7 ms·

Before anyone races in with a suggestion to use a VPN service, I STRONGLY suggest that you consider running your own self-hosted server instead. There is a grea

by dguido 10y ago

Before anyone races in with a suggestion to use a VPN service, I STRONGLY suggest that you consider running your own self-hosted server instead. There is a great set of Ansible scripts to do just that right here: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

cocochanel 10y ago
So now it's at the point where we need to be running our own self-hosted servers? As a European I find it weird that America land of Silicon Valley does not fight for important issues like this. Can anyone explain?
- Endy 10y ago
  Sure, I can explain it in one word: Republicans.
  - obeone1984 10y ago
    I'm almost positive 50 democratic senators voted for this. It's not a Republican or Democrat thing - it's a power thing. You will be hard pressed to find many Republicans in Silicon Valley.
- javiani 10y ago
  I think it's called corruption. Most working folks trusted that rational people were in charge and a duty to the greater good would be more powerful than self-interest. I gather this sort of thing has happened before: http://www.rome.info/history/empire/fall/ http://www.rome.info/history/empire/fall/
- newsat13 10y ago
  I think you misunderstand how modern Silicon valley works. The new wave of companies is not about technology. It's about what makes money and effective marketing. Even Google which supposedly the tech lord of our generation.. is really about ads. Take away ads and Google isn't google anymore doing cool things as they will have no money for it.
  - cookiecaper 10y ago
    Yeah, I think this is being underestimated. These hip tech companies WANT to get as much data on you as possible, so they're not raising complaints. If they can get a contract with your ISP for access to all of your requests, they can see anything you do on the net, not just what you do from Chrome and/or Android!
- rebuilder 10y ago
  Why would Silicon Valley companies fight for tighter government regulation of what and how user data can be used for? Wouldn't you expect the opposite?
  - stephenr 10y ago
    Because not all SV companies are data whores/pimps? I know the hot new thing is to get zillions in VC funds to provide some half-assed free service, based on the idea that one day you'll have a heap of users who you can somehow milk for a profit, but once upon a time, tech companies made money by providing useful products and services that people were willing to pay for.
    - mastazi 10y ago
      > Because not all SV companies are data whores/pimps? True, but the biggest ones among them definitely are (depending on your definition of "data whores/pimps", Apple might or might not be included here).
- TylerH 10y ago
  The companies doing this are not Silicon Valley companies. They're old phone companies, more or less, that became internet companies because they owned all the cable that was already laid. And of course the politicians passing this don't give a shit about the Silicon Valley culture or ideals; Republicans care about profits for corporations because that means more fat donations to them.
  - CaptainZapp 10y ago
    Silicon Valley culture of ideals ? No offense, but that's the most ludicrous statement I read in a long time. Silicon Valley is about money and power. Ideals, apart from "ideals" packed into cheesy marketing slogans, just don't play into that.
  - mastazi 10y ago
    To be fair, those old phone companies just wanted to be able to do the same thing that Google, Facebook and other SV companies are already doing. So much for the "Silicon Valley culture or ideals".
- cookiecaper 10y ago
