D (3:04)

Happy holidays, Beau. Thanks for having me.

A (3:06)

Osint, by the way, if you're not familiar with the term, just means open source intelligence, which kind of means Googling, but it's a little more intense than that.

D (3:15)

Very fancy.

A (3:15)

Googling is a great way to put it.

D (3:17)

OSINT is open source intelligence. And a big part of open source intelligence is finding things that are publicly accessible. You can using things like Google, using things like people's search sites, government databases, things of that nature, where you're using all of this information that is given to the public, but you're using it to find some sort of item on a specific individual. So think background checks. It's a great way to kind of put into what OSIN is, is I do background checks for people.

A (3:41)

Yeah. It's what, you know, the more paranoid among us when we were dating did about the people we were going on dates with, like a thousand. Nick, I want to talk about what we do, which is we remove personal information from the Internet. Why? Why do you think that's a big deal? Are you able to find a lot of stuff online through your work?

D (4:08)

Oh, of course. And there's a lot of different means in which we use to do that.

A (4:12)

Right.

D (4:12)

People search sites are the biggest one. There's also a lot of different privacy sites that we also remove from real estate sites are a huge one. If I could know before I even meet you where your entrances to your home are or, you know, where your kids go to school. That's all things that people should be worried about that a lot of people aren't.

A (4:28)

Also, like, how much you pay in taxes. And there's a lot that can go into profiling somebody. A lot of people are going to hear that and say, well, I don't think anyone's going to come to my house. Mm.

D (4:40)

And a lot of people do.

A (4:41)

Right.

D (4:41)

It's the common thing to say, oh, well, why me?

A (4:44)

Right.

D (4:45)

No one cares about my info. And so inside of cyber, there's something called the cyber kill chain, which is how attackers do attacks. Right. And the end stage of that is called called actions on objectives, which is the attacker gets what they want, they get their goal. And so for a lot of people, you're in the way of their actions on objectives. If they're Trying to reach a CEO of a company, if they're trying to reach someone outside of you, even if they're just trying to extort you for money, Right. Whatever it may be, all of them are doing that for an intentional reason, and you may just be in the way of that. So no one's off the table anymore. There is no such thing as a low value target at this point.

A (5:20)

Well, you know, I always think of the why me? Thing, where I'm like, you know, because of something bad happened, I'm like, why me? And, you know, I try to get into the practice of saying why me? When something good happens, so it can be a little humble.

D (5:30)

100%.

A (5:31)

The why me? Of, of this world of cybercrime is answered always by why not? Absolutely.

D (5:41)

And that's a big part of it too, right? We have to consider who you are, your type of privilege. That's another thing attackers consider all the time is, do you have access to certain databases that I would want access to? Do you have something where, if I put ransomware on your network, could you spread to other people? Are you well known to the organization? All of these questions run through an attacker's mind daily, especially with every attack. And now the threat landscape has changed where it's not just somebody who's sitting in their basement with a hoodie on. This is a real 9 to 5 for a lot of people. And so the expectation that every employee, every person will know what information is exposed about them is not a reality anymore. It's not true.

A (6:19)

I would like to point out we're both wearing hoodies, but the, the, the, the fact is that, Nick, you are. If I wanted to get into Deleteme's systems, and I'm not challenging anyone, so please get the, get the wrong idea out of your head, you would be someone I could target. That's the point I'm trying to land here. Anyway, it's not about titles or org charts. It's about proximity and usefulness. If I'm an attacker, I don't care that you're not the CEO. It doesn't matter. In fact, you're probably not the CEO. I care that people trust you in that organization. I care that your name shows up in Slack, in email threads and calendars. People are used to seeing your name. I care that if I pretend to be you, no one's going to blink. So when you say, why me? The answer is like, I don't know. You're not special. I mean, there's a certain amount of money to be made off of you right in the world. Someone can do criminal identity theft, they can do regular identity theft, account takeover, all that stuff. But it's not because you're special. It's because in an organizational world where a hacker might be looking to get to the CEO of your company, it's because you're connected. It's because you're a stepping stone to a destination. Your shortcut, you're a way in. The, the personal information removal side of things is not perfect because there's still certain things that are going to be online and one of those things is how you vote. And that is, that is a trick that bothers me perennially. And the only reason it doesn't bother me a ton is because that my public facing name is a little bit different from the name that I vote with because one is familiar to the IRS and one is not Nick. So what about that? We're doing these removals. We're doing them well. We're getting rid of a lot of stuff. And yet I can still go on. If I know the name that I vote with and pay my taxes with and find how I voted in the last election or what my, at least what my registration is, there's always information.

