The purpose of this document is to analyse communication options such as mail, social media, chat, calls and video calls from the perspective of a privacy conscious individual. I also care about freedom of speech and would like to avoid vendor lock in.
Max Tegmark:
“…[Robots] are coming to hack us. It’s kind of humbling that we are hacked by this dumb machine learning algorithm.”
Network effects appear when friends encourage you to choose a particular platform. It is hard to resist the pressure from peers, friends and family who describe how convenient the software is and how nice it would be to write, talk, share pictures and videos on that platform. Network effects are natural, I suppose. They can apply to any form of communication.
Through communication tools such as Skype, Whatsapp or Zoom you can only communicate with people registered at the same company. Incompatible tools split our digital expression into silos. These silos lock us to a particular platform and limit our freedom of expression. Once a silo has managed to attract a large number of users, network effects pushes those users to attract more peers inside.
Our communication doesn’t have to be locked into a particular platform. The internet protocols were conceived with neutrality at the core.
Matt Rubin made the source code available under https://github.com/mattrubin/Authenticator but it has not been updated for the last 2 years. It is probably further developed in private.
Paul:
❯ Another colleague also doesn't have internet connection, so there is a
problem at the hardware level on the university cable conneciton this
morning. The issue is that the ethernet cable is prefered over my phone's
USB, that's why I had to disable the connection in the OS. It's plugged in
tough as you correctly noted. In general it's nice that the cable link is
prefered over the usb phone connection, but today the cable link doesn't
work. Out of curiosity would there be a mechanism to check that the cable
connection is failing and use the phone connection in that case? If I just
unplug the cable, the usb phone connection works, so I already have a
solution. It's more out of curiosity how such a dynamic detection of the
availability of the cable connection could work.Claude:
● Great question — this is a classic problem, and the short answer is: yes, the mechanism exists, it’s called active health-check failover, and the whole trick is that “link up” ≠ “internet up.”
Your setup today is the textbook failure case: the cable has carrier (the switch port is alive), so by every signal NetworkManager can see locally, the metric-50 route is “valid” — even though the upstream is dead. Static metrics are passive: they pick a winner once, based on link state, and never re-check whether traffic actually flows. To get failover you need something that actively probes reachability and adjusts routing when the probe fails.
Why the pieces you already have aren’t enough
- Route metrics (your metric 50 vs 101): purely passive. As long as the cable has carrier, it wins. No traffic test.
- NetworkManager’s built-in connectivity check (/etc/NetworkManager/conf.d/*.conf, the [connectivity] section with uri= / interval=): NM will periodically fetch a URL and label the connection FULL / LIMITED / NONE. Useful for detecting captive portals — but NM does not automatically demote a default route or fail over based on that state. It reports; it doesn’t reroute. So on its own it wouldn’t have saved you this morning.
The working design (a watchdog loop)
The reliable pattern is a small daemon/timer that does this:
- Probe the internet over the cable specifically. While the cable is the default route, this is easy — just ping -c1 -W2 1.1.1.1 (it goes out the cable).
- On N consecutive failures, demote the cable: either raise its route metric above the phone’s, or nmcli dev disconnect enp0s25 — exactly the manual step you did. The phone (metric 101) instantly takes over.
- Keep probing the cable to detect recovery — and this is the subtle part. Once the phone is the default route, a plain ping no longer travels over the cable, so you can’t see it come back. You need a dedicated probe path that always exits the cable regardless of the default route, e.g. a pinned host route: ip route add 1.1.1.1/32 via 144.41.253.1 dev enp0s25 table 100 # or just a host route ping -c1 -W2 1.1.1.1 # now this specifically tests the cable
- (policy routing, or simply ping -I
combined with a host route for the probe target). - When the probe succeeds again, restore the cable (lower metric / reconnect), and the phone drops back to standby.
That loop is the entire mechanism. Everything else is packaging.
Off-the-shelf ways to package it
- A systemd timer + a ~30-line bash script using ping + nmcli/ifmetric — the simplest and most fitting for your Debian + NetworkManager box. Run every 5–10 s.