  The idealistic conservative's perspective is that the government should regulate the minimum amount of conduct necessary to have a successful and functioning market. In accordance with free market principles, this regulation is being repealed on the belief that it does not serve a necessary function. Before you scoff, please realize that legal restrictions are immensely heavy-handed, and very frequently abused or misappropriated. Regulations frequently accidentally overshoot their target, and they stay on the books for years. Discarding unnecessary regulations is not only good hygiene, but it may be critical to the development of some improvement or technology that the lawmakers had not conceived when the law was made. It'd be nice if Congress was fast enough on its feet to recognize this as it was occurring and make the necessary adjustments, but it simply does not work that way; once something is law, it's very likely going to stay that way, untouched for decades or even centuries. Remember all the articles about the FBI attempting to invoke a statute from 1798 (yes, seventeen-ninety-eight, numbers not transposed) to compel the decryption of an iPhone? For example, the CFAA passed long before the World Wide Web was a thing, but it's had an immense effect on the internet's development and continues to be misappropriated by large companies to harass small players and break their products before they get large enough to pose a threat. Another example is the Copyright Act, which, under current interpretation, considers RAM copies of copyrighted works as distinct copies eligible for protection. This means that you're potentially violating someone's copyright just by downloading their web site! Combine these two statutes written for bygone times but very much in full effect today, and if you make the wrong person mad, you're looking at not only going bankrupt trying to figure out how to pay your legal bills, but also becoming a felon. Such was the case with Aaron Swartz, who was facing prosecution under these outdated regulations for downloading publicly-funded research papers from a paywalled database. It should also be clarified that this repeal only removes one set of regulations, a set imposed by the FCC and that has only existed for the last couple of years. I'm not a lawyer, but somehow I doubt the issue is so simplistic that Comcast is going to open up "BuyYourNeighborsBrowsingHistory.com" any time soon. There are a variety of other laws that may apply to the legality of reselling such data, and surely these would require evaluation before the concept was greenlit. Furthermore, if Congress can be convinced that this is a bad idea, they need only to pass a new bill. The core issue is that telecommunications services, including ISPs, are not what most people would consider a functioning free market, because 90%+ of the U.S. can not obtain comparable service from anyone besides the main telecommunication provider in their area. If they could, moving to an ISP that respected privacy without being compelled to do so by legal force would be a perfectly reasonable position to take. The focus must be on getting our reps to solve the constrained telco market. Interestingly enough, that may also involve liberations to and/or removals of the FCC regulations around radio broadcasting, licensing, etc. One humorous note: if we believe the most dramatic prophecies about the meaning of this repeal, the last season of South Park may be closer to real life than we think. A foreign company develops technology to uncover the complete internet history of every human and the real-world identity behind every anonymous or pseudonymous post and threatens to publicize these. Complete social breakdown ensues.
ransom1538 10y ago
VPN question. If you take out a credit card and pay for a cloud solution (aws,etc) and run this software, isn't your identity clearly tracked back to you via your one exit ip? It seems if you want to use VPN services you would want to be in a pool of users with many exit nodes - and have deniability?
- Gnewt 10y ago
  It depends on your threat model. If you want anonymity, you'll have to take further steps. Self-hosting on a VPS that's linked to you protects you only from your ISP, which is enough if you're concerned about your ISP selling your traffic data. Of course, you'll need to trust your VPS' outbound ISP... but I think it's fairly reasonable to assume that consumer ISPs are more likely to sell your data than larger providers.
  - daurnimator 10y ago
    > I think it's fairly reasonable to assume that consumer ISPs are more likely to sell your data than larger providers. Why? Most consumer ISPs are larger than data centre ISPs, if they're not the same company in a given region.
