00:00 - Hello, I'm Seth Simmons, and welcome to season one, episode 15 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Wondering why someone decides to do privacy education research? This episode, we're gonna sit down with Sun Knudsen to chat about his education and research on privacy, funding in the privacy and false spaces, and a little bit of macOS versus Linux.

Welcome on to Opt Out, Sun. - Hey, thanks for having me on. - Oh boy, thanks for having me on. - Yeah, yeah, definitely. Glad to be able to finally get things set and scheduled, and this one's a little later than I had planned and we had originally planned on, but glad to finally be able to sit down and chat through this. I really have a huge respect for the work that you've done in the privacy space, and just your educational approach and your ethical approach to funding and content creation on YouTube, I think have been something that I've been learning a lot from, not to mention, obviously, the incredible privacy and kind of self-sovereignty content that you've been putting out.

So I'm really, really excited to sit down and learn a little bit more about you and a little bit about your approach. - Yeah, cool. I mean, thanks for caring about privacy. It's amazing. - Yeah, I've been, I guess, surprised how many people are in the space, but also surprised that there aren't more people doing kind of educational content in the privacy space. So the more people I stumble across, like yourself, I always wanna pull them in and hopefully just learn from you myself and then let listeners learn about you and see some of your content.

But for those who aren't familiar with you, do you mind just introducing yourself? - Sure, yeah. I mean, I'm Sun. I started this YouTube journey about two years ago where I decided that I wanted to do something about privacy not being on everyone's mind. I had been a technologist for about 15 years when I got deeply into privacy and noticed how complicated it actually was. And I started being mindful about how I use computers and creating those guides for myself.

And I gave a talk at Creative Morning about silence, how one can silence oneself on the internet and how people are silenced by lack of freedom of speech and all this stuff. And I was like, "Damn it, I wanna do something about this and I'm gonna start sharing those guides. And yeah, that's how the YouTube journey started." So I guess I'm a self-proclaimed privacy and security researcher. I don't have formal training in this. I mean, I just have spent so much time researching how this stuff works that felt that title was appropriate to frame it also from that kind of educational standpoint.

- Yeah, I think that really honestly benefits your content because it brings a very approachable and I think a really useful perspective and things that you're looking at that it's not like a high academia approach to privacy, but it's, I think you do a great job of, even though you have obviously a very deep understanding of the need for privacy and the technical approaches there, I think you do a really good job distilling that down for your viewers, your listeners, and really helping them kind of get into the weeds of the specific details.

I'm thankful for the content that you've put out so far. It's really, really been excellent. - Yeah, I mean, pleasure. Every single person who starts caring and starts changing how they use technology after having watches stuff is a blessing. I mean, the more of us, the better. - Yeah, absolutely. There is definitely strength in numbers in this privacy battle that we're all fighting, whether we realize it or not. But I did want to kind of dive in and learn a little bit more about you and your background in the privacy space.

So I'd love to hear what it was that woke you up to the need for personal privacy yourself. - Yeah. Yeah, I mean, I'll try to make a short story 'cause it's kind of long. I mean, I actually ran an analytics company and now before everyone starts unsubscribing, there's more to this. So yeah, I mean, I've always been fascinated by business and all kinds of business stuff that is done on the internet requires some level of business intelligence. I mean, that's something that we inherited from the physical world and brought with us in the technical world, technology world.

And back in the day, I was aware of Google Analytics. I was aware of short links like Bitly. And I was like, damn it, we could create this like super cool short link technology that would be able to track marketing campaigns and kind of aggregate data that originates from all kinds of different social media platforms. Back in the day, I was still on Facebook and stuff like this. I was like a late bloomer on Facebook and left early, but anyways. So I created this piece of technology and as I started rolling it out to different customers, they were really pumped about tracking stuff, right?

And I built into what was called LickStats, more and more features. And it kind of became invasive. But back in the day, that wasn't on my radar. So I was just like doing it. And then I'm not sure exactly where that inflection point is, but at some like at one point, I took a few steps back and I realized how powerful technologists, what back then we called marketing technologists, had like how powerful we had become in being able to track everything.

And it's at that point where I decided that I no longer wanted to be part of that ecosystem. And I pivoted LickStats to become a privacy conscious analytics platform, which essentially killed the business. And then I started wanting to protect myself from this kind of pervasive tracking. And that's where I really started learning about this and started using different technologies to, to yeah, disappear on the internet kind of say, yeah. I love that you ended up kind of coming around to privacy because you were building out tools that like now, obviously you and I view as as deeply, deeply detrimental and dangerous to the end user.

But I love that that was something that you were a part of like creating and figuring out new approaches to when you realize and then kind of woke up to how, how that affected you and how that affected the people who were using that tool. I think that's, it's fascinating that you kind of came out of that. And I'm sure came out of that with a better understanding than most people of what those kinds of tools are capable of, which I'm sure helped make it a starker realization at first.

Yeah, yeah, no, no, it's, it's, yeah, it's pretty troubling actually. You know, LickStats was never evil that much, but it got to a point where I was correlating different data sets and essentially doing, I guess, what data brokers are doing nowadays. And that's when I, yeah, it was just ridiculous, the amount of data points that we were able to collect. So yeah, definitely kickstarted this journey of figuring out how to do the opposite, which is even more interesting.

Yeah, absolutely. Had that, that full U-turn, it sounds like. And so I'm curious, what about privacy makes it such an important topic for you today, as opposed to when you kind of first woke up to the need for it? Is the question like, why do I care about privacy like now? Yeah, like why does it continue to be a focus for you? Yeah. I'm a big believer in freedom and democracy and sovereignty. I think as more and more people start using more and more technologies that are inherently not private, we're giving up so much of ourself on the internet.

And I mean, it's, it's purchase histories, it's Alexas and smart home assistants that are listening. It's everything we watch, everything we listen to. I mean, everything, you know, for those older listeners, we used to have like MP trees on our computers and we could listen to them privately, but now everyone is streaming. And that is like, that is applying to more and more of what we do online. And then, you know, there's the classic, I have nothing to hide.

I've heard of you, you know, I listened to a few of your podcasts and that comes up a lot. Yeah, for sure. And in many ways, I don't have something to hide. But in many ways, also, when I look at what happened in Hong Kong, when protesters were trying to fight for their democracy and they were being tracked and, you know, nation-state surveillance programs were trying to find the people who were leading those fights and going after them. And all of this data, all of this technology, all of those smartphones, all of those tracking apparatuses were really hurting democracy.

So I think if we care about freedom and democracy, it's just natural to care about privacy because privacy is how we, I don't know if this is the right word in English, but exercise this freedom. This is, you know, by us being able to have conversations that are private, by us being able to collectively share ideas and fight for those ideas without resistance, that's why privacy is so important. And, you know, I had this privacy-conscious meetup with viewers of the privacy guides and some viewers were in India, some viewers were, you know, in Europe where encryption is attacked right now.

You know, governments want to be able to decrypt information from private conversations. I mean, we're losing this battle. I mean, everyone has to...

10:00 fight for this. At least that's the way I feel about it. So that's one of the reasons for the privacy guys is just to empower as many people as possible to do something about it. Yeah, I love that correlation between privacy and freedom. And I don't know if it's actually a quote by someone else, but just the idea that without privacy, there can be no freedom long term. I think it's a very valuable one that people who are in countries right now that feel free or are free, they're in a legitimately strong democracy. They can oftentimes forget that those two things do go hand in hand. And if while they are free, they're willing to give up their privacy bit by bit or chunk by chunk, they can often find themselves later on down the line in a place where because they have given up those either rights to privacy or technological access to privacy, they ended up not being able to have freedom and not being able to put up a stand against some sort of authoritarian shift in the government or something like that, which like you mentioned,

we saw that type of thing in Hong Kong. Yeah, no, no, it's happening. I mean, it's frightening. It's real. It's real, but the shift has been so slow. And the convenience or the benefits of technology are so, so huge that people are giving up their privacy, like one drop at a time without noticing it. It takes freedom and time to be able to look at the world through a different lens, you know, when we don't have this pressure of day to day and, and yeah, I try to do as much of this thinking as possible to help others see this true, you know, a different lens. So hopefully some of this is coming out on the privacy guides, but yeah, it's tough.

Yeah. Yeah. I definitely, I do think it's coming through there and I love seeing how, how large your audience is and how it's growing in that place. I think it's great to see that there really are people waking up and kind of getting, getting past some of their own personal roadblocks. And I'm curious in your kind of work in the space, what's a roadblock that you've seen people struggle with commonly when it comes to caring about their own personal privacy. And then maybe how do you motivate or prompt people to get past that?

