5 ms·

I suspect that, for less savvy potential customers (read: the vast majority of them), "That One Privacy Site" can do more harm than good. I wrote a bit about c

• rand98765 9y ago
  The problem I've found with running my own vpn is that I could not find affordable vps with anywhere near as affordable bandwidth and speed. The main vps providers all cap your download/upload. ovpn is what I settled on and am quite happy.
  • davepeck 9y ago
    Yes, this is definitely an issue - I should really put an asterisk on my “roll your own” proclamations. Better VPN providers offer numerous POPs and generally good network perf that can be hard to replicate on one’s own. (That said, these are necessary but not sufficient conditions for a given VPN provider to be “better”.)
• LeoPanthera 9y ago
  I don't see how having more information can be harmful. There's even a simplified red/yellow/green table if you don't want the details. TOPS is one of the extraordinarily few impartial guides to VPN providers. We would be far worse off without it. Running your own VPN is fine if your goal is to protect yourself from a malicious LAN, but useless if you're trying to hide your identity. The IP of whatever provider you choose can reveal your identity just as easily as your home IP.
  • davepeck 9y ago
    > I don't see how having more information can be harmful. It can be harmful in the hands of less savvy potential VPN customers, when it leads them entirely to the wrong conclusions. (You're unlikely to fit in this category.)
    • LeoPanthera 9y ago
      Like I said, I'm pretty sure anyone can understand red=bad and green=good.
      • davepeck 9y ago
        If you use TOPS and simply choose the provider with the most green, you'll have made a terrible mistake.
        • LeoPanthera 9y ago
          I never said anything about picking "the most green". The columns are labelled and described in detail on a separate page.
          • davepeck 9y ago
            Neither, I suspect, did you read my post. We can probably end here. :-)
            • JohnStrange 9y ago
              Looks to me like you're primarily advertising Cloaks, owned by a US-based company. There are tons of reasons why privacy-minded users would want to avoid a company under US jurisdiction, but you mention none of them.
              • davepeck 9y ago
                There might indeed be reasons to avoid US jurisdiction -- that's true, but it's not relevant to the point I attempt to make, which is that labeling the US "bad" by default and without qualification is silly, and is one (of several) ways TOPS might lead less savvy potential customers astray. As an aside, I'm skeptical that there are "tons" of actually good reasons to avoid US jurisdiction. I don't doubt that good reasons exist. It's just that I've seen plenty of bad ones! :-) And to clarify: no, advertising Cloak is absolutely not my goal. If you're interested, I'm always happy to recommend trustworthy VPN services that aren't Cloak. I mention Cloak in that post because in my (biased!) opinion it's a good exemplar of the six criterion I look for. That's no accident, since I co-founded Cloak and built it in part to satisfy those criterion. That I'm Cloak's co-founder is pretty clearly disclosed both here on HN and on my personal blog. I should mention, for completeness, that I'm no longer affiliated with Cloak.
• WillyTheWalrus 9y ago
  So much wrong about this blog post - first, written by the creator of a VPN company, someone obviously biased, with a stake in the industry: Many of the items you claim are not addressed by TOPG absolutely are. Questionable/sketchy product marketing & SEO, ethical business practices, etc are all covered in the detailed comparisons Ethics section. Other items you claim he SHOULD look at go against his methodology and are impossible to indepdently verify - such as technical architecture and sustainability. The main purpose of jurisdiction is to see which countries are more likely to illegally spy on its citizens and which have a track record of being an "enemy of the internet". You claim a VPN located in the US (like the one you made and have a stake in) are subject to government agencies such as the FTC, but many if not most of these companies are regularly allowed to flout FTC rules on native advertising and bad SEO and such which is why the industry is largely in the misinformation mess that it is - and we all know about Five Eyes and why that matters - any laws claiming to protect its citizens are kind of negated by programs such as PRISM, XKeyScore, and every other one we've learned about from Snowden. You claim you get suspicious of TOPS reliability is because the data is wrong on Cloak - "TOPS claims that Cloak’s native apps leak IPv6 and DNS traffic." The detailed comparison actually shows whether the service officially tunnels or actively blocks IPv6 and runs its own first party DNS server. This is worded plainly in the header and further explained in the glossary. Lastly, if these are actually not the case for yours or any service, all he requires is a link to the official site where the data can be validated. I'm wondering if the point of the article was a lead up to the end in an attempt to turn people away from TOPS so your joke of a service (which surprise surprise, didn't score so well on the chart) isn't seen for what it is.
