diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 26edc9ac..6d99dc1b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -176,6 +176,24 @@ jobs:
run: |
eval ./run.sh --build --lang=${{ inputs.lang }} "$EXTRA_FLAGS"
+ - name: Run index-generation.sh for top posts
+ if: inputs.lang == 'en'
+ run: |
+ bash index-generation.sh \
+ --source='https://discuss.privacyguides.net/top.json?period=weekly' \
+ --tag="top posts" \
+ --destination="./site/en/index.html" \
+ --count=3
+
+ - name: Run index-generation.sh for latest posts
+ if: inputs.lang == 'en'
+ run: |
+ bash index-generation.sh \
+ --source='https://discuss.privacyguides.net/latest.json' \
+ --tag="latest posts" \
+ --destination="./site/en/index.html" \
+ --count=12
+
- name: Package Website
run: |
tar -czf site-${{ inputs.config }}-${{ inputs.lang }}.tar.gz site
diff --git a/.github/workflows/publish-pr.yml b/.github/workflows/publish-pr.yml
index ea72a727..569b0c7b 100644
--- a/.github/workflows/publish-pr.yml
+++ b/.github/workflows/publish-pr.yml
@@ -148,6 +148,5 @@ jobs:
| 🔨 Latest commit | ${{ needs.metadata.outputs.sha }} |
| 😎 Preview | ${{ env.address }} |
- Please note that this preview was built from an untrusted source, so it was not granted access to all mkdocs-material features.
- Maintainers should ensure this PR has been reviewed locally with a full build before merging.
+ Please note that this preview was built from an untrusted source, so it was not granted access to all mkdocs-material features. Maintainers should ensure this PR has been reviewed locally with a full build before merging.
comment_tag: deployment
diff --git a/.github/workflows/update-discussions.yml b/.github/workflows/update-discussions.yml
new file mode 100644
index 00000000..226d714e
--- /dev/null
+++ b/.github/workflows/update-discussions.yml
@@ -0,0 +1,82 @@
+# Copyright (c) 2024 Jonah Aragon
+
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+
+name: 🔄 Update Discussions
+
+on:
+ workflow_dispatch:
+ schedule:
+ - cron: "*/30 * * * *"
+
+permissions:
+ contents: read
+
+jobs:
+ generate:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ environment:
+ name: production
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: "false"
+ fetch-depth: 1
+
+ - name: Create site/en directory
+ run: mkdir -p site/en
+
+ - name: Update Discussions
+ uses: yakubique/minio-download@v1.1.1
+ with:
+ endpoint: https://${{ vars.PROD_GARAGE_HOSTNAME }}
+ access_key: ${{ secrets.PROD_GARAGE_KEY_ID }}
+ secret_key: ${{ secrets.PROD_GARAGE_SECRET_KEY }}
+ bucket: ${{ vars.PROD_GARAGE_BUCKET }}
+ source: /en/index.html
+ target: ./site/en/
+
+ - name: Run index-generation.sh for top posts
+ run: |
+ bash index-generation.sh \
+ --source='https://discuss.privacyguides.net/top.json?period=weekly' \
+ --tag="top posts" \
+ --destination="./site/en/index.html" \
+ --count=3
+
+ - name: Run index-generation.sh for latest posts
+ run: |
+ bash index-generation.sh \
+ --source='https://discuss.privacyguides.net/latest.json' \
+ --tag="latest posts" \
+ --destination="./site/en/index.html" \
+ --count=12
+
+ - name: Upload modified index
+ uses: yakubique/minio-upload@v1.1.3
+ with:
+ endpoint: https://${{ vars.PROD_GARAGE_HOSTNAME }}
+ access_key: ${{ secrets.PROD_GARAGE_KEY_ID }}
+ secret_key: ${{ secrets.PROD_GARAGE_SECRET_KEY }}
+ bucket: ${{ vars.PROD_GARAGE_BUCKET }}
+ source: ./site/en/index.html
+ target: /en
diff --git a/README.md b/README.md
index 44f6253a..f878f662 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,9 @@
-
diff --git a/blog/.authors.yml b/blog/.authors.yml
index 6425d0f2..c97d1110 100644
--- a/blog/.authors.yml
+++ b/blog/.authors.yml
@@ -23,6 +23,11 @@ authors:
name: Freddy
description: Team Member
