Privacy on Aquasp's blog

Ditch the Official App: Use Your Mi Band Privately with Open-Source Alternatives

Tue, 23 Dec 2025 20:23:05 +0000

If you love wearing a wearable device like a Mi Band but want to protect your privacy (like me), there’s a great way to do it!

Check Device Compatibility First

The first step is to verify if your device is supported. Xiaomi and Huawei devices generally have the best compatibility. I recommend checking two popular alternatives:

GadgetBridge: Fully open-source and highly privacy-focused. It works reliably, though the UI isn’t the most modern or beautiful.
Notify for Mi Band: Offers a much nicer, more polished UI (in my opinion), but it’s not open-source and the Pro version (ad-free) costs about $3.

Privacy-wise, both options are far superior to the official Xiaomi app—no constant data sharing with servers.

It’s almost ironic that Chinese-brand devices end up providing better privacy options than many Western brands when paired with these alternatives. This is likely just a side effect of their popularity and competitive pricing.

Extract the Authentication Token

Unfortunately, you’ll need the official app temporarily. Download the Xiaomi Mi Fitness app, pair your band, create a Xiaomi account, and update the firmware to the latest version*.

Once that’s done, you need to extract the authentication (auth) token from Xiaomi. The easiest method right now is using the Notify for Mi Band app.

Download Notify for Mi Band from the Google Play Store (there are two versions, ensure that you are downloading the correct one for your device)
Start the setup process in the app.
You’ll see two options for getting the token: Offline and Online.

The offline method requires exporting logs from the official Mi Fitness app and extracting the token from them. I tried this several times, but it never worked for me—I couldn’t even find the relevant logs manually.

So, I strongly recommend the online method:

Log in with your Xiaomi account email and password.
Xiaomi will send a verification code to your email.
Enter the code, and the app will automatically retrieve the token for you.

Final Steps: Switch Over and Uninstall the Official App

After getting the token:

Enter it in Notify for Mi Band (or GadgetBridge, if you’re using that).
Grant all necessary permissions.
Uninstall the official Mi Fitness app immediately.

The band can only connect and sync with one app at a time. Keeping the official app installed will cause connection issues or prevent proper syncing with your chosen alternative.

Now you’re all set! Customize notifications, enable/disable features as you like, find your phone or band, install free watchfaces, and track steps, calories, and heart rate—all in a clean, beautiful UI with no privacy compromises.

One minor issue I’ve noticed: sleep tracking is not syncing properly. I’m not sure if this is specific to the Mi Band 10, a firmware quirk, or a setting I changed. The data still shows correctly on the band itself, so it’s just a sync problem. Personally, I don’t mind—I mainly use my Mi Band for a convenient clock, flashlight,quick heart rate checks during workouts and changing music on a bluetooth speaker.

At least for the Mi Band 10, the latest firmware (as of Dec 2025) hasn’t broken compatibility with Notify for Mi Band.

How to Self Host your own Piped Instance

Mon, 08 Dec 2025 23:58:10 +0000

Introduction

Piped is a privacy-first, open-source alternative YouTube front-end. No Google tracking, no ads (even on videos that normally have unskippable ones), and it works perfectly with SponsorBlock and dearrow.

Self-hosting your own instance is incredibly easy with Docker and takes less than 20 minutes.

Requirements

A domain (or subdomain)
A cheap KVM VPS with Docker support (avoid OpenVZ — old kernel)
~$3–6/month is more than enough (1 CPU, 1–2 GB RAM)

Great cheap providers in 2025:

RackNerd
Hostinger (my affiliate if you want to support https://hostinger.com.br?REFERRALCODE=waterdownfall)
Cloudcone, Hetzner Cloud, BuyVM, etc.

Step 1: Secure & Prepare Your VPS

(SSH keys only, firewall, etc. — do this first!)

Then install Docker (Ubuntu/Debian example):

apt update && apt upgrade -y
apt install -y ca-certificates curl gnupg lsb-release

# Add Docker repo
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Step 2: Deploy Piped with the Official Docker Setup

cd /opt
git clone https://github.com/TeamPiped/Piped-Docker
cd Piped-Docker
./configure-instance.sh

During the script:

Choose Caddy as reverse proxy (easiest + automatic SSL)
Enter your domain and subdomains:
- Frontend → piped.yourdomain.com
- Backend API → pipedapi.yourdomain.com
- Proxy → pipedproxy.yourdomain.com

Step 3: Point DNS to Your VPS

Create three A records at your DNS provider:

piped.yourdomain.com → VPS_IP
pipedapi.yourdomain.com → VPS_IP
pipedproxy.yourdomain.com → VPS_IP

Step 4: Launch Everything

docker compose up -d

That’s it! After DNS propagates (usually < 10 minutes), your private YouTube will be live at:

https://piped.yourdomain.com

Caddy automatically handles free Let’s Encrypt SSL — no manual certbot needed.

Step 5: (Optional) Check Logs

Bash

# See what Caddy is doing
docker logs -f caddy

# Or any other container
docker logs -f piped-frontend

Bonus Tips

Want to make it public? Just share the URL — anyone can use your instance.
Want it private? Block it with Cloudflare firewall rules or basic auth in Caddy.
Pair it with the LibreTube (Android) app for the full de-Googled experience.

