References

Streamed on September 17th at 8pm EST, the original livestream from Facebook’s website was in 360p. A 1080p version was simultaneously streamed to YouTube, which Winward and I watched. Later, Facebook edited their site’s livestream to use the 1080p version.

• Original Video (Facebook Live)
• Original Video (YouTube)

Sources

• The initial demonstration of the Neural Band is from Meta Connect 2022
• Mark Zuckerberg vs Lex Fridman in Jiu Jitsu
• The song that originally played was Diplo & Sleepy Tom - Be Right There. Due to copyright, this song has been replaced with J-Louis - Before You (Rachel Foxx flip)

First of all, BGP routing problems don’t just affect Tor. They affect all kinds of network architecture like VPNs and certificate authorities. While I don’t have a complete understanding, the attacks presented by Princeton University’s team against Tor are not unique. A similar attack was documented by Certik against the crypto exchange KLAYswap. By that point, this seems out of scope of Tor when all of us could be hit.

Second, I’m not familiar with the specifics of what NoScript is doing, but the team has expressed that they need more data for building more up-to-date NoScript profiles. Seeing as I’m one of the only people on the planet who uses uBlock Origin advanced mode, I don’t know what the expectation is here nor what should be blocked in each mode except Default. The Tor security settings made sense back when NoScript was the only game in town, but there are plans integrating uBlock Origin into Tor and it’s going to take some time.

Third, on the Tor Browser no longer changing the user agent to Windows, user agents have long been broken. I constantly get questions on old videos and I’ll say it here, stop using user agent switchers. As long as you know what user agent you want (e.g. Chrome on Mac), you can use the responsive design mode in Firefox or “Inspect Element” in Chromium to change it. This feature exists for people who are web designers or app makers to test compatibility and responsiveness of their sites or apps.

Changing your user agent can fool certain scripts, but other scripts easily bypass it using fonts/CSS detection and find some way to detect your true operating system. Since Apple created Apple Silicon, the Tor Browser has reported the accurate “Firefox ESR on Mac” user agent because they mostly still are the only ARM users of the Tor Browser. When you think about it this way, it makes changing your user agent detrimental to your privacy because only weirdos and web devs change their user agent.

Fourth and finally, maybe consider not trusting sources that only show their sources in screenshots and make me go down rabbit holes online and yank things out of my brain. He clearly doesn’t know anything about Fair Use when he watched Reddit videos in a livestream with no meaningful commentary, previously claimed Proton is a honeypot without provided substantial proof, stole thumbnails from other YouTubers to use in videos, or complained about politics/open source rather than helping people or fixing problems. I hope one day the feds would pay me the money some people will likely accuse me of making. Maybe consider not getting your news from YouTubers, including me, especially when they use awful sources like Linuxiac, the Register, Tech Radar, Reddit, and X (formerly Twitter). This kind of critical thinking is taught in school to fifth graders or students in primary school.

Oh and happy Saturday to you all. I realized Meta Connect is this Wednesday, so I’ve had to slow down video production until it’s over. Shorts will be out for the last 4 tech events I’ve watched over the last 2 months, commentaries are out for Patrons/YouTube members, and the groundwork for 2 videos have been laid out, including one about the mythical Windows 12.

Verifying downloads is something that should be ingrained into every computer user. Unfortunately, the process is very complicated and very few services make this easy for people. It’s intimidating to be told to use the terminal, especially if you are on Windows or Mac.

Paid Signatures

What’s more, why bother when a lot of the programs you use are probably verified already? Windows and macOS have a built-in mechanism to identify whether or not a program was created by the manufacturer that claimed to make it. If you use Snaps or Flatpaks on Linux, both implement a checkmark system to show the developer was verified by the Snapcraft and Flathub developers.

Signed applications are necessary to ensure the file wasn’t tampered with on the way from the developer to your computer. If you use a package manager like Winget, Homebrew, or the one in your Linux distribution, this process is also automatic. What’s more on Linux, the vast majority of packages on Linux are not verified. Even within the average distribution repository, most packages are not officially sanctioned by the original developers. This doesn’t mean a application is malware, but it can often introduce more problems.

The problem is signing systems like Apple’s notarization process or Microsoft certificates are costly for developers, requiring at least a couple hundred dollars up front just so the program you made won’t get blocked by the default antivirus.

• Apple’s crazy developer fees
• Microsoft’s explainer about certificates
• Microsoft’s list of code signing certificate providers

Unsigned applications don’t suggest they are malware, but it’s important to pay attention to where you got the program to begin with.

Bypassing Signature Checks on macOS

Like Microsoft, Apple has a robust verification system. Unlike Microsoft, Apple is more proactive at blocking unverified downloads. When you open an application for the first time, Apple will prompt you if you want to open the application.

If you need to open an unsigned application (e.g. LibreOffice, Alacritty, etc): navigate to /Applications and Ctrl + Click the application you want to open. Then select “Open.”

If you are on macOS Sequoia or higher, you will need to go to the Settings, “Privacy & Security” and manually allow an unsigned app.

Manual Verification

Naturally, people aren’t accustomed to verifying their downloads.

A couple years ago, Linux Mint was hacked and the ISO was modified to mine cryptocurrency off the unlucky souls who downloaded it. Thankfully, Mint’s team shut down the attack very quickly, but it goes to show how important it is to verify your downloads.

The attack was easily prevented if users verified their downloads. Unfortunately, verifying downloads is something that doesn’t get enough attention. The hacker of the Linux Mint, Peace, made the bold, but accurate claim:

Who the f**k checks those anyway?

Peace, to ZDNET’s Zack Whittaker February 21, 2016

We’re going to have to go and prove him wrong. It’s not going to be easy and maybe this is something that we need to start developing.

GPG Signatures

One of the most popular ways files are verified is PGP keys. Pretty Good Privacy (PGP) keys are often necessary for verifying other files using a central server for trust. Some projects also require verifying additional files.

PGP was originally only available to the government in the 1970s and PGP was developed to make file and text encryption more accessible to average people. Almost 40 years later, PGP is very unfriendly and is far too complicated to use. Encrypted messaging apps automate this message verifiability and security process, so they fill this void better. Despite its shortcomings, many open source projects and packaging utilities rely on PGP, because nobody has been able to break it.

PGP is typically handled with a command line application called GNU Privacy Guard (gnupg). There are various graphical front-ends:

• Windows: Gpg4win
• macOS: GPG Suite (Mail encryption is paid)
• Linux: Kleopatra

Of course, like most GNU applications, using gnupg or any of its frontends is not particularly straightforward.

Verifying GPG Signatures

I will be using the instructions for Kleopatra and Gpg4win. The instructions are similar for GPG Suite.

First, download the files you wish to verify. This will be your desired file and a signature file with the extension .sig or .asc.

Typically, these files are named something similar. If you download openSUSE Tumbleweed’s ISO and verify the checksums, the files we need here are the signature file openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.asc and file we want to verify openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.

Make note the folder where the files you downloaded are (e.g. Downloads).

1. In your GPG program, navigate to “Decrypt/Verify.”
2. Select the signature file first and the file that needs to be verified.
3. If you are told the certificate is unavailable, select “Search” to download the key from a known key server. Otherwise, skip to #6.
4. Once the key server has found the certificate, click on it and select “Import.”
5. Accept the next dialogue once the certificate was imported.
6. Repeat the process of “Decrypt/Verify” and select the files again.
7. Select “Show Audit Log.” If you see “Good signature from…,” the file has been verified as the authentic file.

Ignore any warnings that tell you the signature cannot be verified. This often confuses people who are trying to verify files when they aren’t trying to encrypt files themselves.

Since PGP keys aren’t designed for humans, you need to move them electronically. But of course humans still need to verify the authenticity of received keys, as accepting an attacker-provided public key can be catastrophic.

PGP addresses this with a hodgepodge of key servers and public key fingerprints. These components respectively provide (untrustworthy) data transfer and a short token that human beings can manually verify. While in theory this is sound, in practice it adds complexity, which is always the enemy of security.

Now you may think this is purely academic. It’s not. It can bite you in the ass.

What’s the matter with PGP? - Matthew D. Green, Johns Hopkins University

Command-Line

gnupg can also be used from a terminal to verify keys. As a GNU utility, it’s best utilized on Linux, macOS through Homebrew, or Windows Subsystem for Linux. It’s also preinstalled in many Linux distributions.

First, verify your file using the signature file first, then the downloaded file.

gpg --verify openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256.asc openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso.sha256

If the certificate is not yet added, we need import it into our GPG keyring. You will get presented with a dialogue similar to this:

gpg: Signature made Tue 06 Aug 2024 09:04:47 AM EDT
gpg:                using RSA key 35A2F86E29B700A4
gpg: Can't check signature: No public key

Next, import the certificate from a remote server. This is the blob of letters and numbers after the key type. In this example, openSUSE uses an RSA key and the key is 35A2F86E29B700A4.

gpg --recv-keys 35A2F86E29B700A4

You should get an output informing you if the signature was imported to your keyring. Rerun the gpg --verify command from earlier. If you see “Good signature from…,” the file has been verified as the authentic file.

Check Out Those Checksums!

Often times, software makers will provide checksums, which are verified using GPG keys. This ensures the files you downloaded aren’t tampered with or corrupt in some way.

Checksums are alphanumeric representations of files or data—every file has one. There are many different algorithms to check files and it’s different for every operating system. For example on Linux, there’s a nice GUI called Collision. There are also command-line options.

An alternative is uploading the file to VirusTotal, but this may be privacy invasive as VirusTotal will receive a copy of your file.

At any point if you need to navigate to a folder or type a file name, you can drag the folder or file into your terminal instead of typing it out.

Popular Algorithms

• SHA1
• SHA256
• SHA512
• MD5

GNU coreutils (Linux)

Linux has the most comprehensive and commonly used hash verification tools by the GNU Project. The commands also have a built-in checker to formatted checksums from a file.

sha256sum openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso

Running the command will give an output that looks like this:

3b55f6f88c0a64f0e4e2abe19e106c40578ef60a9d97b5be149736e83154b0ce  /var/home/user/bin/mullvad-browser/Browser/Downloads/openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso

If you have a .sha* file, you can verify the file with the -c command.

sha256sum -c openSUSE-Tumbleweed-DVD-x86_64-Snapshot20240806-Media.iso.sha256

If you were not provided a .sha* file, you can manually verify by opening the file in a text editor or word processor, then manually comparing the hashes.

macOS/BSD: shasum and md5

On Mac, the process is slightly different than Linux, because macOS still maintains BSD tooling. The GNU version from above can be downloaded from Homebrew if you prefer the Linux commands.

Apple briefly discusses SHA checksums in their developer documentation. MD5 is deprecated due to its insecurities.

Open Terminal (or an alternative like iTerm2) and enter the desired commands.

shasum

For SHA checksums, use the shasum command. Below is an example for SHA256 sums.

shasum -a 256 subscribe.pkg

The output will look like this:

baaeeedffc7ef4a4f65ec8015699a5c95db91d131d253f1eb2ebc469557344c2 subscribe.pkg

md5

For MD5 checksums, use the md5 command.

md5 likethevideo.dmg

The output is very different from the Linux version, but it’s functionally the same.

MD5(likethevideo.dmg)= 20665acd5f59a8e22275c78e1490dcc7

Windows

Windows has a PowerShell utility called Get-Filehash, which is a catch-all command for all signatures and algorithms.

Get-Filehash is always following by your file, then the algorithm you wish to use.

Get-FileHash C:\Users\user1\Downloads\Contoso8_1_ENT.iso -Algorithm SHA256

All common algorithms are supported by Windows like SHA and MD5.

Did It Work?

Regardless of operating system, if the file is verified, you should just get an “OK.” Now your file is ready to use!

Now that you know, verify your downloads every time. You’ll keep yourself safe from the nasty things out there. All we need to do is pray for better tooling.

Resources

• Riseup’s tutorial on GPG key management. The guide is outdated, but the format of commands and best practices are still true.
• The Code Book: The Secret History of Codes and Code-breaking by Simon Singh. If you want to read specifically about key exchange, PGP, and quantum computing, it’s chapter 6 and onward.
• Damon Garn’s blog post for Red Hat “An introduction to hashing and checksums in Linux”

Track Listing

• Takashi Waraya (稿屋 隆) - With watching the donkey (ロバでも眺めながら)
• Yu-Gi-Oh! Power of Chaos: Kaiba the Revenge - Card List
• えだまめ88 - chocomint (チョコミント)
• Outro: Khaim - Neon Lamp

Let’s have a frank conversation about only the biggest buzzword in tech right now—AI. More specifically, generative AI, because it’s all the rage right now, everything from the next piece of corporate vaporware to the next thing to ruin a profession of service workers, creatives, and all coding as we know it.

AI has dominated conversation of tech for a long time, but no matter who talks about it, it’s always divisive. You’re either shaking your fist at that AI cloud in the sky or you’re a tech bro praising the almighty robot and praying in the hope of Roko’s Basilisk.

I can’t help, but feel there’s much more nuance to the issue of AI. People will be quick to blame our culture for the extremism, but I think this sphere of tech has a bigger problem: the personification of AI.

