yeah, I think two main things, too, that I wanted to mention was one, I think I was kind of coming at that from the perspective of a mainly direct messaging service. And I was kind of blanking on the fact that this is primarily a social network.

So, obviously, the things you're posting publicly, if those public things are attached to a blockchain, that's not problematic. You're choosing to share those things. And I think what you mentioned about the personal profile details being local and not being something that's server-side or stored in the blockchain is another key part of that that makes it make a lot more sense. Yeah. So, and I guess I should mention here, I guess my history with social networks on this concept as well.

So, I'm very familiar with diaspora and the concept of social networks.

50:00 social circles in diaspora where you would share information with one group and not another, basically. And also Frendica, which, you know, allowed you to have some pretty fine-grained permissions on content and who it's shared with and so on and so forth, which networks can ingest this content throughout the Fetaverse and so on and so forth. And actually, that's one of the reasons Frendica is sometimes not called part of the Fetaverse, these types of features and incompatibilities that it has and had. But, you know, I've come to the conclusion personally, I think a lot of folks have that, you know, what you post on the internet, unfortunately, is out there on the internet. And the best thing we can do is teach people, you know, from the time they're young, but also, you know, there's a lot of adults who need to learn this, that what you put out there can live on indefinitely, right? And in this sense, you know, having a blockchain is not really any different, right? What's on Twitter is screenshotted very

quickly, archived very quickly, especially if you're high profile, especially if you have reach, especially if you're a target. So, you know, having that in the blockchain record, a blockchain record is not a con for you. It's a very big pro. So that's sort of the thinking around that. Where DMs are concerned, certainly, we're thinking very strongly about that, we're not going to be rolling that out right away. We're considering that for a 2.0 version. That's not something we want to rush for obvious reasons. We want to concentrate on what we're doing right now and make sure we can deliver on the promises we've made. But yeah, direct messaging is definitely a feature that a lot of folks will be clamoring with and we will make sure we do it the right way. So it's good to hear. What is the kind of best thing that people can do right now who may be interested in taking a look at Panquake or diving in? So certainly, there's a ton of things you can do to help Panquake. You can go out to Panquake.com. We have a lot of information out there. In our tech section, we do monthly delivery meetings.

We just finished one that described the tech and also what we've done that month, the type of progress we've made. We rely on donations. So this is a crowdfunded project. So supporting us, as many generous folks have, would be great. So if you want to support us, please go out to the website or go out to gogetfunding.com/panquake and donate directly there. Of course, we accept donations in a variety of crypto as well. So you can check that out on the website too. There's QR codes, you can scan and so on and addresses there. And also, you know, something I'm very excited about that we just launched a few months ago or two months ago is a sub stack newsletter called Talk Liberation. It's a newsletter as well as video content, short video about the latest news in big tech, censorship, you know, surveillance, freedom of information issues. We talk a lot about things like biometric surveillance and so on. So basically we do a rundown. It's a new service that's useful for content creators, you know, just basically to have a breakdown of the usually atrocious stuff that

happened that week in the world of big tech and so on. But also, you know, to provide sort of a easy to access, easy to understand sort of summary of the important news that everybody should know. Often this stuff is buried somewhere in somebody's timeline or some, you know, different version of Google News that someone tries to access and they just can't always find these stories. So we're trying very hard to make sure that we're telling, you know, bringing the stories that are really important to folks in a very accessible way. And that's also why we have the short videos, which I think are great and produced really nicely. And those are good explainers for really what the heck has happened on the internet in the last week. So that's talkliberation.substack.com.

It's not paywalled. If you choose to support it, you can subscribe that will allow you, for example, to comment on articles and join the community. That money also goes to Pancrake to help support with development and scaling and building this thing. So yeah, that's a great way that you can support the project and also, you know, get this cool information to your inbox and check it out online as well. We will soon be doing investigative reporting there, basically. Pancrake investigations, which we just announced, or I'm sorry, talk liberation investigations, which we just announced. And those investigations will be, I think, pretty hard hitting and information that you're not going to find elsewhere.

yeah, that should be pretty cool stuff. So you're going to want to keep an eye on that. So either donate directly or subscribe to talk liberation. Awesome. I will definitely have to check out the the substack newsletter. I think that's a really important way to get news out. I think I'm glad that email newsletters and personal blogs and that kind of thing are really starting to come back into fashion and become a popular way to get info out there.