- NetworkManager dispatcher scripts (/etc/NetworkManager/dispatcher.d/) — event-driven (fire on up/down), good for the restore side, but you still need a timer for continuous probing. keepalived with a vrrp_script / track_script — its health-check-and-act machinery does exactly this, though it’s heavier than you need for one host. mwan3 — the gold-standard multi-WAN failover with per-link health checks, but it lives on OpenWrt routers, not desktops. It’s what a router would use to do this properly.
The honest engineering take: for a single laptop where unplugging the cable is a 2-second fix, a watchdog is over-engineering — but it’s a genuinely fun ~30-line script. If you’d like, I can write you a self-contained systemd timer + script tailored to enp0s25 / your phone interface that does the demote-on-failure / restore-on-recovery dance, including the pinned probe route. Want me to drop it in?
Email is an open protocol and that is good because it means you can exchange emails with someone who uses an email server from a different company. In other words there are no communication silos with email. But the security aspect of email exchanges is fundamentally broken.
Most emails are encrypted at the transport layer. End-to-end encryption would be better, but it’s usage is rare.
You can use mbsync to synchronize emails locally (including deletions). Then read local emails with Neomutt.
Neomutt can fetch emails directly from the IMAP server.
Notmuch is an email client with a vim plugin
Synchronize emails
# Sync all accounts
mbsync -a
# Sync the gmail account, in verbose mode
mbsync -V gmailThe data is stored in the ~/Mail
Installation
sudo apt install pass # To store the password
sudo apt install isyncConfiguration in
~/.mbsyncrc
Configure the pass store
gpg --list-secret-keys --keyid-format LONG
# Initialize with the key id without the rsa3072/ part
pass init ................
pass insert gmailSee .mbsyncrc in the setup directory
IMAPAccount gmail
Host imap.gmail.com
User ___.___@gmail.com
PassCmd "pass gmail"
TLSType IMAPS # Updated from SSLType
AuthMechs LOGIN
IMAPStore gmail-remote
Account gmail
MaildirStore gmail-local
Path ~/Mail/
Inbox ~/Mail/INBOX
SubFolders Verbatim
Channel gmail
Far :gmail-remote:
Near :gmail-local:
Patterns *
Create Both
Expunge Both
SyncState *Can reuse the mbsync credentials.
Neomutt to visualize emails in the local directory
Setup bidirectional deletion with Expunge Both
Commands for the NotMuch Vim plugin.
:NotMuchCommands in the search list view
s search
c compose
t tag
d tag as deleted (added by Paul)Show for example the list of emails tagged as deleted
:NotMuch tag:deletedNotmuch can be used for fzf style grep search on emails.
Install notmuch and the vim plugin with
sudo apt-get install -y notmuch notmuch-vim afewThis installs
Configure notmuch with
notmuch configAfter mbsync has synchronized email, ypdate email Notmuch’s index with
notmuch newInstall ruby is necessary for the vim plugins
sudo apt-get install -y ruby-dev
sudo gem install neovimSync with mbsync and update the notmuch index
mbsync -a && notmuch newA script that performs the same but also moves emails tagged “deleted” to the Gmail trash
~/bin/mail-sync.shCalls another script inside.
deleted into Gmail’s Bin,
then let mbsync push the delete to the mail server.There is a script that trashes deleted mail, pull/push
with Gmail, re-index:
~/bin/mail-sync.sh
In the notmuch list view :NotMuch press “s” to search, then you can use the following keywords:
invoice # word anywhere in headers or body
"quarterly report" # exact phrase (quote it)
from:alice # from-header contains "alice"
to:paul.rougieux@gmail.com
subject:meeting
subject:"travel reimbursement" # quote multi-word values
from:bank and subject:statement # explicit boolean (and/or/not, xor)
tag:inbox and not tag:unread # read mail still in inboxDate ranges work with a double point separator
LOW..HIGH. Either side can be empty for open-ended. Single
values and bounds round to their precision (e.g. ..2024-12 includes all
of December). Date ranges examples
date:2024-01-01..2024-12-31 # explicit day
date:2024-01..2024-03 # month precision
date:2020..2024 # whole yearsBy default it’s not possible to search based on attachement size.