Hmm. Um, a lot of people have shared, um, how they feel isolated when they start being more privacy conscious, you know, they start using signal, but none of their friends or family are there. Um, in India, people start using signal, but their whole school system sometimes is on, um, I don't even know the words, how those things are called anymore. Damn it, son. Uh, are they on WhatsApp there? I know that's very, very common. Yeah. You can see, I'm not a big Facebook guy.

I dislike it so much. Don't even remember the word. I like it. Yeah. Yeah. That's, that's crazy. Um, so yeah, I mean, and they're like, well, if I'm not on WhatsApp, I mean, I'm alone and that's, that's really hard. So I think that it takes, like, it takes a psychological toll on us. So that's one. Um, the other, or at least another is the tech technological complexity of being privacy conscious. And it takes a lot of time to just set oneself up for privacy using computers. And I guess the last one is, um, there's a massive, massive convenience trade-off that a lot of people either cannot afford because they have kids that, you know, they, they have to go to work and do their stuff or yeah. So either they can't do it or they, they're just seduced by the convenience and they're willing to give up so much. I would say that's like, at least part of that landscape. Yeah. I love that you, you harp on the need for community there and like how cutting yourself off from community to become more private is a very,

very, I think probably one of the most human issues of starting to care more personally about privacy and something like I've tried to harp on. And I love that other people in the privacy space are really, I think thinking and talking about the need for community as part of a privacy journey. Um, cause I, I think that is so, so important and not only is it important so you have community around you and don't feel alone, but also so you have other people who have been through the steps that you're going through, who have started out at, at square one where you're starting out and can come alongside you and help pull you through those, those difficult points, especially when you're kind of taking those more drastic steps where you do lose a large amount of convenience in order to become more private. It's so helpful when you have that strong community that can really be encouraging you, giving you tips and tricks and, and helping to, um, just really welcome you into each step along that privacy journey. So important to me. Yeah, totally agree. Um, I guess this is a good segue into what I

like calling these days to privacy infrastructure. I mean, there is this whole psychological side of things, which we just discussed a lot, but there's also that privacy infrastructure dimension, which is, are the tools out there? Are there hosting providers that are privacy conscious out there? Can one get something delivered, you know, through e-commerce privately without revealing, revealing one's home address? Like can one use email aliases, phone aliases? It's just, I tried recently purchasing something online, uh, without giving up too much of myself. And it was crazy. I mean, they asked for an address, a phone number, a credit card. I tried, I really tried to not, you know, to do this in an anonymous way. And it was impossible essentially. So like, there is a big lack of privacy infrastructure out there. And that is one of my biggest battles for 2022. And I've started working on this by collaborating with 1984, by collaborating with Trezor, you know, just seeing how I can help these companies, um, you know, for instance,

using Trezor devices on Tor or on Tails is broken right now. So like I opened issues on GitHub and I'm lobbying to get these features fixed. Uh, I'm lobbying 1984 so that they get bigger bandwidth, like faster connections so that we can route more of our traffic through Iceland, which has really great privacy legislation. So this is like one of those pillars. It's just, if this infrastructure isn't there, how can we as society embrace privacy, it's just impossible. So that's, that's one fight.

Yeah. Especially when digital privacy has to come in contact with the physical world, things get very, very difficult. Like you mentioned, getting something shipped to you in a privacy preserving way is very, very tricky. Um, getting a mobile phone service in many countries in a privacy preserving way is very, very tricky. Actually getting the SIM card without having to provide ID or something like that is very, very tricky. Um, there's so many complexities there. And, um, I'm glad that you mentioned that, like, even though you maybe can't solve the problem of, um, getting something shipped to you, or you can't solve the problem of 1984, not having enough bandwidth. I love that you're still putting forth the effort to, to work with those companies, to work with the projects that you like, and, and to help at least point them in the right direction and give them the info they need so that they know that there's a problem, they know that they need to take a look at it. It's, it's such an

important step that I think so many people, they run into a roadblock when they're trying to use some service privately and they just stop there, give up and walk away instead of putting forth the effort to open an issue on GitHub, to open a support ticket, something like that. It's a very important step. Even if you can't necessarily directly solve the problem, you can at least make sure that there's, there's pressure, good positive pressure on the, the companies and projects to, to do the right thing and, and fix those things so that they can be used privately or like, so 1984 has more bandwidth, hopefully, so we can use more services, um, hosted out of them or routed through them. Uh, so I love that that's the approach you're taking there.

For sure. And, and to be clear, like both 1984 and Trezor are privacy conscious companies, uh, that I have huge respect for. It's just, um, users have to voice what they care about and, and if they don't voice it and they just change to some other provider or just abandon the idea of doing this thing privately, well, the providers are not aware of it. So just opening issues or sharing those ideas is, is, is something that's meaningful on its own, you know, and someone doesn't have to be a technical person to even do this. Um, so yeah, but as you mentioned earlier, the more we are who care, the more leverage we have to, um, have that system change towards privacy. And I'm talking about like, even getting governments to like care and, and yeah, I mean, random idea, like in Canada, post Canada has this thing where you can get the equivalent of like a PO box. Is that how you guys call it in the States? You can kind of get one of those for free and get stuff shipped to that.

So obviously if you're, you know, shipping crystal meth, post Canada, that will get right. But this is not, that's, that's exactly what people think. Like not, not people within the privacy world, but like people outside, they think we're like, we're going to buy crystal meth, you know, that's why we're into Bitcoin, you know, and we want to ship stuff and in an anonymous way. It's not about this. I don't care that post Canada,

20:00 knows that I ordered something. I just don't want data aggregators or all of those plugins running on those websites to share my address, what I'm buying, my phone number with Facebook, Snapchat, TikTok and like 20 other trackers. Like it's, yeah. - Yeah, exactly. It doesn't provide you perfect privacy from everyone when like using a PO box to get something alert to you, but it provides you privacy from the retailer that you're buying something from.

So it's an important step. And I like that I've seen some more people kind of try to approach that. Like there's a European service, something called proxy store, it's S-T-O dot R-E. And they do kind of a remailer service within Europe and you can have them order things for you. They'll order it and ship it to you. And they just pay them for that with a like 7% fee on top of that or something like that. I don't remember the exact price, but they perform that service and they've been a long running like good reputation service.

So there's that. And then there's a new project called sovereign stack that I think I've started doing the same thing in the, in the U S. So I'm hopeful that more kind of third parties will do that. Cause I think it's a good alternative to PO boxes. I mean, you'd probably still want them shipping to a PO box. So they don't have your home address just in case they are compromised or they are malicious or something like that. But yeah, it's another good step towards gaining some physical privacy, which can be really, really tricky.

I totally agree. I mean, but it's, it's weird how I started this journey way down the rabbit hole, trying to solve problems kind of like at my individual level, meaning like, how can I be private, blah, blah, blah. And how can, what, what, you know, what VPNs or poor, whatever I can use. But in the end, what I'm noticing is the fight has to be way, way more at the surface level. It's like, how can we like what post Canada is doing with that service, which is free.

And it helps me break that data aggregation loop with retailers. I mean, that is beautiful. Like that kind of, that's a great, like state level privacy tool that we have. And it doesn't work if you're buying illegal stuff, but if you're just trying to not reveal your purchasing, history to the whole world because of all those invasive trackers, it's beautiful. Right. And I'm wondering if you guys have something like this in the States, can you actually buy something in the States and have like USPS or whatever, like ship it to a USPS store instead of your home address?

Yeah, you can do PO boxes in the U S. And I think I'm not sure if they require ID or not. I'm pretty sure they do, which is the only drawback, but that's somewhat understood. Cause that is a kind of nation state run thing, but yeah. You can do PO boxes, which is generally kind of the recommended approach. You have to pay for it. You have to pay for that. You do. Yeah. Yeah. I think it's relatively cheap, but you do have to pay for it. The cool thing with post Canada is like it's free.

It's something called like flexi delivery. If Canadians are listening or what, but like that system, it, you go on their website, you create an account and you give them like essentially, I don't know if you need to give them your address, but maybe, you know, but then you have this mail routed to that like post Canada storefront thing. So, and it's free. So, and it's free. It's not really appeal box. It's more like you're rerouting mail. You're, you're routing mail to them.

And then you go by foot to that specific location to get your package. Um, anyways, that that's a great example of privacy infrastructure. You know, it's hybrid. Like you're, you cannot be private from everyone. Like you have like your private, like what do you wish to be private from would be like a question that I often ask. Like, yeah. If you keep part of threat modeling. Yeah. Like if you and I have a conversation on signal, right? By default, our IPs will be shared so that we establish a peer to peer connection.