Personifying AI removes accountability and responsibility from the entities that create it. Despite claims of valuing safety in generative AI, the larger tech firms and companies will use this to maintain their hegemony.

Today, 1 year into the AI craze, I want to cast vision on what we can do to navigate AI, how we can discuss it intelligently, and why we should advocate for AI that serves people first.

Corporate Control

Let’s start off with the one that looms over everything in generative AI—corporate influence. Every big tech company wants to get their greasy tendrils into generative AI because they believe they can use it to get more money.

Money is an easy thing to blame, but big tech controls much more in AI than we’d like to admit:

OpenAI, one of the largest AI players in the AI industry, has 49% of their for-profit stake owned by Microsoft. This not discounting for Apple’s push for OpenAI by bribing them with exposure.

While perceived to be behind, Google’s no slouch despite what media outlets and public perception is. Google has used the vast amount of data they harvest to power their AI models, including things most of Big Tech can’t achieve. This includes in video generation (Veo), real-time audio/image recognition, and strong contribution to open source AI projects.

The AI Creep

The biggest problem with corporate AI, much like OpenAI’s ChatGPT and Google’s Gemini, is privacy and surveillance. It’s no shocker that every single Big Tech company has struggled with privacy. When Google tells you that they care about your privacy, you know in your heart that privacy and Google go about as well as peanut butter and tuna fish.

The important thing to remember here is surveillance capitalism, where access to your data is sold as a commodity more valuable than the actual money. Even if you don’t willing provide information to or use these tools, your data will be fed into them because all of these companies have a stranglehold on the majority of the internet’s contents that we all use.

AI Won’t Steal Your Job, But Companies Sure Will

hidden=""

An important thing about AI is acknowledging that human rights are valuable, including privacy. There are some tasks that absolutely need to be replaced of AI because these tasks are just unsuitable to be done by human beings. Nobody wants to work in a retail warehouse. Workers are strictly monitored and kept on a strict track to pack and load things to/from a boarding area. Wouldn’t it be great if we had robots do this instead so people could just operate them instead?

Most people would balk at a statement like this, but if companies are just going to fire you and replace you of AI, maybe you shouldn’t have been working with that kind of job to begin with. You might be better at working someplace else if you’re just going to be abused in the workplace when your employer is just going to replace you with an artificial intelligence unit.

In a different universe, your job would have been replaced with something else because that company clearly thinks your job is worthless. Great example is Google’s major software development layoff (No Paywall) this year before Google I/O. It’s no different than any other kind of “-ism” in the workplace.

This is the final goalpost of artificial intelligence and the growing trend of artificial general intelligence (or the dreaded AGIs). Companies prioritize money, certain types of work, and building the “everything” machine. Sound familiar? A machine that does everything is in effect a disposable human being. Even when said machine is a glorified mimicry writer, raising money towards this reality will advantage corporations in power and disadvantage those with little.

It’s important that we acknowledge that some people have certain jobs because of their privilege or background. The problem is not LLMs; LLMs are merely tools and the cat is out of the bag at this point. It’s now about what we are going to do protect people caught in the crossfire.

Generative AI is not the end of civilization. We can’t judge it as intelligence, we judge as software. Right now, generative AI is a part of that idealistic fantasy corporations want to sell.

All the Reach, No Way to Leave (Enshittification)

hidden=""

Being subject to the whims of advertisers means these new AI platforms will face the same twisted market incentives that allowed Big Tech to gain the position of oligarchs these companies hold today.

The other problem is lock-in. Many companies safeguard the data of their models carefully and refuse to answer any questions about it.

Even the former interim CEO/now CTO of OpenAI, Mira Murati, refuses to answer to Joanna Stern of The Wall Street Journal.

STERN: What data was used to train Sora?

MURATI: We used publicly available data and licensed data.

STERN: So, videos on YouTube.

MURATI: I’m actually not sure about that.

Joanna Stern and Mira Murati, “OpenAI Made Me Crazy Videos—Then the CTO Answered (Most of) My Questions” 10:36

You can’t control many models in web-based services. Big tech knows that the open model is the most successful. A leaked internal document at Google warned that smaller, more manageable, and free AI tools would become the norm in computing.

Accountability & Accessibility

In order for real safety mechanisms to be put into place, the process would need to involve real people, politicians, and the rest of the world. The proprietary nature of most mainstream generative AI programs means everyone who isn’t part of these companies is locked out of making it safer.

To prevent this, generative AI should be interoperable and democratized. It should be made available to everyone and allow its users to whatever they want with it, the same way we would use a hammer. Because of harm that can be done, the same real world consequences and protections need to be put into AI as well.

When there are no safeguards in place, AI will become more regulated by governments, which is a good thing. What’s not a good thing is when said regulation removes agency and power from people.

As much as flack as they get, Facebook has been at the forefront of pushing people to adopt open source solutions to AI. While Google has their Gemma models, their Gemini models by contrast are closed source. Artificial intelligence needs to be widely available for everyone

Free Expression in AI

No matter where you fall on the political spectrum, we’ve seen the disastrous results of legal processes that threaten our freedoms, whether it’s copyright law or allowing big tech to self-regulate. If current trends continue, generative AI will only perpetuate what’s happening in the real world in the digital one.

People need these tools because they can often empower someone who lacks certain abilities to invent or achieve something they wouldn’t otherwise.

People who remix music gets hit the hardest by copyright. On YouTube, playing more than 8 seconds of audio is enough to get your video demonetized. YouTube doesn’t do this because they want to, but they are beholden to the laws of the land, including copyright.

Remixing music is a very complex area to address, but if done right, a remix can make a certain song or multiple songs into a song nobody expected or has ever heard before.

There needs to be protections in our own legal system that protects things like Fair Use or fair dealing because people who remix music don’t get rich. They’re normal people like you and me. And when they get hurt, we do too.

I Cheat… Because I’m Smart!

When I was younger, I considered myself a fairly good student, except in one area: math. All the way from middle school to college, I never got anything higher than a D on a math test. When I was in my college calculus, I intentionally bought the teacher’s edition of the book, just so I could copy the answers and barely pass the class.

Today, I’m not surprised when people use generative AI to write their essays or do their homework. Schools are just broken and disrespectfully ask their students to learn things they may never use in real life. If I were a student today, you bet I would be asking something like Microsoft’s Phi-3 to solve my algebra homework or calculus proofs.

Abilities Are Personal.

But hang on, is this advocating for cheating? Yes, I advocate for cheating, but I ask you: if you’re going to use AI in schoolwork, you better be smart about it.

It’s no coincidence that AI may have unintentionally made writing better. Lots of organizations from colleges to video game companies have been caught or accused of using generative AI to write things.

When I cheat by having AI do algebra, that’s not something mathematicians need to accomplish their work, it’s just labor. Mathematicians still need to come up with systems to identify patterns and craft new new theories or ideas. AI cannot do that effectively and it’s a lie that big tech continues to sell.

Writing and art on the other hand is different because it’s inherently personal. Coding and math are not personal; it’s just a bunch of numbers and letters. This is the real difference that people need to accept.

Your Work and AI Isn’t

I’m expecting some angry license-enslaved programmers to lose their minds, so let me clarify this a bit. A mindset too many people allow themselves to get stuck in is their work is important and it is.

An easy trap people get stuck in is valuing their work over their skill. If you’re going to let yourself be defined by something like your coding work or your art, you should instead pride yourself on the fact your mind is better at these things than most other people.

This doesn’t excuse you in copying work from a generative AI. Generative AI, given enough data, just repeats the corpus of information it’s been fed in an intelligible way. If you’re going to write a paper purely using generative AI, you’ll get caught real fast.

On the other hand, researching a topic can be very painful for some people. Imagine feeding something into an AI summmarizer instead. It might help someone better understand what they are reading or point the reader to key points. AI is a tool and it’s no different from how people would use SparkNotes or CliffNotes.

We don’t value art because of the intricacies of a paint brush. We don’t gush over the verbs in an author’s writing. We value art, writing, or coding because of the skill of an individual or a group of people.

Abuse Is Inevitable

Let’s speak into a fear that needs to be said: abuse of AI systems. Everything from AI-generated porn, presidential deep fakes, and theft of all “publicly available data” from every big company and budding AI startup.

The Threat to Free Expression

Let’s return to writing again, specifically to journalism. Here we see how an industry is adapting or in some cases, merely perpetuating what was always happening. Here’s some examples:

• Reputable outlets like 404 Media have been forced to paywall or login wall their content so AI can’t scrap it.
• Bad outlets like MSN, USA Today’s parent company Gannett, and CNET completely lost all integrity by abusing their employees and replacing journalists with AI.
• There’s also some rich irony when Forbes, an outlet that summarizes other outlets, is upset that a startup company like Perplexity is summarizing their summaries of actual news sources.

News outlets with lots of reach or big parent companies like The New York Times and Condé Nast (No Paywall) (owner of The New Yorker, Vogue, Wired) now want a piece of the AI money pie. In the case of Wired, articles like “Perplexity Is a Bullshit Machine” are written to get people on their side.

The dangerous side of cases from The New York Times and Condé Nast is the rammifications on the aforementioned freedom of expression and abuses our broken copyright system. Even if The New York Times or Condé Nast were to win their lawsuits, they prove that the copyright system is too easily abused because anybody who remotely reports information from another new outlet, is a violation of copyright.

Vilification in Vain

News reporting, even if it’s a summary of another news outlet, is protected under Fair Use. Equivalent laws like fair dealing exist in Canada, Australia, and the United Kingdom. Other countries are more gray like China and Japan.

Learn more about what qualifies as Fair Use from Stanford University’s Copyright and Fair Use Center

What’s more, if the Times and Condé Nast have their way, they aren’t really solving a problem. They have only joined OpenAI, Perplexity, or the newest AI boogeyman of the week in weakening journalism. Big outlets will be able to afford this protection, but smaller outlets and independent journalists will not.

Demonizing generative AI will only hurt everyone and innovation. What we need to aim for is democratizing generative AI. When we have interoperable, open source AI, everybody wins.

On “Public” Data

It’s worth pointing out that web scraping should be allowed and no Wired, a robots.txt file is not a sufficient means to block robots nor should they be obligated to listen to it. The Wayback Machine doesn’t listen to robots.txt on military/government webpages for preservation purposes.

People deserve the right to do what they want to publicly available information. It’s overreaching regulation like the Computer Fraud and Abuse Act that threatened web scraping in the past.

That being said, you’re not going to get my data. In my position as a creator who uses a platform that gives all my data to Google (they use my videos for training AI per the terms of service) and writes on a public website, I block all artificial intelligence bots from scraping my content. The only way the behavior of these companies ends is if you cut off the source of their data. It means discovering open source alternatives that won’t harvest your information for neural networks or line their pockets.

Closing

The bottom line is your skills are personal. Generative AI is not and nor is your work, whether it’s creative or technical. If we lose sight of this, we lose our freedoms and the little guy is hurt.

We can’t stop the abuse that Facebook, OpenAI, Apple, Google, and countless others have committed. Instead, we need to make use of these tools, specifically generative AI that’s open-source, interoperable, and respects human dignity.

If people don’t learn to adopt AI, it will fall by the wayside for normal people and become controlled by corporate interest. We’ve seen what happens the failure of open-source software in the automotive industry, virtual reality headsets, and creative software. If there isn’t enough manpower to work on the free, private, interoperable generative AI, it will fall by the wayside and remain inferior to its closed ecosystem counterparts.

Everyone needs open source AI today and I am an AI believer. Unfortunately, our laws have a long way to go and favor the powerful. I just might not use it very much because it’s still just a glorified echo machine.

Resources:

• The TESCREAL bundle: Eugenics and the promise of utopia through artificial general intelligence Paper
• Nettrice Gaskins on the EFF’s How to Fix the Internet: AI on the Artist’s Palette
• AI and the Evolution of Social Media
• On the Dangers of Stochastic Parrots: Can Language Models Be Too Big? 🦜
• Mark Zuckerberg’s blog post: Open Source AI Is the Path Forward
• Emily Bender and Alex Hanna’s Mystery AI Hype Theater 3000

Referenced

• The clip at 0:36 is from the Simpsons episode “The Old Man and the Key”
• The clip at 0:40 is from THX 1138 (1971).
• Emily Bender’s presentation “On the dangers of stochastic parrots：Can language models be too big？🦜
• Timnit Gebru’s presentation on TESCREAL at SaTML 2023
• Wolfram Alpha’s Problem Generator
• We Replaced Our Tech Journalism Website With AI from 404 Media’s YouTube channel.
• Cloudflare’s blog post about managing AI bots

Track Listing

• zukisuzuki BGM - Everyday
• zukisuzuki BGM - Simple
• alaki paca - refreshing breeze
• Lukrembo - Green Symphony
• Outro: Khaim - Neon Lamp

Do you have external storage like USB drives or portable hard drives? Unfortunately with external storage like USB drives or portable hard drives, your data is totally unprotected and can be accessed by anybody.

What would you do if you lost that device? Some devices come with software you could use, but most of these demand too much trust or might not work on Mac or Linux. Many of these programs are also upsold to you on top of the device you bought.

