I’ve had people tell me that this is (their words, not mine): “mental illness”
I must be one of those. This shit is not okay, yall. Whole psychological profiles, humiliation tactics, and dystopian forms of control are right around the corner. Why would they keep Epstein alive when Palantir automated the job of the blackmail broker?
I dunno, considering that Facebook data has been used to go after people, we’ve got fascists using every method possible to target their current hated group, and police everywhere ignoring or bypassing due process by just buying data, I don’t think it all paranoid to think that privacy concerns are already huge, and could get worse
I came to say, “just because you’re paranoid doesn’t mean they’re not out to get you.”
Of course some people go too far. I think a lot of folks on here grossly overestimate / overstate their threat model, but I think the discussions are good for the limited few who really do need to cover their asses.
Me personally, I hate the idea of companies bidding for my attention without my consent, so I try and make it as hard as possible for them to get it. This just so happens to overlap nicely with the goals of the privacy community much of the time.
I mean font ad blockers cover that.
Yeh my family treat me like I am a nut job. I only swapped away from google and ask them to think about the orgs they spend their money on for example Amazon.
It’s amazing how many people got on board with Covid conspiracies but questioning where you data goes, who’s using it, what for, no that’s a bit far lol.
Told my older parents I use a custom ROM with a profile for work and a profile for personal and they asked me what I’m hiding, and why I’m so paranoid. I said… it’s not paranoia, it’s organization. Color coding profiles allows my mind to switch gears from work to personal life like mental compartments. I am a boring person. I have nothing to be paranoid about. They didn’t believe me. Oh well…
Edit: part of me thinks the whole mental state switching from work profile to personal is an ADHD aspect as well. Especially the color coding helps wonders.
As long as everyone is having fun, I see no problem.
If you’re not having fun switching email providers, researching Gecko forks, or being a part-time sysadmin for your Fairphone, you should probably not do these things.
are you guys doing this for fun? i take some privacy precautions so i wont be mass targeted for anything i do today in the future.
I’d sure hope so! Many of the things that privacy nuts like us do are not efficient uses of one’s time.
They might require constant vigilance. They might need recurring work for continued effectiveness. They might necessitate exposure to intrusive negative emotions (“what is Google doing this week?!”).
If you’re not having fun, focus on measures that you implement once and then never have to think about again.
For example, I wouldn’t recommend GrapheneOS to a journalist in an authoritarian regime. It might be “more secure”, but they have a job to do and can’t keep dicking around with obscure pointer authentication settings or whatnot. They should just get a current iPhone, enable Lockdown Mode if its tradeoffs are acceptable to them, and continue doing their best job, which isn’t “phone administration”.
LARPing as Jason Bourne, or prepping for the Rokobasiliskocalypse, is a hobby. It’s okay, I do it too. However, it’s not approachable or understandable to people who don’t share that hobby, or are not as alarmed at the general state of things as we are.
Damn this take needs more love. You will get shouted down And downvoted to the lowest depths if you speak against anything that isn’t graphene. I like the project, it has merit. It’s far far from perfect in so many ways. I don’t believe it’s the white knight in shining armour we like to think it is. Good yes. Saving grace. Not by a long shot. It’s got many fundamental flaws.
Be conscious of your needs, not obsessive. I think a lot of people are obsessive and I get it totally. But FOMO is powerful. Don’t overwork your mind trying to be perfect that you never make moves. Life isn’t static. If your uneducated enough to truly need the utmost best tech stacks with no real knowledge on how to implement and deploy. You likely don’t need to be doing the shit your thinking of, or currently doing.
people are literally targeted by this system today. and i live in the third world, i’m ripe for the taking.
i’m glad this can be a hobby for some of you guys though.
It kind of has to be, if you’re trying to be persistent about the whole thing. It’s easy to feel overwhelmed and burn out over all of the different threats we’re trying to defend against. I don’t see how you can keep at it for months or years if you feel no joy over it. But maybe being deathly, relentlessly afraid of the dangers around us is enough after all.