That's something that I'll be publishing about on the privacy guides. So we have to manually go deep down into settings to always really get to the privacy. Settings to always really calls through signal infrastructure. Then we're private from one another. But by default, when you signal, you and I would be revealing our IPs. And if we're not using a VPN that can reveal where we are and stuff like this. So when using signal, we are like you and I are private from the outside world, but we're not private from each other.

So like, that's always an interesting question is like, who do we wish to be private from? Yeah. Yeah. I think that's a key step in figuring out especially kind of where you want to start in your privacy journey is deciding what it is you want to protect and who you want to protect it from. Because that'll help you decide what tools are kind of the best first steps for you to jump into so that you're gaining privacy from those specific parties. Whether it be government, whether it be just data brokers, whether it be retailers like we're talking about with PO boxes and the Canadian version of that.

And yeah, it's very important that people kind of take a moment, sit down and think about those details before they're kind of jumping into into their privacy journey. Yeah. Yeah, for sure. I mean, we have to mention VPNs here, right? Like so most VPN providers that you use and route all of your traffic true, it's a honeypot. Like the VPN provider, if it's somehow affiliated with a bad actor, you're helping them track you by routing everything through VPN.

So like all of those VPN ads, a lot of them are like, I was going to say a bad word here, but like they're full of bananas, right? Like it's, it's not helping people to go through a VPN many times. So that's another great example. Like, who are you trying to be private from? Like, are you trying to be private from your ISP? If so, using a good VPN is, is, is good. You know, are you trying to be private from the government? I mean, government could pressure the VPN provider.

So then you need to use a VPN endpoint in a country where you get privacy legislation. But all of these, like all of this thinking is something that one has to do. Like you cannot just, there's no silver bullets. You don't just like set up a VPN and then you're private. And, and VPNs are not anonymous. If ever someone is listening, like, cause you need to pay them in one way or another. Yeah. If you can, with some of them, you can do it pseudonymous, pseudonymously at least, but you should not assume that a VPN is providing you any sort of anonymity.

It's not, it's not for that. It's for, for privacy for you from whatever network you're on, which is usually like your home ISP or your, your mobile carrier. Um, and like you mentioned, the vast majority of VPNs are at best mediocre and at worst malicious and actually a data broker themselves and using that to more, more easily correlate your data to other things that you're doing online. So it's very important that people do do deep research and, and make sure that they are, are using a good, um, non-logging ethically run VPN provider.

It's a very important step there, but VPNs are a very important tool to privacy because they do help you to shift the, the trust in your threat model from your ISP, from your mobile carrier. Yeah. And hopefully someone that you, you trust more, maybe someone in a jurisdiction, like you said, that has much better privacy laws. So there's a lot of value there, but it is definitely one of those fields where there's just so many bad actors, unfortunately, that it makes it a lot harder to find a good trustworthy VPN provider.

Yeah, for sure. And if a VPN is free to anyone listening, it's probably evil. Like there's no such thing as a free VPN. Yeah. Just like in always, as always in the privacy world, if a service is free, the thing that you're paying with is your data or you like there's, there's not something they're going to provide for free in that situation. So definitely a clear sign to stay away. Yeah. So I want to, uh, shift gears a little bit into your, your time in the, in the privacy and FOSS education space.

But I have one more kind of question out of left field. I'd love to hear your thoughts on. And that's just, what's something that you feel like almost no one agrees with you on? Um, uh, well, I mean the, the one that comes to mind and you mentioned this earlier is like, I use a Mac, you know, for a lot of stuff and people are like, you're using a Mac. Like you're full of shit. Stop talking about privacy or something. Like I get a lot in the comments.

Um, I don't know if I'm allowed to say that word here. Sorry. Yeah, it's fine. Um, so, so that's one. I mean, so like, I think people. Uh, I think people think that open source, um, or Linux is necessarily more private or secure than Mac, which I think is wrong in many scenarios. So that's definitely something that gets a good heated debate on. Yeah. Yeah. I'd love to hear more of your thoughts on that. That was, that was another thing I wanted to talk to you about.

Cause I did notice that you, you do use a Mac and talk about that a bit on your channel. Um, and I'd love to hear some more of your thoughts around that. I mean, I generally would advocate advocate people not use Mac OS when they can, but I think you made an important point that assuming that Linux and FOSS software is more secure or private, especially kind of out of the box. Um, is a very dangerous assumption to make. Yeah. And I think something that Apple does very well is third party privacy.

Um, they generally have good approaches to third party privacy, but you're usually not gaining strong privacy from Apple unless you take additional steps. So I'm curious more of your thoughts on kind of Mac OS versus Linux, or maybe just kind of Apple versus the FOSS ecosystem. Yeah. Um, the more I learned about computers, um, the more I realized that having one computer be both secure and private and convenient.

30:00 right, or usable is impossible, right? That's at least how I'm feeling now after like a few years of digging into this. I think the key to privacy is compartmentalization. So if you try to have one computer for everything you do and have it be secure, private, and usable, it's a recipe for insanity. Like it's impossible. So what I ended up doing is using different computers or different computer systems for different use cases. So for instance, I do editing for the privacy guides.

Like open source, free and open source editing software is usually kind of horrible to use, or at least that's my feeling. There is great value to use Adobe Creative Suite, you know, as a creator who does design, video, you know, stuff like this. But the amount of things that one installs when installing Adobe is ridiculous. I mean, they're actually even running Node.js stuff in the background. I mean, there's like a huge amount of bloatware, whatever that's running in the background.

So one cannot have Adobe on a computer and think that one is private, you know, or one cannot just install the apps that one wants to use and think we're gonna be private. And that's where for the past few years, I mean, I've been using Tails OS for more sensitive use cases or for compartmentalization. It's really great to see that even electron apps built and packaged as app image releases can run pretty beautifully on Tails. I mean, I recently released QR Bridge.

It's a proprietary that's gonna, you know, add fuel to the fire, but it's a proprietary app that one can use to bridge the air gaps between, you know, offline Tails computers and Macs, for instance, using QR codes. And it also has a feature that leverages Diffie-Hellman key exchanges to be able to establish an encrypted channel through QR codes and Beam passwords, for instance, over the air. But even if someone has line of sight on the QR codes, it's encrypted with, you know, military-grade encryption.

So I started using, you know, Tails for a lot of stuff. I also started using Raspberry Pis for a lot of stuff. Like I created a project where one can use Raspberry Pis to create encrypted paper backups for secrets. Some secrets can be passphrases, mnemonics in the context of crypto, stuff like this. So I, and by the way, and this is, I understand not everyone can do this because I kind of have my little lab here, but I think I have like maybe, you know, five Macs, like a million Raspberry Pis, like a tank pad.

Like I have many computers and they're all used in very niche select ways. So to answer, or at least to go back to this question of Mac versus Linux or Mac versus open source, stuff like this, I think Mac is a fabulous operating system for many use cases. And I mean, I use a YubiKey so that my private keys for PGP or for SSH are held on the YubiKey. So they're compartmentalized away from Mac OS. So I can sign Git commits using the YubiKey, which means even if someone had compromised my computer, they wouldn't be able to sign on this kind of stuff because they need to have access to those cryptographic keys.

So again, compartmentalization, I think, is where success lies and mental sanity lies. So by default, Linux is just very insecure, right? And by default, having an application layer firewall on Linux is living hell. If anyone listening knows how to do this easily, like, please get in touch with me because I tried finding an alternative to Little Snitch for Linux and it's impossible. And if one thinks that Linux apps are not calling home, you know, install, like, an application layer firewall and probably we're going to see so much stuff trying to call home, even on Linux.

So I think Harden Mac with Little Snitch, you know, one can block now on Big Sur or Monterey, one can block even Apple from calling home. Now, yes, I know that Apple could bypass this because they're God. And I know that, you know, an Intel Mac has the Intel management engine on it, you know, and again, that's like, that's where we just lose our mind. Like, at some point, there are trade-offs. And that's why I love using air gap computers and some of them are offline.

They just cannot connect to the internet. And that's where I do some of that computing. Yeah, I think that's a very, I don't know, it's a very well thought out approach and makes sense to me. It makes me wish even more that you could take a Mac and just properly dual boot Mac OS and Linux on it. And not have to worry about all of the issues that come when you try to do something like that, because it really does, I think Mac OS does really bring a lot of powerful features.

And like you mentioned, just the apps that are available there, especially for content creators, are very hard to part with. And there's not a lot of very solid false alternatives that you could use, even if you were doing purely Linux. So I think that definitely does make sense. And I think, like you mentioned, just finding that approach that works for you, that is privacy conscious, but that maintains that balance of, I guess that line between convenience and privacy or kind of usability, privacy and security were the three that you focused on there.

