# FreeTube's outgoing TCP connections to write.as **URL:** https://discuss.privacyguides.net/t/freetubes-outgoing-tcp-connections-to-write-as/20878 **Category:** Questions **Tags:** video, software **Created:** 2024-09-14T07:10:45Z **Posts:** 25 ## Post 1 by @anon23293884 — 2024-09-14T07:10:46Z **FreeTubeApp** connects to [write.as](https://write.as/) ![Screenshot 2024-09-14 at 10.00.17](//forum-uploads.privacyguidesusercontent.com/original/2X/4/41e280fc0ae45eb2f1043c26326aa54d4b56c809.png) ![Screenshot 2024-09-14 at 10.05.32](//forum-uploads.privacyguidesusercontent.com/original/2X/3/34b302793bf0498e80a0efe4741cc08cb70956c8.png) **write.as is a web pub­lish­ing platform.** Search didn’t turn up any discussion results, not just here. * * * **Plan A: analyze the behavior of the application when it uses this resource.** * * * What exactly it does? I’m interested in the details… --- ## Post 2 by @user1 — 2024-09-14T07:23:24Z That’s the hosting platform of the Freetube official blog, nothing suspicious. Anyways, I think you should report these kind of “findings” to the developer or the related community first before posting here. --- ## Post 3 by @anon23293884 — 2024-09-14T10:36:19Z Hi. I posted something here that I couldn’t find any discussions about. If there are debates on this topic somewhere, please let me know. This isn’t just about this forum. Look it up. Let me be clear: I am not accusing FreeTube of being a Chinese ransomware virus. I am simply interested in the development and processes that deal with involvement, and I have added relevant tags. **I want to know** if **this is a forum for people who only post bad, malicious things?!** **or if it’s a place to question, analyze, and discuss things that bother me in the context of privacy.**? Okay, relax Solid Snake, don’t be grumpy, since specifics from regular users can sometimes be hard to come by, I’ll try to capture that here on Privacy Guides and not on another platform. Anyone who starts using FreeTubeApp will get into the details and include brains. They’ll analyze where and why the application connects and exchanges data. Let me be clear: no one discusses this connection on the Internet. This will be useful for beginners who want to analyse their traffic. There’s no need to send them straight to GitHub where they’ll get lost or stay there and forget about this project. I have found the code. I have a solution for anyone who has notifications popping up from the signed Apple code indicating an unusual connection to FreeTubeApp. ``` lastAppWasRunning = new Date(lastAppWasRunning) } fetch('https://write.as/freetube/feed/') .then(response => response.text()) .then(response => { const xmlDom = new DOMParser().parseFromString(response, 'application/xml') ``` the lastAppWasRunning variable is updated to track the time of the last application activity. code executes a request to retrieve [FreeTube](https://write.as/freetube/feed/), which is an RSS feed hosted on write.as. The response is treated as text and parsed as XML How does this relate to privacy and security? Apparently the connection is used to receive announcements from the FreeTube project. This code shows that the application is only receiving data. HTTPS is used, and the connection could be used for basic analytics (counting active users). This could be part of an update checking mechanism, which has both security benefits because of timely security updates and potential privacy concerns = **update checks can be tracked**. I want to understand how critical it is to block this connection. But I’m done for now. --- ## Post 4 by @bigdzi — 2024-09-14T10:58:10Z > [@anon23293884](#): > > **update checks can be tracked**. Not only tracked, but also, and more impontantly, tinkered with in malicious manner (f.e.: malicious code added etc). > [@anon23293884](#): > > I want to understand how critical it is to block this connection. Extremely critical. --- ## Post 5 by @anon48875053 — 2024-09-14T11:19:20Z That’s some fearmongering right there. --- ## Post 6 by @lepras — 2024-09-14T13:59:27Z Who uses freetube on macos? what. sources are not right on this one :joy: --- ## Post 7 by @anon23293884 — 2024-09-14T14:21:12Z someone who can find [DMG](https://github.com/FreeTubeApp/FreeTube/releases/download/v0.21.3-beta/freetube-0.21.3-mac-x64.dmg) on the developers page and install their preferred software on what ever platform they want. --- ## Post 8 by @eqrlzo8t — 2024-09-14T15:10:06Z You can also ask in github’s discussion: [FreeTubeApp/FreeTube · Discussions · GitHub](https://github.com/FreeTubeApp/FreeTube/discussions) . That’s