It is not clear that this is the app that will be used for the new watches. I imagine it will support the new RePebble watches, but I believe that app was intended for the original Pebble watches.

The thing that makes it so unclear to me is that this is a repo owned by the Rebble team, not the RePebble team. I do not know how much overlap there is between the two teams, but the RePebble team does not have any open source repos that I could find. Any mention of open source software by RePebble (including the OS) are links to repos owned by other teams, which is a little concerning.

I understand that the watch operating system is open source. However, it seems that the watch will connect to a companion smartphone app. Do you know if the app is a requirement and/or if the app will be open source?

If you know your VPN’s DNS server, you can change your local DNS so that it redirects your specified domains/subdomains to the appropriate, local IP address and all other requests would then use your VPN’s DNS.

If you don’t know your VPN provider’s DNS server information, you may be able to still do something similar to the above depending on your setup. Otherwise, you could run your own DNS resolver or use a different DNS provider. I guess doing so could potentially be used to further fingerprint you, but the concern about “DNS fingerprinting” is moreso DNS leaks where your DNS queries are accessible to unintended parties due to improper configuration.

I believe the only other option would be to change your hosts file on each device you want to use to connect to your services, which is probably not the best approach and may be challenging/impossible for certain devices.

Also, unless you setup the self signed certs to be trusted on a network/domain level (or again on each individual device), you will likely get a warning/error about the self signed certs when accessing your services. You may need to work through this process each time the certs renew.

I recommend buying a domain if you do not already have one and finding a service that provides wildcard certification challenges. This would allow you to setup a valid, trusted certificate that you could reuse for all of your services. The only thing that you would need to provide is an email address (can be any email address) and your domain name (in addition to other information that may be required to setup an account at the cert provider, but you may already have an account there as it could be the domain name registrar or other services like VPS providers, Cloudflare, etc.). Since it is a wildcard cert, each subdomain does not need to be set publicly and if you only use the domain within your network, the domain does not need to be publicly associated with any IP address.

If you do go forward with that approach, you could use the wildcard cert directly within NginxProxyManager or other reverse proxies. They will also automatically update/maintain the cert for you.

There is no one-size-fits-all solution and there likely isn’t a solution that works for everyone even in specific situations due to different threat models. Purchasing and using a custom domain is often listed as a good practice for maintaining a person’s privacy. However, it can be even more detrimental to a person’s privacy than just using a trusted email masking/forwarding service and trusted email provider. For example:

• The domain is purchased without WHOIS protection (or without using non-personal information) or the WHOIS protection is not renewed
• The email server is hosted on hardware that can be linked to other services that identify the individual (eg: the email is self hosted using a home IP address)
• A self hosted email server is configured in a way that leaks information or is configured insecurely
• The email domain is used by only one person, which enables agencies to link each individual, unique email address back to that individual and create an aggregated profile across various accounts/services
• If the domain/DNS is not configured properly (or if the domain is not renewed), then the domain (and thus the email accounts) can be hijacked, which could lead to any additional accounts/services that are still using the domain vulnerable to a take over attack
• The email server is hosted by a privacy invasive company/service
• The person assumes that all emails are private since they use a custom domain on a trusted email provider (or self hosted email server), but continue to send emails containing sensitive information to email accounts running privacy invasive email services (eg: Gmail)

Please note that I am not saying that this is not a good option, but I just wanted to note some of the things that should be considered if a person decides to use a custom email domain to improve their digital privacy.

My beef with them is that they’re either pushed by scammer to empty honest but gullible people’s bank accounts, or they’re used to pay for illegal activities because they’re totally opaque and unregulated.

Scammers also use gift cards, checks, wires, cash, bank accounts, investment funds, and many other means to accomplish this. Several of them are tightly regulated and it does not seem to deter or prevent the scams from occurring.

My other beef is that they’re really securities and they’re not subject to the rules on securities for a reason that totally escapes me.

Admittedly, I am not well versed in this area. Do you foresee a way to properly subject cryptocurrencies to the same/similar regulations as other securities while still providing many/all of cryptocurrencies’ benefits, including anonymity? Are the legitimate cryptocurrency exchanges (eg: Coinbase) not subject to those regulations? How different is this from individuals being taxed on gains/losses from cryptocurrencies?

I don’t do cryptocurrencies both out of self-financial preservation, and also because I refuse to participate - and thus promote - stuff that’s generally bad for society as a whole.

The first part is in relation to investing in cryptocurrency moreso than using cryptocurrency.

What makes cryptocurrency generally bad for society as a whole? While I am not familiar enough with the current estimates, I know there are environmental concerns (eg: water/electricity usage, required hardware, etc.). I concede that the environmental impacts may be (and likely are) worse than traditional fist currencies, I am unaware of other reasons that make cryptocurrency generally bad for society as a whole.

Trump loves em

Many privacy advocates also love cryptocurrency. Two different people or groups of people (no matter how similar or different) can have one or more shared interests, even if the reasons or motivations are drastically different. It is likely best to avoid politics on this topic.

• Edward Snowden Says Use Crypto, Don’t Invest In It
• Edward Snowden Calls Bitcoin Most Significant Monetary Advance Since The Creation Of Coinage

Cryptocurrency

Hard no. I don’t partake in scams, even for the sake of privacy.

Is this in relation to the monetary value of cryptocurrency or the anonymity of cryptocurrency?

The list included cryptocurrency as a channel for anonymous payments, not an investment opportunity. The two cryptocurrencies listed are two of the more well established cryptocurrencies that are more widely accepted than many other cryptocurrencies (granted, one or both of them are still not accepted by a large number of merchants). Additionally, the list also mentions some of the considerations necessary to help ensure the cryptocurrency is obtained anonymously.

If the list only included insert_newly_created_obscure_cryptocurrencies then this would definitely be more concerning.

However, if the cryptocurrency is both obtained and used “properly” where the person is ultimately anonymously exchanging cryptocurrency for a desired good(s) or service(s), is it truly a scam?

Congrats on getting everything working - it looks great!

One piece of (unprovoked, potentially unwanted) advice is to setup SSL. I know you’re running your services behind Wireguard so there isn’t too much of a security concern running your services on HTTP. However, as the number of your services or users (family, friends, etc.) increases, you’re more likely to run into issues with services not running on HTTPS.

The creation and renewal of SSL certificates can be done for free (assuming you have a domain name already) and automatically with certain reverse proxy services like NGINXProxyManager or Traefik, which can both be run in Docker. If you set everything up with a wildcard certificate via DNS challenge, you can still keep the services you run hidden from people scanning DNS records on your domain (ie people won’t know that an SSL certificate was issued for immich.your.domain). How you set up the DNS challenge will vary by the DNS provider and reverse proxy service, but the only additional thing that you will likely need to set up a wildcard challenge, regardless of which services you use, is an email address (again, assuming you have a domain name).