    - WalterSear 10y ago
      Because, in aggregate, random server traffic data is going to be less valuable/monetizabe than home use traffic, that can be linked to a specific person or household..
- Perceptes 10y ago
  Algo's stated goal is explicitly not to provide anonymity. It is to secure connections made on untrusted networks, e.g. while traveling. It will work for the use case being discussed w/r/t ISPs collecting and selling your usage info, too, because it's not about hiding who you are, it's about preventing your ISP from seeing the final destination of your requests.
- Wingman4l7 10y ago
lxjw 10y ago
What is the benefit of this over using a provider like PIA? PIA claims to store no logs, and this claim is supported with evidence that government entities could not force them to turn over any logs. But if you use a provider like Digital Ocean and run your own VPN, then Digital Ocean can and will log all connections and traffic to and from the VPN, and if a government entity of any sort ever approached them for any reason (such as if self-hosting VPNs became commonplace with DO, and the NSA wanted to suck all that data up), they'd hand it all over immediately.
- Gnewt 10y ago
  You place full trust in the provider of your VPN. If you'd like to use PIA, you have to trust them -- and you can make your own decisions about that. I think it's fairly reasonable to trust them based on available evidence, but it really depends on your threat model.
- toufka 10y ago
  The threat in this model is not the government, but rather from a private isp selling usage data attached to your name. As you are a paying customer it is not in Digital Ocean's interest to sell usage stats attached to real identities. This somehow is not the case for Comcast.
- fulafel 10y ago
  What makes you think DO logs all traffic?
  - lxjw 10y ago
    They don't advertise themselves as a company particularly concerned with preserving the absolute privacy of their customers like PIA does. I admit I haven't read their privacy policy, but I'm assuming they would have no problems handing over logs, and I'm assuming they indeed keep logs (or at least are entirely willing to do so if asked to).
    - deleted 10y ago
      [deleted]
jorblumesea 10y ago
I don't think this is good advice unless you are a security professional or engineer and isn't a good solution for the vast majority of the country. The amount of things you can misconfigure, screw up or fail to understand is enormous if you aren't well versed. Imo, vpn service is like crypto: far better to leave it up to the pros. Rolling your own may leave you open to far worse things. The real solution is a vpn service people can actually trust.
- nuggien 10y ago
  You should read the mission statement of something like https://github.com/trailofbits/algo https://github.com/trailofbits/algo (linked to by parent post) before making this statement. Would you rather trust your own locked own server which does one thing very well, or a vpn service which has to provide everything under the sun in order to cater to as many customers as possible? Edit: also https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
tensor 10y ago
Isn't one of the benefits of a VPN service that many people use its exit nodes, thus the chance of identifying you is greatly lessened?
skynode 10y ago
And here I am with the VPN solution :) https://www.privateinternetaccess.com/pages/privacy-from-internet-service-provider-isp https://www.privateinternetaccess.com/pages/privacy-from-int... Disclosure: I'm a customer but thankfully not a US-based customer (there are more and more reasons to NOT live in the US these days).
- mirimir 10y ago
  Are you an affiliate for them?
  - skynode 10y ago
    No I'm not.
    - mirimir 10y ago
      Sorry, that was a bitchy question. I like PIA too, but their affiliates are notorious for spamming VPN review sites.
jameslk 10y ago
> Something to know about Algo: the VPN box operator, or whoever pwns it, can MitM all your TLS (!!) connections https://twitter.com/FiloSottile/status/808355117011521537 https://twitter.com/FiloSottile/status/808355117011521537 Worth noting. I guess no solution is flawless.