If you want assurance that you can password protect a device, VeraCrypt is the way to go. VeraCrypt is one of the most reliable ways to guarantee the ability not only encrypt devices, but seamlessly transfer that device’s data to other operating systems.

VeraCrypt’s Website

History

VeraCrypt is a rewritten version of a program called TrueCrypt. Initially for Windows, TrueCrypt was exclusively for Windows users and provided a substitution for Microsoft’s Bitlocker full-disk encryption.

The TrueCrypt developers were anonymous, but seemed genuine in their goals and gave the source code to anyone (we’ll get back to that one later).

But one day, during the height of the Snowden leaks and NSA paranoia, the TrueCrypt website was replaced with big red text demanding their users immediately stop using and uninstall TrueCrypt from their computers.

Enter VeraCrypt, a full rewrite of TrueCrypt. The process was a large undertaking and it was because the source code’s license was very problematic to develop with and to root out the alleged issues.

• The TrueCrypt license does not legally absolve the developers or distributors.
• An audit from Johns Hopkins University in 2015 revealed TrueCrypt is vulnerable to key extraction from live memory. This means if someone gains access to a computer with TrueCrypt turned on, data from volumes could be extracted.
• Another audit by QuarksLabs was completed in October 2016.
• TrueCrypt was for Windows only, although a Linux version was in the works. VeraCrypt is cross platform rewrite for Windows, Mac, and Linux.

The restrictions and lack of legal protection are the reasons most Linux distributions do not package VeraCrypt.

Why Not VeraCrypt?

The first thing you will need to consider is whether VeraCrypt is the right decision for you or not. VeraCrypt is best geared for cross platform file encryption on physical hardware.

Lack of Platform Diversity

If you need to access a file across different devices, for example, Windows and Linux or Linux and Mac, VeraCrypt is good for you.

If you share an encrypted device with somebody who doesn’t use the operating system you use, VeraCrypt will help maintain the encryption of your data while being available across operating systems.

VeraCrypt isn’t good if you only use one operating system or if only you use it. Windows, Mac, and Linux all offer much better integrated solutions (Bitlocker To Go, encrypted APFS, and LUKS respectively) at the cost of platform lock in.

No Official Mobile Clients

VeraCrypt has no official mobile apps. Despite having a page on their website, it is horribly out of date and none of the programs listed are officially by the VeraCrypt team.

A better alternative is Cryptomator. Unlike VeraCrypt, Cryptomator has an official, paid mobile app.

Do not use any mobile app for VeraCrypt. You risk the compromise or loss of data if you do so.

Not Cloud Friendly

Since mobile isn’t supported, this is where end-to-end encrypted cloud storage serves a better purpose. Cloud servers can easily sync to mobile devices more easily while still retaining full encryption at rest. I use Proton Drive personally.

VeraCrypt isn’t a good fit if you use cloud storage. You have to upload a large file with all of your encrypted belongings every time you sync. If that file is 16 GB, you need upload 16 GB each time.

Not to sound like a shill, Cryptomator stores your data is many different encrypted blobs. This way, it’s easier to sync only what gets changed will be synced properly to cloud storage.

I made a video on Cryptomator 2 years ago (Odysee Link).

Installing VeraCrypt

Because of TrueCrypt’s legacy, VeraCrypt is first and foremost a Windows program. You download the installer, verify it, and run it. On Mac and Linux, things get a bit more complicated.

Mac

On Mac, in addition to downloading the installer, you must download macFUSE so macOS can mount external volumes properly.

Linux

On Linux, VeraCrypt comes officially in 3 packages, a Debian/Ubuntu .deb, a Fedora/CentOS/openSUSE .rpm, and a generic tarball installer.

There’s also a third party package in the Arch Linux extra repository, but it’s not officially maintained by the VeraCrypt developers. The reason Arch allows packaging VeraCrypt is because their philosophy doesn’t discriminate against the TrueCrypt license, unlike the vast majority of Linux distributions.

Generic Archive

Unpack the generic archive and run the GUI x64 installer in the terminal.

Fedora Atomic Desktops

If you use Fedora atomic desktops or Universal Blue, you can layer the .rpm with rpm-ostree. Since VeraCrypt is mounting drives, it requires access to your host system and cannot be installed with Distrobox.

Usage

After VeraCrypt is installed, you can choose to use either the GUI or the command line. I’ll focus more on the Windows GUI, since there is more options, but will include the relevant terminal commands to do the same things on Mac and Linux.

Much of this tutorial comes from the VeraCrypt Beginner’s Guide, including the screenshots.

Unfortunately, VeraCrypt’s website looks like it was made at least 10 years ago and could be rewritten to make this information more accessible. There is also little documentation on the command-line options.

Creating a Volume:

sudo veracrypt -t -c

After installing VeraCrypt, click on “Create Volume” to get started. Then you will be presented with 3 options:

• Create an encrypted file container: This creates a digital file that will encrypt your data. This is the default option.
• Encrypt a non-system partition/drive: If you need to encrypt portable storage, select this option.
• Encrypt a non-system partition/drive: (Windows only) VeraCrypt is capable of operating as a substitute to Bitlocker. However, with the system requirements of Windows 11, this is not recommended.

Encrypting your Windows installation is not recommended. It is easier and less hassle to use Bitlocker or follow a guide to enable it for free on Windows Home

• Using VeraCrypt has a major downside of going through various hoops to enable Secure Boot and signing the VeraCrypt bootloader.
• Sometimes Windows Update will delete the VeraCrypt bootloader and you will need to use the VeraCrypt Rescue Disk to unlock your system and reinstall the bootloader.

Hidden Volumes:

Volume type:
 1) Normal
 2) Hidden
Select [1]: 1

A standard or normal VeraCrypt container is a file that houses all of your data. A hidden file creates another section within that file that can be opened with a second passphrase.

Despite what the command-line menu says, it’s much more intuitive to use the GUI to create a hidden volume. Using the command line requires you to create a normal VeraCrypt volume with no filesystem, then modify it after the fact.

Hidden volumes can also store decoy files. In the event you are forced to reveal the contents of the VeraCrypt container, these files can be used to placate or mislead people.

Hidden volumes require a lot of maintanance. Your operating system has the potential to reveal the presence of a hidden volume through things like file caching and “recent files” menus.

If you chose to use a hidden volume, especially if you regularly store files inside it, you need to have the discipline to update the files inside the outer volume regularly as well.

Your decoy files should be regularly updated to keep up the illusion they are valuable. Examples include financial information, journals, or photos.

If you aren’t prepared for this kind of maintenance, it is for extreme threat models. Most people shouldn’t have to resort to this and it reduces your overall storage for valuable files.

Using a hidden volume by default could result in data loss unless specific mounting options are checked. By default, your hidden volume files will be deleted to free up space for the outer volume, so give the illusion it is a normal container. Better safe than sorry!

Volume Location

Enter the location where you want to store the file. If you use the command-line, this must be an absolute path.

Enter volume path: /home/user/Documents/test.hc

Encryption Algorithms

VeraCrypt comes with various standard encryption algorithms. Most people should just stick with the default settings.

Encryption Algorithm:
 1) AES
 2) Serpent
 3) Twofish
 4) Camellia
 5) Kuznyechik
 6) AES(Twofish)
 7) AES(Twofish(Serpent))
 8) Camellia(Kuznyechik)
 9) Camellia(Serpent)
 10) Kuznyechik(AES)
 11) Kuznyechik(Serpent(Camellia))
 12) Kuznyechik(Twofish)
 13) Serpent(AES)
 14) Serpent(Twofish(AES))
 15) Twofish(Serpent)
Select [1]: 1

Hash algorithm:
 1) SHA-512
 2) Whirlpool
 3) BLAKE2s-256
 4) SHA-256
 5) Streebog
Select [1]: 1

A warning for the command-line, the order is the swapped between the encryption algorithms and the volume size. Consistency!

Volume Size

Specify how big you want your volume to be. If you are using a hidden volume, you will need to allocate space for the decoy files in addition to your hidden files.

Enter volume size (sizeK/size[M]/sizeG.sizeT/max): 1M

As another knock on inconsistency, you will be prompted to pick your volume format here.

Volume Password

Enter a strong passphrase to protect your volume.

PIM

Personal Iterations Multiplier (PIM) is a value that will run an algorithm for multiple iterations. For extreme threat models, volumes will mount slower, but the more the algorithm is run, the more secure your data is.

Normal users can leave this at its default setting.

Keyfiles

In addition to a password, keyfiles can be added as another file required to unlock your volume in addition to a password.

You can add file paths to any file you want or have VeraCrypt generate a keyfile for you.

Enter keyfile path [none]: /var/home/user/like.txt
Enter keyfile path [none]: /var/home/user/subscribe.txt
Enter keyfile path [finish]:

It’s imperative you backup and store your keyfiles in a safe place. If you cannot access them, you will lose access to the data within a VeraCrypt volume.

By default, no keyfiles are used.

Volume Format

Filesystem:
 1) None
 2) FAT
 3) Linux Ext2
 4) Linux Ext3
 5) Linux Ext4
 6) NTFS
 7) exFAT
Select [2]:

Formatting your container dictates where your container can be shared or what kind of files can be stored inside. In general, using these filesystems outside of VeraCrypt is the same.

• Ext: One of the oldest file formats on Linux. Do not pick the other options, just pick Ext4. Can only be opened on Linux.
• FAT: A filesystem universally supported across Windows, Mac, and Linux. Maximum of 4 GB per file.
• Mac OS Extended (APFS): The macOS filesystem. It can store files larger than 4 GB, but is only supported on macOS. Some Linux distributions like Kali Linux come with a driver called apfs-fuse to read it, but Windows cannot open it.
• NTFS: The Windows filesystem. It can store files larger than 4 GB and decent support on Linux as well. However, macOS doesn’t behave well and often will not let you write files to it.
• exFAT: Yet another Windows filesystem. It can store files larger than 4 GB, but plays better with macOS. Works across Windows, Mac, and Linux.
• BTRFS: A newer Linux only file format with special repair functions.
• None: This option is only available in the command-line and used if you use hidden volumes. This will prompt you to create a hidden volume. The rest of the space will become the outer, decoy volume.

Finalizing Your Volume

Entropy

Once you have made it here, it’s time to collect some random noise. This further protects your VeraCrypt volume.

• In the GUI, you will be prompted to shake the mouse as randomly as possible within the window.
• In the command-line, you will be prompted to type 320 random characters on your keyboard, then hit Enter when you are done. If you still have characters remaining, you will be prompted to continue typing.

Click “Format” and then your volume will be created to specification.

Access Your VeraCrypt Volumes

Now that you have created your first volume, let’s open it.

Unlocking

GUI

Select a drive letter (Windows) or a number (macOS/Linux), then click “Mount.” Then a password prompt will appear. Enter all information relevant to your container.

If you stuck with the default settings, they are the defaults here too. VeraCrypt will auto-detect which format your container is.

Command Line

To unlock a VeraCrypt volume, here are some sample commands:

# File
sudo veracrypt -t --mount /home/user/hitthebell.hc

# External Device (Linux, match letters)
sudo veracrypt -t --mount /dev/sda

After either option, you will be prompted to use your administrative password on macOS and Linux. On Windows, VeraCrypt is able to bypass UAC for admin users.

Once your volume has been unlocked, it can be accessed the same way you access a USB drive. Files can be interacted with in real time.

Dismounting

Similar to thumb drives, VeraCrypt has a procedure that needs to be followed to remove disks.

To dismount a VeraCrypt volume, select the volume you want to remove, click “Dismount” in the menu and enter an admin password.

sudo veracrypt -t -d /dev/sda

If you need to dismount multiple volumes, click “Dismount all”

sudo veracrypt -t -d

Updating VeraCrypt

VeraCrypt doesn’t have a mechanism to auto-update. Newer versions of VeraCrypt often fix issues or serious security vulnerabilities.

The only way to see if there is an update is to subscribe to the VeraCrypt GitHub releases. You can track VeraCrypt releases using an RSS feed, where you will repeat the installation process again once you are notified of a new release.

To follow VeraCrypt’s updates, add the following to your RSS feed reader:

https://github.com/veracrypt/veracrypt/releases.atom

Referenced:

• YouTube to insert server-side ads to break skipping sponsors and adblocking.
• The footage from the Snowden leaks is from Citizenfour (2014).
• “Come with me if you want to live” is from Terminator 2: Judgment Day (1991).
• xkcd 538: Security
• The clip shown at 29:18 is from Keijo!!!!!!!! Episode 2

Track Listing

• Kei Morimoto - Utopia
• The music for the sponsor segment is “Blizzard in DC” from the game Arctic Thunder. Heavily edited to remove the interposed America bits.
• yuhei komatsu - Bump!
• crepe (くれっぷ) - Fairy Lullaby (妖精の子守歌)
• crepe (くれっぷ) - Fairy Gift (妖精の贈り歌)
• yuhei komatsu - Scattered Sakura (桜が散る時)
• Outro: Khaim - Neon Lamp

Did you know Microsoft Build happened? It’s one of the biggest days for Microsoft every year, including announcing the new features of Windows like the new Windows Recall. Unfortunately for Microsoft, their PR team was quite up to snuff and has been greeted with hostility about Recall since the moment of its inception.