You now have your own ad-free, tracking-free, SponsorBlock-enabled YouTube — fully under your control.

Thanks for reading!

How to setup your own email server

Mon, 08 Dec 2025 23:35:02 +0000

Introduction

Want your own ultra-private email like name@yourdomain.com with a beautiful webmail interface? This guide walks you through setting up a full mail server in under an hour using Luke Smith’s legendary EmailWiz script + Roundcube webmail — all on a $2–3/month VPS.

Everything is free, open-source, and 100% under your control.

Step 0: Grab a Cheap VPS

Good providers with frequent sales:

Contabo
LowEndTalk “Offers” section
Hostinger (my affiliate if you want to support me -> https://hostinger.com.br?REFERRALCODE=waterdownfall)

Requirements:

Any location (USA works fine)
Debian 10 or 11 (we’ll use Debian 10 in this guide)
At least 1 GB RAM (2 GB+ recommended)
Set hostname during signup to your domain (e.g., sobremail.com)

Wait for deployment → grab root password from email → SSH in.

Step 1: Basic VPS Hardening

ssh root@your-vps-ip
apt update && apt upgrade -y

Change root password:

passwd

Create and upload an SSH key (do this from your local machine):

ssh-copy-id root@your-vps-ip

Now disable password login:

nano /etc/ssh/sshd_config

Change:

PasswordAuthentication no
UsePAM no

Then:

systemctl restart sshd

Only your SSH key works now — much safer.

Step 2: Install EmailWiz (the magic script)

apt install curl nginx python3-certbot-nginx -y

Point these DNS records to your VPS IP:

yourdomain.com → VPS IP (A record)
mail.yourdomain.com → VPS IP (A record)

Run Luke’s script:

curl -LO lukesmith.xyz/emailwiz.sh
sh emailwiz.sh

Follow the prompts:

Say Yes/Y to everything
When asked for “System mail name” → enter ONLY yourdomain.com (NOT mail.yourdomain.com!)

Wait ~5–10 minutes. When it finishes, it gives you three DNS records to add:

DKIM TXT record (mail._domainkey.yourdomain.com)
DMARC TXT record (_dmarc.yourdomain.com)
SPF TXT record (root domain)

Add them at your DNS provider (Cloudflare, Namecheap, etc.).

Step 3: Set Up Reverse DNS (Critical for Deliverability!)

In Cloudcone panel → Networking → rDNS → set to yourdomain.com Do NOT enable IPv6 (Cloudcone doesn’t support IPv6 rDNS yet — it will hurt deliverability).

Step 4: Create Your First Mailbox

useradd -G mail -m yourusername
passwd yourusername

Your email is now: yourusername@yourdomain.com

Test in Thunderbird/IMAP client:

IMAP: mail.yourdomain.com (port 993, SSL/TLS)
SMTP: mail.yourdomain.com (port 465, SSL/TLS)

Step 5: Install Roundcube Webmail

Add backports + PHP 8.x repo:

apt install -y lsb-release ca-certificates apt-transport-https software-properties-common gnupg2
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/sury-php.list
wget -qO - https://packages.sury.org/php/apt.gpg | apt-key add -
apt update
apt install -y php8.0-fpm php8.0-common php8.0-gd php8.0-imap php8.0-mysql php8.0-curl php8.0-zip php8.0-xml php8.0-mbstring php8.0-intl mariadb-server

Secure MySQL:

mysql_secure_installation

Create Roundcube database:

mysql -u root -p
CREATE DATABASE roundcube;
CREATE USER 'roundcubeuser'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON roundcube.* TO 'roundcubeuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Download & extract Roundcube (latest complete version):

cd /var/www
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz
tar xvf roundcubemail-1.6.9-complete.tar.gz
mv roundcubemail-1.6.9 roundcube
rm roundcubemail-1.6.9-complete.tar.gz
chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
mysql roundcube < /var/www/roundcube/SQL/mysql.initial.sql

Nginx config for Roundcube (/etc/nginx/sites-enabled/roundcube):

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com;
 root /var/www/roundcube;
 index index.php;

 location / {
 try_files $uri $uri/ /index.php;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass unix:/run/php/php8.0-fpm.sock;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
 expires 360d;
 access_log off;
 }
}

Test & reload Nginx, then get SSL:

nginx -t && systemctl reload nginx
certbot --nginx -d yourdomain.com

Visit https://yourdomain.com/installer → follow the wizard:

Database: roundcube, user roundcubeuser, password you set
IMAP host: localhost
SMTP host: localhost
Default host: mail.yourdomain.com

Enable all plugins except Enigma (it breaks identities in older versions).