avatar: https://github.com/freddy-m.png
+ mastodon:
+ username: freddy
+ instance: social.lol
+ twitter: m00ws
+ bluesky: freddy.lol
jonah:
name: Jonah Aragon
description: Project Director
@@ -31,6 +36,7 @@ authors:
username: jonah
instance: neat.computer
twitter: jonaharagon
+ bluesky: jonaharagon.com
kaitebay:
name: Kai Tebay
description: Former Team Member
diff --git a/blog/assets/images/pwa-vs-iwa/iwa-diagram.png b/blog/assets/images/pwa-vs-iwa/iwa-diagram.png
new file mode 100644
index 00000000..a8d4b8c9
Binary files /dev/null and b/blog/assets/images/pwa-vs-iwa/iwa-diagram.png differ
diff --git a/blog/author/jonah.md b/blog/author/jonah.md
index 19eea7f3..639faa41 100644
--- a/blog/author/jonah.md
+++ b/blog/author/jonah.md
@@ -34,3 +34,4 @@ schema:
He is also known for his work on the Techlore YouTube channel, including the Techlore Talks podcast he co-hosts.
[:simple-mastodon: @jonah@neat.computer](https://mastodon.neat.computer/@jonah "@jonah@neat.computer"){ .md-button rel=me }
+[:simple-bluesky: @jonaharagon.com](https://bsky.app/profile/jonaharagon.com "@jonaharagon.com"){ .md-button rel=me }
diff --git a/blog/posts/pwa-vs-iwa.md b/blog/posts/pwa-vs-iwa.md
new file mode 100644
index 00000000..28d0d5d5
--- /dev/null
+++ b/blog/posts/pwa-vs-iwa.md
@@ -0,0 +1,45 @@
+---
+date:
+ created: 2024-11-30
+categories:
+ - Opinion
+authors:
+ - fria
+tags:
+ - PWA
+ - IWA
+ - Web
+license: BY-SA
+---
+# State of the Web App: Current Woes and Promising Futures
+
+The concept of a [progressive web app](https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps) is enticing: an application using web technologies that is inherently cross platform (since it runs in a browser) and acts like a native app, even functioning offline. Support for PWAs in traditionally locked-down platforms like iOS means that PWAs can give users the freedom to install apps without having to go through Apple’s App Store. But there are problems with web content that PWAs haven't solved.
+
+## Current Web-Based Apps
+
+Attempts at similar things have been made before, the most infamous of which is [Electron](https://www.electronjs.org). Electron is a software framework that allows developers to easily create cross-platform apps by essentially bundling an entire Chromium browser in with the app. This approach has its [drawbacks](https://usa.kaspersky.com/blog/electron-framework-security-issues/28952/?srsltid=AfmBOor_UcYY-84soHz5K2ULTmhlX44-DsIfJp_StotBrusD63MweSGO), though. Browsers have huge attack surface so it's important to keep them updated with the latest security fixes, but many Electron apps ship outdated versions, leaving those apps vulnerable. Each Electron app has its own version of Chromium with its own attack surface, amounting to a performance and security nightmare. In contrast, PWAs use the browser that you already have installed, so as long as you keep it updated, all your apps will have the latest security fixes.
+
+So why isn't every Electron app shipping as a PWA? The answer is an age-old problem with web content: the fact that you have to trust the server fully. You make an HTML GET request and you're served the content (i.e., the site's HTML, CSS, and JavaScript), but if the server is compromised, you'll be served a compromised website. You also need to rely on the security of DNS name resolution and the [certificate authority](https://www.digicert.com/blog/what-is-a-certificate-authority) system. This is a huge problem for security-sensitive applications like messengers. An attacker that gains access to their server—even just temporarily—could distribute compromised clients to millions of people, potentially breaking E2EE or executing a host of other malicious actions.
