Wyrm's Hole

< home | findings | about >

Computers and security

Posted on 2026-08-09

  1. Context
  2. On threat models
  3. Private technologies
    1. Operating system
    2. Web browsing
    3. Instant messaging
    4. Phone
    5. E-mail
    6. Dark net
    7. Firmware and CPUs
  4. Additional ressources
  5. Closing thoughts

Text below might use em dashes (i.e. --). Rest assured, it is still written by a person!

# Context

In those times that I personally find troubling, we're more and more tracked online. We saw the Internet greatest times, and now we can witness its downfall. The situation is more complicated than what will be said in this post, there are many factors which led to the state in which it is today. Needless to say, the decline is not only happening content-wise. In fact, I already find that talking about it as content is pejorative[1]. Anyways.

Another big aspect of the Internet is how communities are built, through online forums, instant messaging services (aka chats), mails, blogs, etc. They've played a huge role in sharing knowledge, helping minorities, getting people to do great things.
However, at the time I'm writing this post, those communities are basically becoming endangered species. Through the end of anonimity online, the emergance of walled gardens, the restrictions imposed onto everyone -- the Internet feels less like a safe place and more like the average corporate building.

With this post, I want to mostly share links and associated simple descriptions to people so they can improve their privacy and security online. We need to build communities which are more resilient and allow anonymity[2].

# On threat models

When searching for different security or privacy focused solutions, you will often encounter the idea of a threat model. The purpose of this post is not to specify an associated threat for every listed item.
To simplify things, in general, every layer of security/privacy comes at the price of convenience. It doesn't have to be that way but it is. Depending on the threats you're facing, you might be willing to give up some simplicity in order to gain more security.
Threat modelling is the "science" of choosing the right tools for the right situation when coming to security. You can always get the top-notch security, but is that necessary?

This list does not assume to answer to a specific threat.

Obligatory XKCD by the way:
A comic with stick figures talking about some very good encrypted computer.The comic presents reality as thugs hitting the person with a $5 wrench.

# Private technologies

Throughout the rest of this post, you can assume the following statements:

Chapters below are given in no particular order.

# Operating system

Probably the most important piece of software on your device. Until recently, people didn't even really think about operating systems. Windows used to be the default choice, it is less and less the case.

Some privacy focused Linux distros are available as well. These are special purposes and should be used if extreme privacy/security is needed:

# Web browsing

Sadly there's less diversity when it comes to web browser compared to operating systems. Even though there are many different browsers, there are only really two different backends: Firefox and Chrome.[3]

Another interesting concept available in browsers is plugins. These have been heavily limited since the extension Manifest V3 for chromium-based browsers, hence the need for alternatives. Note that adding too many extensions produce a unique fingerprint which can be possibly tracked down as well. These mainly add privacy more than security.

# Instant messaging

When it comes to instant messaging -- and more broadly social medias, which I won't cover -- there are notable aspects to consider. These help choose the appropriate platform.

For the following list, a D means Decentralization and a E available E2EE.

# Phone

This section would almost require a separate post, but I figured it's useful enough to be put here as well. This blog isn't security-focused so this might be the only post of the subject, it might as well be as useful as possible.

Phones nowadays are in an even closer ecosystem than computers and it makes it very hard to trust them. Still, there are many softwares being developed today to counter this lack of trust.

First, let's go with OSs. When changing the it there is always a risk that some apps such as banking ones won't work.

The intent of these OSs is generally to "de-google" the phone. Due to the state of the ecosystem, many limitations come with this feature. To install software, there are a few possibilities:

Some apps might require Google Play Services, if you're not on GrapheneOS, try using microG. It is a free software reimplementation of those services.

Finally, here's a list of some applications that can replace those usually provided by Google:

# E-mail

E-mailing is one of the oldeset method of communication available on the Internet. It is used extensively everyday, everywhere, all the time. The hardest thing to find nowadays is good providers, they often aren't free or invite-only.

There's not much to say about providers, I generally take those who are privacy focused. Note that most of them have a far-left connotation, if that's not your thing, skip them. Most of those provide services for non-commercial uses.
You should generally have separated mail addresses for commercial and personal anyways.

As for softwares, there are a few good options available:

# Dark net

Many people I encountered view the "dark net" as something scary and illegal where dangerous things happen. While I can't deny the existence of such content, it's actually a place very similar to the clear net! The main difference between these two is that the clear net relies on the standard internet stack, that is the protocols and means of achieving communication. On the other hand a dark net requires specialized software to decode and interpret the packets received.
There are actually multiple different dark nets, which can be completely separated from the clear one! They often emphasize on anonymity or decentralization.