D (8:26)

That'S going to be outside of your control. Right. For example, I always like to provide the example of data breach lists. So this is something where you are involved in a data breach. Let's say it involves your password, your Social Security number and your home address. Those leaks can't inherently be taken down, they can't be removed. But a big part of it is knowing that it's there.

A (8:47)

Right.

D (8:47)

You know, your exposure because it is on your voter record, because it is still up. And there are sites where you can remove that info. But a lot of this comes back to ownership info as well. Right. Who owns these data brokers? It's a really challenging and complex topic that involves a lot of nuance. But a lot of these places are run from overseas. A lot of them use US people's data in order to make some sort of currency out of it. Right. Radarus is a fantastic example. It's run by two brothers who are out in Russia who have very, very high political ties to certain individuals.

A (9:18)

Right.

D (9:18)

And I think that's a big component of it as well is even with the information we can remove like voter records from some websites, others will be incredibly challenging just because of that ownership info.

A (9:29)

Now that's very interesting to me. What do you make of the fact that these people, search site owners aren't even in the United States and yet they're trafficking in all of our data. I mean, what's the end goal there? Are they just making money? I mean, how do they make their money?

D (9:44)

It's extremely concerning. And they make it off of US Citizens data. That's how they make their money. They let people pay for their records and when they get access, that's how they make it. And so a lot of the time, $6 in USD will go a long way depending on the country that they're based out of. And so a lot of these people are using US Citizens data that's publicly accessible because of the way that our governments are set up and then selling that data on the back end and that's how they're bringing in their revenue. But I mean, they make millions of dollars every year. And so the way I quantify it is it's very scary. It's, it almost is a national security threat. Especially since a lot of our foreign adversaries who are very involved in hacking, like China and Russia run a lot of these data brokers on the US front. And so it's a question of why would you want their, that info to be in their hands? Right.

A (10:33)

Yeah. And so, so part of it is removing your data from, from environments where people are making money off of it just because they, it's publicly facing and they can scrape it and use that, use it that way. What do you think, and I think about this all the time. What do you think the difference is between a person who has had their personal information removed, as far as that is possible, and the person who has done absolutely nothing? And what is, I'll tell you anecdotally, one difference is I went to a dinner a couple weeks ago and they didn't send me the address. And I showed up and they said, you didn't ask for the address? And I said I didn't need to. And they were creeped out by that.

D (11:17)

The biggest difference is that you're closing the door on attackers. Right. So attackers always look for something called the low hanging fruit, the easiest possible person that they can exploit. Because for a lot of these people, they don't care about the money they spend, but their time is money. If they spend an hour investigating a target, that's going to be an hour that they didn't investigate someone who may have been easier. Right? Someone that they could have pivoted to and used to break into a network or exploit a home address or exploit you financially. And so a lot of the times, what what you end up doing is you close the door on these attackers by having your Instagram accounts private, by removing yourself from public data, data brokers, you get rid of yourself and you close these doors. The attackers have less to grab onto, making you less of a target, making you less exploitable. That's really the biggest thing that data removal does.

A (12:07)

And here's what I heard you just say. You stay in the middle of the herd because if you're out at the, at the edges with all your stuff hanging out, you're going to get picked off by the predators if you're in the middle. And what does that look like to be in the middle? Let's do the flowchart. Have your social media. Have a social media account. You're towards the edges. Have where you can get picked off. Have a social media account that's set to private. You're closer to the center of the, you're safer. Have a social media account that is set to private. But friends of friends can see what you post. You're closer to the, to the, to the predators. So that's one thing. Now I'm a hacker. I, I am sort of a hacker. I mean, I'm, everyone's a hacker, guys. But I mean, yeah, but I'm, I, I, I'm pretty good at, at finding what, finding out things and, and I don't do anything with the information that's not true. I write about what I find out. But, you know, so, so I go, okay, Nicholas doesn't have an Instagram account that I can look at. Nicholas doesn't have any people search data that is reliable. I see a couple things, but I can't tell whether how reliable they are. And I don't find Nicholas on, you know, YouTube or anywhere else where I might be able to like grab some information. Whether that is your voice, your image, who knows? All I know is Nicholas is not easy. So I'm done. Not interested in Nicholas. I'm going to move on to somebody where I go, oh my gosh, they spent how much on their house? Whoa. And look at that car. And look at that. And their kids go to that school and they have a 3.6 average because they put that grade right in their Instagram account. That's the person I'm going after. When we come back, the Cyber New Year's resolutions we are thinking about.

