5 ms·

Just this weekend, I setup a domain name, setup email, and setup apps and accounts to replace Google with open-source software and servers I control, generally

Just this weekend, I setup a domain name, setup email, and setup apps and accounts to replace Google with open-source software and servers I control, generally (I use some 3rd party services that I feel I can trust, like Fastmail and Namecheap). I then turned off and deleted all of my data from Google that I could without deleting my Google account (I need to forward this long-standing email to my new email and I don't want to lose my Google Music ratings and playlists right now). It wasn't hard, just about 5 hours of work and then a few hours to set everything up as I like it. I pay ~$5 per month for email/calendar/contacts through Fastmail, ~$10 per year for 2 domains (each), and ~$5 for an Android app to sync my CardDAV/CalDAV accounts with my Android phone. I have almost completely deleted/disabled Google apps on Android, although I'm not ready to run LineageOS quite yet. I even use an OSM-based maps app, which doesn't work as well as Google Maps, but it is sufficient; navigation sucks compared to Google Maps, but that's the price you pay for doing this sort of thing. I'm not super-paranoid about government surveillance and I didn't care about Google tailoring ads to me like most folks here, but after all of the data breaches and such, I decided that controlling my own data is worthwhile just to make me feel better. Now, I am able to do most of the stuff I could do before, maybe 70-80% as good as with Google for some things (like maps), but I have peace of mind.

bpye 8y ago
I've been working my way down this path. Fastmail for email and CalDAV/CardDAV, DavDroid to sync, K9 as my email client, OsmAnd for maps, Firefox instead of Chrome. I try and remember to use SkyTube not YouTube but it isn't flawless. I use KISS as my launcher on Android. I still haven't eliminated Google Photos, I do appreciate the free sync on my Pixel 2 XL for peace of mind, Google Translate is still super useful for offline translate and the camera translate feature and I haven't yet been able to replace Google Maps for transit instructions. I still use a Chromecast which I guess is next to go, maybe I'll actually setup a HTPC of sorts, or perhaps just use Kodi on my Xbox One S as that seems to work well enough.
nashashmi 8y ago
Your security is only guaranteed by your obscurity. The moment this becomes standard practice and people start using popular software to handle personal services, this version of security will become laughable again.
- deleted 8y ago
  [deleted]
- _qbxp 8y ago
  I can understand this position, but I'd be curious what your thoughts are on how to best (I realize there is no perfect) keep your data private from snooping employees, hackers, or law enforcement. I've thought about this over and over, and it's hard to come to a solid conclusion about keeping personal data safe (in this context I mean emails and files you may store in the cloud, not browsing history, social media posts, etc.). There are so many options with downfalls for each, and I'm not a security expert. So every time I get excited about trying a new service geared towards privacy, or setting up my own instances, inevitably somebody points out the terrible pitfall in it and I get discouraged. 1. Don't use the internet or internet services, period. <- Not tenable for most of us. 2. Use services who market themselves as geared towards privacy. <- Can't actually trust those services, even with E2E encryption because they could be running different code from what you think they're running. 3. Use regular cloud options, but stack stuff on top - VeraCrypt volumes or Cryptomator with Google drive, GPG for email, etc. <- Really difficult to setup and have a nice reliable way of accessing data on mobile/desktop/etc. No security audits on a lot of the open source software. 4. Host your own services - i.e. a Nextcloud 14 instance on EC2 with an S3 backend, then use client-side E2E <- Difficult to make sure you set the service up in a safe way, and not even a fraction of as much resources in auditing code as, say, a giant corporation. 5. Spread what you do out over multiple services - FastMail for email, DropBox for cloud storage, Standard Notes for notes, etc. <- A real pain. I know there will never be a consensus on this, but I'd love to hear what your thoughts are on the best way to keep my personal files and notes personal to me. Let's assume I'm not a target of any spy agencies or whatnot, but I want to make it very, very difficult for anyone to read my person notes and files but me.
- Analemma_ 8y ago
  I think even that is being too generous. If you’ve ever set up any kind of public-facing server, no matter how obscure, you know that scans for vulnerabilities are constant. Whoops, you didn’t install that urgent Apache update because you were on vacation with no SSL access? You’re pwned. Centralization does have drawbacks, but it in terms of security it is a major step up from homerun servers in many ways.
envy2 8y ago
Every time I read comments like this, I shake my head. Despite recent breaches, I still trust the big players--Google, FB, Microsoft, etc.--with my data from a security perspective far more than I'd trust myself to be able to manage security properly on my own servers or trust a smaller shop. Security is hard. There are many, many more compromises of small firms and self-maintained servers than of these big players, it's just that they don't get major media coverage in 99% of cases.
- bpye 8y ago
  Yes, I trust Google, Microsoft, Apple, etc with data reasonably. I would however like one breach to not be catastrophic. Also Google discontinuing Inbox made my Fastmail experiement permanent.
- candiodari 8y ago
  The problem is that you need to trust a lot more than just Google. 1) Google 2) Every government that has the power to compel Google to release your private information, from Chile's to the Cayman Islands 3) Every agent empowered by any of the governments from 2) 4) Every person and/or organisation that could be furnished with your data as part of some sort of "discovery" process by any of the agents listed in 3 (for the US: essentially anyone and everyone you've ever had any sort of commercial relationship with) This means that if you, say, have a divorce case, expect your entire Gmail contents to be used against you by your significant other. The problem is well explained here: https://www.stangelawfirm.com/Articles/Facebook-Evidence-and-Divorce/ https://www.stangelawfirm.com/Articles/Facebook-Evidence-and...
  - joshuamorton 8y ago
    >This means that if you, say, have a divorce case, expect your entire Gmail contents to be used against you by your significant other. This has nothing to do with Google. In a divorce case, you would be compelled to disclose your email, not Google, so using another provider wouldn't matter, because you would be compelled to turn over any emails there too.
usuallymatt 8y ago
I've been considering a switch to Fastmail myself and I have a domain on their free trial right now. I'm going to be pulling the trigger end of this month. Only thing that sucks is going and changing my email address everywhere. Like you I'm doing it for piece of mind knowing I can switch providers elsewhere if I need to down the line. I'd rather pay $50US each year then be as tangled up in Google's services as I was.