If you don’t even like doing this stuff, wouldn’t it be better to focus on measures that require little upkeep? This is what my example suggestion was getting at, something that’s as close to set-and-forget as possible, while getting you 90% of the way there. (Depending on your threat model, sure. If yours says that the sky is falling if Tim Apple gets your iCloud data, it certainly doesn’t apply.)
if you are properly threat modeling, getting away from big tech is a long process but not that complicated. for most people it pretty much just means replacing apps and deleting accounts. eventually maybe installing a rom.
honestly services like icloud are whats truly dangerous, but i digress.
Yes, some people absolutely take things way too far, and often unproductively.
Like the person who was trying to disable websockets. Or the people who will shun signal, but jump directly on the flavour of the month signal clone, which might be completely backdoored.
If you dont know what you are doing, randomly turning things on and off at best does nothing, at worst makes you even more signaturable/trackable.
Its good to educate yourself on various protections, but unfortunately, it requires a lot of careful research and understanding.
There’s certainly also the aspect of simply “nerds who want to experiment.” I know I’ve tried out weirdo encrypted messengers and such in the past, just to never actually use it for anything and delete it. If you are smart, you know the difference between an experiment and sage advice. Boring stuff like the EFF’s Surveillance Self Defense suggest the reasonable tools for a spectrum of people’s threat models, but those things were all once experiments too.
I have no issue with tinkering, my issue is more when tinkering gets turned around into advice.
I think I would be happier if these communities/subreddits were a bit more explicit about “We are amateurs, for actual advice, go to X, Y, Z”.
Couldn’t agree more.
I think that “mental illness” kind of comments would come from people whose attitude for safety in many aspects of life is “that’s never going to happen (to me)”. Those people exist, so sooner or later you’ll see comments like that.
On the other hand everybody is trying to find a balance in convenience and safety and the situations and environments and life on general for one person can be quite different from that of some others’. So what’s adequate for one won’t be for another.
It’s like PPE or personal finance or many other things. There’s no one size that fits all and finding the right fit isn’t easy. For a lot of us it’s work in progress. Sometimes you know what’s definitely needed and tweak the details. Sometimes you know something is not going well and needs to change.
Maybe it’s enough to say that it’s complicated and have some compassion and support for people that think it isn’t. Or people that think it’s all too much to handle.
Yeah. I think people can become obsessive over it. I also think there is a large group of users who gamify privacy and act as if its an mmo quest where they just need to collect the best tools to win instead of being responsible and understanding threat modelling.
There is a point of diminishing returns. Like most things, you have to evaluate what you are willing to live with and let go.
I know someone who only browses incognito because they don’t want cookies tracking them. They log into everything every day. Which, imo, is worse because those cookies are still tracking you but you now have to log in everyday.
But for them they like the control.
I’ve moved most of my incidental link on my phone clicking to Firefox Focus (thanks to URL Checker) which has upped my privacy. I wouldn’t have made that change without the prompt that URL Checker provides though.
I use a VPN outside of my house and I use pihole at home. I am tempted to switch my DNS to unbound but the juice doesn’t seem to be worth the squeeze. We’ll see the next time I need to rebuild my pi.
I used to run unbound on my laptop just so I could configure stuff like forwarding zones with more precision than what a stub resolver normally gives you.
It can also be your validating DNSSEC resolver, which also satisfied that sort of morbid curiosity in me.
In the age of DoT and DoH, with endpoints hardcoded in browser binaries, that sort of thing has a lot less punch than it used to. Even back then Go binaries would start ignoring your
nsswitch.conf…
https://www.explainxkcd.com/wiki/index.php/2501:_Average_Familiarity
Relevant XKCD;
I feel that it is closer to the fact that the communities forgot most beginners are completely new to this in general. They might not even know what exactly a ‘browser’ is, much less cookies and stuff.
Hence when we try to spoonfeed them information, it comes off as overwhelming and forced.
Agree that there are some extremist, but they mostly act in good faith tbh.