my first place I go to when I want to ask something about a project. --- ## Post 9 by @anon23293884 — 2024-09-14T15:21:18Z If that is okay with you. I’ll share my thoughts here on **Discourse** after I’ve had a chance to explore some ideas of my own and literally **discuss** privacy aspects of this here. all code should be independently verified Asking on GitHub is part of that. --- ## Post 10 by @overdrawn98901 — 2024-09-14T15:27:40Z If you visit the URL, it’s an RSS feed. How critical it is to block or not depends on your threat model. You should share your threat model in order to have meaningful discussion around what it is you are concerned with. Unless someone has poisoned your DNS to link to a different RSS feed, this is all extremely normal. To check for updates, an application may check some server somewhere to see if updates are available. This doesn’t just apply to applications - even a Linux package manager has to make a network request to check for updates. Very normal. The only thing that is important is that checking for updates is separate from applying them - they should never be glued together so you can control when or if you want to update. Regardless, if this behavior isn’t wanted, check if the application allows you to disable checking for updates. If not, and this is a concern, open a bug report on GitHub, and someone may add a setting to disable checking for updates. As for someone snooping on your updates, it uses HTTPS so the request and response is encrypted. As for someone knowing you made a get request to a FreeTube update server if they are intentionally spying on your DNS queries, use a VPN and ensure you aren’t leaking DNS. As for security risk, it’s pretty much FUD unless someone is actively targeting you to trick you into installing a malicious FreeTube update as worst case scenario. If this is a discussion on general opinions of this, I’d say it’s bike shedding and there are more important things to focus on for privacy. If this is about a specific concern of yours, I believe the above suggestions mitigate most of the problems. --- ## Post 11 by @anon23293884 — 2024-09-14T15:31:02Z First of all, it is essential to justify the developer’s time, which has been wasted. A responsible and forward-thinking negotiator will always figure things out for himself and understand how much the community of people who care about privacy is interested in providing an alternative for the functionality. I want to be clear about my thoughts before the discussion. If something is to be changed, I want to know why you think it matters to anyone. The dev deserves to know who and why cares. --- ## Post 12 by @overdrawn98901 — 2024-09-14T15:38:02Z I am not following the discussion on what the issue at this point of time. Is there something unclear about the application? --- ## Post 13 by @anon23293884 — 2024-09-14T15:46:45Z Perhaps the first thing to consider is whether it is possible to provide stable updates without connecting to this www It would be advisable to pay attention to this next point, given that threat models are involved and there is a possibility of code abuse in the beta version, which is enforced on the product site. In the event of any issues, the beta version may be a potential area for concern. It would be beneficial to consider the scalability of the potential threat model in relation to the total number of users who will be able to access this topic. --- ## Post 14 by @overdrawn98901 — 2024-09-14T15:51:25Z > [@anon23293884](#): > > Perhaps the first thing to consider is whether it is possible to provide stable updates without connecting to this www Disable checking for updates on FreeTube, download updates via direct download or package managers; or, compile the source code yourself? :person_shrugging: that’s about it --- ## Post 15 by @anon23293884 — 2024-09-14T15:54:03Z Consequently, 90% of prospective customers who are either indolent or lacking in diligence, yet concerned about security, will be discouraged from utilizing the product. FreeTubeApp is a product that is of primary importance. The app needs to just work. You know, some kind of philosophy of Apple. It just works. --- ## Post 16 by @overdrawn98901 — 2024-09-14T15:59:27Z Just look at the settings and see if there is a setting to disable checking for updating.. --- ## Post 17 by @anon23293884 — 2024-09-14T16:04:00Z I see your point. Now, let me make one too. Imagine an Apple software engineer saying this to Steve Jobs before the release of Safari on iOS. > Just look in the settings and see if there is an option there to disable checking