+
+## Improving Web Apps
+
+A typical native app is downloaded onto your computer from some kind of trusted place like an app store and only receives updates when the developers push them out. Additionally, there's usually a process of checks and verification before that happens, like Apple's [App Review](https://developer.apple.com/distribute/app-review) and the Google Play [App Review](https://support.google.com/googleplay/android-developer/answer/9859455) process. In contrast to PWAs, with which the threat of an attacker with server access constantly looms, it's much more difficult to target a particular person. In other words, a malicious app update is much less likely to escape scrutiny than a highly targeted attack via compromised servers.
+
+Isolated Web Apps (IWAs) build on the work done on PWAs and [Web Packaging](https://github.com/WICG/webpackage). They are a specification that allows web content to be distributed offline outside of a browser, much like a traditional app. It can be signed just like a regular app too, allowing you to verify that it came from the proper place and hasn't been modified. You could install an IWA from your favorite app store just like any other app and have the same security assurances. This would be incredibly useful in allowing for cross-platform E2EE web apps that don't need to trust a server every time you use them.
+
+Google [distinguishes](https://chromeos.dev/en/web/isolated-web-apps) between the drive by web, PWAs, and IWAs. The drive by web requires more conservative access to the system as the most accessible and is therefore least trusted. PWAs are a bit more trusted and can integrate a bit more deeply into the system as a result. IWAs are the most trusted and, as such, can have deeper access into the system and more powerful capabilities.
+
+
+ 
+ source: chromeos.dev
+
+
+This higher security assurance from isolated and signed web applications and the inherently more trusted nature of a natively installed app will allow for IWAs to safely access APIs which wouldn't be safe to allow normal websites to access, like [Direct Sockets](https://github.com/WICG/direct-sockets/blob/main/docs/explainer.md).
+
+IWAs use a totally new [URL scheme](https://github.com/WICG/isolated-web-apps/blob/main/Scheme.md) since they're not relying on HTTPS certificate authorities or DNS. They're totally isolated from each other and the web using enforced Content Security Policy and Cross-Origin Isolation, hence the name.
+
+## Issues
+
+The [Worldwide Web Consortium](https://www.w3.org) currently has an open issue on their GitHub for IWAs with some interesting discussions that are worth checking out. There are some [criticisms](https://github.com/w3ctag/design-reviews/issues/842#issuecomment-1989631915) of IWAs, at least in their current form. A big point of contention is giving IWAs access to more powerful features like raw TCP and UDP socket access, similar to what a natively installed app might be able to do, which Martin Thomson at Mozilla argues is dangerous even with user consent. Martin wrote a nice in-depth [article](https://lowentropy.net/posts/bundles) on bundling web content that's worth checking out on their website. It'll be a long process of iterating on the design before a version of this idea that's secure and available across browsers.
+
+Right now, Chrome ships the feature [enabled by default](https://chromestatus.com/feature/5146307550248960) but only on ChromeOS for admin-controlled machines and select development partners of Google. Safari and Firefox haven't implemented the feature, with [Firefox](https://github.com/mozilla/standards-positions/issues/799#issuecomment-2342084330) taking a stance against it. Perhaps in its trial run, the technology will prove its potential, or maybe IWAs aren't the best solution after all and another attempt at improving web apps will come along. I'll be watching with great interest either way.
diff --git a/docs/ai-chat.md b/docs/ai-chat.md
new file mode 100755
index 00000000..4e09b4f3
--- /dev/null
+++ b/docs/ai-chat.md
@@ -0,0 +1,188 @@
+---
+meta_title: "Recommended AI Chat: Private ChatGPT Alternatives - Privacy Guides"
+title: "AI Chat"
+icon: material/assistant
+description: Unlike OpenAI's ChatGPT and its Big Tech competitors, these AI tools run locally so your data never leaves your desktop device.