After finishing, delete the installer:

rm -rf /var/www/roundcube/installer

Step 6: Quality-of-Life Tweaks

Edit /var/www/roundcube/config/config.inc.php:

// Login with just username (no need to type @domain.com)
$config['username_domain'] = 'yourdomain.com';

// Stay logged in for 6 months
$config['session_lifetime'] = 259200;

// Disable Enigma if you enabled it
// Remove 'enigma' from $config['plugins'] array

Increase attachment size:

nano /etc/php/8.0/fpm/php.ini

upload_max_filesize = 50M
post_max_size = 50M

Then:

systemctl restart php8.0-fpm

Step 7: Brute-Force Protection with Fail2Ban

apt install fail2ban -y
cd /var/www/roundcube/plugins
wget https://github.com/texxasrulez/roundcube_fail2ban/archive/refs/tags/1.4.zip
unzip 1.4.zip
mv roundcube_fail2ban-1.4 fail2ban
rm 1.4.zip

Enable in Roundcube config (config.inc.php):

$config['plugins'][] = 'fail2ban';

Add jail (/etc/fail2ban/jail.local – create if missing):

[roundcube]
enabled = true
port = http,https
filter = roundcube
action = iptables-multiport[name=roundcube, port="http,https"]
logpath = /var/www/roundcube/logs/errors.log
maxretry = 5
bantime = 3600

Create filter (/etc/fail2ban/filter.d/roundcube.conf):

[Definition]
failregex = IMAP Error: Login failed for .* from <HOST>
ignoreregex =

Restart:

systemctl restart fail2ban php8.0-fpm

Done! Your webmail is now protected.

Final Result

You now have:

Full email server with DKIM, SPF, DMARC
Beautiful, fast Roundcube webmail
Zero Google/Microsoft involvement
Login once every 6 months
Brute-force protection
All for ~$50/year

Welcome to real email freedom.

Thanks for reading! 😊

How to use AI privately at Brave browser (2 methods)

Mon, 08 Dec 2025 23:15:59 +0000

Introduction

Brave Browser 1.69 introduced a game-changing feature: you can now connect Leo (Brave’s built-in AI assistant) to any model you want — including fully local models or third-party APIs. This means you get an always-available AI sidebar with zero subscription and total control over privacy and cost.

Here are the two best methods I’ve tested (one ultra-private, one smarter but cloud-based).

Method 1 – Maximum Privacy: Run a Local Model with Ollama (No GPU Needed)

You can run a surprisingly capable model completely offline, even on very modest hardware. The current sweet spot is Google’s Gemma 2 2B — it’s tiny (~1.4 GB), runs great on CPU, and works perfectly even with just 4–6 GB of RAM free.

Step 1: Install Ollama

Download and install Ollama from the official site: https://ollama.com (It has native packages for Windows, macOS, and Linux.)

Step 2: Download Gemma 2 2B

Open a terminal and run:

ollama pull gemma2:2b

(If you use Docker: docker exec -it ollama ollama pull gemma2:2b)

Step 3: Verify it’s running

Open http://localhost:11434 in your browser. You should see “Ollama is running” — that’s all you need.

Step 4: Add the model to Brave Leo

Open Brave → Settings → Leo
Click Add new model
Fill in the details exactly like this:

Label → anything you want (e.g., “Gemma 2 2B Local”)
Model Request Name → gemma2:2b
Server Endpoint → http://localhost:11434/v1/chat/completions
API Key → leave empty

(Optional but recommended) Set this model as your default for new chats.

Done! You now have a fully private, offline AI inside Brave that uses almost no resources.

Method 2 – Smarter Answers (Cloud): Use CryptoTalks.ai (Pay-as-you-go, No Subscription)

If you want access to the absolute best models (GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Flash, Llama 3.1 405B, etc.) without creating accounts at OpenAI/Anthropic/Google, CryptoTalks.ai is currently the best option. You pay only for what you use and can fund the account with Bitcoin or Lightning.

Step 1: Create an account & get your token

Go to https://cryptotalks.ai/signup → sign up → copy your API token (keep it safe!).

Step 2: Add a tiny amount of credit

Deposit any amount via Bitcoin or Lightning. Even $1–2 lasts a very long time for personal use.

Step 3: Add the model(s) to Brave Leo

Same process as before, just different values:

Label → e.g., “Claude 3.5 Sonnet”, “GPT-4o”, etc.
Model Request Name → exact model ID from their docs, examples:
- openai/chatgpt-4o-latest
- anthropic/claude-3.5-sonnet
- google/gemini-flash-1.5
- meta-llama/llama-3.1-405b-instruct
Server Endpoint → https://cryptotalks.ai/v1/chat/completions/
API Key → paste your token

You can add as many models as you want and switch between them instantly in the Leo sidebar.

Pro tip: Check current model rankings at https://artificialanalysis.ai/models to pick the best one for your needs.

Real-World Use

With Leo + your own model you can:

Summarize long articles or YouTube videos in one click
Explain complex code snippets
Draft emails or messages
Translate on the fly
All without ever leaving the browser and without sending data to big tech

When I’m on battery and want zero extra power draw → I switch to the local Gemma 2 2B. When I need maximum intelligence → I switch to Claude 3.5 Sonnet or GPT-4o via CryptoTalks.

Conclusion

Brave just turned every browser into a private, customizable AI workstation. Pick Method 1 for 100% privacy and zero cost, or Method 2 when you want the absolute best answers available today.

Either way — welcome to the future of browsing.

Thanks for reading! 😊