for updates if you want the app to be safe. > Let the competitors make it so that everything works at once and nothing bothers them. --- ## Post 18 by @anon23293884 — 2024-09-14T16:08:20Z I know some people want to respond: > But let’s be real. > > We’re not in Cupertino, and you’re not Steve Jobs. I’m rooting for the FreeTubeApp to succeed as much as Apple. That’s my two cents. --- ## Post 19 by @anonymous227 — 2024-09-14T16:17:28Z can this thread be nuked please, it is just nonsense. an app loads a news feed for itself, completely expected. FreeTube directly connects to Google for YouTube, if you want privacy use a VPN or Tor --- ## Post 20 by @anon23293884 — 2024-09-14T16:28:37Z Even though you’ve only been here on the forum for a couple minutes. Welcome. Free Tube is [mentioned](https://www.privacyguides.org/en/frontends/?h=freetube#freetube) in the Privacy Guides. You should explore the functionality and connectivity in the FreeTubeApp settings Your passage makes no sense in literally every phrase, both in terms of practice and convenience. --- ## Post 21 by @jonah — 2024-09-14T17:06:49Z I think it is fair to say this is pretty mundane behavior. Apps checking in with a developer blog or API endpoint to notify you of changes is often preferable to not doing so, because staying up to date is one of the most important things you can do when improving your security. Of course there is some small risk to privacy and security, as there are for any internet connection, but I don’t think most people need concern themselves with it. Seeing as the original question has [been answered](https://discuss.privacyguides.net/t/freetubes-outgoing-tcp-connections-to-write-as/20878/10) by @overdrawn98901 in more detail already, I’m not really seeing a point to continuing this discussion. If you agree please mark the answer above or this post as the accepted solution. * * * For the record, > [@anon23293884](#): > > A responsible and forward-thinking negotiator will always figure things out for himself and understand how much the community of people who care about privacy is interested in providing an alternative for the functionality. Figuring things out about tools, especially those we recommend, is on-topic for this forum, so I think it is fine to create threads like this. However, providing an alternative for the functionality (i.e. considering “whether it is possible to provide stable updates without connecting to this www”) is probably **off** -topic here. Since we are not FreeTube developers, and many of us are not developers at all, I don’t think discussing all the things FreeTube could be doing differently in detail is super helpful. It isn’t helpful to our readers, who are not in a position to make these changes themselves, and it isn’t helpful for FreeTube, who are probably unaware of this thread. So I think we are beginning to stray into the sort of discussion that would be better served on an app developer’s forum rather than here, probably. > [@anon23293884](#): > > Okay, relax Solid Snake, don’t be grumpy, since specifics from regular users can sometimes be hard to come by, I’ll try to capture that here on Privacy Guides and not on another platform. > > Anyone who starts using FreeTubeApp will get into the details and include brains. They’ll analyze where and why the application connects and exchanges data. Let me be clear: no one discusses this connection on the Internet. > > This will be useful for beginners who want to analyse their traffic. There’s no need to send them straight to GitHub where they’ll get lost or stay there and forget about this project. I feel like your replies frequently get a bit muddied (in translation?), but I think I understand your point: - Other FreeTube users who are wondering about the write.as connection might look it up, encounter this thread, and find the information useful. In which case I agree, that is sort of the point of the forum. Now I think this thread is getting off the rails a bit and may become less helpful for beginners, so that is also why it might be time to move on from this discussion :smile: --- ## Post 22 by @lepras — 2024-09-16T01:38:23Z Bro asked a question, wrote the entire thread then marked his own post as a solution. is Bro real? --- ## Post 23 by @anon23293884 — 2024-09-16T01:43:23Z Kid, they don’t teach you that in school, but what’s not illegal is allowed. --- ## Post 24 by @overdrawn98901 — 2024-09-16T01:46:32Z @jonah I don’t think anything useful is going to come from this thread at this point, could we lock it? --- ## Post 25 by @anon23293884 — 2024-09-16T01:46:49Z yes