+cover: ai-chatbots.webp
+---
+Protects against the following threat(s):
+
+- [:material-server-network: Service Providers](basics/common-threats.md#privacy-from-service-providers){ .pg-teal }
+- [:material-account-cash: Surveillance Capitalism](basics/common-threats.md#surveillance-as-a-business-model){ .pg-brown }
+- [:material-close-outline: Censorship](basics/common-threats.md#avoiding-censorship){ .pg-blue-gray }
+
+Since the release of ChatGPT in 2022, interactions with Large Language Models (LLMs) have become increasingly common. LLMs can help us write better, understand unfamiliar subjects, or answer a wide range of questions. They can statistically predict the next word based on a vast amount of data scraped from the web.
+
+## Privacy Concerns About LLMs
+
+Data used to train AI models, however, includes a massive amount of publicly available data scraped from the web, which can include sensitive information like names and addresses. Cloud-based AI software often [collects your inputs](https://openai.com/policies/row-privacy-policy), meaning your chats are not private from them. This practice also introduces a risk of data breaches. Furthermore, there is a real possibility that an LLM will leak your private chat information in future conversations with other users.
+
+If you are concerned about these practices, you can either refuse to use AI, or use [truly open-source models](https://proton.me/blog/how-to-build-privacy-first-ai) which publicly release and allow you to inspect their training datasets. One such model is [OLMoE](https://allenai.org/blog/olmoe-an-open-small-and-state-of-the-art-mixture-of-experts-model-c258432d0514) made by [Ai2](https://allenai.org/open-data).
+
+Alternatively, you can run AI models locally so that your data never leaves your device and is therefore never shared with third parties. As such, local models are a more private and secure alternative to cloud-based solutions and allow you to share sensitive information to the AI model without worry.
+
+## AI Models
+
+### Hardware for Local AI Models
+
+Local models are also fairly accessible. It's possible to run smaller models at lower speeds on as little as 8GB of RAM. Using more powerful hardware such as a dedicated GPU with sufficient VRAM or a modern system with fast LPDDR5X memory offers the best experience.
+
+LLMs can usually be differentiated by the number of parameters, which can vary between 1.3B to 405B for open-source models available for end users. For example, models below 6.7B parameters are only good for basic tasks like text summaries, while models between 7B and 13B are a great compromise between quality and speed. Models with advanced reasoning capabilities are generally around 70B.
+
+For consumer-grade hardware, it is generally recommended to use [quantized models](https://huggingface.co/docs/optimum/en/concept_guides/quantization) for the best balance between model quality and performance. Check out the table below for more precise information about the typical requirements for different sizes of quantized models.
+
+| Model Size (in Parameters) | Minimum RAM | Minimum Processor |
+|---|---|---|
+| 7B | 8GB | Modern CPU (AVX2 support) |
+| 13B | 16GB | Modern CPU (AVX2 support) |
+| 70B | 72GB | GPU with VRAM |
+
+To run AI locally, you need both an AI model and an AI client.
+
+### Choosing a Model
+
+There are many permissively licensed models available to download. [Hugging Face](https://huggingface.co/models) is a platform that lets you browse, research, and download models in common formats like [GGUF](https://huggingface.co/docs/hub/en/gguf). Companies that provide good open-weights models include big names like Mistral, Meta, Microsoft, and Google. However, there are also many community models and 'fine-tunes' available. As mentioned above, quantized models offer the best balance between model quality and performance for those using consumer-grade hardware.