  • davepeck 9y ago
    Whoa there, WillyTheWalrus! Thank you for creating a new and anonymous HN account just to deliver your important message. Alas, it is confused in many particulars. Normally I wouldn't feel the need to reply to posts such as yours, but today the oppressive heat wave seems to have lifted from Seattle and I happen to have a delicious coffee beverage in hand. So I'll bite: > First, written by the creator of a VPN company Guilty as charged. That I co-founded a VPN company is disclosed quite clearly, both here on HN and on my blog. Let there be no confusion. :-) > someone obviously biased It's hard to judge another person's biases from afar. I generally refrain from accusing others of bias when I don't know. But I definitely understand how you might reach the wrong conclusion here. If it helps, I will reiterate that I am no longer with my old company (I sold it quite some time ago); I no longer have skin in the VPN game. --- Before I dive into your specific points, I want to make a meta-point that seems to have been missed both by you and by other people who responded to my post: TOPS is, in the right hands, a valuable resource. The person who built TOPS appears to have extremely good intentions and has done an amazing amount of useful work. The problem isn't TOPS in isolation. The problem is when TOPS gets in the hands of the typical unsavvy potential purchaser of VPN services. It is my belief that the right axes on which to judge VPN services are fundamentally resistant to objective measure. In my experience, unavvy customers armed only with objective information are likely to go astray. Okay, on to the specifics: > Questionable/sketchy product marketing & SEO, ethical business practices, etc are all covered in the detailed comparisons Ethics Let's take a look at the current ethics columns. Today, they break down more-or-less into two buckets. The first bucket has to do with affiliate marketing and effectively asks three questions of both the VPN provider and its affiliates: is SPAM avoided, is the copy ethical and is disclosure followed properly? Alas, the gradations of unethical behavior run pretty deep in the VPN affiliate world (ask me over beer sometime), and go far beyond copy and disclosure. TOPS is providing useful information here, but capturing the fullness of affiliate behavior would probably require an armada of columns. The second bucket is for "good faith" behavior and has exactly three columns, including "contradictory logging policies" (do they say 'no logging' but it looks sketchy?), "claims 100% effectiveness" (nobody can!), and "incentivizes social media spam". These are interesting in a shallow sort of way... alas, it's hard to go particularly deep while remaining objective. Which brings us to the crux of the matter: > Other items you claim he SHOULD look at go against his methodology and are impossible to independently verify Yes and, again, this is the point of my post! I believe that some of the most important attributes of a VPN provider to consider are precisely the ones that cannot be objectively measured. In other words, trust signals are potentially far more important than many of the objective columns on TOPS. Perhaps I argue this unsuccessfully, but there you have it. At the end of my post, I suggest six trust signals to look for. These are things that, realistically, cannot be captured objectively. These are also things that I recommend to all potential VPN customers. A handful of VPN providers (including the one I co-founded and providers like TunnelBear and VyprVPN) fit the bill. > The main purpose of jurisdiction is to see which countries are more likely to illegally spy on its citizens and which have a track record of being an "enemy of the internet" Yup, the US is bad... which has little to do with whether a VPN provider based in the US is fundamentally trustworthy. There's a bunch of muddled discussion in your paragraph that follows, so I'll just say this: if one of the "bad" countries wants to get at your VPN traffic, do you really think it matters where your VPN provider is located? If the NSA wants your data, they'll probably find a way to get it. I will provide one specific ding against US-based VPN providers that you didn't mention: they're subject to National Security Letters. NSLs typically come with a gag order, so providers must both comply and cannot say they have done so. That's quite bad; there's a lot of political momentum in the US right now to change this. > The detailed comparison actually shows whether the service officially tunnels or actively blocks IPv6 This column on TOPS is a bit confusing and in my opinion needs to be fixed, since it's effectively using a binary to handle tripartite state. The three possible states seem to be: IPv6 is blocked, IPv6 is supported, and IPv6 isn't blocked and actually leaks. I suppose the right thing to do is to have two separate columns. I elided this detail in my post, I think reasonably so. But it's a good point to make for people looking at TOPS. > runs its own first party DNS server Which the service I co-founded does, despite TOPS's claim to the contrary. A minor data inaccuracy; given the complexity of maintaining TOPS, I don't count this against them. I say as much in my blog post. --- > I'm wondering if the point of the article was a lead up to the end in an attempt to turn people away from TOPS so your joke of a service Y'know, it really annoys me when thirsty randos show up on the Internet to cast aspersions. But I'll resist the temptation to go further and just have another nice sip of coffee instead. :-)