So we've talked a lot about Panquake, which I was really glad to hear kind of what's going on with that. I'm going to have to check that out and maybe check out the beta after we finish up here. But one of the things that we talked about with every guest on opt out is what are some of the other tools that you use regularly to opt out that you'd recommend others to take a look at? And then why? Sure. So I usually default to what I say at workshops for this, which has changed over the years. That's for sure.

So the first thing that really hasn't changed though is an ad blocker, right? So make sure you're using an ad blocker. I use you block or mute block over. I'm supposed to pronounce that. And make sure you have an ad blocker in your browser and also on your phone if you can, if you can install one. That's going to radically alter your relationship with the internet and also keep trackers and survey, you know, a specific kind of surveillance from advertising. You're going to be able to block that pretty easily. The other thing that I use often, let's see. So I use GNU slash Linux. I use a variety of Linux distros. I am a big fan of Debian and Debian based distributions. I think that the whole Linux for the desktop, your Linux on the desktop, et cetera. I think we're pretty much there. I think folks who are interested in trying out an operating system that doesn't have, you know, the kinds of backdoors we've seen in Windows and Mac OS lately. If you want to try out an OS that respects you and does not insert

that kind of crap that, you know, is not built by some corporate conglomerate, but is usually built by a community. You should check out GNU slash Linux or Linux distributions. Ubuntu is the one that a lot of folks talk about and use, and there's a lot of versions of that. It's beautiful. It runs pretty smoothly, and it makes my life easier because I don't have to jump through a lot of hoops installing it on other people's systems anymore. It's actually really simple to do. So that's something I always make sure I want to recommend. Related to that sort of is Tor and Tor Browser. Definitely still use those things.

And Tor Browser specifically, I think, is a very useful tool to be as anonymous as you probably can be on the internet these days. I think combined with other technologies like a VPN, it's also a very powerful tool. So that's something I use and you should use as well. And then related to that, I guess, is Tails. Tails is a combination of the last two, Linux Distro and Tor-powered. It's something that you can run off a USB key, for example, or in a virtual machine, or hypothetically you can install it, but you probably shouldn't. It allows you to have a real amnesiac experience and ephemeral experience computing so that if you really need to be off the map as much as possible, you can use this tool, learn to use the tools that are bundled with it, and be anonymous, both on the internet and interacting with others. Because it allows you to do things like, for example, collaboratively edit documents using the Tor network, which is pretty cool. And yeah, I don't know, other tools, I'm still using things like Signal and so on. I have mixed feelings about end-to-end encrypted

messengers, but everybody should at least try an end-to-end encrypted messenger that's not given to them from big tech. And I would say in that world, start with one that is used by your friends and family. I mean, we really have to help pick each other up in this battle, basically, for our privacy. And start with what your friends are using. You know, identify the individuals who are most savvy or most

1:00:00 tech savvy and try to spread that circle outward um and try not to get bogged down as we were talking about um in these sort of wars over which messenger is necessarily better um that can degrade pretty quickly it isn't no kidding isn't very fruitful so yeah that is always a always a fun one that i run into all the time is well you shouldn't be using that that chat app you should be using this one you can't use that because of this specific thing it's yeah people i think a lot of people need to just settle down and realize that as long as the tool itself is not like completely broken as long as it's providing reasonable privacy be happy that people are using that if it fits their model great like just be glad that people are taking privacy at least somewhat seriously and don't fight everyone who doesn't use the messaging app you prefer right yeah i love your your mention of linux becoming more accessible because i really do think that's true i've seen far more people than i expected starting to dive into using linux as a daily driver on

laptops or desktops i'm i've been using it for quite a while on my desktop but i'm i'm excited i have a system 76 machine coming in soon hopefully um and that'll be what i'm running right now so yeah it runs really well so yeah i'm really excited i'm glad that companies like that seem to be doing quite well creating linux first hardware it's a it's a really a really cool thing to see grow and i'm hopeful that that will continue to expand for sure yeah they're not magically bulletproof right they're not going to solve all your privacy and security problems but i mean this is a slow process like anything meanwhile meanwhile you or worthwhile i should say um you you have to work at it you know and um you know as i used to say you have to free yourself in pieces um i used to say that in a political context text primarily but in this context it's true as well because you really are trying to free yourself from um from really uh atrocious control by um primarily these corporations ad tech surveillance and also governments um and those are powerful adversaries it's not gonna it's not gonna