C (14:17)

This message may be shocking to many millennials. If you are one, you might want to sit down right now. Loads of people are searching the following on low rise, jeans, halter top velour, tracksuit, hookah shell necklace, disc belt. You likely place these in the dark of your closet in 2004, never to be seen again. But if you can find it in yourself to dust them off, there are a lot of people who will give you money for them. Sell on Depop where taste recognizes taste Toast the holidays in a new way and raise a glass of Rumchata, a delicious creamy blend of horchata with rum. Enjoy it over ice or in your coffee. Rumchata. Your holiday cocktails just got sweeter. Tap or click the banner for more. Drink responsibly. Caribbean rum with real dairy cream. Natural and artificial flavors. Alcohol 13.75% by volume 27.5 proof. Copyright 2025 Agave Loco Brands, Pojoaquee, Wisconsin. All rights reserved.

A (15:18)

Let's get straight to the New Year's resolutions we want people to put in place in the New Year.

D (15:27)

The biggest thing I would suggest to people, especially in the age of AI, is establishing a safe word with your family and friends. Right? You brought up a really interesting point with the deep big technology and having your face and your voice out there, because people could start to mimic who you are. And this has created a big problem, especially when we navigate towards, okay, people can find your information on brokers, they can sound and look like you. Now we're starting to open the door to not only can they sound and look like you, they can be you. They can know information about you that only you should know. And so a lot of the times these people will call your family, they'll call distant relatives, they'll call people who you may be familiar with sounding like you, looking like you, and ask for money, ask for credit cards or gift cards or passwords. And all of these things sound like they're coming from your person. And so establishing a safe word is easily the best thing that people can do. Just one word, butterfly, whatever it may be. And establishing the safe word absolutely prevents you from being a target of these attacks because they won't know if you ask, what's our safe word? They're going to have no idea. Or what's the word that I told you about? They're never going to have any idea.

A (16:35)

I'm going to make fun of you a little bit and say from my person is not usually how I refer to things coming out of my mouth, but fine, I and by the way, I used to do Nick, I actually still am very hated for the April Fool's Day prank I played on my ex wife, my girlfriend and my I think it was just my ex wife and my girlfriend at the time. No, no. And a friend of the family. I sent them all a text saying, somebody go to school and pick up the kids. It was my day to pick up a four year old and a six year old. Somebody please go to the school and pick up the kids. I'm being arrested. Oh, goodness. But now here. And it wasn't true. It was an April Fool's joke. But they all showed up and I just sat there going, hi. And they were really mad at me. But the. I was younger and yeah, you would have to bleep what I was. But the point is, urgency is how you're going to get got at the end of the day. I said I was a hacker. I just demonstrated a hack. What I did was a hack. I got three people to show up to a place that was not convenient to them in 15 minutes.

D (17:51)

And that's a big thing that me.

A (17:54)

Yeah, exactly. Because had that been, had the gold been money, I would have had the money. So here's, here's, mine is. I don't care if it is a device that you think doesn't matter, like the thing that's playing music in your house or a camera that you don't think is connected to the outside world, or a mesh router that you have so that you can get service out in your yard. If you have something that plugs in and has a password and it doesn't support multiple factor authentication and it came with a default password that you're still using by January 15th, I want you to get those devices out of your house and replace them with devices that support mfa. And if you're like, I can't afford that right now. You can afford to change the default password to something secure.

D (18:59)

And bo, I actually have a question for you on that part. With smart devices, do you think people should have smart devices in their house at all? Because I feel a very certain way about smart devices.