+
+To help you choose a model that fits your needs, you can look at leaderboards and benchmarks. The most widely-used leaderboard is the community-driven [LM Arena](https://lmarena.ai). Additionally, the [OpenLLM Leaderboard](https://huggingface.co/spaces/open-llm-leaderboard/open_llm_leaderboard) focuses on the performance of open-weights models on common benchmarks like [MMLU-Pro](https://arxiv.org/abs/2406.01574). There are also specialized benchmarks which measure factors like [emotional intelligence](https://eqbench.com), ["uncensored general intelligence"](https://huggingface.co/spaces/DontPlanToEnd/UGI-Leaderboard), and [many others](https://www.nebuly.com/blog/llm-leaderboards).
+
+## AI Chat Clients
+
+| Feature | [Kobold.cpp](#koboldcpp) | [Ollama](#ollama-cli) | [Llamafile](#llamafile) |
+|---|---|---|---|
+| GPU Support | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-check:{ .pg-green } |
+| Image Generation | :material-check:{ .pg-green } | :material-close:{ .pg-red } | :material-close:{ .pg-red } |
+| Speech Recognition | :material-check:{ .pg-green } | :material-close:{ .pg-red } | :material-close:{ .pg-red } |
+| Auto-download Models | :material-close:{ .pg-red } | :material-check:{ .pg-green } | :material-alert-outline:{ .pg-orange } Few models available |
+| Custom Parameters | :material-check:{ .pg-green } | :material-close:{ .pg-red } | :material-check:{ .pg-green } |
+| Multi-platform | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-alert-outline:{ .pg-orange } Size limitations on Windows |
+
+### Kobold.cpp
+
+
+
+{align=right}
+
+Kobold.cpp is an AI client that runs locally on your Windows, Mac, or Linux computer. It's an excellent choice if you are looking for heavy customization and tweaking, such as for role-playing purposes.
+
+In addition to supporting a large range of text models, Kobold.cpp also supports image generators such as [Stable Diffusion](https://stability.ai/stable-image) and automatic speech recognition tools such as [Whisper](https://github.com/ggerganov/whisper.cpp).
+
+[:octicons-home-16: Homepage](https://github.com/LostRuins/koboldcpp){ .md-button .md-button--primary }
+[:octicons-info-16:](https://github.com/LostRuins/koboldcpp/wiki){ .card-link title="Documentation" }
+[:octicons-code-16:](https://github.com/LostRuins/koboldcpp){ .card-link title="Source Code" }
+[:octicons-lock-16:](https://github.com/LostRuins/koboldcpp/blob/2f3597c29abea8b6da28f21e714b6b24a5aca79b/SECURITY.md){ .card-link title="Security Policy" }
+
+
+Downloads
+
+- [:fontawesome-brands-windows: Windows](https://github.com/LostRuins/koboldcpp/releases)
+- [:simple-apple: macOS](https://github.com/LostRuins/koboldcpp/releases)
+- [:simple-linux: Linux](https://github.com/LostRuins/koboldcpp/releases)
+
+
+
+
+
+
+
Compatibility Issues
+
+Kobold.cpp might not run on computers without AVX/AVX2 support.
+
+
+
+Kobold.cpp allows you to modify parameters such as the AI model temperature and the AI chat's system prompt. It also supports creating a network tunnel to access AI models from other devices such as your phone.
+
+### Ollama (CLI)
+
+
+
+{align=right}
+
+Ollama is a command-line AI assistant that is available on macOS, Linux, and Windows. Ollama is a great choice if you're looking for an AI client that's easy-to-use, widely compatible, and fast due to its use of inference and other techniques. It also doesn't involve any manual setup.
+
+In addition to supporting a wide range of text models, Ollama also supports [LLaVA](https://github.com/haotian-liu/LLaVA) models and has experimental support for Meta's [Llama vision capabilities](https://huggingface.co/blog/llama32#what-is-llama-32-vision).