Finding what works for you, that still kind of keeps those three things in mind, I think is very important. And if that's Mac OS and you're conscious of the downsides and you're conscious of the issues, like you clearly are, I think it definitely can be a valuable tool. Yeah. I mean, just, I have to say a few disclaimers here. So disclaimer number one is anything on iCloud is not encrypted, you know, or we should assume this, meaning like we should not be uploading our files to iCloud.

We should not be uploading our contacts to iCloud. Like we should not be uploading anything to iCloud. There is a feature in Little Snitch that one can use to block iCloud from calling home. And so number one is not use iCloud. And number two is always, if someone has the $50 that it costs, and I haven't tried Lulu, which looks like an open source, you know, free alternative, but one should always use an application layer firewall on Mac OS and just deny anything from calling home, you know, because that gives us visibility on what's going on under the hood in a way that is mind boggling.

I think everyone should experience, or at least everyone who cares about privacy should experience any computer with a good application layer firewall, because then you see everything that is going outbound. For the longest of times, we were all worried about firewalls in the sense of blocking inbound. From a privacy perspective, outbound, man, that's where your hair, like, gets, I don't know what's the word in English for this, but like, that's where you freak out, right?

You're like, holy bananas. Just end up pulling your hair out when you see all of the traffic that's going out. I think the closest I've gotten, I haven't focused much on application level firewalls. There's a couple things I've been looking into, and I'll send them to you. I don't want to recommend them on air because I haven't used them myself yet, but there are a couple I've been digging into and want to learn a little bit more about, but I think the closest I've gotten to seeing that is when you deploy something like PyHole or when you use a service like NextDNS, and you get to enable DNS level blocking of a bunch of tracking, a bunch of just malicious kind of DNS queries going on in your network when you get to see all of the data that these apps are sending back home about the ways that you use them.

Oftentimes those things aren't put into the app for a malicious reason. They're so that the app can get useful information about, the app developer can get useful information about how the app is used, but obviously when you're sending all of the details back home about how you're using a specific application, it could be a huge privacy risk, especially if they don't properly handle the data, or if even worse, they're selling it to a data broker and they're using it to improve their app, yes, but they're also forwarding it on because I know they can get a bunch of money for all of the detailed data about how people use their computers.

So there's definitely, there's so much there. And once people realize, I think how many outbound pieces of traffic are happening every day on just even the fine applications, like not even the malicious ones, but just the ones that are like good tools, but also have a bunch of metadata being sent out. It's really, really eye-opening. It is. It absolutely is. And I mean, as a developer myself, it is very insightful to have some user data, right? Or some analytics.

For instance, when people go on my website and it crashes for a reason or another, when people hit an in-page anchor that is broken, or when people hit, you know, a page that no longer exists, it's very insightful for me to know this. And my website uses Sentry.io to like track this kind of stuff. But instead of just installing their JavaScript thing on my website and funneling

40:00 everything to them in the way that they wanted it, I created a proxy and all of those requests are proxied through my server and I'm obfuscating everyone's IP. So everyone shows up as being the same person essentially or whatever. Like I think I'm using some kind of a, I've done that a long time ago, but I think I'm using some kind of an HMAC to like obfuscate things in a way where Century IO cannot connect dots. Neither can I once because it's done in an ephemeral way, but that's where developers have to, you know, go the extra mile to protect users. And it's totally possible to get some level of business intelligence without compromising people's privacy. It just requires a little more time, right? And that makes it all the more important that users who like not having all of their telemetry data being subact app developers, if you don't want that and you disable in the app, if there's an option or you disable it through something like little snitch on Mac or maybe at the DNS level, make sure if you, if you do enjoy that application, both reach out

to the developer and ask them what literature they collect or look into that. And then when you run into issues or when you have bugs or when you, you find features that you think could be improved or added, make sure that you're reaching out to the developer and letting them know. Because if we're very active in doing that, we could actually remove the need for any telemetry and apps and can really help to drive developers towards relying on user input rather, rather than on passive telemetry collection or user data collection. So it is definitely, there's some of the onus on us to be actively pushing information back to the developers of the apps that we love so that they can improve them without passively collecting telemetry data.

Yeah. Yeah. And then I, I think as we're mentioning that any developer, any app maker should have explicit consent of the user before collecting anything. And some apps do this well, but a lot just collect by default. So that should be like a user decision to open up that pipeline back home or not. You know, that this is, it's not normal that we have to do this in little snitch or at the DNS level. Like we should just flick a switch to say, yes, I'm okay with sending information.

And then it's a great opportunity for the developer app maker to state what is collected and establish trust, you know, because it's okay to like send stuff to the developer. If we know what we're sending and if we have a chance to decline. Yeah, absolutely. Has to be opt in, not opt out. It's always a good, good show of where the kind of the heart of the developer is, if they're automatically opting you into that or if it's something you manually have to do is, is very, very important.

Kind of in the same vein, I'd love to hear your thoughts around the kind of recent in the past year to Apple's made a really big push towards privacy, at least in a marketing sense. And so since you're, you're kind of a Mac OS user and you see the benefits that Apple products and specifically Mac OS can bring. I'd love to hear your thoughts on if you think that Apple's push towards privacy is really just kind of marketing fluff and preying on the, the kind of the push towards privacy more broadly.

Or if you think they are seriously aiming to help their users in at least third party privacy. It's a very interesting question. Okay. First things first. Apple is what? Two trillion soon, $3 trillion company or something. Its governance is designed to represent shareholder interests. Like if I think it would be very naive to see it otherwise. So whatever Apple is doing, it would probably be doing this to increase shareholder value. Looking at that question through this lens, I guess the question is why would Apple care about privacy?

Because not everyone wants privacy, right? Like if everyone wanted privacy, you and I would not be having this call. Right? Right? So how is it strategic for Apple to do this in the first place? Why does it make financial sense for Apple to embark in this marketing journey? I mean, one way of looking at this is who is Apple's competitors, right? Like Google, I guess. Any others that come to mind? Microsoft for like desktop OS. Okay. Microsoft. Yeah.

Yeah. Because a lot of the bottom line of Apple, at least for a long time, was sales of iPhone, right? So how can Apple win market shares against Google, right? Because the phones are close to each other, I guess, from a future perspective. So one could argue that Google having been criticized as a privacy invading company, blah, blah, blah. I think it's strategic for Apple to position itself as a privacy conscious company, trying to get users to shift onto iPhones.

You know, people that may have left for Android, kind of scare them from using their Android phones so that they go back to using iOS. And that would make a lot of business sense and generate shareholder value. So is Apple doing this because Apple really cares about privacy? I'm sure some people at Apple really care, but I would love to have like a fierce conversation with a few of them to see if they really care. My gut feeling is it's a business move.

And it gets even more intriguing when you consider the fact that they released this new like iCloud privacy relay thing where... They're... They've created like proprietary slash two-hop version of Tor-ish, right? Yeah. Where, you know, but they're using, in theory, two separate providers. And, you know, it's interesting. I mean, there's an episode on this on Privacy Guides. We could have like a one-hour talk just on this, but why would Apple do this, right?

So I guess it's they're reinforcing this positioning and they're reinforcing iCloud like buy-in because of this, which is ironic, by the way, because iCloud data is not encrypted end to end. Nope. Yeah. But then there, you have to be on iCloud, you know, to have this iCloud private relay thing or to have email aliases, I believe, with iCloud. So it's really, it's fascinating. Now, if Apple is doing it for the right reasons or not, or if Apple, you know, if the, if nation-state surveillance programs have backdoors into Apple, I would think we should expect that they do.

I don't think we should expect Apple to be a good player, but I think we should celebrate the work that Apple is doing to make privacy mainstream. Now, the problem is they're doing this with such massive resources and such incredible levels of convenience that people might end up being stuck in their paradigm. Like they won't be ready to use a slower internet because it's better engineered. Like using iCloud privacy relays, I, I wouldn't, I wouldn't really use it myself.

Like, I don't think I would gain that much privacy, but they are fixing things at like the retailer level, as we discussed at the beginning of this call. So anyways, I'm, I'm happy that they're advocating for privacy. I think the more people make noise around this, the better, but now we are lacking significant funding to be able to create alternatives. And that is where I would segue this, like, although I'll let you segue it because you're the segue master, but like we need way more funding to be able to create alternatives.

And the disparity between what Apple is able to do and what we're able to do is just growing. It's disproportionate. Like they have so much resources behind those moves. Like Tor is so underfunded, right? Anyways, I'll let you segue master it from here. Yeah, I do have a couple of comments before we jump into talking more about funding. I think you, you really hit the nail on the head all throughout that. And the tricky thing with that question is we have to basically act on peer speculation.

