The “main” web is a terrible experience when browsing without ad blockers.

If you’re one of those people who don’t have an ad blocker, here are some links to improve your web browsing experience.

Browser Extensions to Block Ads

The best and arguably only ad blocker you’ll need for your browser is uBlock Origin. It has worked consistently for me on Firefox and Chrome for many, many years.

Here are some convenient links to get uBlock Origin:

• Get the uBlock Origin Firefox extension
• Get the uBlock Origin Chrome extension
• Get the uBlock Origin Microsoft Edge extension (if you use Edge for some reason)

For Safari Users

Safari has limited support for extensions. While there is some tracking protection out of the box, it doesn’t compare to running a full blown version of uBlock Origin. If you REALLY want to keep using Safari then check out AdGuard for Mac. It blocks ads system-wide on macOS and not just in Safari.

If you like the Safari aesthetic but don’t want to install AdGuard, check out Orion Browser. It comes with ad blocking out of the box. It’s based on WebKit just like Safari. There’s even an iOS app available.

• Get Orion for macOS
• Get Orion for iOS

Brave Browser

Brave Browser is also a great browser if you want an ad-free web experience. It’s available on all major platforms (Windows, Android, Linux, macOS, iOS) and it comes with ad blocking built in. I hesitate a bit to recommend Brave because it comes with some optional crypto bullshit called Basic Attention Token, but you don’t have to opt into that.

• Get Brave Browser

Start Browsing the Web with Ad Blockers

There are many options for blocking ads regardless of the device you’re using. Start browsing the web with an ad blocker and you’ll never go back to browsing the normal ad-infested web.

Overall, I just don’t think Proton is focused as a company and their core offerings are lacking even after years of customers providing feedback. I mainly subscribed for Proton Mail to be able to use a custom domain. I’m also trying really hard to de-Google my life. Proton seemed like the obvious choice to introduce more privacy in my life.

Over the years Proton Mail has not improved very much. It’s still very slow and has UI bugs.

A common UI bug I run into is that emails don’t render properly in dark mode. The text in my emails will be white along with the background, making the emails unreadable. Here is a Reddit post where a user runs into this very issue.

In regards to speed, I don’t expect Proton Mail to be blazing fast since there is end-to-end encryption, but I thought I would see a few speed improvements after a few years. That has not been the case.

Proton also released a Proton Mail desktop app that is as slow and buggy as the website. This is because it’s an Electron app. When it was released I installed it, used it for around 10 minutes, then deleted it. It offers no benefit over the Proton site itself.

Instead of focusing on optimizations and bug fixes, Proton rolled out Scribe. It’s basically an AI assistant for emails. This is the wrong area to focus on, in my opinion. Also, it feels like Proton is just following the current trend of tacking on LLMs into every product.

Aside from mail, Proton Calendar, Proton Drive, and Proton VPN were also services I was interested in. With the exception of Proton Drive, I found these services to also be lacking. Proton Calendar was barebones for a calendar and I don’t trust it to use professionally. I still use Google Calendar for scheduling important meetings. Proton VPN gets the job done, but it is not as customizable as Mullvad VPN. In my case, I like being able to choose the protocol and port to use when connecting to a VPN. Mullvad VPN lets me do that. Proton VPN does not.

Finally, Proton released Proton Wallet. This came out of the blue. I do not understand why they would work on this service when their other offerings need more work. There was a lot of community backlash on Reddit when they announced it. Here’s some more feedback that overall represents my sentiments.

This post is meant as honest feedback. Proton has a respectable mission that resonates with me. I wish Proton well and I hope I can return some day. I sincerely mean that.

Further Reading

• Proton Spam and the AI Consent Problem

2025-01-28 Update:

I was recently made aware about Proton CEO Andy Yen’s comments regarding the incoming USA administration. Do with this information what you will.

• https://theintercept.com/2025/01/28/proton-mail-andy-yen-trump-republicans/
• https://web.archive.org/web/20250116145602/https://archive.ph/txuJ2
• https://www.reddit.com/r/ProtonMail/comments/1i1zjgn/so_that_happened/
• https://www.reddit.com/r/privacy/comments/1i210jg/protonmail_supporting_the_party_that_killed/

Disclaimer:

This is purely for educational purposes. I don’t plan on collecting information and using it for malicious purposes.

I started by searching domains that host static sites like github.io and pages.dev.

I found a lot of resumes with this Google search. Try this search yourself.

resume.pdf filetype:pdf site:github.io

Searching for resume instead of resume.pdf also works, but the results are polluted by “Resume Guide” PDFs, etc.

Searching for the standard github.com domain also yields lots of results. Try this search yourself.

resume.pdf filetype:pdf site:github.com

After GitHub I decided to try the pages.dev domain used by Cloudflare Pages. Here is a simple search query that gives good results. Try this search yourself.

resume filetype:pdf site:pages.dev

The Netlify domain netlify.app is used for static pages and also hosts a lot of resumes that users upload. Try this search yourself.

resume filetype:pdf site:netlify.app

There are top level domains (TLDs) commonly used for personal sites, such as .me and .dev. These domains are also great for finding resumes. Here’s a Google search for the .me TLD. Try it yourself.

resume filetype:pdf site:*.me

And here is a Google search for the .dev TLD which is commonly used by developers. Try this out yourself.

resume filetype:pdf site:*.dev

I didn’t try this with other TLDs but I know that other TLDs like .id, .blog, and .codes are usually used for personal sites. Feel free to search by these TLDs and see what you can find!