People who know me know I’m far from the biggest fan of Microsoft. As a company, Microsoft is rotten to its core and has few redeeming qualities. When I was reading the news and listening to opinions last week, I was very disappointed in new outlets and online influencers at spreading the narrative Recall is a privacy disaster (which to be fair, it probably will be in the future).

From the Microsoft Build keynotes, Microsoft showcasing a rigged Minecraft game and a gamer AI chatbot.

In addition to making a video and hopping on the bandwagon of recent news, I waited and did some reading about Microsoft documentation. Recall does a lot of things that will negatively impact your Windows computer, but let’s also be realistic about what those things are, so we don’t spread any panic, moral or otherwise.

What is Windows Recall?

At Microsoft Build this year, Microsoft announced Recall, a system powered by the artificial intelligence processors in the Qualcomm Snapdragon X computers, dubbed Copilot+ PCs. Recall is powered by a new API system in Windows called Windows Copilot Runtime, which empowers other non-Windows applications to take advantage of the newfound power and features of the Snapdragon X chips.

Inside the Snapdragon chips are what’s called language models, which give the Windows Copilot Runtime to caption dialogue, translate it, or run other types of local, onboard processing. Recall is also not as intelligent of a system as Microsoft’s engineers would have you believe. In order to make use of the on-board AI of a Snapdragon X chip and Windows Copilot Runtime, Recall needs to take screenshots of your screen every 5 seconds.

Ensuing/Ensured Outrage

Over the last month, many people decried the feature, but we encounter the first problem with the presentation with Recall and the Windows Copilot Runtime in general—it’s Microsoft’s inability to communicate. Not just any woman, Joanna Stern from The Wall Street Journal got to interview the CEO of Microsoft and the answer only instilled panic in people because it was poorly worded.

After watching the paywalled interview, The Wall Street Journal should have interviewed a lower level engineer or a different PR rep for Microsoft, because Satya did an awful job at giving Stern a straight answer to any of the questions she asked. The free interview also warps the conversation in 2 cuts and hides some of the information Satya said.

STERN: There could be this reaction from some people that this is pretty creepy. Microsoft is taking screenshots of everything I do.

NADELLA: Yeah, I mean, that’s why that it can only do it on the edge, right? …So this is, you have to put two things together. This is my computer, this is my Recall, and it’s all being done locally, right? …So that’s the promise. So, that’s one of the reasons why Recall works as a magical thing, because I can trust it that it is on my computer.

Joanna Stern & Satya Nadella, Microsoft vs. Apple: Satya Nadella Says AI-Focused Copilot+ PCs Beat Macs | WSJ (the free version) 4:16

How does Windows Recall work?

What’s interesting here in this interview is the distinction between offline language models versus large, cloud-based language models, like Windows Copilot or ChatGPT. While machine vision AI models are not something new, the dedication of neural processing units (NPUs) like what we see in the Snapdragon are going to become commonplace because of Microsoft’s insistence to their hardware makers.

Since Windows Recall is a very simplistic system. But it does prompt the question—does it violate user privacy? First, we need to put what Microsoft tells us about Recall under a microscope. As there is requirements and compliance for businesses, in light of potential privacy concerns, Microsoft documents the process.

Unfortunately, the most useful is scattered across 5 pages: Microsoft Support, the Microsoft Learn page about Copilot, the Microsoft Learn page about Windows Copilot Runtime, and the landing page for Copilot+ PCs. This is all the information for app developers and IT admins, but it’s arranged in multiple places.

About Windows Recall:

Microsoft fails to communicate anything clearly if there’s no place to consolidate this information.

• Recall Overview | Microsoft Learn
• Consumer Information (i.e. the Windows support site)
• Copilot FAQ
• Manage Recall for Windows clients - Windows Client Management | Microsoft Learn
• Microsoft Copilot Runtime Overview | Microsoft Learn

The App/Browser Bottleneck

The first thing to return to is the Windows Copilot Runtime. In order for the search to be the AI enhanced search like Microsoft shows in their demos, app makers need to write their applications with these features in mind. If an application is not supported, Windows Copilot will capture this data and it cannot be automatically filtered out.

As of time of writing, it’s not clear what non-Microsoft applications that don’t support Windows Copilot Runtime. It appears they will be indiscriminately captured and collected because of the section in Microsoft Learn about browser support, so let’s try to read between the lines here.

The mainstream browsers for Windows: Edge, Chrome, Firefox, and Opera all support the Windows Copilot Runtime and already filter out private browsing, DRM-protected content, or user-specified websites. The only time that private browsing will be collected is when the user explicitly presses Win + j to manually take a Recall snapshot or if a browser is not supported.

Opting Out

Since we know how browsers work and what makes Recall’s search to be effective, what can we, as users or businesses, do about Recall? How can we turn it off?

To configure Recall, in the Settings app, navigate to Privacy & security → Recall & snapshots → uncheck Save snapshots.

To configure Recall’s storage of screenshots, in the Settings app, navigate to Privacy & security → Recall & snapshots → Storage → Maximum storage for snapshots limit. There is a table of the storage minimum requirement for Recall on Microsoft Learn.

To delete Recall snapshots, in the Settings app, navigate to Privacy & security → Recall & snapshots → Delete snapshots from a specific timeframe or Delete all snapshots.

The most comprehensive way is to use Windows Pro or higher, where you get access to Group Policy Editor. There is likely an undocumented registry key for Windows Home users.

In Group Policy, navigate to User Configuration > Administrative Templates > Windows Components > WindowsAI > Turn off saving snapshots for Windows

“Justified” Outrage

An important thing I want to touch on is what I call “justified” outrage. It’s fine to be angry about something our oppressive corporate overlords do, but if you’re going to pick something, it better be something with demonstrable, substantial evidence and based in reality and technical feat.

The point being—Windows Recall cannot be tested right now and we should reserve judgement until it can be. There’s a common myth that proprietary software cannot be analyzed, but that’s far from true. It’s harder, but it’s not impossible.

Most importantly, let’s critically analyze why you should reserve your judgement about Recall, but also what can you be angry about now. To be clear and given Microsoft’s track record, there is a high likelihood that Recall will be used by invade your privacy, but this will need to be subject to experimentation.

The NPU Requirement

Recall requires a Snapdragon X processor. Additionally, hardware makers AMD and Intel have promised to release Copilot+ PCs in the future. The key thing here is none of these devices are in the hands of journalists or consumers (as of time of writing). Since nobody has any of these computers handy, you can’t do any of the testing.

The annoyance introduced by Recall is Microsoft’s requirements for it that screws over people who have computers capable of AI operations. I have a Nvidia 4060 in a gaming laptop. I can already run AI that runs speech inference or large language models like Google’s Gemma or Facebook’s Llama 3.

According to Microsoft’s arbitrary system requirements, my computer, fully capable of AI programs, cannot run Recall. I can only guess that it’s because they want to sell me more computers…

• a NPU (Qualcomm Snapdragon X, Intel, AMD)
• a minimum of 256 GB of storage
• 16 GB of RAM
• 8 processor cores

Recall’s “Allocated Storage”

While Recall allows you to turn it off, Recall will perpetually eat up at least 10% of drive. There’s a full table in Microsoft’s documentation about how much storage is taken up by Recall.

• If you have storage higher than 1 TB, 150 GB will eaten up out of the box.
• This is in addition to the 27-28 GB part of the base Windows 11 installation.
• The amount cannot be customized beyond the set amounts Microsoft prescribes.
• All future snapshots will stop when Recall is disabled or if the C:/ has 25 GB or less space.
• Snapshots will only commence if 50 GB is available.
• Since snapshots are stored in the temporary files, all data is deleted upon resetting Windows or installing an alternate operating system.

Peering Deeper In the Crystal Ball

Recall is a PR nightmare. Microsoft is vague about actual information people are looking for and distrust for Microsoft is at an all time high as a result. Privacy will be a concern for some, but Windows itself and Microsoft have greater problems that will eventually ruin the good parts of Recall.

On the Build Day 2 Keynote, Microsoft showed an ad for Lumen. For a brief moment within the ad, a Windows desktop is shown, but Google Chrome is blurred out in the taskbar. Microsoft traditionally has tried to make switching to alternative browsers like Google Chrome more difficult.

• Windows has a nasty habit of resetting your settings to default settings after updates. Such a feature could be enabled again after an update.
• Recall is enabled by default, according to The Verge’s Tom Warren. Microsoft claims it is opt-in. We need to wait and see which one.
• While Windows may process and store your Recall data offline, there’s nothing to stop Microsoft from running not-so-private telemetry on it after the fact. This will need to be subject to experimentation.
• Microsoft has a problem with enshittifying Windows by adding advertisements or promoting their own products. Recall has the potential to be next.
• Storing this data brings up the possibility that law enforcement will start requesting it, hackers will steal it, or people will sabotage it.
• The snapshots are not synced to the cloud. Yet.
• What is the power draw of the NPU accelerated tasks like Recall? It’s probably terrible.

As someone who has a deep distrust of Microsoft, I don’t recommend anybody use Recall. The greater problem is how the “choice” of using Recall or not is handled by Windows. This outrage over the last month is distraction from real questions people should be asking and where Microsoft has been light on answers.

We need to wait until Recall becomes generally available so it can be tested and prove/dispel rumor. The next time you read the news, hold off on sounding the alarm. Think before you act and as always, just buy a Mac or install Linux already.

Referenced:

• Microsoft Build 2024 Monday Keynote: Introducing Copilot+ PCs (Journalists only)
• Microsoft Build 2024 Tuesday Keynote
• (Disinformation Warning) The origin of Roko’s Basilisk
• What is Windows 11 ‘AI Explorer’? Everything you need to know about Microsoft’s upcoming defining AI PC feature - Zac Bowdin It’s important to note this information came out before the announcement and Bowdin says the leakers were insistent the data was stored locally.
• Scott Hanselman’s (VP at Microsoft) TikTok about the local processing of Recall
• Windows 10: CNIL publicly serves formal notice to Microsoft Corporation to comply with the French Data Protection Act within three months (Archive)
• Microsoft Windows 10 Home and Pro investigation by the Autoriteit Persoonsgegevens (Dutch DPA), August 2017
• Windows Weekly 884 and Paul Thurrott’s angry rant about Recall sensationalism at 33:57
• The Neuralink livestream featuring the first patient Noland Arbaugh
• Neuralink’s silent blog post about the setbacks of Arbaugh’s surgery

Bonus Content

Track Listing

• KK - ordinary landscape (いつもの風景)
• Kurippu (くれっぷ) - Skip of the Beginning (始まりのスキップ)
• Moppy Sound (もっぴーさうんど) - Escort
• Sharou (しゃろう) - Weekend Kyoto Reality Escape (週末京都現実逃避)
• yuhei komatsu - Holiday
• Outro: Khaim - Neon Lamp

Today, I’m here to talk about my mother. My mom has also been looking to downsize the amount of technology in her life. My mom daily drives an iPhone and has for a long time, but has no concern for the Apple ecosystem. My dad still handles most of the tax collecting duties and my mom has also completely dropped using a computer altogether and only uses her iPhone. After all, most things are done in a web browser just fine.

But as my parents starting to get up there in the years and their senses are start to get weaker. My mom in particular has wanted a device with a screen larger than her iPhone and initially suggested an iPad. Not wanting her to fall deeper into the Apple ecosystem, I pushed her to get Google’s first generation Pixel Tablet. You have the ability to use a tablet fully free of the Google ecosystem through GrapheneOS and a mobile device with more software longevity than an iPad. Google has had a rough reputation with Android tablet support, but have leapt into action to try to catch up to iPads. So going in, I’m going to be focusing on the Android Tablet experience for a “normal” user–my mom.

I do a lot of paranoid things with my own devices, but the priority is for my mom to what she needs done done; open source and respect for her privacy are secondary priorities. Don’t get too excited about a hardware review because there isn’t a whole lot to say.

As a reminder, I receive nothing from Google except your ad revenue (if you watch the video on YouTube). The tablet was bought at a Best Buy with my parents’ retirement fund.

Hardware

The Pixel Tablet comes in a large box with the “charging speaker dock,” some manuals, and the tablet itself. In terms of hardware, the Pixel Tablet uses and shares similarities to Samsung’s Galaxy Tab. A difference is the Pixel Tablet uses the Exynos chip, which Samsung appears to be returning to with their phones.

If wasn’t clear by the video footage, the Pixel Tablet isn’t very visible in bright lighting conditions. The display is quite capable, but not ideal. It works great in dark environments like during the evening, but leaves a bit to be desired during the day.

On the charging speaker dock, it’s an interesting idea, but the speakers are kind of middling. There is also no charging cable included, so you will need to provide your own. When charging the tablet, the tablet comes with dots which allows you to magnetically attach it to the dock. The magnets are pretty sensitive, so you have to make sure the dots are properly aligned or you risk the tablet falling. She also purchased a synthetic leather Fintie case from Amazon.

In terms of hardware, the Pixel Tablet is pretty unremarkable, but not overtly cheap. The price comes in at $500, frequently discounted 1 year in. In some ways, the Pixel Tablet provides a worse app experience than an iPad, but outperforms an iPad in offering more freedom and features Apple refuses to give users.