But I think you took a very, a very level-headed approach. And I think you hit the nail on the head with the comment about how it is at least normalizing the idea of privacy in the mainstream. And I think that's a huge win, no matter what their motives are. I think it is a huge win that they are putting so much money into marketing the importance of privacy, even though obviously they're selling their specific take on privacy. But it is good to see that so many people are starting to think like, even my parents have started to think a little bit differently about privacy since seeing Apple's ads because they, they, it starts a conversation about like how private actually is Apple and what are they doing differently to kind of spark this and, you know,

50:00 I think it has started a lot of good conversations and has brought a lot of good focus on the need for privacy. So that's definitely the positive side of it. But I think, like you said, I mean, obviously they're a business at the end of the day, and they are a business that benefits from building a monopoly in both the hardware, software, well, I guess in all of the hardware, software, and marketing spheres. And making a move like this can help them to continue to build a monopoly, and especially the software and the marketing spheres.

The marketing one, I think, is essential in this because they can cut off so many third-party ad companies and data brokers and force people to go through Apple for user data and for marketing access. So I think there definitely are, I'm sure, ulterior motives that are business-oriented. But I think overall there definitely has been some good stuff to come out of it. And hopefully, too, the things that they make, even if they're not open source, hopefully the ideas that drive the tools that they make to push towards privacy will be helpful to those in the open source and the more broad privacy communities as just kind of a valuable tool to get some insight into alternative approaches to these privacy tools.

And even just normalizing, like normalizing the ideal of email aliasing is awesome. I hope that that's something that really does take off. Like I use SimpleLogin and know a lot of other people that use it, or I think AnonAddy is the other main one. But I hope that even just that takes off because email aliasing can be a huge win for somewhat for privacy, but really for security and just kind of ease of switching off aliases if they get hacked or put on a spam list or something like that.

Yeah. Yeah. I mean, here's an idea, right? Like I hope somehow Apple will allow third-party relays, you know, like it or third-party circuits. Like it would be great for the user to be able to choose which privacy abstraction layer they want to connect their iPhone to. But right now, Apple, I think, is the only one, right? So like, as you said, they are monopolizing privacy, which is really freaky when you think about it. And they'll absolutely be faster than any other anonymity layer.

Anonymity layer because they're a centralized service that can choose the perfect tops for you and that can provide very strong infrastructure that's always dependable. Like they'll make the idea of a proxy service like Tor interesting, but will make it so hard to switch to Tor because of the drawbacks that you get when you have a decentralized network versus a centralized one. It'll be interesting to see where that goes, but hopefully at the least it'll spark some good conversations and get people thinking.

Let's take a quick break from this episode to chat about the sponsors of OptOut, Cake Wallet, and LocalMonero. Cake Wallet is a key tool that I use daily as it allows me to easily and quickly use Monero for private by default payments. It's available in both iOS and Android and is a fantastic way to get started buying and using Monero with a simple and easy to understand user experience. I regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency.

If you're interested in purchasing Monero for the first time or helping to bring others into a parallel economy, I'd recommend you look at using LocalMonero like I do to buy and sell Monero while maintaining your privacy and avoiding invasive exchange surveillance. LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy. Thank you to both sponsors for their incredible support and partnership.

And I hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors. I did want to jump into the funding question because I think that's an interesting one. And I hadn't considered that with the Apple approach that they really can out, both outfund the technological tools themselves with their competing FOSS alternatives and kind of pro-privacy alternatives, but also just obviously pouring money into marketing and pitching to people themselves as the ultimate privacy solution.

But I know that you've had kind of a lot of back and forth with funding in the privacy education and the FOSS space. So I'd love to hear kind of how funding or the lack of it has impacted your approach to educating your audience. And then maybe some broader thoughts around the funding issues that exist in the FOSS and pro-privacy space today. Yeah, I mean, I guess I can start by saying that developing a technology such as Gmail, to take an example that everyone has probably used, is ridiculously expensive, like insanely expensive.

The simplest of ideas to create a prototype of it, like of a web service and put it out there to the world, you know, would require at least like 50,000 bucks. That's for like the most simple idea that one can have, sort of. If you're, everyone's expectation nowadays is that everything is free online. And that is a massive problem, right? Like, so I think that everyone has to start valuing tools that they use online if they care about privacy, through the lens of like, like, how is this sustainable?

If I love this, you know, privacy conscious alternative, how is, like, who's the person behind it? Like, what are, how are they, like, are they struggling? Are they able to have a normal life? It's really hard. I think a lot of people see open source as passion projects. It's like, oh, the people doing KeePassXC. It's a password manager. That's open source. For people who don't know, I mean, it requires a lot of work. And even if it is open source and, you know, a hundred different contributors have contributed to the source code, managing an open source project of that scale requires ridiculous levels of dedication and love.

Just doing the triage of issues is probably something that one could spend half a week on, right? You know, for, for the whole year. So I, and also like a lot of those apps will solve a very niche use case or need, but often will, a lot of those apps will kind of look like crap because making something great to use and beautiful is even more work. So, I mean, I, I just, I, I just, I just wished more people realized that technology is not free to manufacture and requires, you know, resources.

And if we're not crowdsourcing those resources and sustaining those developers, those projects are just dying off. Right. And they're either dying off or becoming semi-proprietary. So I, anyways, that's kind of like a long emotional rant here, I guess, like, uh, at least in my journey, uh, so on YouTube, I have, you know, almost 27,000 subscribers and people are watching this content, you know, thousands of hours a month. Um, and if I had enabled monetization, which I don't, maybe we can discuss this more a bit later, but like I disabled monetization, I would probably be making maybe 300 bucks a month, which is like peanuts.

Essentially. I mean, for, for someone living in North America, right. I know for, I have viewers in Indium and they would like be pumped, you know, they could sustain their families with this, but here, here it's, it's not, it's, I mean, it's, yeah, it's, it's, it's, you cannot, you cannot even consider, that doesn't even pay enough for one to just think about how that could be sustainable. It's, um, and I have donations, so people have been donating, um, and, and some people are very generous. And if ever, some of you are listening, because I have no clue who donates, by the way, I'm using Libera pay, which is kind of like Patreon, but it's for donations. And I don't know who donates or I have, you know, a Bitcoin address.

Um, so I don't know who donates, but like some people do donate, you know, you know, significant amounts like 500 bucks or something, which means the world to me. And, and, but it, it still isn't sustainable, which means like for the past few weeks, I've been off YouTube doing a lot of research and doing some client work. Um, because creating this kind of content or even just maintaining existing guides on GitHub requires a massive amount of time. So, um, yeah. So funding is, I haven't found the recipe yet. Like an idea I have is to create the privacy conscious org, which would be this nonprofit nonprofit organization that could, you know, do a lot of deep work on privacy infrastructure. Um, the idea also involves creating like the B Corp of privacy. So like we could audit, uh, providers that want to establish themselves as privacy conscious, making sure that there's

1:00:00 infrastructure, their code, their ethics are good. So that's an idea, you know, but we would need funding, you know, in the hundreds of thousands to be able to do something significant. So for me, at the individual level, I mean, donate people who have donated. Thank you so much. It buys me time that I can then allocate to do more research and more content. But in the large scope of things, if I take all donations that I've received so far, and I compare that to working for the private sector, it's, it's almost like a rounding error, unfortunately. Yeah, yeah, I think, I think we have a lot of very similar thoughts in this field. And I love how you focus that people view the tools that they use being free is just like the norm, and not a problem at all. And I think unfortunately, we kind of had that normalized by the, the Googles of the world with Gmail and Google search and just all the services that they provided for free, knowing that they could both build a monopoly and use the data that users were providing by using those services as a monetization vector, like they knew

that they could use that data, sell that data or use it internally, and gain immense value from that itself, rather than having to rely on money from users. And I think unfortunately, we got very used to that concept of, I use a service, it's free, I just use it, move on, and I don't need to worry about how the money is, how the money is made, or how the project is funded, or who handles merging into into master about who handles issues that are coming in, anything like that, and very much kind of missed the big picture of how, how difficult it is to run services, both obviously, within a central company like Google, that's, it's still tricky, and it takes money, I mean, they're putting billions and billions of dollars purely into the hardware that are behind those services. But then in the open source space, it gets even more, the problem gets even more exacerbated, because people love the services, they use them, but there is no central entity behind those projects, usually handling the funding,

or handling the man hours that go into managing a project like that. I mean, you, you mentioned how difficult it is to manage an open source project with many contributors, and like, that's something I've seen firsthand, trying to do what I can to help out the Monero project, and just the, the absolute massive amount of work that has to go into all of the moving pieces of a software project, is just, I don't think people who haven't kind of really delved into that world can understand what goes into that. And they just assume that people are doing it, like you said, as a passion project, and while they are, no one, if no one is funded within that, it will continue to either die out, or you'll just have a constantly, a constant rotating door of contributors, because they can't afford to continue to focus all of their time, or the majority of their free time, even on that project, if there's no way for them to become sustainable through it. So that's a, it's a hot topic for me, and something I've tried to focus on, and tried to