TODO: add a post-notmuch new hook that stats each attachement file and runs notmuch tag 1mb, 10mb to tag files that are larger than 1MB and larger than 10MB.
Dump all attachements of a search directory
mkdir -p ~/tmp/contracts
cd ~/tmp/contracts
for id in $(notmuch search --output=messages \
'date:2009..2018 and tag:attachment and (contrat OR embauche OR CDI OR CDD OR avenant OR engagement)'); do
notmuch show --format=mbox "$id" | munpack -t -C ~/tmp/contracts
doneBackup Thunderbird Emails for Beginners https://support.mozilla.org/gl/questions/1395205
That is correct. Everything is in the profile. Copying what you described includes everything. Two reminders:
- do the copy when Thunderbird is not running.
- in restoring, install thunderbird first and exit prior to copying in the backup. It will overwrite the initial empty profile specification.
Snail mail is an emotional form of communication through a physical medium: paper. You can smell it. You can touch it. You can drop a tear on it. You can tear it apart. You can burn it. It’s based on plants that were growing in a forest somewhere. It might have spent time in a trash bin. It might have been recycled.
What happened to the VOIP software on Linux? Why is there such a reliance on proprietary platforms? Is it because of technical constraints or are there other political reasons for it?
Free programs recommended by Richard Stallmann on his skype page: Jami, Linphone, Mumble, Jitsi.
Ekiga is/was a softphone for gnome Linux desktop. Development has stopped since the last release in What happened to it? Why has development stopped? According to wikipedia, the original developer Damien Sandras is now working for be.ip on open source voip software.
“Matrix is an open protocol for decentralised, secure communications.”
- People should have full control over their own communication.
- People should not be locked into centralised communication silos, but instead be free to pick who they choose to host their communication without limiting who they can reach.
- The ability to converse securely and privately is a basic human right.
- Communication should be available to everyone as a free and open, unencumbered, standard and global network.
Element, previously called Riot-web is a chat application based on the matrix decentralised communication protocol. Matrix is an open protocol meant to avoid communication silos.
Based on the Double Ratchet Cryptographic library called Olm specified in whispersystems.org doubleratchet which now redirects to signal.org doubleratchet.
Wikipedia Jami
“Jami (formerly GNU Ring, SFLphone) is a SIP-compatible distributed peer-to-peer softphone and SIP-based instant messenger for Linux, Microsoft Windows, OS X, iOS, and Android. Jami was developed and maintained by the Canadian company Savoir-faire Linux, and with the help of a global community of users and contributors, Jami positions itself as a potential free Skype replacement. Jami is free and open-source software released under the GNU GPL-3.0-or-later. In November 2016, it became part of the GNU Project.”
Jami.net peer to peer file sharing support based on the PJSIP library. Write the following about the improvements they made to enable communication over UDP:
“While PJSIP is recognized as the reference for Voice over IP communication applications, it is not designed to work in a distributed network. For this reason, our team had to make significant contributions to the PJSIP project. In order to grasp the nature of those improvements, it is necessary to understand the difference between UDP and TCP. They are both data transfer protocols allowing machines to communicate, but they work differently.” “TCP keeps track of every packet of data sent and ensures that they are reliably transferred by requiring the receiver to confirm reception of every single one of them and the sender to resend those that were lost. UDP on the other hand, doesn’t handle packet loss. While it is less reliable, it is preferable in applications such as media streaming because the data is time sensitive. In those cases, a lost packet will simply cause a small video or audio glitch and waiting for it to be resent would make it worse than simply moving on to the following bits. In the case of data transfer however, a single lost packet can corrupt a whole file and reliability is therefore more important than timeliness, which is why TCP is more suited for this application.”
Linphone Development and support available from Belledonne-communications, a company based in Bordeaux, France.
Linphone desktop is programmed mostly in C++ the sdk has some java code in it.