GrapheneOS

The very first thing that I did was install GrapheneOS. On this tablet. However, one thing I want to make obvious is my mom is not a technical user–far from it actually. I chose to use GrapheneOS because of the security features, but also the “extended” support cycle. Since moving away from Qualcomm, Google has extended their hardware to 3 years of feature updates (or Pixel Feature Drops) and 5 years of security updates. After June 2028, the Pixel OS will be out of support and ROMs like GrapheneOS and CalyxOS will be the top picks. GrapheneOS is the winner for me because of their frequent updates and the constant innovation of features to making Android better, including assisting Google and the Android community in detecting serious vulnerabilities and bugs.

There are some post installation steps you can do, which I never touched on in my original GrapheneOS video. I want to cover some of GrapheneOS’s extra apps and features.

Following the esoteric guide on GrapheneOS’s website (seriously, this thing is way too technical for normal people) and used my Pixel 7 Pro as the installation device. I jacked in with a USB-C cable and pressed all the buttons the installer told me to.

If you don’t have another Android device, you will need to use one of the supported operating systems, download the Android debugging bridge from Google’s website or from a supported Linux distro’s repos, and the Chromium browser from their list. Then you enter what is basically a cheat code to unlock the bootloader and click 3 buttons.

The installation took about 20 minutes, but at the end, the Google was ripped out and GrapheneOS was in. Afterwards, you follow more post-installation steps.

The GrapheneOS App Store

GrapheneOS comes with an app store for independently updating their secure Camera, PDF Viewer, the default Vanadium browser, and the Auditor.

Separate from the stock apps, GrapheneOS includes downloads for various Google products compatible with GrapheneOS: Android Auto, Markup, and the Play Store. Typically, Google’s apps get much more visibility into your device and could potentially use this to collect more information about you.

GrapheneOS levels the playing field by forcing these apps to be installed and treated as normal apps you might download from another app store. They don’t get the special access, but are still able to do what most people expect them to do.

Google Play Store

Unlike other Android ROMs, GrapheneOS provides a fully functional copy of the Google Play Store. This is the standard of way of getting apps on Android, but also necessary for specific services. For example, when you use apps that receive notifications, most apps call for the Google services because it’s more battery efficient.

• To download the Play Store, you need to download all of the pre-requisite libraries. At the end, you should only get the Play Store available. The Play Store and the Google services are required if you wish to use Android Auto.
• Some apps require Google services in order to function properly. Others will have features missing, like passkey support or specific banking apps. Great resources for seeing app performance are Techlore’s Plexus, which documents various apps with(out) Google services and PrivSec’s list of working banking apps.
• There are some apps like Tuta or Signal, which do not use Google’s services and provide a redundant service instead for privacy reasons.

Usage

Using an Android tablet like the Pixel Tablet is pretty similar to running an Android phone, but there are some differences. My mom also has very different uses than most of the target audience of something like GrapheneOS–she needs to use all of the spyware apps in her life.

User Profiles

A feature Android possesses is user profiles. User profiles allow Android users to have a separate profile where they can store data or install things separate from their main profiles. User profiles are similar to users on computers.

On most Android ROMs, you are limited to 4, but GrapheneOS bumps this limit up to 32 and makes various enhancements to these profiles, including a secure “end session” feature, which shuts down all running apps.

While not typically seen as a business device, using a profile is much more valuable when a tablet is a family device. Suppose my dad wants to use the Pixel Tablet. He can create a user profile for himself to install apps just for him, completely separate from my mom. My mom is also given the “owner” account, which allows her to retain full control of the Pixel Tablet. What if you have a child who want to hop in on the latest mobile game? You can install the game in a separate profile so the game doesn’t get access to all my personal app data.

To Google or Not?

My mom has very specific needs and uses her tablet only for using streaming services and social media apps. This already encompasses a wide variety of apps like YouTube, Netflix, and Amazon Prime.

As a result, I linked her Google account to the Tablet and we got the Play Store up and running. YouTube requires Google services to function, plus my mom was just going to sign in anyway.

I said earlier that GrapheneOS locks these apps down more, but they are still very much functional. This includes spying on you, so with higher threat models, Google Services will still capture your notifications. Google account information is also kept if you choose to login, so it would be prudent to disable your advertising ID.

Disable your advertising ID (GrapheneOS)

hidden=""

In the Settings app, navigate to Apps > Sandboxed Google Play > Google Settings > Ads > Delete advertising ID

Android Tablet Support Exists…

When I set up the Pixel Tablet last year, my mom and I came across our biggest hurdle–incompatible apps. The long and short is despite the budding interest in Android tablets, not every app will work with Android tablets properly, if even at all.

Fixing the Aspect Ratio

Similar to iPads, some apps like Reddit are limited to a phone-like window to preserve the app’s intended aspect ratio. If you are bothered by this, Android 14+ allows you to stretch these apps to match your tablet’s screen ratio. It’s pretty seamless.

Early Woes with Signal

Thankfully, I have convinced a good portion of my family to adopt the secure messaging app Signal. However, when we first got the Pixel Tablet, there was a major issue: Signal would not work on Android tablets at all. Today, Signal works flawlessly on Android tablets, but this was not always the case.

With Signal in particular, there was a workaround I found that worked. I installed Molly using their F-Droid mirror. Molly is a fork of Signal Android client that implements some anti-forensic features not present in Signal. For a long time, Molly was the only way to use Signal’s service on an Android tablet.

Molly is generally a day behind Signal with updates (which is pretty reasonable) and I personally prefer the main Signal app as using Molly requires you trust their developers in addition to Signal’s. Molly is also great if you need to access more than one Signal account on a single Android profile.

While Signal works today, I feel it is too much friction to get my mom to switch away from Molly.

AirPods on Android

As an Apple refugee, my mom has 2nd generation AirPods as her headphones of choice. However, as Apple products, controlling them without an Apple device is difficult. I discovered a project by Frederico Dossena (the creator of LibreSpeed) called OpenPods. It lets you control your AirPods, gives connection notifications, and monitor their battery life of both ears.

OpenPods must be downloaded from F-Droid as they were mysteriously banned from the Play Store.

Viki & Vanadium

In the United States, there’s been a surge in people seeking to stream Korean dramas and my mom is no exception. The most popular app to watch K-dramas is an app called Viki. However, Viki is incompatible with Android tablets and they still refuse to make a compatible app.

The solution was actually fairly simple–using a web browser. Using a web browser is not only possible, but we can also create a home screen shortcut so it can be used similar to an app. However using a web browser opens up the can of worms that is browser choice.

GrapheneOS’s default browser, Vanadium, supports Google’s Widevine DRM. GrapheneOS also takes your connection to Google’s DRM and puts it through a proxy to limit what Google can collect about you.

The one disappointment with Vanadium doesn’t support blocking static or cosmetic ads and I really do not want my mom clicking on malicious ads. Instead, my mom uses Brave. I know there are some who swear by Vanadium, but Vanadium has weaker fingerprinting protection and content blocking. Brave is the only other browser endorsed by GrapheneOS and my second choice anyway.

I’d be open to exploring NextDNS in the future, but have not had adequate time to test whether the free plan would work with my mom or not. If it doesn’t, I would have to pay and have her piggyback off my plan.

Gboard

I installed Gboard, the stock Google keyboard and the keyboard for the Pixel Tablet’s stock ROM. I disabled the internet connection for the app to limit Google’s data collection. As much as I like GrapheneOS, the AOSP keyboard is borderline unusable. Since my mom uses Google services anyway, I figured it would be a better experience.

Misc

• There’s a phone app in GrapheneOS’s Tablet ROM. The Pixel Tablet can’t use eSIMs or a SIM card, so I don’t know why this is here.
• I enabled button navigation opposed to gesture navigation. My mom has a strong preference for buttons.
• I disabled all touch/tap sounds. My mom is so angry whenever my dad types on his phone.
• Adaptive brightness can sometimes be very aggressive.

Should you buy?

After 5 months with the Pixel Tablet, my mom has been very satisfied with its performance and rarely commented on the differences of GrapheneOS. It very much is the stripped down Android experience for the vast majority of people, but they will need help setting it up, whether it’s a custom ROM like GrapheneOS or because of lack of app support.

Setting up a custom Android ROM is not overly difficult, but if you don’t have that knowledge, it can difficult. While GrapheneOS has made lots of great changes to make the installation experience pretty painless, it could stand to hold the less technical user’s hand a little bit. Most people will see the wall of text on that installation page and lose their minds. In my mind, unless you set up GrapheneOS or CalyxOS, the Pixel Tablet isn’t worth your time.

There’s also the issue of identifying problematic apps because Android tablets have been treated like third-class citizens for years. The Android tablet app experience leaves a bit to be desired, complicated more by the “fragmentation” of the Android ecosystem. If you won’t install a custom ROM or you have apps you know will not work, you’d probably be better off with the tried and true iPad.

I think that if you are willing to learn and follow that ultra-technical guide on GrapheneOS’s website, the Pixel Tablet is the best choice for you for a tablet device that respects your privacy, freedom, and ownership of the device. This, combined with user profiles, proper split-screen, and freedom to use alternate app stores are all amazing reasons to consider a Pixel Tablet. It would also be cool to see if Google keeps making tablets and what the next generation has in store.

Summary

🚫 Not recommended, due to poor Android tablet compatibility and Google discontinuing future prospects for this form factor (but will continue device security updates until 2028). Installing GrapheneOS is necessary to last beyond end of life, but not encouraged.

Pros

• Allows installation of a custom OS (GrapheneOS)
• Best choice for Android tablets in terms of updates (5 years of support), legacy support on custom ROMs
• Tablet experience offers things Apple will not: calculator, split screen, user profiles, third party app stores
• Good performance
• Great as media or emulation device

Cons

• Comes with privacy invasive stock OS
• Android tablet experience (while functional for most) leaves a bit to be desired
• Screen does not perform well in bright conditions
• No headphone jack
• Forces you to buy a gimmick speaker dock with a proprietary cable and does not include a USB-C charger

Track Listing

• kinono - Peaceful Days (平穏な日々)
• Sharou (しゃろう) - 10°C
• KK - Oya oya (おやおや)
• Takashi Waraya (稿屋 隆) - Cats (カッツェ)
• Outro: Khaim - Neon Lamp

Firefox is one of the longest living browsers still with us today (good riddance Internet Explorer) and is arguably the most customizable browser when comes to protecting your privacy. I have made lots of videos about Firefox, but lots has changed to Firefox since then and I want to take my time to take a step back to review the basics, update some of the configuration files I have, and why I still use Firefox as my daily browser.

Browser Battles

The undisputed point is Firefox is Mozilla has always been at odds with the current browser at the time (Netscape in the old days and now Chromium). Firefox has also become the heart of many important open source projects: Thunderbird, the Tor Browser, Web Assembly, and nss.

Mozilla has diverged from many other browser makers because of their nonprofit status and has been more proactively for the end user than many other web browsers.

• It’s easier to switch your default search engine in Firefox and access multiple search engines in the address bar.
• It’s easier to change it to the default browser on Windows 11.
• Firefox has one of, if not the most, robust screenshooting utilities in a web browser, full stop.
• Also has a built-in color picker and my favorite developer mode.
• Firefox has also been faster to accept hardware acceleration on Linux and macOS than Chromium has. For example, Firefox’s initial Apple Silicon support was much better than Chromium’s, as they got the secret sauce directly from Apple. Similarly, Wayland support on Linux is much stronger than Chromium.
• Firefox also offers Total Cookie Protection, blocking websites from viewing your other websites by further isolating the cookie jar.

Mozilla has also been much more forgiving in regards to the dreaded C-word, and you know, the C-word that blocks things on websites. That’s right, I’m talking about cont—Containers to compartmentalize multiple logins and data. Want to stay logged into work and personal accounts at the same time? Firefox Containers have you covered!

Unlike Chromium, Mozilla has been much more of ManifestV2, soon to be replaced by ManifestV3. To be fair, ManifestV3 is absolutely a security win: browser extensions will be much more limited in what they can do. This comes at the drawback of traditional content blockers not being as good as they used to be die to rule limits of 500,000, far too low for most common content blockers.

Mozilla’s response to this has been to continue support for ManifestV3, especially because of the number 1 most downloaded extension on Firefox that starts with the letter U. The bottom line is this: Chromium is largely maintained by companies that rely on surveillance capitalism and have incentive to neuter content blockers. Firefox doesn’t and is able to users this choice.

Unfortunately, most people fall victim to the tyranny of the default. The decline of Firefox has been obvious for multiple reasons.

• Firefox has little mobile market share. By default, phone users are presented Google Chrome on Android and Safari on iPhone. Even if you do install it, it’s a crippled browser. It’s also more insecure, but that’s a topic for another day.
• Most browsers are based on Chromium, which is for the most part largely controlled by Google. Lack of browser competition among giants is harmful for users in the long run.

That also doesn’t even account for Firefox has some cheap imitators. I would advise you stay away from most of them. A lot of them struggle to receive updates in a timely manner.