A (19:10)

Okay, Now I have a mini split in my house. It is, I wouldn't say it's smart, but it's not stupid. It does connect to the Internet. And, and because I heat my house with firewood and when I go away to the house, go away from the house more than six hours in the wintertime, that's an issue. I am very happy to have a smart device that I can turn on and off in my house. Now can a hacker hack into that device and turn my heat off? Sure can. Yes, they can. And if someone, if I really pissed off the wrong hacker. And they wanted to do that to me. If you think they wouldn't, bear in mind someone like Brian Krebs, who is a security reporter who had heroin sent to his house.

D (20:03)

Why?

A (20:04)

Because his address was online. Okay. Did that answer your question?

D (20:08)

That did. And part of the reason I bring that up is because smart devices aren't bad and I think they make our lives more convenient. Right. But if you have an Amazon owned anything, an Alexa Google home, anything along those lines, a ring doorbell even, I would suggest trying to move away for something that's more privacy centric. And the reason I suggest that is they're monitoring tools that people put into their homes. They listen to you and people say that they don't, but they really, they really do. A lot of the times you'll end up on shopping lists and marketing lists based on what you tell your Alexa or what you tell your Google. You add these certain terminologies and you become even greater of a target because people can know, okay, this person is shopping for diapers. Right. They're shopping for cribs. We can infer that a baby is on the way if you're on those marketing lists. And so that makes you a target as well. A new mother who may be stressed out. Right. We may be able to exploit that as a hacker from an organization who, let's just say I'm trying to get to your CEO of a company that you work for, you're not going to pay attention to that link, you're not going to pay attention to that email, you're going to be stressed out because you have all these new responsibilities that are on the way. And so what I would suggest doing is trying to navigate away from Google home, away from Alexa. And if you can't do that, tweaking the privacy settings in your respective apps to where voice control isn't shared, or even with your ring doorbell, you don't opt in to any sort of facial recognition technology. All of these different types of things are great steps in the right direction. So I would highly suggest doing.

A (21:35)

You purist, you purist, you purist. I agree entirely. And bear in mind that when you get in your car, it knows who you are, it knows what you're doing, knows where you're going. And it's, it actually is getting very granular about the information that you, that you don't even know you're sharing with it.

D (21:50)

Absolutely. And, and there's something, if you look up car privacy or along those lines.

A (21:56)

Don'T do it, you'll lose Sleep. That's my advice.

D (21:58)

If you search up your VIN on those websites, you're going to see the types of controls that are baked into these companies privacy policy. And so for example, I just bought a new car that was manufactured in 2023 and they have no reference of what data is being shared. They have no reference of the data that they're using or utilizing for you. They have no reference of the third party brokers that they sell to. So all of this information is just a mystery and even though it should be involved in their privacy policy. And so that's a great point. Turn your devices to limited transmission, especially if you have a newer car. Make sure that you turn off or opt out from that type of recognition as well.

A (22:37)

Now I am trying not to be a system blaming critical person in 2026, but I, I am a bit. And so I do want to say that, you know, Mozilla did a report on cars that is very important and you should read it. And among the things that they discovered was that your car knows more than you would like about your sex life. How is that possible? I still don't quite understand it, but I really don't like it. And you know, it's a great idea to just bear these things in mind when you, when you are in front of a ring device at someone's door or whatever. I have gotten into the habit because I just think it's funny and I want it to become like a data point at, at Google. I just point to the camera and I say oh, that's recording. And, and then you know, let's go over there. That's recording. And here's the thing. If you don't think it's recording, how do you think it knows when you say Alexa or Siri or whatever its activation word is, the activation word doesn't turn it on, it's already on. Was that me? That was me. This is your turn now. What do you got?

D (24:04)

Well, I mean I think the biggest final piece that a lot of people don't recognize.

A (24:08)

Right.

D (24:09)

Because we've talked about MFA turning that on. I think you made a great point with securing your passwords a little bit more. Using something over 12 characters to 16 characters is suggested.

A (24:18)

But no default passwords.

D (24:19)

No default passwords ever. Right. Those things, you know, they're very. You can, you can Google what. What can I do to be more secure? Opt out of data brokers is another huge one. I think the biggest thing is taking action at specific events that you feel passionate about. Right. Especially with things pertaining to privacy. For example, Flocked cameras have popped up everywhere around the United States. Flocked is a privately owned company that scans license plates around the city and reports that to law enforcement agencies. That's what they do. That's their whole business model. And they're everywhere now. And so one of the things that a Denver cop recently said to someone who was innocently charged with breaking and entering was that you can't get a breath of fresh air in the city without us knowing about it. And I feel very strongly about that. Right. And so I've started to go to committees and started to go to things where we're speaking to legislative bodies who can do something about it.

