The lowest effort VPN guide for newbies

A few friends have asked me for recommendations recently so I thought I would write a guide with recommendations and explain why I chose them.

The recommendations:

  • Vpn.AC – fairly cheap, good speeds, does not spy on you
    • downside: does log time, IP, and bandwidth but not actual traffic
  • Mullvad – fairly cheap, takes antispying very seriously, anonymous payment
    • downside: does not support easy payment such as PayPal. Your best bet is to buy bitcoin, which is easy but an extra step.

The basis of my recommendations:

  • Threat model: Your threat model is the basis of who you are hiding sensitive information from. If you are in a US university they are legally required to log information about the internet traffic you generate, that is, they are mandated to spy on your browsing history, and some people may not like the websites you visit. Even if you are not in a university, internet service providers will soon be allowed legally to sell information about you and your browsing habits to advertisers and that is creepy. Even if you “have nothing to hide” this information is still valuable to bad guys who want to know things like the name of you dog or you mothers maiden name. That information is valuable for password reset security questions and for stealing your identity. This guide should cover most threat models. Personally, my interest in in hiding from advertisers and the government.
  • Is the provider based in a Five Eyes or Seven Eyes country?
    • Five Eyes / Seven Eyes / Fourteen Eyes is an international spying program in which countries spy on their citizens. If the information is stored, it can either be used for immoral purposes or it can be hacked and stolen.
  • Does the provider store logs?
    • if the provider logs things like your IP, the times you were logged into the service, your bandwidth used, or the websites you visit that information could be either sold to creepy advertisers or hacked and used against you. You are paying for the product, you should not also be the product.
  • Does the provider by default put policies into place to avoid leaking data.
    • A misconfigured VPN can leak DNS data, which is the method that your computer translates a domain name (google.com) to an IP address (216.58.193.142). Providers should force DNS data through the VPN so that your university, ISP, or other DNS provider cannot see the websites you visit.
    • Misconfigurations can also leak WebRTC traffic which unmasks a permanent token that can be used to track your web browsing.
  • Do policies require full disclosure?
    • This basically means that the VPN provider will promise to always make a public statement when they receive a legal order for user data, or if they have a security breach.

You can see a huge comparison chart of VPN providers here to see a larger list of issues and providers to do your own research and select your own.

A lot of people missed me after I left, and that was more impactful than I expected.

I recently started an excellent new job in Kansas and I left Ohio for it. During my last week at my old church my leaving was announced and there were quite a few people who wanted to see me one last time to give me well wishes. Even though I had not made an effort there to be well connected with them, they still cared to give me heartfelt goodbyes, capped off with lunch with my Pastor who recommended me an excellent church near my new hometown. I partied with my friends one last time, even having one old friend come that I had fallen off with since finishing highschool.

After leaving I’ve been hearing stories that members of my old church are asking my mother how I am doing to the point that she confided in me that she wishes they would not as their queries remind her that I am no longer there with my family. In my friend groups I am hearing that they are remembering me by trading fun stories of me in my absence.

I expected more to miss my old life there, possibly even to feel remorse for leaving, but in keeping touch with family and closest friends the disconnected feelings are kept far at bay. Still, it gets me that all of these people care so much. I really feel that love. It reminds me of my inability to read people and understand them, but without the typical negative feelings of disconnection and disassociation from people. These feelings allow me to better explore new healthy social connections instead of being mired down in feelings of not being able to form social relationships with people and become a happier person out here in windy Kansas.

Look at this lad. He is happy, excited for his future. This is an accurate representation of me.


Thoughts about my dog dying

I used to have two dogs. One died a few years ago. She just sort of gave up died during the night and passed. I saw her the next morning before going to work and while I was sad, I knew that she was gone and was able to move on.

The second one was put down last week. She spent her last night in the house, I said goodbye to her the next morning, then she was taken off to the vet. I saw the car leave the house, but I didn’t actually see her dead. I think because of that whenever I walk near one of the places she typically lays around at I still expect to see her and want to go over to her to show her some affection on the way to where ever it is that I’m going.  I come home and the first thing i think about is needing to let her out.

I think I see now why funerals have viewings. I had never considered the impact that comes from actually seeing someone who has passed.

New Blog

I used to run this blog on the Ghost platform. I chose Ghost because it did not link to any outside resources, which was important to me at the time because I did not want my users to feel like they were being tracked, now I honestly care a lot less and am leaving anti-tracking practices up to the user. I am still anti-tracking myself, I just dont want to go out of my to stop it for someone else if they can block trackers themselves. I ended up scrapping the Ghost blog because of a very annoying issue related to NPM and pm2 that I didnt care to fix because I wanted to move away from Ghost anyway.

With Ghost, the blog was started with npm start from the ghost dir. To keep Ghost running after closing the shell or rebooting it was recommended to use pm2 to start it. starting Ghost from pm2 would start a different instance that would have different content than what would be seen if Ghost was started with npm. After upgrading, pm2 is not able to start ghost anymore and the blog content is missing. The only thing lost from scrapping the blog are the weekly link dumps, an outdated review of the Plex media server, and a notification that the DEF CON warrant canary was out of date. It was fixed a day later after I alerted someone.

Setting up WordPress was ultimately much easier to complete than Ghost. Node and NPM were a mess that I never want to touch again.

cool

now zaph will stop bothering me

dont let him know i havnt set up ssl yet