Installing Firefox

Installing Firefox is about what you’d expect: visit your software store or Mozilla’s FTP server to get it and avoid the unique identifier planted in the installer. If you are on Mac, consider using homebrew.

Special Note for Windows Users

An important thing to note is Windows users are going to need to take some extra steps:

1. While you can download Firefox from the Microsoft Store (not winget), this version doesn’t include various hacks to automatically set Firefox as your default browser when you ask it to. This is because Microsoft hates your freedom, plain and simple. The primary benefit of using the Microsoft Store is to get UWA apps, which Mozilla isn’t anyway.
2. Firefox installs a scheduled task to constantly check if Firefox is your default web browser. Mozilla, it’s none of your beeswax what I use as my default browser. Go into Task Scheduler and delete it.

Profile Manager

Now you have Firefox and we’re going to configure it, right? Hold your horses there sport! We’re going configure profiles. While not as easy to use or as forward facing as Chromium, Firefox supports profiles to separate different identities and configurations of Firefox. I’m going to cover some in a future video, but it’s all about ensuring we only use one browser that we know works in various different ways.

First, you have to run a Firefox command, then we can append an argument to open the profile selector by default. This varies based on operating system. In the video, I cover Linux and Windows, but the principal is the same on macOS as it is on Linux.

Windows

C:\Program Files\Mozilla Firefox\firefox.exe -p

macOS

Make sure you open Firefox normally first to bypass Gatekeeper prompts. Then you can create an alias with the following:

/Applications/Firefox.app/Contents/MacOS/firefox -p

Linux

If you are on Linux, consider using the snap package on Ubuntu or the Flatpak if you don’t use Ubuntu.

• Snap/Flatpak: Both the snap and Flatpak are maintained by Mozilla’s developers. The snap and Flatpak are also sandboxed, so you can configure permissions using Snap Store or Flatseal.
• Your distro’s native package: While behind on updates, native packages can offer stronger sandboxing than what Flatpak provides.

You’ll need to make a decision:

Native

Pros

• Stronger security
• Can include special fixes for your distro

Cons

• Slower to deliver security updates and bug fixes
• Might not even be available at all due to licensing conflicts

Snap/Flatpak

Pros

• Universal package
• Officially maintained by Mozilla, no middlemen
• Fast updates and bugfixes

Cons

• (Flatpak only, snap untested) Weaker sandboxing and isolation
• (Snap only) Requires AppArmor for proper isolation

# Native/snap
firefox -p
# Flatpak
flatpak run org.mozilla.firefox -p

Uncheck the box Use the selected profile without asking at startup, now every time you launch Firefox as such, you will be presented with a menu to choose which profile you want. The first profile you create is called default-release, but you can rename it or create a different one.

Stock Firefox

Out of the box, Firefox isn’t all that great. The search engine is a bit invasive and has sponsored links. Pocket is lurking around at the top. Mozilla collects telemetry which they never cite as helpful. Rather than fix this right now, I might get some hate for this, but there’s an argument to not configure Firefox at all. Configuring Firefox in extreme ways can cause websites to be much more suspicious of you. You must be doing something wrong if you used the about:config, obviously!

Keeping a stock Firefox with no configuration is great for a browser where your anonymity isn’t as important. Services like banks and critical work or business functions are great examples of this. You could get on your high horse and say that you are doing your duty by configuring it, but I would argue it’s not worth the hassle when these services probably know you by your real name anyway, so it’s not a big deal.

Configuring Firefox the Easy Way

Firefox has a lot of configurability, especially when configuring Firefox offers a lot benefits protecting your privacy, security, and the occasional weird Mozilla feature. If you’re looking to configure Firefox, but don’t want to have to deal with the fuss of a user.js file, this is the place for you!

Why bother?

Firefox has a lot of settings and these are the only ones that most people have access to! If you haven’t already, I strongly recommend setting up custom profiles if you haven’t already. I maintain at least 4 Firefox profiles at once, each of them serving a different purpose. I typically name this profile “PrivacyFox,” because we’re going to configure Firefox to a minimal degree. Scripts like Arkenfox turn off a lot of features and while features that break websites are marked, many others indirectly cause websites to break.

And even if you’re an advanced user and use privacy-hardened Firefox with a custom user.js and fancy userChrome.css, you still need to be aware of the GUI settings because scripts like Arkenfox won’t configure these for you most of the time. They often leave the GUI settings open for users to configure it themselves.

The benefit is you can customize Firefox to resemble the behavior you want and you can choose how you want Firefox to look. Unlike most other browsers, Firefox truly lets you claim it as your own, and no, it won’t break upon updates unlike Vivaldi!

We’re going roll through all of the default Firefox settings and give a quick rundown of each one.

Home

You can toggle your homepage by changing it something else. And for the last time Josiah, I’m not making your homepage Google if you can just type in the search bar to use Google!

Popular options include:

• DuckDuckGo
• Startpage
• Brave Search
• Google
• Bing
• Yandex
• Baidu

Search

The search settings are where you can configure Firefox’s search engine. I would be remiss not to tell you that Firefox gets paid millions of dollars by Google to be the default search engine. There have even been rumored talks of a bidding war with whether or not Bing would replace Google as the default. If you have preference for a different search engine here, you can change it here.

Alternatively, if your search engine is not listed, you can visit your favorite search engine and right-click on the Address Bar, then click to add it to these options.

• Disable “Provide search suggestions”

Firefox will also proactively search with autocomplete enabled by default. This means that anything you type into your Address Bar will be sent to your search engine provider. I recommend turning this off.

Privacy & Security

• Select “Strict” Enhanced Tracking Protection

Firefox offers Enhanced Tracking Protection (ETP) against common threats on the web. It will not protect you from everything, but it’s designed not to negatively impact your browsing at all, even on Strict.

Navigate to “Address Bar,”

• Disable “Suggestions from the web”
• Disable “Suggestions from sponsors”

In America, us Firefox users are pestered with sponsored links in the autocomplete. Just turn them off.

• Navigate to “Cookies and Site Data” and select “Delete cookies and site data when Firefox is closed”

Cookies are used to track things across the web like login sessions and cached information. However, most websites abuse this and use this as a mechanism to track you.

[Advertisers] capture the “cookies” that your computer automatically deposits into your Web browser, creating an indelible of every site you visit and every page you view, then use that information to send you personalized advertisements… “Cookies are used by virtually all commercial websites for various purposes, including advertising, keeping users signed in and customizing content… Bad as it was to be stalked by shoes…”

Martin Lindstrom, Brandwashed

But naturally this leads to a question: how do you stay logged into accounts you always use and you want the convenience of staying signed in?

• Under “Manage exceptions,” you can add an exception by typing in the site, and selecting “Allow”
• Visit the site you want to save your credentials for, then press Ctrl+i (⌘+i on Mac) Navigate to “Permissions” -> “Set cookies” -> “Allow”

HTTPS-Only Mode

Back in the old days, websites thought it was a good idea to use unencrypted websites, which allow your ISP to snoop on what you do. Most of these things have been eradicated from the Internet today, but for those who couldn’t figure out how to do it, you want to be presented with a full-screen warning to protect your privacy.

• Enable “HTTPS-Only Mode in all windows”
• You can also “Manage Exceptions”

DNS over HTTPS

DNS over HTTPS (DoH) is one of the newest web standards for secure DNS connections, which translate your URLs like “trafotin.com” into the corresponding servers on the internet and IP addresses.

DoH changes the DNS paradigm by using HTTPS packets to call the websites you want to visit. By using DoH, in junction with encrypted DNS, your internet service provider can still see sites you visit, but they aren’t allowed to tamper with any of the content, because yes, they have done this before.

I previously enabled the US default of Cloudflare’s DoH server as the default, but I’m taking a step back and letting you guys decide what you want. I think Cloudflare is a great default and the other, NextDNS, is also very handy. Other providers like Quad9 offer their own servers.

Enable Secure DNS using:

Lastly, Firefox now has the ability to force all traffic through DoH, which is really cool. In Chromium and previously in Firefox, DoH would be the default, but if websites rejected it, it would just fall back to normal DNS.

• Select “Increased Protection” or “Max Protection” for DoH.

If you select “Max Protection,” if you can’t connect to your DoH provider or if the connection is routed back, you will get a full screen warning.

If you are interested in learning more about DNS, I recommend a talk from Jim Nitterauer about compliance and protecting your privacy with DNS.

Telemetry

• Disable “Allow Firefox to send technical and interaction data to Mozilla”
• Disable “Allow Firefox to install and run studies”
• Disable “Allow Firefox to send backlogged crash reports on your behalf”

While Firefox is fairly respectful of your rights, one of the things I am the most suspicious of is their telemetry collection. The telemetry being opt-in isn’t a crime, but they don’t make it clear whether this information is useful or not, nor is it published anywhere publicly. It also doesn’t help that Mozilla places ads everywhere.

Even if you believe Mozilla is in the right, I’m a paranoid weirdo who would turn it off anyway. If you use an account, Mozilla collects more information about you and ties it to your Firefox account, so you might have more reason to turn it off given Firefox accounts demand an email.

Customizing Firefox

Firefox allows users to customize the UI to their liking. For example, if don’t like the “wide” address bar, you can remove the spaces. If you’re a front-end dev, you can add the developer tools to the toolbar. If you want to add back the extension icons to your taskbar, you can pin them near the puzzle piece icon. Be creative and make Firefox your own. You can make it look like Chrome, old school Firefox/Opera, or Safari.

• Right-click on the top bar or window decorations and select “Customize Toolbar”

New Tab

Firefox also allows users to customize the New Tab page, including using a custom website as one. Still, with the vanilla New Tab page, there are things to be done.

• Right-click and unpin all preinstalled shortcuts. These are all sponsored links for companies who paid to be here.
• Gear -> # rows here
• Gear -> Sponsored Shortcuts -> Disabled
• Gear -> Pocket

Mullvad Browser

You could configure Firefox by going through the settings, but the easy way to get a privacy-hardened Firefox is using the Mullvad Browser. Since my very first video with Arkenfox, this has been what I consider the most radical change to Firefox forks. Ordinarily, I never recommend Firefox forks because most of them have trouble updating in a timely manner or don’t have a good enough reason to exist.

The Problem With Firefox Forks

The problem with most Firefox forks is you need to not only trust Mozilla, you need to trust the other people who are touching the fork, and trust that they will keep it up to date. With something as important and unfortunately resource heavy like a web browser, you need to ensure you get updates promptly and most smaller browser forks aren’t able to do this well.

Why the Mullvad Browser?

The exception has been the Mullvad Browser. Mullvad Browser doesn’t use the normal Firefox, but the Extended Support Release or ESR of Firefox. It’s much slower to adopt features, but the core security and engine of Mullvad Browser is the same.

In fact, Mullvad Browser was developed in conjunction with the foremost popular fork of Firefox, the Tor Browser. The Tor Browser has worked with Mozilla for years to fine tune Firefox against the invasive practice of surveillance capitalism and protecting your anonymity on the internet. Mullvad Browser inherits all of the Tor Browser’s work and it basically the Tor Browser, just no dark web functionality.

Well if you can’t connect to the dark web, what’s the point? Because Mullvad Browser is perfectly privacy-hardened by default and has all the extensions you might need in it, you don’t even need to pay for a Mullvad subscription to use it; you can use it as is. Everyone who uses Mullvad Browser is now lumped into the same pool of people and if you use a VPN (commercial, self-hosted, etc), you are now part of the same army of people using this browser.

Limitations to the Mullvad Browser

There are some caveats where you might want to avoid Mullvad Browser:

• You can’t use some newer features of Firefox. Previously this included screenshots, but also things like AI integration and vertical tabs. This is because Mullvad is based on Firefox’s extended support release (ESR).
• You can’t save logins. All data is deleted upon closing Mullvad Browser. You run this in Private Browsing/Incognito mode all the time.
• You are stuck with the extensions they give you and you shouldn’t configure them beyond their default values. In order to blend in, everyone needs to have the same uBlock Origin settings and the same NoScript settings.
• There are what some would consider bloat features like the Mullvad extension or the Mullvad Leta search engine, especially if you don’t use/like Mullvad.
• Some websites might not work correctly, because of the Tor Browser configurations. You can’t watch DRM-protected content for example or some website elements might not work.
• There’s also the pain point of the Mullvad Browser is pretty young and not as many people use it.

The Easy Way Out

And that’s why I’m recommending it. I’m selfishly recommending it because it is the easiest way to get privacy-hardened Firefox and you can join me in the sea of people using it. It’s the newest kid on the block, so we need to make this pool of people bigger and more normies use it.

Remember the last time I made a video on Android? It was over a year ago (and on Airguard)! Now that changes. I have right here a Google Pixel 7 Pro, which I pawned off a relative. I mean, if it were me, I would have waited for the Pixel 8! But this is something I’ve been excited for: an Android operating system that truly puts your rights first and foremost. This has now become my daily driver phone and I have never been more exicted for a Phone since my LG VX-5400! Buckle up guys, Android ROM flashing time!

What is GrapheneOS?