+
+[:octicons-home-16: Homepage](https://ollama.com){ .md-button .md-button--primary }
+[:octicons-info-16:](https://github.com/ollama/ollama#readme){ .card-link title="Documentation" }
+[:octicons-code-16:](https://github.com/ollama/ollama){ .card-link title="Source Code" }
+[:octicons-lock-16:](https://github.com/ollama/ollama/blob/a14f76491d694b2f5a0dec6473514b7f93beeea0/SECURITY.md){ .card-link title="Security Policy" }
+
+
+Downloads
+
+- [:fontawesome-brands-windows: Windows](https://ollama.com/download/windows)
+- [:simple-apple: macOS](https://ollama.com/download/mac)
+- [:simple-linux: Linux](https://ollama.com/download/linux)
+
+
+
+
+
+Ollama simplifies the process of setting up a local AI chat by downloading the AI model you want to use automatically. For example, running `ollama run llama3.2` will automatically download and run the Llama 3.2 model. Furthermore, Ollama maintains their own [model library](https://ollama.com/library) where they host the files of various AI models. This ensures that models are vetted for both performance and security, eliminating the need to manually verify model authenticity.
+
+### Llamafile
+
+
+
+{align=right}
+
+Llamafile is a lightweight single-file executable that allows users to run LLMs locally on their own computers without any setup involved. It is [backed by Mozilla](https://hacks.mozilla.org/2023/11/introducing-llamafile) and available on Linux, macOS, and Windows.
+
+Llamafile also supports LLaVA. However, it doesn't support speech recognition or image generation.
+
+[:octicons-home-16: Homepage](https://github.com/Mozilla-Ocho/llamafile){ .md-button .md-button--primary }
+[:octicons-info-16:](https://github.com/Mozilla-Ocho/llamafile#llamafile){ .card-link title="Documentation" }
+[:octicons-code-16:](https://github.com/Mozilla-Ocho/llamafile){ .card-link title="Source Code" }
+[:octicons-lock-16:](https://github.com/Mozilla-Ocho/llamafile#security){ .card-link title="Security Policy" }
+
+
+Downloads
+
+- [:fontawesome-solid-desktop: Desktop](https://github.com/Mozilla-Ocho/llamafile#quickstart)
+
+
+
+
+
+Mozilla has made llamafiles available for only some Llama and Mistral models, while there are few third-party llamafiles available. Moreover, Windows limits `.exe` files to 4GB, and most models are larger than that.
+
+To circumvent these issues, you can [load external weights](https://github.com/Mozilla-Ocho/llamafile#using-llamafile-with-external-weights).
+
+## Securely Downloading Models
+
+If you use an AI client that maintains their own library of model files (such as [Ollama](#ollama-cli) and [Llamafile](#llamafile)), you should download it from there. However, if you want to download models not present in their library, or use an AI client that doesn't maintain its library (such as [Kobold.cpp](#koboldcpp)), you will need to take extra steps to ensure that the AI model you download is safe and legitimate.
+
+We recommend downloading model files from Hugging Face since it provides several features to verify that your download is genuine and safe to use.
+
+To check the authenticity and safety of the model, look for:
+
+- Model cards with clear documentation
+- A verified organization badge
+- Community reviews and usage statistics
+- A "Safe" badge next to the model file (Hugging Face only)
+- Matching checksums[^1]
+ - On Hugging Face, you can find the hash by clicking on a model file and looking for the **Copy SHA256** button below it. You should compare this checksum with the one from the model file you downloaded.
+
+A downloaded model is generally safe if it satisfies all of the above checks.
+
+## Criteria
+
+Please note we are not affiliated with any of the projects we recommend. In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project and conduct your own research to ensure it's the right choice for you.
+
+### Minimum Requirements
+
+- Must be open-source.
+- Must not transmit personal data, including chat data.
+- Must be multi-platform.
+- Must not require a GPU.
+- Must have support for GPU-powered fast inference.
+- Must not require an internet connection.
+
+### Best-Case
+
+Our best-case criteria represent what we *would* like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
+
+- Should be easy to download and set up, e.g. with a one-click install process.
+- Should have a built-in model downloader option.
+- The user should be able to modify the LLM parameters, such as its system prompt or temperature.