We can take this further. What if we want to find people based on something more specific than a domain or TLD? I’ll keep using the .dev TLD for simplicity but there are many possibilities.

Maybe we want to find someone in a specific city? Try it yourself.

boston resume filetype:pdf site:*.dev

Or someone that went to a particular college? Try it yourself.

University of California Los Angeles resume filetype:pdf site:*.dev

Someone that works or worked at a certain company? Try it yourself.

"Apple, Inc" resume filetype:pdf site:*.dev

Maybe we want the name, number, and address of someone who has worked at a defense company and may know sensitive information important to U.S. national security? Note that I didn’t filter based on domain or TLD here. Try it yourself.

"resume.pdf" "Raytheon" filetype:pdf

(I’m just joking. Please don’t come after me, feds.)

I also considered writing a script to run these searches for me, gather all PDF links, download the PDFs, and then parse through them for names, numbers, emails, and addresses. But I stopped because I have no interest in collecting this information. I just wanted to see and show others how easy it is to find information on the open web. It’s definitely possible to write a script to do this though.

Conclusion

In conclusion, it’s really easy to find private information on resumes posted online. Please reconsider if you are thinking of making your resume available online.

Further Reading

I am not the first to have this idea. Here’s a similar post that you should also check out:

• https://www.trickster.dev/post/simple-ways-to-find-exposed-sensitive-information/

With git shortlog you can list all contributor emails for any git repository, not just GitHub repos.

Disclaimer:

I am writing about this to make others aware of this form of scraping and it is purely for educational purposes. I do not plan on doing anything with emails from git repos and you shouldn’t either.

tl;dr:

You can run this command within any git repo to extract all contributor emails:

git shortlog -sea | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" | awk '{print tolower($0)}' | sort | uniq | grep -wv 'users.noreply.github.com'

Command Break Down

The git shortlog -sea part of the command is short for git shortlog --summary --email --all. This command outputs the number of commits each user has made, along with their name and email, across all branches.

$ git shortlog -sea

    54  First Last <FirstLast@example.com>
   385  Another User <Anotheruser@example.com>
     2  user1 <user1@example.com>
    31  first last <firstlast@example.com>
    10  Someone Else <1234567+someoneelse@users.noreply.github.com>

The next command, grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b", extracts emails from each line using a regular expression.

$ git shortlog -sea | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b"

FirstLast@example.com
Anotheruser@example.com
user1@example.com
firstlast@example.com
1234567+someoneelse@users.noreply.github.com

The output from the previous command is piped into awk '{print tolower($0)}', which lowercases all the emails. Sometimes emails are typed in with capital letters. Lowercasing all characters will help with sorting and finding unique emails later.

$ git shortlog -sea | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" | awk '{print tolower($0)}'

firstlast@example.com
anotheruser@example.com
user1@example.com
firstlast@example.com
1234567+someoneelse@users.noreply.github.com

After that, the output is piped into sort and uniq. These commands are straightforward. The emails are sorted alphabetically, then duplicates are excluded from the output.

$ git shortlog -sea | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" | awk '{print tolower($0)}' | sort | uniq

1234567+someoneelse@users.noreply.github.com
anotheruser@example.com
firstlast@example.com
user1@example.com

That should suffice for a lot of git repos, but I also added grep -wv 'users.noreply.github.com' to the end of the command to exclude noreply emails associated with GitHub.

$ git shortlog -sea | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b" | awk '{print tolower($0)}' | sort | uniq | grep -wv 'users.noreply.github.com'

anotheruser@example.com
firstlast@example.com
user1@example.com

Extracting Emails With git log

It’s possible to do something similar with the git log --pretty="%ce" command. However, I noticed that this command does not show as many emails as git shortlog. I didn’t look too much into it, but I believe it only pulls emails from one branch rather than all branches like with git shortlog --all.

References

I learned about git shortlog from this Stack Overflow question:

• https://stackoverflow.com/questions/9597410/list-all-developers-on-a-project-in-git

I got the email regex from here:

• https://www.shellhacks.com/regex-find-email-addresses-file-grep/

Note:

Git Emails

When setting up Git on the command line, you are asked for your email. When pushing commits to GitHub, the email you are using for Git gets pushed along with your code as part of the metadata. While your GitHub email does not publicly show when viewing a repository’s commits, it does come up when viewing commits using the GitHub API.

This presents a privacy risk and the potential for someone to find the email associated with your GitHub account. I wanted to see how easily someone could do this so I created a scraper to do this for me. It turns out it’s not hard to scrape commits for emails that are otherwise hidden from public view.