A comparative table between different privacy networks is provided on I2P's own website. While potentially slightly biased it does list practical and good information.

Tor provides a browser by default while I2P used to work as a proxy or an extension. Know that you can also run a proxy/node yourself. If you'd rather avoid Java for I2P, a daemon known as i2pd is available and written in C++. A rewrite of Tor in Rust known as arti is currently in the making.[6]

# Firmware and CPUs

This category is mostly present for "educational" purposes. If you wish to change your firmware or hardware, do proceed with extreme caution. Some manipulations can brick your computer thus rendering it unusable.

Did you know that your CPU is most likely to run its own little operating system in a weirdly isolated environment? This is called the Intel Managment Engine, a completely opaque and proprietary autonomous subsystem which has the quite unique capability of having more power than your own operating system.
It is present on virtually all Intel chips since August of 2015. While you probably don't have to care about it, it had many security vulnerabilities in the past. Moreover, Intel's requirement of a valid cryptographic signature -- otherwise the computer reboots after 30 seconds -- and unconditional presence of this subsystem, begs many questions.
There exists a tool called me_cleaner whose objective is to reduce Intel ME's impact as much as possible.

The issue of untrusted proprietary blobs persists with BIOS as well. Some alternatives exist which partially or even completely remove proprietary firmware:

If you somewhat do not trust your CPU, prefer more open ISAs such as ARM or RISC-V. x86 is the biggest architecture on desktops and laptops but is deeply proprietary.
If you still do not trust the chip, you can run a softcore on an FPGA. It is basically a chip you can configure on the gate level. It will certainly be slower and more expensive than CPUs, but provides the greatest level of "openness".
If you do not trust your FPGA, you'll have to produce it yourself or inspect it manually. For the latter, great work has been made by bunnie, notably the IRIS Project.[7]

On the topic of trusting, you might not trust your OS because of the sheer size of it. This is especially the case for Linux which is built upon millions of lines of code.
Some OSs such as DuskOS are conceived with the idea that they should be understandable by a single individual. These often provide very unique environments.

# Additional ressources

There are many ressources on the Internet which go into great length about security, privacy, freedom etc.[2] Just to be clear, I do not endose any of their political statement and only provide this list as a mean of finding more information.
While I like redundancy and doing things myself, I do not have the ressources necessary to reproduce all the work done by these people. The primary objective of this post is to give an idea of what is available and the existing issues.

From these few ressources I hope you'll find interesting websites. Click on badges and explore! If you wish me to add more links or replace some of them with better alternatives, tell me.

# Closing thoughts

I hope that with this list you will be able to keep your communications secure and private. You shouldn't have to feel watched every time you try to talk to someone close to you, a member of your community, or other people in general.
Hosting software yourself even using old hardware might be the best way to keep privacy, as long as the communications are properly encrypted. FOSS mainly helps in trusting what's running on your computer.
The hardest part will be to convince people to use potentially less user-friendly alternatives to existing proprietary software.

Generally you'll want to share as little information as possible on the internet and keep multiple separate identities, if you care about privacy a lot. This is doable but requires adaptation and appropriate system configuration.

Stay safe out there! You can share, exploit, and download this post as much as you want. Knowledge needs to be shared.

Have a good rest of your day.

  1. Talking about artists as "content creators" is inherently demeaning to me. While those people are creating art or resources to share with others, reducing that to content classifies it as a commodity. While some people are indeed content creators, it would be wrong to group most people as such. ↩

  2. A lot of people who talk about anonymity also like to talk about free speech and how essential it is. While I can't really disagree, this argument is mostly used to justify hateful and intolerant speeches. Never will I stand with such things. ↩ ↩2

  3. While there are many forks which improve privacy, these actually add so much diversity that it would require its own post. I don't plan on making a comparison of web browsers, plenty of them exist already. ↩

  4. Decentralization often implies that you can host it yourself without too much hassle. ↩

  5. A node is a computer hosting specific Tor software which transmits data to the next node. On a Tor network, not all people participating in this network are nodes. This is actually closer to a client-server model. ↩

  6. I explicitely mention other server softwares because I find it to represent a healthy ecosystem. A single point of failure is to be avoided everywhere and this holds for software development as well. ↩

  7. To be honest, when going to these lengths for privacy, it might be better to not use a computer at all! Still, I wish to provide these options because I find them neat and you might have to use one. ↩

Made by a real human with Zola.