+
+[^1]: A file checksum is a type of anti-tampering fingerprint. A developer usually provides a checksum in a text file that can be downloaded separately, or on the download page itself. Verifying that the checksum of the file you downloaded matches the one provided by the developer helps ensure that the file is genuine and wasn't tampered with in transit. You can use commands like `sha256sum` on Linux and macOS, or `certutil -hashfile file SHA256` on Windows to generate the downloaded file's checksum.
diff --git a/docs/android/obtaining-apps.md b/docs/android/obtaining-apps.md
index 7f60cd49..f50b8dc7 100644
--- a/docs/android/obtaining-apps.md
+++ b/docs/android/obtaining-apps.md
@@ -114,9 +114,9 @@ If you download APK files to install manually, you can verify their signature wi
Due to their process of building apps, apps in the *official* F-Droid repository often fall behind on updates. F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust. Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk).
-Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from GitHub and is the next best thing to the developers' own repositories. However, it is not something that we can fully recommend, as apps are typically [removed](https://github.com/vfsfitvnm/ViMusic/issues/240#issuecomment-1225564446) from that repository if they are later added to the main F-Droid repository. While that makes sense (since the goal of that particular repository is to host apps before they're accepted into the main F-Droid repository), it can leave you with installed apps which no longer receive updates.
+Other popular third-party repositories for F-Droid such as [IzzyOnDroid](https://apt.izzysoft.de/fdroid) alleviate some of these concerns. The IzzyOnDroid repository pulls builds directly from code forges (GitHub, GitLab, etc.) and is the next best thing to the developers' own repositories. They also offer [reproducible builds](https://android.izzysoft.de/articles/named/iod-rbs-mirrors-clients) for hundreds of applications and have developers who verify the reproducibility of developer-signed APKs. Furthermore, the IzzyOnDroid team conducts [additional security scans](https://android.izzysoft.de/articles/named/iod-scan-apkchecks) of apps housed in the repo, which usually result in [deliberations](https://github.com/gouravkhunger/QuotesApp/issues/22) between them and app developers toward privacy improvements in their apps. Note that apps may be removed from the IzzyOnDroid repo in [certain circumstances](https://gitlab.com/IzzyOnDroid/repo#are-apps-removed-from-the-repo--and-when-does-that-happen).
-That said, the [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be a useful tool to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
+The [F-Droid](https://f-droid.org/en/packages) and [IzzyOnDroid](https://apt.izzysoft.de/fdroid) repositories are home to countless apps, so they can be useful places to search for and discover open-source apps that you can then download through other means such as the Play Store, Aurora Store, or by getting the APK directly from the developer. You should use your best judgment when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
F-Droid Basic
diff --git a/docs/data-broker-removals.md b/docs/data-broker-removals.md
index 131920f3..0d4e8a19 100644
--- a/docs/data-broker-removals.md
+++ b/docs/data-broker-removals.md
@@ -85,8 +85,6 @@ Our testing indicates that EasyOptOuts provides the best value out of any data r
EasyOptOuts does not cover the following sites we consider to be "high priority," so you should still manually opt-out of:
- Intelius ([Search](https://intelius.com), [Opt-Out](https://suppression.peopleconnect.us/login))
-- PeekYou ([Search](https://peekyou.com), [Opt-Out](https://peekyou.com/about/contact/optout))
-- PublicDataUSA ([Search](https://publicdatausa.com), [Opt-Out](https://publicdatausa.com/remove.php))
diff --git a/docs/tools.md b/docs/tools.md
index 28a574b3..7f6eed61 100644
--- a/docs/tools.md
+++ b/docs/tools.md
@@ -364,6 +364,18 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
## Software
+### AI Chat
+
+
+
+[Learn more :material-arrow-right-drop-circle:](ai-chat.md)
+
### Calendar Sync
diff --git a/includes/abbreviations.en.txt b/includes/abbreviations.en.txt
index 03c478c7..4d2f9ada 100644
--- a/includes/abbreviations.en.txt
+++ b/includes/abbreviations.en.txt
@@ -49,6 +49,8 @@
*[ISPs]: Internet Service Providers
*[JNI]: Java Native Interface
*[KYC]: Know Your Customer
+*[LLaVA]: Large Language and Vision Assistant (multimodal AI model)
+*[LLMs]: Large Language Models (AI models such as ChatGPT)
*[LUKS]: Linux Unified Key Setup (Full-Disk Encryption)
*[MAC]: Media Access Control
*[MDAG]: Microsoft Defender Application Guard
@@ -62,6 +64,7 @@
*[OCSP]: Online Certificate Status Protocol
*[OEM]: Original Equipment Manufacturer
*[OEMs]: Original Equipment Manufacturers
+*[open-weights]: An open weights-model is an AI model that anyone can download and use, but for which the underlying training data and/or algorithms are proprietary.