A (25:09)

Right.

D (25:09)

Be passionate about security, be passionate about privacy, especially knowing that you're the product. At the end of the day, they're not selling this information because they, you know, they want to keep you in this ecosystem. They want to do the best that they can for the world. They're really selling you this information because you are the product. Right? I mean, even things like Google, they, they offer new phones for $800 off. And how do they do that? It's because your data is worth more than that to them. And so always being privacy minded, always reading the privacy policies even though people don't. And really being passionate about privacy is what I would suggest for 2026. It's a big, big topic and it's not going away anytime soon. Right now, get up to 20% off select online storage solutions put heavy duty HDX toads to good use, protecting what's important to you. The solid impact resistant design prevents cracking and the clear base and sides make items easy to find even when the totes are stacked. Find select online shelving and tote storage up to 20% off at the Home Depot. To organize every room in your home from your garage to your attic, visit homedepot.com how doers get more done.

A (26:27)

All right, how about a twist on data poisoning? So I'm talking about a kind of data poisoning that makes your information online worth less to a hacker or a threat actor. It's the digital version of what I've come to think of I personally call a Burger King liar. Now, what is a Burger King liar? A Burger King liar is a person who you call them on the phone. You're like, yo, what's up? Where are you? And they say, I'm at McDonald's. And you're like, cool, oh great, I'll meet you there. But they're actually at Burger King now. Why did they say McDonald's. It's the kind of lie that, you know, it doesn't make a difference anyway. That's the point. Tell a lie that doesn't make a difference. Poison your data with bad information.

D (27:16)

Oh, with. Without a shadow of a doubt, my. I think the best thing that people can do is starting to use that type of information, right? Have a voiceover IP number for the things that you use. One off, I'll give you an example. I went to Sky Zone with my nephews and they ask you to sign a waiver, but they ask you to provide an email address, a phone number, a full name and a home address, right?

A (27:37)

Which. Oh God.

D (27:38)

It's a lot of information, especially going to an organization that you have no idea about their privacy policy. You have no idea about who they are or what they're selling that to.

A (27:47)

And so two little kids yanking on.

D (27:49)

Your hand, two little kids trying to get you to go. It's overwhelming. And so people will just throw in their info, but you have to take the time, say, okay, I'm going to use a temporary email address, I'm going to use an address that doesn't really matter to me because they still can see you. If you use your first and last name and you show them your id, they still get to know who you are, you still get to sign that privacy policy. It's just you're not using a real phone number, you're not using a real email, you're not using a real address. I always suggest that people set up a P.O. box of some kind, try to use an LLC or a trust so that way your name doesn't become associated with that type of thing. The more info that you add to certain types of elements, it becomes concerning, it becomes worrying for a lot of people. And that information, who knows what will happen to it. We talked about the third party breaches. You can't control that. And so the best way you can control that is if that information does get exposed, you don't have to worry about it because there's nothing that's real out there. So data poisoning is a great, great, great, great thing to do. Especially in an age of brokers, foreign.

A (28:54)

Power round. You get one more thing that you get to tell people that you think they should do for 2026. And this is like real, Nick. This is super real. If you could, like, if you, afterwards, you can't be like, oh, I should have said that. Yeah, because now they got scammed. All right, so what do you got now?

D (29:11)

I was going to say the final point that, that I hope people do for 2026, especially with people buying new houses and setting up these new things and new big purchases that are coming up in this next year, I think the best thing you can do, set up an llc, set up a trust, set up something and put all of that into that. That would be my.

A (29:33)

But don't name it after yourself name.

D (29:34)

Yeah. Don't give a common name. Like, like, oh, Nicholas llc. Write something that's super common. Make it very generic, make it very, very safe word. Yeah. Establishing the same word. Right. Make it very basic, make it very simple. Don't use simple word.

A (29:49)

Yeah.

D (29:49)

And what you can end up doing with that is you're preventing your data from being exposed to your real name, to your real broker. Use a registered agent when you're setting up that LLC because you're protecting your information in that regard at that point. When you buy that home, when you buy that address, when you purchase that car. Right. All of those things can end up in data brokers hands due to the nature of public information. And the more that you limit that information in the new year, the better it's going to be. So you don't reappear on these broker sites, they won't be able to find you as easily and you won't be able to be aggregated. That would be my final suggestion.

