~/changelog
Changelog
every recommendation change, dated and explained
When something here changes, this page says what and (more importantly) why. Recommendations move because facts move: a new audit, a pricing change, a policy rewrite, an acquisition. If a change ever seems unexplained, call it out.
Nostraddition
Added Nostr to Social Media as the key-based pick: identity is a cryptographic keypair instead of a server-issued account, which is stronger portability than the ActivityPub entries above it, at the cost of unrecoverable key loss and weak built-in spam/impersonation resistance. Added a new Nostr clients subsection underneath it covering Primal (the polished cross-platform pick, with its own caching server as the honest trade-off) and Damus (the grant-funded, relay-transparent client maintained by a core protocol developer). The category is up to 5 recommendations plus the new subsection.
Whonix on Qubesaddition
Added Whonix on Qubes to Desktop OS as the hardened-anonymity pick, slotted right after Qubes OS since it depends on it. Running Tor in one VM and applications in another means the workstation never learns its own real IP, and pairing that with Qubes adds Xen isolation and disposable workstations on top. Neither project has had a formal third-party audit, and Whonix 18 requires Qubes R4.3 (R4.2 reached end of life in June 2026). The category is up to 7 recommendations.
Technitiumaddition
Added Technitium to DNS & Network as the full-stack self-host pick, right after Self-host: it resolves recursively to the root servers itself and hosts authoritative zones with DNSSEC signing, rather than only blocking and forwarding like Pi-hole or AdGuard Home. One developer has maintained it since 2017 with no third-party audit, and only the newest release gets security fixes. The category is up to 8 recommendations.
Mullvad DNSremoval
Removed Mullvad DNS from DNS & Network. Mullvad announced it's
shutting down its public encrypted DNS servers (dns.mullvad.net)
on November 2, 2026, redirecting those resources to sponsor Quad9
instead. Pulling the recommendation now rather than waiting for the
cutoff; the category is down to 7 recommendations. This doesn't affect
Mullvad VPN itself: DNS resolution through the VPN tunnel uses a
separate internal resolver that isn't going anywhere.
NordPassaddition
Added NordPass to Password Managers as a full entry: mainstream, closed source, and popular enough (Nord Security's own manager, alongside NordVPN) to warrant the same "know where it stands" treatment already given to Dashlane, rather than the passing mention it previously got. Its promotional pricing has no published renewal rate: check the live price before committing.
1Passwordupdate
Added a Mind the bullet on a 2025 clickjacking flaw affecting most browser-extension password managers. 1Password's fix is an opt-in confirmation dialog rather than a structural close of the hole, and independent tracking still showed it exploitable as of January 2026.
Bitwardenupdate
Rewrote the body text so the 2026 leadership-change story stops dominating the entry: it's now one line, with the technical case (open source, audited, self-hostable) leading instead. Added two Mind the bullets that were missing: a 2023 audit that found and fixed a critical remote-code-execution flaw in the desktop Electron app, and an April 2026 npm supply-chain attack that briefly compromised the CLI's distribution channel (contained in about 90 minutes, no vault data affected).
Proton Passupdate
Added a Good bullet and an audited pill for two
independent security audits: Cure53 (2023) and Recurity Labs
(2026), the latter rating the security posture "well above par".
Proton Passcorrection
Corrected the pricing footer. The previous "$4.99/mo" figure was the pay-monthly, no-commitment rate, not the annual-billed rate this page uses as its convention elsewhere; the annual-billed rate runs roughly $1.99–2.99/mo depending on signup timing.
KeePassXCupdate
Added a Good bullet for KeePassXC's first-level security certification (ANSSI CSPN) from France's national cybersecurity agency, awarded November 2025.
Nitterremoval
Removed Nitter from Frontends. X sent the project a cease-and-desist and its public instances are down for good this time, ending the February 2025 comeback covered here previously. There's currently no working X/Twitter frontend to recommend in its place; the Frontends category is now down to 7 tools.