GrapheneOS is a custom Android ROM, but what does that actually mean? Android ROMs are the same as when you choose to run operating systems on your computer. Few Android phones grant you the ability to install custom operating systems and many manufacturers refuse to provide you such a freedom or will hamper your efforts to run custom Android ROMs.

But why would someone choose to do this? It really comes down to control or functionality. Since many manufacturers maker it difficult, they are effectively taking away your freedom to do or run exactly what you want on your device. It’s important because compared to Apple for example, at least you are given the choice (on certain phones) to do what you want.

That being said, there are risks and I can’t go without mentioning them. In the past, installing a custom Android ROM could result in bricking your phone, but times have changed. As long as you choose to run a reputable Android ROM, the chances of you bricking your phone are telegraphed to you. As long as you play it safe and stick to big name ROMs, it’s hard to mess up.

Custom ROM Insecurity

While I am all about encouraging software freedom and running what you want on you device, I want to warn you against rooting your device. Rooting usually gives you as the end user the same ability to run dangerous command that could your damage your system. “But Trafotin, I made it this far and I haven’t gotten in trouble yet!” Rooting your phone has dangerous consequences especially if you are downloading files outside of the Google Play Store. Sure you can do you get your whiz-bang battery enhancing apps, but newer innovations prove using an unrooted device is great. You can install an Android ROM and not be constantly using your phone with administrative privileges. It’s a bad practice for computers and it’s just as much a bad practice for phones.

The GrapheneOS Solution

This is why I am firm proponent of GrapheneOS. GrapheneOS is a custom Android ROM, designed to not compromise on user security while still respecting your rights. It’s the most robust custom Android ROM, but that polish comes at a cost. GrapheneOS can only be installed on Google devices. Google makes the best smart phones when it comes to keeping your phone up to date and not flooding your phone with crapware that other Android manufacturers throw in. Inevitably, people will fear Google kills off their phone line, but I am doubtful that this will happen. The state of manufacturers providing timely security updates on Android is so bad Google is willing to go into debt and force their OEMs to do the same. Sure Google is one of the Big Tech companies, but they recognize they are responsible for the biggest phone operating system in the world.

And I know the irony of using a Google phone to get more privacy, but Google’s phones are legitimately the easiest phones to install custom Android ROMs on and they have been for years. The entry level devices, like the Pixel 7a and the Pixel Tablet are less than $500 and pretty affordable.

Installing GrapheneOS

So you’re sold on using a custom Android ROM and you have a nice fresh Google phone. I’m doing this with a Pixel 7 Pro, but all of Google’s newest product line is compatible with GrapheneOS. I normally recommend buying a phone on sale, but I got a $200 discount for 4 years of updates and I wanted a model with an actually decent camera because anyone who has seen videos filmed with my iPad are atrocious. But how do we install GrapheneOS?

The following entails a guide on how to install GrapheneOS. The project has been in some drama because their former head developer didn’t like publishing guides, even if you supply the same or more depth instructions than on their website.

Prerequisites

I’m not going to get into detail, but the first step is to

• a Google device that is carrier unlocked
• use a computer from one of their supported operating systems to reduce as much error as possible. This can be a computer or even another Android phone.
• use a Chromium-based browser from the list
• connect your Google device with a USB cable and trust the device you plug it into

If you do the computer method, you need to make sure to have the Android SDK tools. I used a spare computer with Ubuntu and Brave and the instructions are pretty reliable with Linux and Windows, but pretty vague overall. If I had criticize the installation process, there could be a little pulldown menu with some extras instructions.

OEM Unlocking

But that’s the hard part, let’s do something more fun–OEM unlocking. This is one of the coveted features of Android phones that allow custom ROMs. But how do we configure this?

• Go to Settings→About→Build number then smash that button until you become a developer.
• Go to Settings→System→Developer options→OEM unlocking enabled.

You might also need to connect to Wi-Fi at least once.

Rebooting

After you enabled OEM unlocking, you need to turn off the Google device. In my case, it’s the sleep button and the volume up button at the same time. This took me more attempts than I would like to admit.

When you turn on the device, then hold the volume down button while the phone turns on and you get a spooky tiny text menu. This means we are in business for the hardest step of all…

Doing the Deed

• Go to your nice Chrome browser and click the button to identify your Google device and unlock the bootloader.
• Click the button to download the corresponding release for your device.
• Click the button to wipe Google off your device. Do not touch your device or unplug it while it is working. It will reboot multiple times and you know when you succeed when the Google logo shows up, only for the GrapheneOS logo to jumpcut in front of it just like having in movies.

You still see a hash appear as your phone boots up and compare this with the hash on GrapheneOS’s website. This ensures you’re running an official GrapheneOS image.

Zuckerberg is back with some new AI chicanery! Cheaper VR headsets, glasses souped up with their AI assistant, and the desperation for his products to be loved by literally anyone.

Takeaways

• All Facebook products are now equipped with an AI assistant powered by ChatGPT and with the likeness of celebrities. They will weirdly react as you read your prompt.
• Posts and DMs can now be composed by AI. Just in case you thought the latest post from grandpa was real.
• Instagram now has AI picture filters.
• The Meta Quest is now more affordable. It’ll still spy on you of course.
• You get to play your 2008 looking games on your Quest, but that’s about it. Since the games must designed with the Quest in mind, it’s likely it will stagnate.
• Partnering with Ray-Ban, Facebook has engineered camera glasses and no doubt will humiliate streamers, let creepers creep, and grant Facebook the ability to data harvest your vision.
• Llama and other Facebook products received improvements stolen from other open-source learning models.

Referenced:

• Elon Musk “promises” to fight Zuckerberg
• Facebook helped instituionalize violence against a religious minority in Myanmar
• Christopher Wylie, the Cambridge Analytica whistleblower, is interviewed by UK Parliament
• Frances Haugen accuses Facebook of prioritizing incendiary posts for profit
• A picture of Zuck with his third daughter
• Zuck with his other 2 kids and Priscilla
• Zuck tries to spin privacy into his companies and fails horribly, F8 2019 Keynote
• Meta Connect 2023 Keynote

Case 1: Windows 10

Windows telemetry can’t be turned off and you only get 2 options: Full and Basic. No matter which version of Windows you use, the GUI won’t give you a way to deal with this. You can use Group Policy Editor of course, but in order for you to get access to the real Group Policy Editor, you need Windows 11 Pro or higher and pay through the nose to get.

Telemetry collected in both cases appears to be useful, but it’s ruined by the ethical quandary. Users are never given the proper means to consent except that big Terms of Service box when they bought their Mac or PC and clicked “I Agree.” Arguably, Windows’s telemetry is worse because Windows’s team continues to smear their name by ripping out existing features and the overreliance on siphoning user information. All of this compounded by the fact that Microsoft sells off your information to advertisers in their Bing network and has been doing so since the Sinofsky era of Windows.

But wait! Even if you use Windows Pro, you still can’t turn off the telemetry! The only way to avoid it is to:

• get a Windows Education/Enterprise license
• In order to get the license, you need to contact a Microsoft sales rep and give Microsoft business-relevant/mostly accurate information.
• Then you need to pay for volume licensing or a subscription fee for its activation, which also might involve hosting a Azure AD server.
• Then you can turn off the telemetry.
• Screw Microsoft and just use anything else except ChromeOS.

Case 2: Opting Out & VS Code

But let’s say a program that lets you turn off the telemetry, what do you do? You could of course trust them, but we need operate with “distrust, but verify.” Let’s take one of my favorite examples: VS Code. If I haven’t already, I hope I’ve drilled into your skull that Microsoft is one of the most evil and privacy invasive companies on the planet, so because Microsoft is evil, that must mean VS Code is evil!

Indeed, at a glance when you review the documentation for VS Code, VS Code is subject to Microsoft’s privacy policy, the same legalese privacy policy that allows Microsoft to market off your information. But there’s a few important differences between VS Code and Windows: VS Code includes a toggle for users to turn off telemetry collection. Unlike Windows, this toggle fully disables VS Code’s telemetry.

There’s no way you could know that…

Now, the keen-eyed keyboard warriors are going to pounce on this and say “Aha! But there’s no way you can actually know that!” But there is, dear commenter, and it’s the GitHub page, you know, where they publish most of the source code, including the code for the telemetry bits! “But the backend for VS Code’s extensions are proprietary!” If you don’t want VS Code to track your extensions, simple, don’t use VS Code. You can go crawl over to VS Codium, but it isn’t going to change Microsoft gets to monitor the VS Code Marketplace and all the silly AI extensions you install.

The other reason VS Code wouldn’t help is also obvious: you don’t trust the telemetry being turned off when you uncheck the box? Consider that VS Code is the IDE of choice for developers, some of whom have to be savvy enough to read the source code, and would type an angry message on Twitter and Mastodon that VS Code was spying on everyone even if the box was unchecked? Come on, use your noggin. Who knew that if you used an online service, you have to trust they won’t do anything bad?

Case 3: The Preceding Reputation

Let’s talk about the most spicy one: Ubuntu. Ubuntu has garnered a long history of being called spyware by the famous Richard Stallman (sucking his toe) and the Electronic Frontier Foundation because of the Amazon search integration into their operating system. However, Ubuntu suffers from not what they are actually doing, but they dragged their reputation was dragged through the mud for years. Ubuntu removed the Amazon searching, but continued to include an Amazon icon that would redirect people with a referral link, just like if you were to visit the description of my video and click on a link. The problem is because the Amazon incident with search queries, people held that against them.

This reputation also may have further damaged another part of Ubuntu, the introduction of operating system telemetry in Ubuntu 18.04. Now we get into the realm of what telemetry is harmful and what’s benign. Canonical’s developers have always been open about what information about what will be collected. In practice, Canonical collecting this telemetry is purely to improve Ubuntu and some fairly common settings that can’t really be used to identify people as it’s largely impersonal.

When poor Will Cooke announced this on the mailing list, people piled in complain online and how Ubuntu was continuing down a dark path, even though the data is pretty harmless. Why? Because Ubuntu 18.04 continued to package the Amazon icon and the baggage of the Amazon incident. Even though it’s pretty clear how to disable it by unchecking a box. Once again, because Ubuntu is open-source, we can verify unchecking the box does as it claims.

Playing Devil’s Advocate

But let’s wrap this up. I spoke in an entire video defending telemetry and trying to understand it, but what about the normal person? What about someone who wants to protect their privacy? If you want to help the developer and you feel that you are helping them by providing telemetry, then by all means provide them that data; it’s your prerogative.

On the other hand, you are an extremist when it comes to privacy. We’ve seen studies about how easily information can be deanonymized and it helps that the information is impersonal, but I want all the help I can get and that includes turning it all off.

And by the way, if you need to resort to using Little Snitch or Portmaster to clam up telemetry if you’re given no opt-out, maybe you should consider using something else.

Hey guys, it’s always good to avoid controversial subjects, so let’s talk about the pandemic! The 2020 Coronavirus Pandemic fundamentally changed the way we go about our lives, but I want to address some of this today. One of the things greatly affected by the pandemic was the right to privacy.

The Pandemic Problems

Working from home and doing so privately has become more difficult with things like employee monitoring software, constant video calls with mandatory rules that your camera is on at all times, and the use of personal computers and “bring your own device” are now commonplace.

But this goes beyond the workplace and education. Many other facets of our lives are now done at home on video conferencing software ranging from therapy sessions, telehealth visits, and town hall meetings. The question is, how are we going to keep our computers clean and maintain our privacy in a post-pandemic world?

Schools, workplaces, and medical services require you use a personal computer, where you keep all sorts of things you’d like private, and they install all sorts of invasive video calling programs, anti-cheat rootkits for online classes, and bossware playing Big Brother to make sure you are working.

Instead of complaining, I want to take this time to either improve what we can do or more importantly, prepare us for the next pandemic. The next time this happens, let’s be ready.

A Disclaimer

Before I proceed with any of this, I want to you to be aware I do this for fun and games because I value my own privacy, but if this is critical to you getting a job, educational opportunity or healthcare treatment, do NOT do anything I say; your well-being is more important than the content I make on my YouTube channel. Pick the hill you will die on wisely and know which battles you can win. Be smart about this and don’t break the law or any guidelines set by work or school.

That being said, your employer or university might be kind enough to offer accomodations, let’s say that, so you can work from home and not have the privacy invasive technology wreck havoc on your personal computer. All of this is also a lesson on social engineering and while social engineering might have negative connotations because of the infosec world, it’s all about everyone getting what they want in the end. They get a good worker and you get your privacy at home and with your data. Think of it as professional excuse making.

I’m not going to go into deep detail, but I’m also going to go over price or potential costs. I understand, especially for broke zoomer students that price is an important consideration.

The “Work” Computer:

Obviously the cheapest solution is to have a dedicated computer. You could use an old computer you have lying around, buy a new one, or convince your employer/school to provide you one.

• Tell your employer providing you a computer will have everything all preset and it’s more secure as it’s hardware the company controls.
• Say how technically illiterate you are and installing all that VPN software and monitoring software is too difficult for you to do.
• If it’s a university, they often allow students to rent out laptops like library books and most other types of schools provide Chromebooks or iPads for younger age groups.
• Tell them you’re an Arch Linux user and frequently get kernel updates that break PulseAudio and Arch doesn’t natively support Zoom or Teams. (Don’t tell them Flatpak or Snap exist!)