Disclaimer:

I don’t plan on doing anything malicious with this script or the emails collected. I did this out of curiosity and for demonstrational purposes.

The scraper I created is below. Instructions can be found on the README:

• https://github.com/nelsonfigueroa/github-email-scraper

Scraping for Emails

By running the script, I can scrape for emails found in each commit for a given repository:

$ ruby main.rb -u torvalds -r linux

	+-------------------+
	|   GitHub          |
	|       Email       |
	|         Scraper   |
	+-------------------+


Scraping https://github.com/torvalds/linux/
Rate limit exceeded.
Pages scraped: 1-46 out of 10449
53 emails written to torvalds-linux.txt

Just like that, I’ve scraped several emails. It’s not much, and I could get a lot more if I bothered to authenticate to prevent rate limiting. A patient scraper could simply run this periodically to get as many emails as possible.

So what can we do about this?

Hiding your Email in GitHub Commits

You can choose to hide your email when performing Git operations on the GitHub site as well as the command line. There are two checkboxes you’ll need to tick. Instructions are below:

• Blocking command line pushes that expose your personal email address

Next, you’ll need to change your email Git uses on your machine to the @users.noreply.github.com email that GitHub provided in the previous step. Run the following:

$ git config --global user.email "00000000+yourusername@users.noreply.github.com"

Then verify that the email has been set:

$ git config --global user.email
00000000+yourusername@users.noreply.github.com

Now your actual email will be hidden from Git commits that have been pushed from your machine as well as any Git operations on GitHub. Note that your email will still show up in older commits that were pushed before these changes. However, this will still improve your privacy on GitHub going forward.

Firefox

Official site: https://www.mozilla.org/

Firefox has always been a great alternative to Chrome for privacy purposes. Firefox is, in my opinion, the only real alternative to Chrome and Chromium-based browsers. Sure there’s also Safari but the support for extensions is butchered. If I can’t install uBlock Origin on a browser, I don’t use it.

uBlock Origin

Official site: https://ublockorigin.com/

uBlock Origin is probably the best adblocker out there. I debated adding it to my list because I thought it was the norm to install an adblocker but I’ve come across so many people that, for whatever reason, do not use any sort of adblocker.

If you use a browser (aside from Safari) and you don’t have this extension installed…what are you doin’??

Tor

Official site: https://www.torproject.org/

If you really care about privacy to the point where you want to be anonymous, use Tor. When using Tor, your connection goes through several Tor servers that encrypt connections multiple times along the way. This way, your connection is difficult to trace and decrypt. Tor is widely used by journalists, whistleblowers, and activists to remain safe from government surveillance and punishment.

Signal

Official site: https://signal.org/

Signal is a cross-platform messaging app. If you’ve ever used iMessage on Apple devices, then it’ll feel familiar, except Signal is not exclusive to Apple hardware. Signal is free, open source, end-to-end encrypted, and peer-reviewed. It’s used by privacy advocates around the world.

It has all the essential features that you’d expect from a modern messaging application like sending photos/videos, calls, video chat, stickers.

Mullvad VPN

Official site: https://mullvad.net/

Mullvad VPN does not log any activity (and has been audited to prove it), and is pretty affordable. I know many people out there opt to use free VPNs, but there’s a 99% chance they’re selling your information to marketing companies. It’s much better to pay for a VPN.

The source code for the Mullvad client applications is open-source.

Mullvad even encourages you to remain as anonymous as possible when buying their service. You don’t need an email to sign up and you can pay with Bitcoin.

Mullvad VPN is based in Sweden, which has generally good privacy laws.

Proton VPN

Official site: https://protonvpn.com/

I eventually switched to Proton VPN since I bought their subscription suite that includes email and cloud storage. My experience with Proton VPN has been very positive and it’s just as good as Mullvad from what I can tell. Proton VPN (and the rest of their services) are based in Switzerland which has good privacy laws.

Proton Mail

Official site: https://proton.me/mail

Proton Mail is an email service based in Switzerland. Your emails are encrypted and aren’t used for training AI or selling advertisements to you.

The UI/UX isn’t as great as something like Gmail but I think it’s worth the trade-off. They also support bringing in your own domain to use for emailing.

You can create a free account to try it out.

Little Snitch

Official site: https://www.obdev.at/products/littlesnitch/index.html

Little Snitch is a macOS-only application firewall that runs on your Mac and monitors all incoming and outgoing connections. It allows you to allow or deny connections as needed and gives you plenty of information about what your applications are connecting to. There are also curated blocklists you can add to Little Snitch to block things like ads on your entire machine.

This is a paid app (and there’s a free trial), but I think it’s worth it.

If you want a free alternative, check out LuLu. It has fewer features, but it’s worth a try if you want to see what your machine is connecting to. The same developer has other Mac-related applications that may be useful: objective-see.org.

Further Research

These are my favorite tools and services, but there are many, many others out there. If you want to claim back more of your privacy, start by reading through privacyguides.org.

I’ve also learned a lot about privacy in these subreddits:

/r/privacy

/r/PrivacyGuides

/r/degoogle