The issue is that the desktop client requires a mobile phone with camera to be started. As of January 2020 I still use a nokia 3010 phone. I cannot install the signal application on that phone and this means that I cannot use signal on my desktop.
https://www.city-journal.org/article/signals-katherine-maher-problem
“One person who has worked extensively with OTF but asked to remain anonymous told me that, over time, it became increasingly clear “that the project was actually a State Department-connected initiative that planned to wield open source Internet projects made by hacker communities as tools for American foreign policy goals”—including by empowering “activists [and] parties opposed to governments that the USA doesn’t like.” Whatever the merits of such efforts, the claim—if true—suggests a government involvement with Signal that deserves more scrutiny.”
“The other potential problem is the Signal Foundation’s current chairman of the board, Katherine Maher, who started her career as a U.S.-backed agent of regime change. During the Arab Spring period, for instance, Maher ran digital-communications initiatives in the Middle East and North Africa for the National Democratic Institute, a largely government-funded organization that works in concert with American foreign policy campaigns. Maher cultivated relationships with online dissidents and used American technologies to advance the interests of U.S.-supported Color Revolutions abroad.”
“Maher then became CEO of the Wikimedia Foundation in 2016, and, earlier this year, was named CEO of National Public Radio.”
Skype was purchased by Microsoft. Screen sharing has a poor quality on Linux desktop.
How to transfer credits and contacts to another skype account
Teams is a Microsoft product based on Skype. It has a development version that runs on Debian Linux desktop computers.
Side note: I use second-hand laptop computers with open source software on them. They cost less than a fifth of new computers and I run them for years. Running the latest version of Microsoft windows is generally not possible or becomes very slow on old hardware. In fact companies that rely on Microsoft OS have a different world-view since the heavy requirements of Windows, leads to planed obsolescence.
See also the Teams section in the debian page.
Issue when logging in teams in Firefox. Adding the following to your browser security settings https://learn.microsoft.com/en-us/microsoftteams/troubleshoot/teams-sign-in/sign-in-loop#resolution
Issue when logging in teams from an external organization, if you have an account at that organization, then it requires a login.
Another chat application.
See the security section at https://en.wikipedia.org/wiki/Telegram_(software)#Security
See also the Facebook Meta section.
Short message to friends:
I don’t use Whatsapp for ethical reasons, because of the Cambridge Analytica scandal and the risk posed by Facebook’s extensive use of personal data and social connections to sell not only advertisement but also political influence. Whatsapp users give away their metadata, such as their location, the date of call with each contact and their duration. This metadata describes every users preferences within its social graph. As Whatsapps user base grows, it makes the social graph available for a better fit of the machine learning models that influence our decision making. These rather simple models feed us with information and optimise the effect that this information has on shifting the needle of a purchasing decision or a voting decision. Facebook has billions of users. Among them there are several hundred users similar to us. The information that was the most effective at influencing their decision will be shown to us first. The models are driven to optimize viewing time and engagement, as a result, controversial or shocking news will be shown more often. The use of these models becomes unethical when misleading or false information is propagated within the network. Facebook provides the infrastructure and sells the users metadata necessary for these advertisement models to operate within our societies. It has been accused by multiple jurisdictions in the US and in Europe of not putting sufficient safeguards in place to avoid the oversized influence of misleading actors. Already in many developing countries, Facebook is gaining more revenue from political campaign funds than from advertisement.
Why you should switch to signal or telegram (2018):
” A lot of people wondered why would a company such as Facebook pay so much money to acquire a company such as WhatsApp, which had absolutely no way of making money, yet. The (not so and subtly) obviously answer was, WhatsApp had collected a lot of user data, and that’s precious to the Gollum that is Facebook.”
Whatsapp betrayed its user by sharing contact details with FaceBook for advertisement purposes:
“Today, we know that there’s a separate WhatsApp app for businesses. And now there are also reports that WhatsApp will soon start showing ads in users’ statuses, and in other places within the app ([1][2][3 BBC]). What this means is that WhatsApp and Facebook will start tracking everything you do on your phone to tailor ads to you. They will see your contacts list (which they already are, actually). This is a clear betrayal, for many users.”