Also when you make excuses like this: do not be hostile or say how much you disapprove of their practices. Your employer or university might feel they don’t have to do anything for you and you are the one on the short end of the stick here. You will get more accomplished by being agreeable and demonstrating the willingness to be a good worker.

The Home Router/Firewall

The con of being issued a computer is many schools or workplaces forbid you from installing software on your computer and this is where a home firewall becomes your first line of defense. A home firewall can be a spare computer or a dedicated piece of hardware to control what happens on your network. This also protects your back if a skilled adversary targets your company or university, like what happened with LastPass.

To prevent any unsavory connections, system calls, or third-party IT software tracking your home address, I use a pfSense firewall on a Protectli firewall when I’m at home . I have had bad luck with OPNSense, but many others tell me it’s great. Both pfSense and OPNSense allow you to set up custom VPN connections with a VPN provider through OpenVPN, Wireguard, or IKE2.

The Most Expensive (Potentially)

Unfortunately, this is a steep price hike. Buying dedicated hardware for this is at least $300 and paying a subscription fee to a trustworthy, commercial VPN provider, which can be up to another $10 per month. You also need the know-how to setup a firewall or acquire hardware to run it.

But using this setup ensures you never download any programs on a work device. Having a dedicated machine also makes it easier to mentally and digitally compartmentalize your work activities from your personal activities. I know when I crack open my Windows laptop I’m there to get work done. I believe with the right investment, this setup is incredibly effective at achieving privacy while working from home.

Using Your Own Computer

So let’s say you can’t get your hands on a device; there’s no budget for you or the school cheaped out on you, what now?

Virtual Machines

The next solution is if you have capable hardware, run a Linux virtual machine. VirtualBox or HyperV on Windows, UTM on Mac, and KVM on Linux through GNOME Boxes or virt-manager will separate your work life from your personal machine through a strong sandbox.

Interestingly enough, all of the video conference software most businesses use, like Zoom, WebEx, Google Meet, and Microsoft Teams, all work on Linux and Windows. I strongly recommend installing Windows 11, Fedora, or Debian because Zoom, WebEx, and Teams all offer .deb and .rpm packages. You also might want to consider using X11 as your display manager as screensharing is not as functional as it is on Wayland.

The Cons of Virtual Machines

The issue with virtual machines is USB passthrough, which varies wildly from device to device. This means you pass a USB webcam or microphone to a virtual machine so you can use it with video conference software, the same way you do on a physical computer.

Some might argue VM escapes are a threat, but the reality is business software from official sources won’t contain such exploits. HyperV and KVM especially are enterprise level software and Microsoft and the Linux Foundation will do everything in their power to stop that from happening.

This also requires you have a half-competent gaming computer in order to run a virtual machine effectively. You also need to be sure you can allocate enough storage and if you do something like animation or video editing, this is progressively more difficult. Anti-cheat software and security programs might also alert your proctors or your IT department you are using a virtual machine.

Live USBs

If you can’t get a virtual machine working or you have a low-spec computer, use a live Linux USB. The live USB ensures you can use a separate operating system, but still using the same computer. The problem is removing the USB stick will cause you to lose your setup and lose all of your data. There’s also the issue of performance. Especially on low spec hardware, live USBs are limited in their read speed and running off the RAM of your computer.

Secondary/Portable Drives

To avoid your files getting erased, you could use a portable hard drive or a second drive. If you have a second SSD or hard drive, you can boot into it when you need to get work done. And since you have full control of your hardware, you can use VPN software on your device. Using Windows on a portable hard drive isn’t very feasible (it was discontinued in 2020), but it will if you use a PCI or SATA connection. Debian, Fedora, and Ubuntu should work fine regardless of your situation.

Progressive Web Apps

Many programs today are also done in progressive web apps, and using a Chromium-based browser like Brave, you can use many websites the same as you would on Windows. I did a full video on running Discord as a progressive web app and you can apply the same blocking techniques to other web-based software like Google Meet or Slack.

Webcam Rules

Now we also have mandatory webcam rules. Some workplaces, online classes, and telehealth visits require interviews or your work day with your camera on all day. Of course, you could raise a stink about it (and some would argue you should), but it’s far easier to play stupid than say you don’t like something. Whenever you appear in a video call, always have an excuse ready, especially when you take your computer to get setup with your employer.

Desktop Computers

The most successful one I have had is say your main computer is a desktop computer. Most monitors for desktop computers don’t include webcams or microphones and it’s impossible to use video conferencing programs without one. Don’t tell them you use your USB webcam for running a secret Vtuber YouTube/Odysee escapade though!

And notice this: I never lied to my employer; my main computer is a desktop computer and my poor Asus E403NA laptop isn’t good enough to run Zoom. When I told them about my situation, they were happy to provide a Windows laptop with Microsoft Office and monitoring software preinstalled.

Part of making a good excuse is you express that you are trying your best to do what they want. Also pick something that is the most true for you.

“My Internet is bad”

But let’s say your employer or school isn’t as accommodating. They give you a webcam and tell you to get to work. You can also claim you live in an area with low-bandwidth. You know what takes up a lot of bandwidth? It’s the pictures and videos in video calls!

If you were to say, your first couple of calls, disconnect yourself from the network from your settings rather than hanging up in the middle of a call, it will help sell your story. This way, participants in a video call will see you disconnected and you come back, but tell them “Oh my call works better with my webcam off,” they just want you to get work done and will be more likely to adapt to this change.

What about your phone?

One question I heard once from the doctor’s office was “why don’t you use <<our video conferencing app>> on your phone?” But I was prepared. I bought a cheap phone from Best Buy, hit the screen a few times with a hammer, used the Android Debugging Bridge to rip out all Google apps, and brandished it in front of the receptionist and said “Oh, but my Android phone has trouble downloading apps.” And that ended conversation really quick, with my iPhone safely in my pocket.

A Little Bit of Tape

Another weird alternative is putting layers of scotch tape or using a dedicated room in your home for work. Now hear me out: the layers of scotch tape diffuse the mass surveillance and facial recognition done by platforms like Zoom and Microsoft Teams, but it allows people to loosely see the detail of you and your workspace.

A Dedicated Space

The other reason why I recommend a dedicated room or space is as a last resort if they demand you remain on camera, you can limit how much of your home they see. Make sure important sentimental or controversial things are not in frame like:

• pictures of you, your family, or friends
• certificates or trophies
• items unrelated to work
• religious imagery
• alcohol or smoking products (depending on culture)
• adult or NSFW material

The reason you need to do this is because first, your coworkers and supervisors will judge you based on your Zoom room, so it’s to be conscientious of this. The other reason it’s easier to mentally be in a room you know you’re going to be working. This tells you mentally, I’m in this room, so I’m going to be working.

The other reason is some anti-cheat proctors will demand you move your computer around and show them the entire room. This way, if you are forced to do so, you can limit what they see.

Takeaways

The culture of working from home may be a new one, but the situation is not entirely hopeless and we have a wide variety of options at our disposal.

• You can use a dedicated computer or a work device.
• You can use a Windows or Linux virtual machine to separate your work activity on your main machine.
• You could use a live USB or a portable drive to boot into Linux and do your business.

You provide sufficient excuses to get your work done and play dumb.

• You have bad internet.
• Your computer can’t run the software.
• The webcam provided isn’t Linux-friendly.
• That you’re too stupid or tech-illiterate to download their stuff

And hopefully this provides some hope in our ever-connected cyberpunk dystopia.

One of the coolest staple operating systems to always have in your toolkit is Whonix. Whonix has always been one of my personal mainstays in my arsenal of Linux operating systems, especially since it’s so different. So strap yourselves in, since people love them distro reviews, let’s learn about Whonix.

What is Whonix?

Whonix is not your traditional Linux operating system. Most people install Linux on real computers, virtual machines, or servers, but Whonix exclusively works on virtual machines. Also it requires that your computer supports virtual machines, and not just 1, but 2.

Whonix is incredibly distrustful of their “Workstation” virtual machine, which is where you conduct all the normal activities that you’d expect to do on Linux. To protect your privacy (and from all those loser sellouts with VPN sponsors), Whonix filters everything through the Tor network using a second lighter-weight virtual machine, the Gateway virtual machine.

Now if you were running Whonix with just one virtual machine, a virus or phishing email could in theory turn off the anonymity protections that Tor gives you, and deanonymize you. In fact, we know this has been done before by companies and governments in targeted attacks before.

Even if it was a child predator, Facebook is so messed up that they are willing to pay for 6 figure research to develop a cyber weapon for a government agency.

By using multiple virtual machines, malicious programs can’t just “turn off” Tor, they need to get past the virtual machine system you use, KVM or VirtualBox. In fact, if you use KVM, which I covered on the channel before, companies like Red Hat, Google, and Amazon have a vested interest in preventing people from doing just this to their data centers.

So you need to have not the most amazing computer, but one decent enough to run 2 other operating systems. And if you are going to use it, you can’t use an Apple Silicon Mac, and you need to use Linux and KVM to make the most out of it.

Another oddity for people who know me well is Whonix is based on Debian. The Whonix developers have mitigated a lot of the security issues that exist in Debian’s default installation and implemented further kernel hardening measures on top of it; so in my mind, if you’re going to use Debian, this is one of the ways to use it best.

Installation

Whonix has a page for installing VirtualBox, but I want to focus on KVM, which stumped me years ago getting into it. Whonix’s current KVM maintainer, HulaHoop, provides very in-depth instructions based on operating system.

Downloading the .QCOW files

Download Whonix Xfce.

Verify you received the authentic archive using the OpenPGP Signature by downloading it.

cd [the directory in which you downloaded the .libvirt.xz and the .asc]

Download HulaHoop’s OpenPGP key.

Import HulaHoop’s key to your GPG keyring.

gpg --keyid-format long --import --import-options show-only --with-fingerprint hulahoop.asc

Next, we need to verify the PGP key.

gpg --verify-options show-notations --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz

If the download is authentic, we want to see:

gpg --verify-options show-notations --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz

Do not continue if the verification fails. Try downloading Whonix again

The Whonix License Agreement

Extract the archive:

tar -xvf Whonix*.libvirt.xz

First we need to read the Whonix License Agreement. Unlike Microsoft’s end user license agreement, you can do whatever you want to Whonix, but you are 100% responsible for whatever you do, not them nor I am responsible for whatever happens.

more WHONIX_BINARY_LICENSE_AGREEMENT

To agree, enter the following: touch WHONIX_BINARY_LICENSE_AGREEMENT_accepted

If you don’t accept, you can’t continue with the installation.

Importing the KVM Templates

First add the virtual machine networks:

sudo virsh -c qemu:///system net-define Whonix_external*.xml
sudo virsh -c qemu:///system net-define Whonix_internal*.xml

Next activate the virtual networks and import the images.

sudo virsh -c qemu:///system net-autostart Whonix-External
sudo virsh -c qemu:///system net-start Whonix-External
sudo virsh -c qemu:///system net-autostart Whonix-Internal
sudo virsh -c qemu:///system net-start Whonix-Internal
sudo virsh -c qemu:///system define Whonix-Gateway*.xml
sudo virsh -c qemu:///system define Whonix-Workstation*.xml

Finally, let’s move them in place. Don’t be alarmed that they are 100GB, they will be much smaller at first and will expand as you put more in them.

sudo mv Whonix-Gateway*.qcow2 /var/lib/libvirt/images/Whonix-Gateway.qcow2
sudo cp --sparse=always Whonix-Workstation*.qcow2 /var/lib/libvirt/images/Whonix-Workstation.qcow2

If the move is successful and you can dispose of the files.

First Setup

If you open virt-manager, you’ll see there’s two new entries:

1. Whonix Workstation: This is where you conduct your browsing and desktop activities.
2. Whonix Gateway: This is where you configure your connection to the Tor network.

There’s a specific order to launching the virtual machines. You can also make duplicates of the Workstation, but there isn’t much value into making duplicate Gateways.

There’s also a live boot mode, which allows you to boot into a completely disposable desktop session that will delete your files when powered off.

Logging In

First boot up Gateway. This will kick you into a TTY environment.

Default username: user

Default password: changeme

Next, change your password using passwd. You shouldn’t use the default password.

Connect to the network using sudo whonixsetup. Then wait for Tor to connect.

Finally, run updates. Whonix’s devs created a script which manages apt without root privileges:

upgrade-nonroot

Then repeat the same steps with Whonix Workstation, but no sudo whonixsetup. You will also need to open the Tor Browser and allow it to be fully updated.

Using Whonix

Whonix also places priority on your security first and foremost. That doesn’t mean that other operating systems don’t protect you, but in addition to being locked into a virtual machine, you can’t just install and use the same programs you like to use on Linux.

• Wine does not work due to a modified kernel parameter.
• The kernel hardening has made it harder to run Flatpaks in the past.
• Using other programs that use Tor within Whonix (OnionShare, Brave, etc) makes you stand out amongst others in the Tor network. This is because your traffic is being bounced twice as much as everyone else.
• Tor is not a place for illegal activity. Do not rely on it for protection.