Another thing I noticed is there are more preachers of ‘how’ than ‘why’. Having a beginner go down the route of privacy without giving them a purpose to do so is quite off-putting.
I’m like a test-bed for a) my business customers and b) friends and family. also, “wasting” time thusly is vastly better than my previous “hobby”, namely buying new and exciting shit.
my customers benefit from me knowing how exactly (and why!) I should implement e.g. an unbound instance on-premise. or an in-house prosody communication platform. or the “dev team” (buncha dudes poking at wordpress) getting a slew of used elitebooks with linux for the price of one new windows-with-ai yoga the spec initially called for.
f&f benefit from my early adoption by way of trickle-down tech. no way is anyone of them going to selfhost all this crap, but they get sprinkles of benefits in the form of “get this phone with that OS with those apps” and they’re dramatically better off. you don’t need the new ideapad ryzen that’s “on sale” (isn’t), have this 10-year old macbook I fixed and installed linux on - off you go. you don’t need the new phone that’s “free” with an exorbitantly priced plan, have the cheapest plan with this Redmi/Poco phone I swapped the battery on and installed LineageOS.
as to practical considerations, any and all interactions with the likes of FAANG are and should be adversarial from the get-go, they are out to hurt you by any means necessary. them fucks lost the benefit of doubt ages ago so you not letting them have a millimeter of grasp in your domicile should be your primary task. as their gains are cumulative in nature, every battle won is significant and you’d do well to remind yourself constantly of that.
Once, someone sent me an Amazon link for baby nappies, and fool me clicked on it. Now Amazon showed boomer me baby nappies suggestions for the next six months. AI at its best… These things annoy me, so I try to avoid being tracked whenever reasonably possible.
OTOH, I am old and hope to not live long enough to experience any rogue government or whatever else persecuting me for having clicked on a baby nappies link years ago; so my threat model is short term only. I keep my privacy to a level, where it hopefully prevents as many annoyances as possible, but does not hamper what I am doing online too much. If I was younger, I’d likely do more.
Yes, paranoia is not healthy. When people can’t formulate a realistic threat model then usually to be “safe” they assume everyone is out there to get them … while failing the most basic steps, e.g. not relying on surveillance capitalist fueled tools voluntarily.
A year ago: yes.
Today: nope.
A few weeks ago, I would have said 100%. I am needlessly careful.
I know I’m protecting against privacy threats that are technically possible, but unlikely. Preventing the tracking is just an interesting hobby, to me.
But earlier this month, we learned that Meta went “all-in” on what I consider some fucked up shit - running a mini localhost server to track the vanishingly few people who bother to block their tracking.
So now I guess I’m only about 30% sure I’m being needlessly careful.
Like most things on the internet it’s a game of one-upsmanship. User X uses Firefox with Incognito. User Y say’s that isn’t good enough for his own inconsistent definition of “good enough.”
So User-Y suggests Firefox with 14 different add-ons and only browse through an immutable VM. But then user-z comes along and says that if you are using windows at all, you don’t really care about privacy, so you should be using Icefox on some obscure fork of ubuntu through an immutable VM, with a pi-hole.
Then user-w says well if you aren’t using a VPN none of this matters, so Obviously you need to rent an Alibaba cloud server hosted in China, that you only connect to through a privacy respecting VPN, and then you only browse through TOR.And so on. By the time a user is asking about how to stop google ads, the only “serious” answer by the community involves using Packet over Ham-radio -> and spending thousands of dollars a month on 4 different cloud providers, rented through several shell companies set up in Switzerland, the Cayman Islands and China, while only typing in Esperanto using an ASCII-only font.
It’s so overwhelming. I just want to be able to use Wireshark well to figure out wft is going on at my house with outbound surveillance data.
Wireshark is the wrong tool for the job unless you are only interested in the destination IPs, but those are useless to most people because malware and PUPs are hosted on public cloud services or rarely hijacked insecure endpoints, so what value is a source IP going to get you? For example most ‘suspicious’ traffic is from your cell phone and some app is phoning home over TLS, with ‘home’ being an elastic IP in AWS.
