Default threat model: Some malignant demon, who is at once exceedingly potent and deceitful, has employed all his artifice to deceive me

I found the Anarcho-Texh security guide helpful in getting started thinking about this with more nuance. I’m including the link below but here’s a short summary

Are you an: Individual Journalist Targeted Activist

Are you annoying: Random assholes Assholes with resources The State

Each category has bigger security needs on one side and more powerful tools on the other. It’s kind of humbling to realize that I’m just an individual and the NSA has no special interest in me, but that makes me feel better using a separate browser without additional security to shop on sites that block a VPN etc

(Also tbh I’m not sure when this page was last updated and I have no involvement with the org. Just a cool resource)

https://github.com/AnarchoTechNYC/meta/wiki/Persona-based-training-matrix

I once talked with a colleague from the data-analysis field. Apparently the company they work at is somewhat in the legally grey area.

They advised other companies on hiring candidates, by scraping all possible data about them online (which included buying anonymized advertising data and correlating it to all their publically available data and the data from the application). Using that, they claim to predict worker motivation, loyalty, how often they are sick, their political alignment, what their acceptable rate is, if they are going to ask for a raise, how well they work under pressure and much much more.

Since hearing it this has basically become my thread model.

As I am writing this, I realize that it is probably time to delete my Lemmy account and never post here again lol

i'm thinking long term - sure, right now google knowing everything about me isn't dangerous. but if a massive political slide to the right happens in countries that host services, suddenly all the saved data from many years ago can be used against me. and don't fall for the "end to end encrypted" bullshit either - all these services can flip a switch and have your encryption keys instantly. (or, if its an open source app that ACTUALLY keeps keys on the device only, which is extremely rare, it's one update away from happening, and you better read the whole diff every update and compile the app yourself.)

that's why i choose to self host everything. yes there's a risk of being hacked, or installing something malicious because i don't read every diff on every update. but i feel more confortable with it being my own responsibility, and my services are also all on seperate virtual machines to hopefully isolate any breaches.