Federal trade Commission FTC Alleges Facebook Resorted to Illegal Buy-or-Bury Scheme to Crush Competition https://www.ftc.gov/news-events/news/press-releases/2021/08/ftc-alleges-facebook-resorted-illegal-buy-or-bury-scheme-crush-competition-after-string-failed
“Agency’s amended complaint details how the monopolist survived existential threats by illegally acquiring innovative competitors and burying successful app developers”
A question I wrote, with answers about a native install How to use webex from Debian Linux
Webex test meeting https://www.webex.com/test-meeting.html
Some conversations and related data need to remain private.
How to use GPG to encrypt stuff
“Suppose Alice wants to send a message to Bob. Alice will encrypt Bob’s message using Bob’s public key. This ensures that no one else other than Bob can read the message, because only Bob can decrypt the message using his private key. Anyone with Bob’s public key encrypt a message that only Bob can view. This explanation should also explain why Bob must guard his private key - because anyone with his private key can decrypt any message encrypted using his public key.”
“Now, Alice has guaranteed that whatever message she sends to Bob can only be viewed by Bob. This ensures the privacy of the message.”
“However, anyone with Bob’s public key can send a message intended for him. How can Bob ensure that when Alice says she sent him a message, that the message is from Alice and not from someone else?”
“This is where signatures come in. Alice can generate a file containing the checksum of the original, plaintext message and sign that file using her private key. Anyone who has Alice’s public key (and trusts her public key) can verify the authenticity of that file, because to generate that signature, Alice’s private key is required. Assuming that Alice’s private key has not been compromised, it is pretty much impossible for anyone to forge the signature, or for Alice to deny that she did not generate the signature. This ensures the authenticity of the message, that it is indeed sent by Alice herself and not anyone else.”
“PGP conflates non-repudiation and authentication.
“I send Bob an encrypted message that we should meet to discuss the suppression of free speech in our country. Bob obviously wants to be sure that the message is coming from me, but maybe Bob is a spy … and with PGP the only way the message can easily be authenticated as being from me is if I cryptographically sign the message, creating persistent evidence of my words not just to Bob but to Everyone!”
“OTR has introduced deniable authentication to address this problem and many next generation tools have adopted that concept. OTR cryptographically allows two people to be sure who they are talking to, yet they cannot prove it to anybody else.”
Efail Usenix conference paper Efail: Breaking S/MIME and OpenPGP Email Encryptionusing Exfiltration Channels.
The PGP problem mentions age as a potential alternative.
“It’s time for PGP to die.”
https://en.wikipedia.org/wiki/XY_problem
“situations where the question is about an end user’s attempted solution (X) rather than the root problem itself (Y or Why?).”
“The solution for the support personnel is to ask probing questions as to why the information is needed in order to identify the root problem Y and redirect the end user away from an unproductive path of inquiry.”
I have noticed that those probing question can be frustrating to the user. I asked you a question, why do you ask me another question instead of providing a direct answer?
Related links:
http://www.catb.org/~esr/faqs/smart-questions.html
“Ask probing questions to elicit more details. If you’re good at this, the querent will learn something — and so might you. Try to turn the bad question into a good one; remember we were all newbies once.”
tbm=isch argument https://www.google.com/search?q=cobwood+houses&tbm=ischeff.org surveillance self defence
Gmail large attachements
Social Media
Social media “facilitate controlled experimentation”. When you use social media, you subject yourself to experimentation and behaviour modification.
Facebook now Meta
Facebook–Cambridge Analytica data scandal
2021 Facebook leak
Facebook Extended API https://arstechnica.com/gadgets/2024/03/netflix-ad-spend-led-to-facebook-dm-access-end-of-facebook-streaming-biz-lawsuit/
Facebook let Netflix see user DMs, quit streaming to keep Netflix happy (arstechnica.com) https://news.ycombinator.com/item?id=39858850
Meta tolerates rampant ad fraud from China to safeguard billions in revenue
https://www.reddit.com/r/technology/comments/1pn6yg5/meta_tolerates_rampant_ad_fraud_from_china_to/
Twitter now X
In 2023, it’s not possible to view twitter without an account any more. Twitter has become a closed silo like Facebook.