remind people that like, the services you're using, they may be free and open source, but that doesn't mean, A, they shouldn't be, you shouldn't have to pay for them. I think they're definitely a very valid ways to have a payment model within a free and open source project, free as in Libra, obviously, not as in no cost. And then obviously, for those projects that aren't behind a paywall of any kind, where you don't have to pay to get the app or pay to use the service, understanding that, like you said, there are real people behind that project who are dedicating real hours of their lives, and finding a way to help sustain them is a massively, massively important thing for us to continue to have these privacy conscious and open source alternatives to opt into when we're opting out of the the current problematic centralized surveilled ecosystems that we're in. So hopefully more and more people will continue to wake up to that. And hopefully more people will continue to think of concepts around funding, like you mentioned, with kind of building out a privacy conscious org and

something like that, I think, could be a very fascinating approach. I mean, like, Calyx Institute is an interesting take on a nonprofit where they've found ways to monetize and fund themselves through donations with really cool perks that you get for donating. And they use that money to drive the creation of privacy preserving services of CalyxOS, their mobile operating system. And there, I think there's a lot of work to be done on just coming up with concepts that are are viable for funding these projects without preying on user data without close sourcing it and making it something that's restricted to only behind a paywalls, things like that. So there's a lot of work to be done. It's a very tricky space. And I'm glad that you're focusing on that, too. And I think your your video talking about the issues you've had with funding and just your your take on it. It was very cool to see and just very heartfelt and real.

And I'm glad that you're willing to be that open with with your viewers and to share some of the difficulties that come with being a content creator, because that does have similar but different funding issues. And yeah, it's it's so hard to walk that balance, too, between like respecting and being thankful for the donations, but making sure people understand that, like donations alone as a vector for supporting someone putting the majority or all of their time into a project is almost never sustainable. I don't know anyone that's been able to do donations as a full time gig. So it's always a tricky world. And while it's like, we're super thankful for that type of thing. People also need to realize that donations at least as is are not something that's able to sustain a person, at least not in the Western world, really, Yeah, or not at the scale that we're operating. I mean, so there's YouTubers with like 800,000 subscribers, you know, and that's a whole different ballgame. But like, if you're fighting for privacy, this is a really niche, and small community. So

it's we don't have like the scale. Yeah, yeah, yeah, it's it's definitely growing. But we even see large organizations like Tor and Signal can still have have issues, raising funding or having it be a reliable source of income. And they obviously have a lot of good nonprofit legal structures behind them to help them to be to be able to do that more easily. And they have actual like they're a nonprofit company behind that, that can run those tools. But even they rely on user funding. And that can be hit or miss and and pretty tricky. So yeah, even large organizations have problems. So much less the smaller projects and the individual content creators and all the other people in the space.

You might you might you might have an answer to this, which, which I would love to hear. I mean, so Signal, the Signal Foundation got, I think, a $50 million donation from Brian Acton, maybe I'm messing up his family name. I hope I'm not. Co founder of WhatsApp, right? Which is interesting. I would you happen to know how much other funding they've received? Or if any other significant funding? I don't. I definitely need to look into that more. I mean, I know that they like right now they're doing a big push to get people to become what they call sustainers, which is just a donor to their to their services. But I think they found some other different ways to fund Signal. They're a little bit abnormal outside of donations. They are not entirely donation funded. As you mentioned, they have lots of large people who have donated in the hopes to bring Signal to more people and to improve the project.

Yeah, but they've they've also taken odd and maybe dangerous steps towards other funding solutions like they've introduced a cryptocurrency called MobileCoin and the actual creation and history behind MobileCoin is very problematic and it's very centralized and it actually has venture capitalist funders behind it that will help that want to have a say in how the cryptocurrency works. And so that's being used as an avenue to fund Signal and there's a lot of drawbacks there and that's probably not something to dive into too deeply here. I've written a lot about it on Twitter, but there's a lot of problems there. But the fact that they're a they're willing to do something like that and it was a huge PR And it's a huge organization like signal and probably the most or one of the most well recognized brands in the privacy space. They are even resorting to different approaches to funding outside of purely donations.

Yeah, and it's unfortunate. I mean every like it's this very weird landscape where signal could not be really private and then have me pay five bucks a month. It's this dichotomy, right? Like yeah. And yeah, somehow I wish I could. You know, I would pay signal $5 a month, you know, and I could donate $5 a month. Agreed. But the masses won't go through that donation channel. Like, And they won't value signal. They'll just use iMessage, right? Like if signal is five bucks, they'll just anyways, the other thing that I wanted to mention is Firefox, right? Firefox has almost 100% of its funding coming from Google to be, you know, to have Google be the default search engine. It's a crazy landscape. That's the point I'm trying to raise here is like, it's a crazy landscape. If signal didn't receive that 50 mil funding, you know, I'm not sure it would exist today. If Firefox didn't receive that 50 mil funding, you know, I'm not sure it would exist today.

If Firefox was not funded by Google, I'm not sure it would exist today. So I kind of really like, I have no, you know, insider information on this, but like, I love the fact that the Signal Foundation was funded by Brian. It sounds similar at a massive scale to my

1:10:00 my LickStats journey, right? Of like switching hats. So like, I guess Brian decided to go on the other side and invested 50 mil. I mean, to anyone listening that has been fortunate enough to, you know, make a killing during their life and have a few million under their belt, you're the people who can have the most significant impact donating to these projects. If you see someone that is doing something that you relate to, that you think is powerful, that like you can give that person wings.

That is what can make the biggest difference right now. And some, I've had the chance to have some people like help me out, not nearly close, like not 50 mil, right? But, and like one person donating can donate as much as like 500 others, right? And that's getting things closer to living wage. So I just really hope that more of these wealthy people who see privacy being, you know, a mainstream important, like problem in society, we need to improve on it.

These are people that can really help those projects. So to all of you guys who have donated to, you know, Tor, you know, Signal, Firefox Foundation, you know, Mozilla Foundation. Thanks, right? Thanks. Thanks. Cause that's amazing. That is empowering change. So sorry. That was my little ad break for everyone donating to all of those amazing projects. I mean, yeah. Yeah. I mean, I think that's it. It could very well be the make or break issue between how, how many options we have to choose from when we're trying to become more privacy preserving and work on our own personal privacy.

The funding issue could be the make or break thing that really decides the future of that landscape. So the funding will be make or break. And it's like, I'll be blunt about this. Yeah. I can go, I can start a company that will, you know, make money, go and see VCs, get funding for it. You know, just get that lift off, grow, become a more significant company, get a larger user base. VCs do not fund privacy, or at least it's extremely rare, but we still need that influx of cash.

If we want to compete with Google, you know, or Apple, we need a massive amount of push to be able to do this. And we're not only fighting to build competing technologies that are as good or better, which would be naive. It's hard to be better than, you know, billion dollar companies, but like that's, we're fighting to make great software, but we're also fighting so that people develop a conscious about why it's meaningful. So we're fighting twice, right?

And that's a distraction to turning a big fat profit. And that will get VCs turned off, you know? So like we need more Brian Actons, you know, investing massively into the privacy ecosystem if we want this to work out or government, but government is this weird, you know, weird landscape where a lot of surveillance is government backed, you know? So. Yeah. Yeah. And I definitely don't want to, like, I don't want to discount the impact of individual contributors to these projects, but I think you, I think you've made a very important point that the scale of the privacy preserving and privacy conscious community is relatively small nowadays.

So it's hard to fund any kind of bigger projects out of those individual contributions. So I think that's like, especially because of the scale of the communities today, those individual large contributions can have an outsized impact on the space when they're willing to do that. But the value of those individual contributions, even if it's a dollar, is still massively important. And that is still something that I hope each and every one of you will think about the tools and services that you love for their ability to preserve your privacy or even just their ability to create a great open source product.

I hope that you will think very, very deeply about finding a way that you can sustain them, whether it is a direct kind of monetary donation or some other way that you can pitch in and help. But you can have a huge impact too, but obviously those individual people who have access to massive amounts of capital can have a massive impact as well. So I'm hopeful that both of those groups will jump in and really kind of think twice about using these excellent services for free and never giving back into them.

Yeah. Yeah. I totally second this. Thanks for getting me back on my chair. And you're right. I mean, there's two, like we can attack this by both ends. Like I think, and people, you know, donating or paying for, you know, monthly for a SaaS or whatever, like that really gets developers pumped. Like I can, you know, as a developer myself, when people buy QR bridge, I'm pumped, right? Like I busted my ass to develop this little project. I'm in love with it.

