Add an Invidious instance (https://invidious.snopyta.org/feed/popular)

[youdontneedtoknow22]

I wrote an explanation but everything was removed, because apparently changing the category removes everything you wrote and you never get it back. I'll make it short:
Not all people want to use an App for youtube (especially not on desktop) so recommending an instance would be good. Here's a list with all instances:
https://docs.invidious.io/Invidious-Instances.md

And I would go with https://invidious.snopyta.org/feed/popular as you're already trusting snopyta.org with their DNS server, so I assume you read the privacy policy and found it to be good enough.

[rusty-snake]

I'm against recommending instances as it would mean concentrating more traffic on less servers.

See also privacytools/privacytools.io#2113 (comment).

[TommyTran732]

That link is only there to make it clear what Invidious instances are and what can be used within FreeTube. It is not a recommendation whatsoever.

When you are using Invidious instances, you are just shifting trust from Google to them to not profile you, especially when you log into an account. Shifting trust around when there is a better alternative is not a viable approach, imo.

The whole reason FreeTube is recommended is the fact that you can have your playlist and subscription list stored locally on your computer, so you don't have to trust any third party with that data.

This is also the reason why I did not list PeerTube - you have to log into an instance to have your subscription list and playlist, at which point you are trusting the PeerTube instance operator anyways.

I am still looking for a nice desktop client (like FreeTube) for PeerTube :(

[ItsIgnacioPortal]

Realistically, 1% of people who even see that will investigate what Indivious is. That is not a recommendation. Indivious was essentially removed.

It does not make sense to remove a recommendation on the basis that "trust is shifted to the operators" because then the entire DNS Providers category would have to be removed.

PrivacyGuides is meant to guide the user, not decide for the user. There's no evidence that suggests that Indivious operators are ill intended, so I don't see a reason for removing them from the recommendations.

It should also be noted that indivious can be configured by the user to act as a proxy beetween googlevideo and the browser, further eliminating the chances of Google profiling Indivious users.

^
This also seems to be the consensus on r/privacyguides regarding Indivious

Indivious should be added back-in

[ItsIgnacioPortal]

As @dngray said, on the Indivious recommendation, users should be directed to the instances list to let them pick whichever they want.

[fxbrit]

I agree with @PinkDev1. if you want to use the "shifting trust" argument, then every service running server-side is a no, including ddg, protonmail etc.

• how do you verify what they are running?
• why would you trust ddg more than you trust a peertube operator?
• google aggregates data from all over the internet, I question what a peertube operator might be able to do with your subscription list honestly. what are you trying to defend from?

also, why don't you guys recommend self-hosting? things like invidious, piped, searx etc are meant to be self-hosted, you can suggest the service instead of a certain instance.

[TommyTran732]

1. I totally agree with the DNS providers section needing to be removed/rewritten. I made discussions about removing it, but it got stonewalled. I will bring it up again. It makes 0 sense why we are even shifting trust on DNS around - there is 0 benefits whatsoever. If you are using a VPN, you should only be using DOH/DOT with your VPN provider. If you are not, try to setup DOH/DOT with your ISP first, because they can see whatever website visit regardless of whether you use DOH or DOT with a third party or not. There is no point in trying to hide from them if you are not using a VPN.

2. You cannot verify anything anyone is running. That is why trust should be put into the client instead of the server wherever possible.

3. You shouldn't trust DDG more than a peertube operator. Neither of them should be considered "trustworthy". You should always layer up your defenses if profiling is a threat to you at all (using a VPN, a fingerprinting resistant browser, etc). Sometimes, with things DDG, you got very little choices - you have to use something to search. With FreeTube, you don't need to trust any operator whatsoever.

I do plan to make a PR to add Invidious back because it apparently works very nicely without JS, but I don't want to recommend anyone create an account on any instance.

4. Self hosting is eh, idk. It's like "Why don't you self host your own VPN". If you don't share the instance with other people, then you don't have anyone to blend in with, and you have just given yourself a permanent IP for the big boys to profile you.

5. ProtonMail is not to be trusted if your threat is "email provider reading your emails". They can absolutely do that, and using them isn't a solution. However, if your threat is "government requesting for your emails", and you assume your email provider to be safe, then it is a valid option. Even if Google wasn't malicious, they have everything to hand over and do have to hand them over. On the other hand, if ProtonMail isn't malicious, then they don't have your message bodies to hand over, as they are encrypted at rest using your own key.

[youdontneedtoknow22]

Yes it is

And you really expect users to read that and use invidious? Invidious should be listed there as the other software, even before them. Put a link to the instances and call it a day.
Otherwise good luck convincing people to download a software just to watch YouTube videos.

[TommyTran732]

Yes it is

And you really expect users to read that and use invidious? Invidious should be listed there as the other software, even before them. Put a link to the instances and call it a day. Otherwise good luck convincing people to download a software just to watch YouTube videos.

That is their choice. I didn't list Invidious there so that users would use Invidious. I already explained it in https://github.com/privacyguides/privacyguides.org/discussions/341#discussioncomment-1672457

It makes no sense to be afraid of Google profiling you then switch to a third party who could do the same.

[dngray]

In addition to google, because most requests to invidious instances still make direct calls to googlevideo.com.

Though what you could argue is that the analytics Google does is most likely to be on the actual page (youtube.com) itself, so by using Invidious you're not actually hitting youtube.com with your browser that is logged in (assuming it is).

Assuming you didn't want to have features such as playlists, etc, it really wouldn't be any different from using FreeTube.

[youdontneedtoknow22]

I get your points and they're valid.
To quote Freetube:

Use YouTube without Google tracking you using cookies and JavaScript

And I assume all Invidious instances achieve the same thing, but they don't offer you a way to save playlists and subscribe to channels without signing in your google account. So yeah, Invidious is basically Freetube without that feature and without having to download a software. (I just wanted to type that for the case if someone sometime wants to know the difference)