by dguido 10y ago

cocochanel 10y ago

So now it's at the point where we need to be running our own self-hosted servers? As a European I find it weird that America land of Silicon Valley does not fight for important issues like this. Can anyone explain?

Endy 10y ago
Sure, I can explain it in one word: Republicans.
- obeone1984 10y ago
  I'm almost positive 50 democratic senators voted for this. It's not a Republican or Democrat thing - it's a power thing. You will be hard pressed to find many Republicans in Silicon Valley.
javiani 10y ago
I think it's called corruption. Most working folks trusted that rational people were in charge and a duty to the greater good would be more powerful than self-interest. I gather this sort of thing has happened before: http://www.rome.info/history/empire/fall/ http://www.rome.info/history/empire/fall/
newsat13 10y ago
I think you misunderstand how modern Silicon valley works. The new wave of companies is not about technology. It's about what makes money and effective marketing. Even Google which supposedly the tech lord of our generation.. is really about ads. Take away ads and Google isn't google anymore doing cool things as they will have no money for it.
- cookiecaper 10y ago
  Yeah, I think this is being underestimated. These hip tech companies WANT to get as much data on you as possible, so they're not raising complaints. If they can get a contract with your ISP for access to all of your requests, they can see anything you do on the net, not just what you do from Chrome and/or Android!
rebuilder 10y ago
Why would Silicon Valley companies fight for tighter government regulation of what and how user data can be used for? Wouldn't you expect the opposite?
- stephenr 10y ago
  Because not all SV companies are data whores/pimps? I know the hot new thing is to get zillions in VC funds to provide some half-assed free service, based on the idea that one day you'll have a heap of users who you can somehow milk for a profit, but once upon a time, tech companies made money by providing useful products and services that people were willing to pay for.
  - mastazi 10y ago
    > Because not all SV companies are data whores/pimps? True, but the biggest ones among them definitely are (depending on your definition of "data whores/pimps", Apple might or might not be included here).
TylerH 10y ago
The companies doing this are not Silicon Valley companies. They're old phone companies, more or less, that became internet companies because they owned all the cable that was already laid. And of course the politicians passing this don't give a shit about the Silicon Valley culture or ideals; Republicans care about profits for corporations because that means more fat donations to them.
- CaptainZapp 10y ago
  Silicon Valley culture of ideals ? No offense, but that's the most ludicrous statement I read in a long time. Silicon Valley is about money and power. Ideals, apart from "ideals" packed into cheesy marketing slogans, just don't play into that.
- mastazi 10y ago
  To be fair, those old phone companies just wanted to be able to do the same thing that Google, Facebook and other SV companies are already doing. So much for the "Silicon Valley culture or ideals".
cookiecaper 10y ago
The idealistic conservative's perspective is that the government should regulate the minimum amount of conduct necessary to have a successful and functioning market. In accordance with free market principles, this regulation is being repealed on the belief that it does not serve a necessary function. Before you scoff, please realize that legal restrictions are immensely heavy-handed, and very frequently abused or misappropriated. Regulations frequently accidentally overshoot their target, and they stay on the books for years. Discarding unnecessary regulations is not only good hygiene, but it may be critical to the development of some improvement or technology that the lawmakers had not conceived when the law was made. It'd be nice if Congress was fast enough on its feet to recognize this as it was occurring and make the necessary adjustments, but it simply does not work that way; once something is law, it's very likely going to stay that way, untouched for decades or even centuries. Remember all the articles about the FBI attempting to invoke a statute from 1798 (yes, seventeen-ninety-eight, numbers not transposed) to compel the decryption of an iPhone? For example, the CFAA passed long before the World Wide Web was a thing, but it's had an immense effect on the internet's development and continues to be misappropriated by large companies to harass small players and break their products before they get large enough to pose a threat. Another example is the Copyright Act, which, under current interpretation, considers RAM copies of copyrighted works as distinct copies eligible for protection. This means that you're potentially violating someone's copyright just by downloading their web site! Combine these two statutes written for bygone times but very much in full effect today, and if you make the wrong person mad, you're looking at not only going bankrupt trying to figure out how to pay your legal bills, but also becoming a felon. Such was the case with Aaron Swartz, who was facing prosecution under these outdated regulations for downloading publicly-funded research papers from a paywalled database. It should also be clarified that this repeal only removes one set of regulations, a set imposed by the FCC and that has only existed for the last couple of years. I'm not a lawyer, but somehow I doubt the issue is so simplistic that Comcast is going to open up "BuyYourNeighborsBrowsingHistory.com" any time soon. There are a variety of other laws that may apply to the legality of reselling such data, and surely these would require evaluation before the concept was greenlit. Furthermore, if Congress can be convinced that this is a bad idea, they need only to pass a new bill. The core issue is that telecommunications services, including ISPs, are not what most people would consider a functioning free market, because 90%+ of the U.S. can not obtain comparable service from anyone besides the main telecommunication provider in their area. If they could, moving to an ISP that respected privacy without being compelled to do so by legal force would be a perfectly reasonable position to take. The focus must be on getting our reps to solve the constrained telco market. Interestingly enough, that may also involve liberations to and/or removals of the FCC regulations around radio broadcasting, licensing, etc. One humorous note: if we believe the most dramatic prophecies about the meaning of this repeal, the last season of South Park may be closer to real life than we think. A foreign company develops technology to uncover the complete internet history of every human and the real-world identity behind every anonymous or pseudonymous post and threatens to publicize these. Complete social breakdown ensues.

ransom1538 10y ago

VPN question. If you take out a credit card and pay for a cloud solution (aws,etc) and run this software, isn't your identity clearly tracked back to you via your one exit ip? It seems if you want to use VPN services you would want to be in a pool of users with many exit nodes - and have deniability?