A (30:24)

It's brilliant. It's totally on message. And by the way, nowadays anyone can do it for like 150 bucks, if not less. All right, I'm going to say password managers, think about this. You have now one password. And the password is the pink skull loves the cloud because the cloud makes cupcakes and the cupcakes lights, the cupcake likes Christmas lights. Algebraic formula. How do you like me now? Question mark. It's not an easy one to. That is a hard password to guess. And that's the one password you need to know because it's protecting all your other passwords and you don't have to like, you're not doing verifications all over the place saying authentication, saying this is me. The fewer times in a zero trust environment where you don't always know who you're talking to on the other end and it might be a hacker. Why would you want to say, here's the PIN code I just got.

D (31:27)

And that's, that's another huge part, right? And a big majority of this is that these password managers are so confident in their security, they offer $1 million, $2 million to anyone who can break into their systems. They're that confident in their security. It's an extra layer.

A (31:54)

All right, Nicholas, final thoughts.

D (31:57)

Change your privacy on everything. Read the privacy policies for apps, right? A big majority of data broker awareness that people don't know about is your apps on your phone. Everything you download that, that app your kid downloaded, right, that you thought was harmless? Well, turns out it shares location information and additional permissions that you didn't give explicit consent to give away to that app. And so a big majority of it, a big majority of data broker information comes from things that you download and you put into your homes, you put onto your devices. And so limiting that exposure, making sure that you're only downloading apps that you know about and the privacy policies and reading those things, it really makes a world of difference. And when you find something that is secure, it's night and day difference. Use secure things. That's really the final piece of info that I have.

A (32:50)

All right. And we're both obviously of the opinion that you should, if you can have your personal information removed from online, you should do it. And by the way, Delete Me has the only personal information service removal service that has been deemed number one by the New York Times Wirecutter. So if you're wondering which one to use, that's the one to use. Yeah, we, we agree. I wish you all a very happy New Year's. If you're working this week, I'm working a little bit this week, too, so I get it. It's fine. We're all going to get through this and we're not going to get hacked in 2026 because we're all going to do what we just talked about. HE LAUGHS because we are going to get hacked. But anyway, thanks for having me, Bill.

D (33:37)

I appreciate it.

A (33:39)

Thank you, Nicholas. Okay, that's it for now. See you in the new year. Stay safe out there. What the Heck? Is produced by Beau Friedlander. That's me and Andrew Steven, who also edits the show. What the hack is brought to you by delete. DeleteMe makes it quick and easy and safe to remove your personal data online, and was recently named the number one pick by a New York Times wirecutter for personal information removal. You can learn more about DeleteMe if you go to JoinDeleteMe.com wth that's JoinDeleteMe.com wth and if you sign up there on that landing page, you will get a. A 20% discount, I kid you not, a 20% discount. So, yes, color me fishing, but it's worth it.

C (34:47)

Why have three Gilmore Girls in a small town resonated with generations of fans? And what does a TV series that ended nearly two decades ago reveal about who we want to be? Generation Gilmore Girls is a brand new three part podcast series that looks for answers where it all began in Connecticut. Hosted by me, Chloe Wynn and produced by Connecticut Public, the same award winning NPR and PBS member station behind the chart topping podcast Generation Barney. This series is about the TV we love and how it shapes us. We'll take you inside the creation of Gilmore Girls, why we keep revisiting it, and the impact the show has had on its home state. Whether you're a longtime fan or new to the show, this show, this podcast offers fresh insights and heartfelt nostalgia. Follow Generation Gilmore Girls on Apple Podcasts, Spotify or wherever you're listening now. Trust me, it's worth the trip back to Stars Hollow.

D (35:46)

Hi, it's Reece Gorman, Congressional Reporter and host of the brand new podcast On Notice. This is the new podcast from Notice, the nonpartisan newsroom covering politics and policy in Washington, dc. Each week I'll bring you real conversations with members of Congress and those who make the Hill run, and it's packed into just 30 minutes so you can learn a lot without taking too much time out of your busy day. Join me for On Notice. That's Notice spelled N O t u s available every Monday wherever you get your podcast or on YouTube.