And when people are, you know, willing to help out and I'm super pumped, right? But yeah, I mean, it's amazing the impact that a bunch of people can have when they decide to align. It's crazy. So thanks for making sure that was heard. Yeah. Yeah, absolutely. I knew that that was your thought behind it, but I just wanted to make sure that people heard that and understood that there. So I do want to shift a little bit more into your content itself and just kind of help people understand where they can dive into the things that you've created, depending on kind of where they are in their privacy journey.

So the first question around that is just, where would you suggest people start when they're watching your videos if they're early on in their privacy journey? Yeah. It's a great question. And I have to admit that I'm a little all over the place. Like some guides are super complicated. Some guides are more beginner friendly. I have a labeling system that maybe not everyone knows that that's what it is, but there's like a little L with like, I think it's L1, 2, 3, 4.

And that's like level 1, 2, 3, 4. So there is, how does this call? A playlist on YouTube that is level 1. It's the getting started guides. And then there's L2 to L4, which is like in this advanced, you know, playlist. So like I would start on that playlist. And there's like a whole bunch of things. So like, you know, getting started is about using a browser that is privacy conscious. Learning about how the internet works, you know, and why VPN doesn't solve all problems.

Using signal and getting our loved ones to switch to signal. I mean, and a lot of this stuff is discussed in the level ones. So that's definitely where one can start. There are other content creators that really specialize on maybe more of that getting started stuff. Like Techlore comes to mind. I also think that everyone has a learning style or like will relate with a content creator maybe more than another. So yeah, if someone watches my stuff and it doesn't really, you know, work, I mean, there's Techlore.

One that I really like listening to these days is mental outlaw. It's a little more radical, but there's a lot of good stuff there as well. Computerphile is amazing if one wants to learn about how the internet works, how cryptography works, stuff like this. I've heard of that one before. I'll have to check that out. Computerphile, yeah. It's really cool. And all of those that I just mentioned, if you go on my YouTube channel, there's links to them.

I don't know exactly where. Let me just pop that open here. So there are links to those other YouTubers. That's a good way to start. And also like the privacy guides reference material, how it works is a lot of the content you see on YouTube has associated reference material. That associated reference material is hosted on my website and or on GitHub. It's like the same content. So if you watch an episode and you want to learn more about it, always check out the description.

That's valid for all content creators. I think not everyone like has the instinct to go and dig into the description. But often there's like a lot of links to like insightful reference material or related videos, stuff like this. Yeah, I love that you make accompanying guides to your videos. That's been super helpful for me when watching through them to have something like, because I do enjoy watching videos to absorb information. But when actually trying something, I've really just like video guides.

Like if I'm doing the thing, I don't like having to have a video up and watch that and pause and play and pause and play. Yeah. Versus just a straight like blog style guide. So I really do like that, especially your videos that are more focused on like how to use a specific tool. You have really excellent blog style guides that go along with it. Those have been super helpful for me when playing around with things like Jitsi, a guide specifically around that.

That's been super helpful for me. So I love that.

1:20:00 approach yeah i have no analytics on my website so i'm glad to hear that some people are looking at this stuff i and i miss it right like i i i do have an itch to create like a really privacy conscious version of lick stats so that i could know like is are 10 people watching this you know reference material or a thousand yeah i don't know if you've uh if you've heard of matomo but they're an open source um you can do local only like on premise analytics so that's definitely someone i would recommend taking a look at that's who the monero project uses on their kind of quote unquote official website so very cool no no i'll look into it i mean i haven't looked into that for for a while yeah it's not something i've used yet i have no analytics on my blog as well which can be frustrating at times but it's something i've wanted to jump into so i want to make sure that's something something you're aware of um but circling back to your videos i actually had not seen that that labeling system of l1 through 4 so that's helpful for me and i assume that'll be the the recommendation

you have for advanced listeners too that they take a look at more of the the l2 and up uh videos there yeah yeah for sure um i mean i'm not sure if i mentioned it before but like if you go on youtube.com sunnewtson uh there's home videos playlists and within that playlist tab that's where you can get you know privacy guides events or privacy guides getting started and that as you mentioned goes along with the you know l labeling system so l1 is getting started l2 is deeper into rabbit hole so those are like levels down the rabbit hole essentially awesome that's super helpful i wish uh wish more people organize their their videos like that it's nice to be able to to jump in depending on where where you are in your own journey rather than just kind of having to look through manually um so i'll definitely have to take a look at those for myself as well um cool and uh last main question i had for you was just uh wanted to get an idea of some of the tools that you use regularly to opt out that you'd recommend

listener to take a look at and then why um i mean the ones of the moment i mean this is this is i'm not sure if this is going to make any sense but like uh i use tails os more and more i love how you can boot tails on a computer that supports it so like mid 2015 max and earlier or like tank pads or whatever and and you can run app image releases on it so like trezor suite if you're into bitcoin that works on tails uh not by default uh yet but i have a guide on the privacy guides on how to do this um i also love signal i mean as that you know drop and replacement for i message or whatever text message um i mean yubi keys you know moving two-factor authentication out of the same computer where you're using it to compartmentalize that so that's that's maybe more of a security thing though um i started using KeePass xc instead of one password like i don't personally feel the need to synchronize my passwords between devices because i don't trust my my phone um so yeah keep sxc as like a password

manager that runs on the computer um i also really love VeraCrypt um VeraCrypt is a way of creating encrypted volumes uh or folders in which files can can live and you can create that uh encrypted volume of a specific size so like say 50 megabytes and it's it works on all operating systems including tails uh so it's a really cool portable way of creating backups and moving files around um i'm looking at my my computer here um to see what else i'm using i mean just learning about the terminal and command line in general is super empowering for for people and i use that all the time uh yeah i wonder i mean hardware wallet if you're into crypto like move your stuff off exchanges onto cold storage but be mindful about how to do it properly because it's very possible to lose your funds if you don't do it properly so there's a lot of content on the privacy guides and a lot of other channels on how to do this um so like having a treasure device or a cold card um that's something i use also on a regular basis um trying to think if there's

anything else i mean there there's just like so much stuff uh that i probably don't even notice anymore that's okay if if i can give one piece of advice to anyone you know looking at the rabbit hole and and considering going in or having gone in and gone back out because it's a little dark um humans are um what's the word for this resilient like we get used to comfort and convenience and then we kind of expect it to always be there but as soon as you give it up it feels like crap for the first few days and then you forget about that convenience and life is back to normal so true and that is how my journey has been you know like at first you stop using google and you're like holy you know like duck duck goes is painful right because you're used to this self-fulfilling prophecy of google knowing you more than you know yourself so obviously you're finding everything you're looking for um but then once you start using duck.go it just gets normal right and you're like oh i find what i need to find

you know um i remember when i was using an email client called spark i believe which is not a recommendation um and now i use apple mail because i don't want to route my email to a third-party provider i wanted to go straight from the server to my inbox and there's no features there it really looks plain and boring but after a while you forget about the bells and whistles so we're adaptable that's the word i was looking for not resilient we're that too but we're adaptable so to anyone getting started in that journey just uh endure the pain for a few days and eventually it stops hurting and it's a renaissance then you can you you're reborn in a privacy conscious way so yeah i think it's such a such a solid point because people do kind of feel feel that it's too daunting at the beginning to start taking those steps but like i don't like you said i don't even think about using signal or using firefox with a few privacy preserving add-ons and some customization i don't think about the many of the

security and privacy tools that i use today because i've just become familiar with them and moved on so like that that line between convenience and privacy can be shifted greatly a lot a lot further than you think it can because the things that are privacy preserving will become convenient to you once you understand them and once you kind of understand the trade-offs and the the unique ways that you need to use them um so there's there's so much value there and understanding like if it's hard right at the beginning that doesn't mean it's going to be that hard all the time um it definitely does get easier and you become familiar with things and you've you either find community that are using those tools as well or you pull community into those tools like pulling family and friends in the signal makes signal a lot easier to use if the people you're talking with are already in there as well um so it definitely does it definitely is something that drastically improves over time and we have a

great ability to to adapt to those changes and and really grow into them being just a normal part of life yeah totally um i and it's very rewarding that's a hard word for me to say in english rewarding it's very rewarding um to experience technology differently and also just being away from social media is such a blessing right it's it absolutely i feel so much better like psychologically since i took many steps back so yeah there's there's so much to win we just have to try it and at first like everything else it feels uncomfortable and eventually it it becomes comfortable and then you just don't want to go back that's that's the fascinating side of things yeah yeah yeah very much so and i mean i feel like you kind of answered this question already but my last question was what advice would you give to someone who's just starting to realize the need for personal privacy um and if you have something else i'd love for you to to jump in but i feel like you hit the nail on the head at least in a very key point that when you're starting that journey it feels very difficult

and very daunting and the the lists of tools and the different things you need to get used to seem impenetrable um but once you do dive in you adapt very quickly and and find others that are using those tools as well but if if you do have any other input on someone who's starting to realize the need for personal privacy um i'm all ears yeah i mean it's it's it's it's going to be uncomfortable uh both from the convenience standpoint and from like a psychological isolation standpoint but um it becomes much more comfortable so like um please like anyone listening that once or as part of that journey like we're adaptable it's uncomfortable at first um take it one step at a time like don't take that's one that we haven't mentioned like one step at a time like don't one should not try to learn like one should not start using tor for everything using proton mail with pgp for everything you know uh not talking with people outside of signal because they're not in signal like one one one step at a time right and and then it really makes that transition more comfortable so that's