just happen you know overnight or magically with a magic bullet and that's another reason to always be skeptical you know when you hear of these magic bullet kind of solutions um to be more private more secure potentially anonymous on the internet you're going to use a basket of tools um you're not going to just use one magical thing so yep definitely it's about a a varied toolkit finding the right tools for the jobs that you specifically need for sure last question i have for you is what advice would you give to someone who is just starting to realize the need for personal privacy yeah i guess uh my advice is not to you know i'm going to be able to do something to do something that you're going to do something that's really important to do something that's really important to do something that's really important to do and i'm going to be able to do something that's really important to do something that's really important to be able to do something that's really important to do something that's really important to do

um it can be really hard and really distressing um to to find out a lot of the things that we're talking about or maybe even we're glossing over a little bit because we assume the audience already knows about a lot of them but um the world is very much intermediated by machines that are tracking every aspect of what you do and gobbling up as much information as they can as they can. That's starting to merge with the physical world, you know, IRL, whatever you want to call it, with these IoT devices. And things are not looking pretty, from facial surveillance to other types of biometric surveillance to, you know, Bluetooth tracking of your movements and geofencing and so on. It's a pretty rotten world out there as far as this tech is concerned.

And finding that out, learning about it, understanding about it is a very empowering thing. But I understand why folks can despair and just say, screw it, I'm not going to even try. So not giving up, I think, is the important thing. You have to realize that in many ways, in a very real way, your life is on the line here. But also the lives of your friends, family, colleagues, the people around you, and the things you care about. That sounds dramatic, I know. But as you get deeper into this stuff, you're going to see changes in the world around you that are very much guided by surveillance technology. And we either push back against it, or we allow it to sort of envelop us and trap us. So I recommend pushing back against it. Try to find the empowering and awesome ways that you can use this stuff. We still can get information out, we're still having conversations like this. So I guess I invite folks to join that conversation rather than dismissing it.

Absolutely. Well, thank you so much for coming on, Sean. It was a great chat. I had a really good time learning about Panquake, learning about kind of your personal privacy journey, and just really, really glad you were able to come on. For listeners who want to chat with you in the future, or kind of keep up with your work in the future, what's the best place for them to reach you? Sure. So I'm all over the web. But you can check out cyberclear.cc. That's my personal website, and usually has what I'm up to, or at least, you know, the last thing I was up to. Also, check out me on Twitter or Mastodon. I'm on Twitter. I'm Sean O'Diggity on Mastodon.social.

I'm Diggity. I'm on the web. So use a search engine that is not Google to find me. Or Bing, but I probably don't have to say that. Awesome. Thanks for coming on, Sean. Yep. Thanks for listening, and I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the links to our guest content and contact info, as well as links to all of the tools we discussed in today's episode in the show notes or at optoutpod.com. Now get out there and opt out this week.

For this week's project to help you opt out, I'd recommend you take a look at an excellent messaging app in Threema. Threema has been around for quite a few years, but at the community's request to open source their messenger and have created an excellent messaging platform that is end-to-end encrypted by default, exposes very little metadata, and supports both direct and group messaging. Threema also has built-in video and audio calls that are end-to-end encrypted, so it's a great alternative to Signal in almost every way. I've personally switched to using Threema for all non-family chats to help protect my privacy by not needing to share a phone number, as well as several large group chats that have migrated from Signal or Matrix.

It's important to note that while Threema is free and open source software, it is not free and costs $5 for a license. However, that can be a great thing, as it makes sure that Threema remains sustainable and makes it easy to support what they're doing. I'd recommend purchasing Threema with Bitcoin if possible, or reaching out to them to ask for Monero support, but they do accept many other different payment methods for the app. If you're on CalyxOS or similar, you'll need to get the APK directly from their web store, but if you're on normal Android or iOS, you can get and pay for Threema directly within your app store.