bpye 8y ago

I've been working my way down this path. Fastmail for email and CalDAV/CardDAV, DavDroid to sync, K9 as my email client, OsmAnd for maps, Firefox instead of Chrome. I try and remember to use SkyTube not YouTube but it isn't flawless. I use KISS as my launcher on Android. I still haven't eliminated Google Photos, I do appreciate the free sync on my Pixel 2 XL for peace of mind, Google Translate is still super useful for offline translate and the camera translate feature and I haven't yet been able to replace Google Maps for transit instructions. I still use a Chromecast which I guess is next to go, maybe I'll actually setup a HTPC of sorts, or perhaps just use Kodi on my Xbox One S as that seems to work well enough.

nashashmi 8y ago

Your security is only guaranteed by your obscurity. The moment this becomes standard practice and people start using popular software to handle personal services, this version of security will become laughable again.

deleted 8y ago
[deleted]
_qbxp 8y ago
I can understand this position, but I'd be curious what your thoughts are on how to best (I realize there is no perfect) keep your data private from snooping employees, hackers, or law enforcement. I've thought about this over and over, and it's hard to come to a solid conclusion about keeping personal data safe (in this context I mean emails and files you may store in the cloud, not browsing history, social media posts, etc.). There are so many options with downfalls for each, and I'm not a security expert. So every time I get excited about trying a new service geared towards privacy, or setting up my own instances, inevitably somebody points out the terrible pitfall in it and I get discouraged. 1. Don't use the internet or internet services, period. <- Not tenable for most of us. 2. Use services who market themselves as geared towards privacy. <- Can't actually trust those services, even with E2E encryption because they could be running different code from what you think they're running. 3. Use regular cloud options, but stack stuff on top - VeraCrypt volumes or Cryptomator with Google drive, GPG for email, etc. <- Really difficult to setup and have a nice reliable way of accessing data on mobile/desktop/etc. No security audits on a lot of the open source software. 4. Host your own services - i.e. a Nextcloud 14 instance on EC2 with an S3 backend, then use client-side E2E <- Difficult to make sure you set the service up in a safe way, and not even a fraction of as much resources in auditing code as, say, a giant corporation. 5. Spread what you do out over multiple services - FastMail for email, DropBox for cloud storage, Standard Notes for notes, etc. <- A real pain. I know there will never be a consensus on this, but I'd love to hear what your thoughts are on the best way to keep my personal files and notes personal to me. Let's assume I'm not a target of any spy agencies or whatnot, but I want to make it very, very difficult for anyone to read my person notes and files but me.
Analemma_ 8y ago
I think even that is being too generous. If you’ve ever set up any kind of public-facing server, no matter how obscure, you know that scans for vulnerabilities are constant. Whoops, you didn’t install that urgent Apache update because you were on vacation with no SSL access? You’re pwned. Centralization does have drawbacks, but it in terms of security it is a major step up from homerun servers in many ways.

envy2 8y ago

Every time I read comments like this, I shake my head. Despite recent breaches, I still trust the big players--Google, FB, Microsoft, etc.--with my data from a security perspective far more than I'd trust myself to be able to manage security properly on my own servers or trust a smaller shop. Security is hard. There are many, many more compromises of small firms and self-maintained servers than of these big players, it's just that they don't get major media coverage in 99% of cases.

bpye 8y ago
Yes, I trust Google, Microsoft, Apple, etc with data reasonably. I would however like one breach to not be catastrophic. Also Google discontinuing Inbox made my Fastmail experiement permanent.
candiodari 8y ago
The problem is that you need to trust a lot more than just Google. 1) Google 2) Every government that has the power to compel Google to release your private information, from Chile's to the Cayman Islands 3) Every agent empowered by any of the governments from 2) 4) Every person and/or organisation that could be furnished with your data as part of some sort of "discovery" process by any of the agents listed in 3 (for the US: essentially anyone and everyone you've ever had any sort of commercial relationship with) This means that if you, say, have a divorce case, expect your entire Gmail contents to be used against you by your significant other. The problem is well explained here: https://www.stangelawfirm.com/Articles/Facebook-Evidence-and-Divorce/ https://www.stangelawfirm.com/Articles/Facebook-Evidence-and...
- joshuamorton 8y ago
  >This means that if you, say, have a divorce case, expect your entire Gmail contents to be used against you by your significant other. This has nothing to do with Google. In a divorce case, you would be compelled to disclose your email, not Google, so using another provider wouldn't matter, because you would be compelled to turn over any emails there too.

usuallymatt 8y ago

I've been considering a switch to Fastmail myself and I have a domain on their free trial right now. I'm going to be pulling the trigger end of this month. Only thing that sucks is going and changing my email address everywhere. Like you I'm doing it for piece of mind knowing I can switch providers elsewhere if I need to down the line. I'd rather pay $50US each year then be as tangled up in Google's services as I was.