1:30:00 that's definitely something that I think should be mentioned. And it's weird. Like, it's a hard sell, right? Like, okay, how do you sell privacy to someone? Like, why does privacy matter? It's a hard one to pitch to a general audience. I mean, I've talked a little bit on the podcast in recent episodes about kind of getting past the point of trying to sell people on privacy. Just because usually people haven't kind of woken up to the idea, it's usually very hard to turn them around.

Like, yourself in a conversation. But I think to me, like, the way that I focus on selling it to someone is trying to target it specifically to, like, who they are and the things that they do. So it could depend. I mean, like, I think it could be a parent who's trying to keep an eye on their children and keep them safe. But to do that, they're using some sort of affordable, like, tracker app that's feeding that data not only to them, but to a ton of data brokers about where their kids go, what apps their kids use, how long they're talking to people, what they're saying, all of those kinds of things.

So it could be more pitching it around, like, maybe you don't want this information in the hands of all of these other third parties because they could do these things with it. That could be an example. But I think it really just depends on who I'm talking to and kind of where they're at, finding the best way that I can share with them how privacy has been helpful to me and maybe a specific way that caring more deeply about privacy could be helpful to them.

Hopefully now, but at least in the future. Yeah. I don't know why the image I had in mind is someone that has been locked in a box for so long that they don't even appreciate outside the box. It feels like that's the technology landscape that we've been slowly being put into. So it's hard to sell. Like, you're selling this outside stuff. But, like, the person's like, oh, the box is fine. Yeah, exactly. I just wish people realized what's on the other side.

I mean, it's so empowering to understand technology and to see how all of this connects together and how the internet works and why all of this is deeply tied to freedom. And then, yeah, start. The way I'm feeling right now, to be blunt, sun-style in some of my episodes, it's like, I'm trying to end this in some way that would get people pumped about privacy. And I'm trying to end this in a way where I kind of look smart or something to be completely transparent.

But it's weird. I am now using computers differently. I'm now, I've changed my habits. And I no longer see privacy as something else. It's just normal now. So I'm, like, there's no fireworks. It's just, I have a million computers in front of me right now. And I just use them differently. And I still get a ton of creative work done. I still get to connect with other human beings. I still get to do the stuff I love. But it's between me and the people that I want this to, like, it's between me and the people that I care about.

It's between me and people that I collaborate with. I'm not just broadcasting everything I do online with everyone. And I feel incredibly good about it. So I hope others will be able to have a taste of that and realize that there is a way outside of, you know, Google's of this world. And it's amazing. I love it. I think that's a great way to end this one. And just a great reminder to people that there is a great amount of freedom once you start to think about privacy.

And it becomes something, like you mentioned, that you don't have to consciously be fighting for every minute of every day. But it becomes the default and the norm for you, which makes it both very, very much easier and more freeing there. So definitely, definitely echo those sentiments. So just, yeah, thank you so much again for coming on, son. I feel like I learned so much in this episode. I'm really glad to be able to end season one with this and just glad to be able to learn a bit more about you.

But for those listeners who want to dive in and maybe communicate with you or watch some of your content, what are the best places for them to do that? I guess YouTube is a good place. There's also on GitHub. So on my GitHub repository, there's the privacy guides. I mean, I'm a GitHub account. There's the privacy guides repository in which there is like the discussions part of GitHub where people can ask questions to each other. And there is like a community there that is bouncing ideas.

I'm flirting with the idea of having more privacy meetups, but I'm, so those are essentially calls, you know, on Jitsi where we can all get together. I'm just trying to find the best way to get, like, how can I have the highest impact in the privacy space? Because there's so much to be done and there's so little time. But yeah, and for anyone who's involved with more sensitive stuff, I mean, there is like my email is available on my website and my pub key as well, if someone wants to, you know, get in touch and privately.

But I have to admit, like, it's getting harder and harder to follow up to all emails. So yeah, to be honest, like the real answer here is like, I don't know. Like, I'm at a point where it's no longer human scale because there's like a whole bunch of us on YouTube. And yeah, I'm trying to find the right way of having some of it operate at a human scale where we can kind of connect. But I haven't found the solution and I'm running out of energy. So I guess YouTube, GitHub, and hopefully a whole bunch of better ways soon.

I love that idea of the meetups. I'll definitely have to keep an eye out for those and see if I can jump into one in the future. But I love that idea of bringing people together in a more, like you said, more human way to keep that pro-privacy community connected to the ups and downs. So I love that concept. I'll definitely have to keep an eye out for that. And we'll glad they share that with my followers and listeners. If you do, you'd like to do more of those.

Thanks for what you're doing, by the way. I mean, you're clearly pouring a lot of love and time into your podcast project. And I mean, thanks. Thanks so much for putting it out there and getting people. It's a lot of work. Just people probably don't even realize the amount of work that it takes for you to schedule this in, book people, do the research, prepare, edit, publish, rinse, repeat, you know, and you're now, this is your first season, right?

Yeah, it is. This is episode 15, first season. How are you feeling? Man, it feels like it's been ages, but I only started it six months ago. It is incredible the amount of work that goes into it. But I'm just, I'm so grateful for the platform that I've gotten out of this and just the interactions with people who truly have woken up and are passionately approaching privacy now. It has definitely been well worth it, but it's been a ton of work. So next, I'll be kicking off season two, which will actually just be in a couple weeks now, which we'll be focusing actually on a lot of the topics that we focused on today.

We chatted about a lot about kind of FOSS funding and the sustainability of FOSS and pro-privacy projects. So my focus in season two is actually going to be around that and just highlighting a different project each episode, chatting with them about just kind of the pros and cons of the tool, the limitations, but then also really focusing on how can listeners get involved, both just in a monetary way, like how can they help to fund or sustain the project?

And then what other ways can they give back, whether it be like GitHub issues, jumping into a community, helping answer questions, whatever the approach will be, but really trying to give those projects an extra platform, more visibility, and just the chance to hopefully have some of my listener base and audience diving in and giving back actively to those projects that I love and that they love. So that'll be the focus of season two, which I'm really excited for.

Very cool. Very cool. And how can people support you? Yeah. I mean, the main ways are definitely, if you are wanting to support the channel financially, you can go ahead and donate at optoutpod.com slash support. And then another way that I don't mention enough, but that's super helpful to bring new people into the community for Opt Out is just leaving a review on whatever podcast platform you use. If you use one that doesn't have reviews built in, you can just go to the website, optoutpod.com slash reviews, and you can drop one there.

Or if you use something like Apple Podcasts or some other platform that has their own review system built in, leaving a review there is super helpful to keep the podcast in front of new eyes, to pull new people in and to help other people jump into the privacy journey with you. So that's a super useful way. And then really the third one and the key one is just sharing the show, especially episodes that you think would be valuable to that specific person, sharing the show with friends, family, and any other communities you're a part of.

So those are definitely the key ways for me. Cool. Well, to everyone who's listening, you know what to do.

1:40:00 Thanks for listening, and I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast, or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode. Now get out there and opt out this week. For this week's project to help you opt out, I'd recommend you take a look at I2P, an anonymizing network similar to Tor, but with some alternative design choices and use cases.

While it's not something I've used myself heavily yet, it's extremely important that we don't get stuck behind the Tor is good enough mentality and not have a good working alternative. I2P is an excellent choice for hosting anonymous sites, anonymizing your browsing, and improving privacy while tunneling traffic through I2P. It leverages a similar approach to encryption to hide the sender and receiver of traffic from intermediary nodes, but does not rely on onion routing, unlike Tor.

If nothing else, I'd recommend you read up on the links in the show notes to better understand the approaches I2P takes and start to get familiar with the software as an alternative or backup to the Tor network. Thank you.