Stoatcorrection
Corrected the jurisdiction claim: Stoat's developer, Revolt Platforms Ltd, is UK-based and answers to UK GDPR and the ICO, not EU law as previously stated. Most data is still hosted on EU servers, but that's a hosting detail, not the governing jurisdiction. Added Mind the bullets noting the UK is a Five Eyes member and that Stoat has no end-to-end encryption — messages are readable on the server. Added a 🇬🇧 uk jurisdiction pill to match, and added it to the site's pill vocabulary since no UK flag existed there before.
Fluxeraddition
Added a disclosure from Fluxer's privacy policy update (effective 14 Aug 2026): most stored data lives on servers in New Jersey, not Sweden, which brings it within reach of the US CLOUD Act despite the Swedish incorporation. Also added a Mind the bullet noting text chat has no E2EE by design (voice and video E2EE is in progress but not live yet), and sharpened the "less battle-tested" bullet to note no independent security audit has been published.
Mastodonaddition
Added a Good bullet for quote posts, which shipped in version 4.5 (November 2025) with consent controls over who can quote you. Also added a note that Mastodon's team has patched several 2026 vulnerabilities within the same release cycle they were disclosed, with no sign any were exploited.
Lemmyaddition
Added a Good bullet on Lemmy's security track record: the developers have found and patched several 2026 vulnerabilities, including user-enumeration and metadata-leak bugs, through public GitHub security advisories.
PeerTubeaddition
Added a Good bullet on the mobile app, which supports background playback, Chromecast and AirPlay casting, and uploading video from your phone. Also added a Mind the note that live streaming needs a separate, Android-only companion app.
Pixelfedupdate
Updated the single-founder bullet: Daniel Supernault still runs Pixelfed largely alone, but a 2025 Kickstarter raised money to build out a team and register a nonprofit. Updated the mobile-app bullet too, since native iOS and Android apps shipped in January 2025 and the old "polish lags behind" wording no longer held.
Added a Good bullet noting Supernault turned down five VC offers in January 2025 to keep the project independent, and a Mind the bullet on a 2025 privacy bug (CVE-2025-30741) that forced instances like Hachyderm to defederate until they patched it.
Proton Mailcorrection
Tightened the Swiss-cooperation paragraph. The court orders Proton has complied with covered billing details and account metadata, not IP logs or message content, and the old wording claimed more than the record supports.
Posteoupdate
Corrected base storage from 2GB to 4GB. Posteo doubled it in February 2026 at the same €1/month and gave it to existing customers too. Added app passwords to Good in the same pass: they arrived in March 2026, five per account, and they make 2FA worth turning on if you use a desktop client.
StartMailcorrection
Stopped stating the System1 ownership link as fact. Corporate databases assert it, StartMail denies it, and nothing public settles it either way, so the entry now says the ownership is disputed.
Disrootaddition
Added custom domains to Good. Disroot unlocks them as a donation reward instead of a paid tier, around twelve coffees' worth given once or yearly, and you bring your own domain name.
iMessagecorrection
Added a UK caveat to the Advanced Data Protection warning. Apple withdrew ADP for UK users in February 2025 under a Home Office order, so the old bullet told British readers to turn on something they can't.
Telegramcorrection
The entry framed Telegram's accountability problem entirely around the CEO's 2024 arrest in France. Russia charged him with facilitating terrorism in July 2026 and issued its own international arrest warrant, so two governments are after him now, not one.
Telegramupdate
Noted that Apple pulled Telegram from the App Store worldwide on August 3, 2026 after scanning it and finding illegal content, and restored it forty minutes later. The removal doesn't change the encryption claims this entry rests on, but it's the kind of moderation failure worth having on the record.
Signaladdition
Added Secure Backups, available since February 2026. They move your history to a new phone with end-to-end encryption, and Signal never sees the recovery key. Until now you couldn't switch phones without losing your history.
Heliumcorrection
Updated to reflect Windows auto-update support (added June 2026). Replaced the outdated "limited auto-update" caveat with a note on patch lag during upstream Chromium security releases.
Site launchedmilestone
This is the first public version of the site: a threat modeling guide, a growing set of tool recommendations, and this changelog. One person, no sponsors, no affiliate links; the about page explains the rules this site runs by.