*[OS]: Operating System
*[OTP]: One-Time Password
*[OTPs]: One-Time Passwords
@@ -73,6 +76,7 @@
*[PII]: Personally Identifiable Information
*[QNAME]: Qualified Name
*[QUIC]: A network protocol based on UDP, but aiming to combine the speed of UDP with the reliability of TCP.
+*[rate limits]: Rate limits are restrictions that a service imposes on the number of times a user can access their services within a specified period of time.
*[rolling release]: Updates which are released frequently rather than set intervals
*[RSS]: Really Simple Syndication
*[SELinux]: Security-Enhanced Linux
@@ -86,6 +90,8 @@
*[SaaS]: Software as a Service (cloud software)
*[SoC]: System on Chip
*[SSO]: Single sign-on
+*[system prompt]: The system prompt of an AI chat is the general instructions given by a human to guide how it should operate.
+*[temperature]: AI temperature is a parameter used in AI models to control the level of randomness and creativity in the generated text.
*[TCP]: Transmission Control Protocol
*[TEE]: Trusted Execution Environment
*[TLS]: Transport Layer Security
diff --git a/index-generation.sh b/index-generation.sh
new file mode 100755
index 00000000..89acc744
--- /dev/null
+++ b/index-generation.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+
+DATE_CMD="date"
+
+# Check if the script is running on macOS
+if [[ "$OSTYPE" == "darwin"* ]]; then
+ DATE_CMD="gdate"
+fi
+
+# Defaults
+source="https://discuss.privacyguides.net/top.json?period=weekly"
+tag="top posts"
+destination="./site/en/index.html"
+count=3
+
+for arg in "$@"
+do
+ case $arg in
+ --source=*)
+ source="${arg#*=}"
+ shift
+ ;;
+ --tag=*)
+ tag="${arg#*=}"
+ shift
+ ;;
+ --destination=*)
+ destination="${arg#*=}"
+ shift
+ ;;
+ --count=*)
+ count="${arg#*=}"
+ shift
+ ;;
+ esac
+done
+
+# URL of the Discourse top.json
+DISCOURSE_URL="$source"
+
+# Fetch the JSON data
+json_data=$(curl -s $DISCOURSE_URL)
+
+# Extract the first 3 topics
+topics=$(echo $json_data | jq -r ".topic_list.topics[:$count]")
+
+users=$(echo $json_data | jq -r ".users")
+# Generate HTML for the first 3 posts
+html_output=""
+for row in $(echo "${topics}" | jq -r '.[] | @base64'); do
+ _jq() {
+ echo ${row} | base64 --decode | jq -r ${1}
+ }
+
+ title=$(_jq '.title')
+ id=$(_jq '.id')
+ like_count=$(_jq '.like_count')
+ reply_count=$(_jq '.posts_count')
+ views=$(_jq '.views')
+
+ author_id=$(_jq '.posters[0].user_id')
+ author_info=$(echo "${users}" | jq -r ".[] | select(.id==$author_id)")
+ author_username=$(echo "${author_info}" | jq -r ".username")
+
+ html_output+="