Gnewt 10y ago
It depends on your threat model. If you want anonymity, you'll have to take further steps. Self-hosting on a VPS that's linked to you protects you only from your ISP, which is enough if you're concerned about your ISP selling your traffic data. Of course, you'll need to trust your VPS' outbound ISP... but I think it's fairly reasonable to assume that consumer ISPs are more likely to sell your data than larger providers.
- daurnimator 10y ago
  > I think it's fairly reasonable to assume that consumer ISPs are more likely to sell your data than larger providers. Why? Most consumer ISPs are larger than data centre ISPs, if they're not the same company in a given region.
  - WalterSear 10y ago
    Because, in aggregate, random server traffic data is going to be less valuable/monetizabe than home use traffic, that can be linked to a specific person or household..
Perceptes 10y ago
Algo's stated goal is explicitly not to provide anonymity. It is to secure connections made on untrusted networks, e.g. while traveling. It will work for the use case being discussed w/r/t ISPs collecting and selling your usage info, too, because it's not about hiding who you are, it's about preventing your ISP from seeing the final destination of your requests.
Wingman4l7 10y ago

lxjw 10y ago

What is the benefit of this over using a provider like PIA? PIA claims to store no logs, and this claim is supported with evidence that government entities could not force them to turn over any logs. But if you use a provider like Digital Ocean and run your own VPN, then Digital Ocean can and will log all connections and traffic to and from the VPN, and if a government entity of any sort ever approached them for any reason (such as if self-hosting VPNs became commonplace with DO, and the NSA wanted to suck all that data up), they'd hand it all over immediately.

Gnewt 10y ago
You place full trust in the provider of your VPN. If you'd like to use PIA, you have to trust them -- and you can make your own decisions about that. I think it's fairly reasonable to trust them based on available evidence, but it really depends on your threat model.
toufka 10y ago
The threat in this model is not the government, but rather from a private isp selling usage data attached to your name. As you are a paying customer it is not in Digital Ocean's interest to sell usage stats attached to real identities. This somehow is not the case for Comcast.
fulafel 10y ago
What makes you think DO logs all traffic?
- lxjw 10y ago
  They don't advertise themselves as a company particularly concerned with preserving the absolute privacy of their customers like PIA does. I admit I haven't read their privacy policy, but I'm assuming they would have no problems handing over logs, and I'm assuming they indeed keep logs (or at least are entirely willing to do so if asked to).
  - deleted 10y ago
    [deleted]

jorblumesea 10y ago

I don't think this is good advice unless you are a security professional or engineer and isn't a good solution for the vast majority of the country. The amount of things you can misconfigure, screw up or fail to understand is enormous if you aren't well versed. Imo, vpn service is like crypto: far better to leave it up to the pros. Rolling your own may leave you open to far worse things. The real solution is a vpn service people can actually trust.

nuggien 10y ago
You should read the mission statement of something like https://github.com/trailofbits/algo https://github.com/trailofbits/algo (linked to by parent post) before making this statement. Would you rather trust your own locked own server which does one thing very well, or a vpn service which has to provide everything under the sun in order to cater to as many customers as possible? Edit: also https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...

tensor 10y ago

Isn't one of the benefits of a VPN service that many people use its exit nodes, thus the chance of identifying you is greatly lessened?

skynode 10y ago

And here I am with the VPN solution :) https://www.privateinternetaccess.com/pages/privacy-from-internet-service-provider-isp https://www.privateinternetaccess.com/pages/privacy-from-int... Disclosure: I'm a customer but thankfully not a US-based customer (there are more and more reasons to NOT live in the US these days).

mirimir 10y ago
Are you an affiliate for them?
- skynode 10y ago
  No I'm not.
  - mirimir 10y ago
    Sorry, that was a bitchy question. I like PIA too, but their affiliates are notorious for spamming VPN review sites.

jameslk 10y ago

> Something to know about Algo: the VPN box operator, or whoever pwns it, can MitM all your TLS (!!) connections https://twitter.com/FiloSottile/status/808355117011521537 https://twitter.com/FiloSottile/status/808355117011521537 Worth noting. I guess no solution is flawless.