4 ms·

Private Internet Access VPN Open Source Repository

58 points by rasengan 7y ago

miked85 7y ago
Even with this open source repo, it is still hard to trust PIA after the Kape acquisition [1]. 1. https://news.ycombinator.com/item?id=21612488 https://news.ycombinator.com/item?id=21612488
- ignoramous 7y ago
  Here's a thread where PIA's co-founder actively engaged in discussion to clarify similar concerns raised (at the time): https://news.ycombinator.com/item?id=21679682 https://news.ycombinator.com/item?id=21679682
  - tmpz22 7y ago
    > PIA's business is built on trust and rasengan decided to hire Mark Karpeles as their CTO. I honestly can't think of anyone who I would trust less as a CTO than Mark Karpeles. I'm not being sarcastic, I genuinely can't think of someone as bad as Mark for a role like CTO. There's not a chance in hell that I'm going to give PIA another cent based on that alone, even ignoring the most recent Kape debacle. That thread fails to explain why PIA hired the former CEO of Bitcoin exchange Mt. Gox as their CTO. By comparison that's like hiring Rudy Giuliani as your Chief Legal Counsel, Elizebeth Holmes as your CEO, Madoff as your CFO, or Rush Limbaugh as your Chief Diversity Officer.
    - netsharc 7y ago
      There is no reason to trust them just because their CEO actively answers people's concerns by saying "Please don't worry, please trust us!", but I also wonder: if they were trying to be evil, why make it so obvious by putting known bad people in C-positions? Why not just have these people work as anonymous "consultants", doing all the evil under the radar?
      - rasengan 7y ago
        I don’t want anyone to trust us. I want people to verify [1]. If you rely on trust in any system, be it VPN or other, you’re going to have a bad time. Secondly, Mark was not hired to PIA. He was hired to LTM and I posted a blog post about it to fully explain the world I am a part of. I stand behind my decisions, and no matter how many times people try to make up some conspiracy around it, I will make the same decision everytime; because I want a world that gives second chances, even if I have to build it myself. [1] https://www.privateinternetaccess.com/blog/2019/12/dont-trust-verify/ https://www.privateinternetaccess.com/blog/2019/12/dont-trus... [2] https://www.privateinternetaccess.com/blog/2018/04/why-i-hired-mt-gox-ex-ceo-mark-karpeles-as-cto-of-london-trust-media/ https://www.privateinternetaccess.com/blog/2018/04/why-i-hir...
        miked85 7y ago
        I read your blog, but how does one actually verify PIA logs or not for example? It seems there is always going to have to be some level of trust involved.
    - rasengan 7y ago
      PIA never hired Mark as the CTO, and he never worked at PIA.
      - tmpz22 7y ago
        Correct I was wrong, Mark is the CTO of the parent company who in their own copy describes "LONDON TRUST MEDIA, Inc. is the world's first privacy and security focused accelerator and owners/operators of Private Internet Access, the world's leader in privacy online." Who doesn't trust a name like London Trust Media.
- rasengan 7y ago
  This is exactly why we have become the most transparent VPN and are continuing to become even more so. 1. No other VPN provides its financials and management/ownership info publicly. We do. 2. All of our apps are open source. 3. We are introducing a random audit program. We want verification, not trust [1]. [1] https://www.privateinternetaccess.com/blog/2019/12/dont-trust-verify/ https://www.privateinternetaccess.com/blog/2019/12/dont-trus...
Thorentis 7y ago
So they've open sourced all their clients? The clients weren't the issue. I'm glad to know there is less likely to be a problem with getting data from my computer to their servers ... but what happens on their servers is the issue. How do I know they don't save logs, snoop on data, log DNS requests, etc.? No amount of Open Source software they release will be able to prove that, since we will never know with 100% certainty what software is running on their servers.
- Barrin92 7y ago
  pretty much by definition you have no idea what happens on someone else's server, it is always a trust issue. the fact that there haven't been any cases involving leaked data is as good as it is going to get. I don't really understand this line of questioning though because the use case of a VPN isn't you hiding Iranian nuclear secrets from the NSA, it's mostly just useful for circumventing region logs or sending DMCA requests to /dev/null
  - craftinator 7y ago
    > the fact that there haven't been any cases involving leaked data is as good as it is going to get. No. No proof of leaked data is a basic requirement for trust, but at the end of the day, PIA is now associated with known criminals. Unless they can continuously provide impartial audits of their server operations (they can't), then they have lower trustworthiness than any other VPN I know of.
    - rasengan 7y ago
      Good luck with other VPNs. Let me know how that works out for you. Meanwhile, we will continue to stand true to our principles at PIA as the only proven no log VPN provider. I’m biased because I know PIA doesn’t log, but given all the VPNs caught logging and/or overall operating with remedial practices (IPvanish and PureVPN caught logging, NordVPN using default passwords, etc.), even if I wasn’t biased, I would choose the VPN who has a proven no log policy and proven technical know-how. And that’s Private Internet Access - that won’t be changing while I’m here.
justlexi93 7y ago
Can it bypass VPN if it has the IP address of the device?
commoner 7y ago
Thank you for following up on your comment from November. https://news.ycombinator.com/item?id=21613267 https://news.ycombinator.com/item?id=21613267 Some of the repositories are a couple versions behind, but this is a nice effort, and I appreciate it. Now that PIA, Mullvad, and ProtonVPN all offer open source clients, this should eventually become a baseline expectation for all VPN services.
- rasengan 7y ago
  You’re welcome! Next up is transparency to our servers and the random audits!
  - commoner 7y ago
    On closer inspection, it doesn't look like PIA's Android client is open source. This repository does not appear to be the Android app, despite the name and description: https://github.com/pia-foss/android-openvpn https://github.com/pia-foss/android-openvpn

58 points by rasengan 7y ago

Even with this open source repo, it is still hard to trust PIA after the Kape acquisition [1]. 1. https://news.ycombinator.com/item?id=21612488 https://news.ycombinator.com/item?id=21612488

ignoramous 7y ago
Here's a thread where PIA's co-founder actively engaged in discussion to clarify similar concerns raised (at the time): https://news.ycombinator.com/item?id=21679682 https://news.ycombinator.com/item?id=21679682
- tmpz22 7y ago
  > PIA's business is built on trust and rasengan decided to hire Mark Karpeles as their CTO. I honestly can't think of anyone who I would trust less as a CTO than Mark Karpeles. I'm not being sarcastic, I genuinely can't think of someone as bad as Mark for a role like CTO. There's not a chance in hell that I'm going to give PIA another cent based on that alone, even ignoring the most recent Kape debacle. That thread fails to explain why PIA hired the former CEO of Bitcoin exchange Mt. Gox as their CTO. By comparison that's like hiring Rudy Giuliani as your Chief Legal Counsel, Elizebeth Holmes as your CEO, Madoff as your CFO, or Rush Limbaugh as your Chief Diversity Officer.
  - netsharc 7y ago
    There is no reason to trust them just because their CEO actively answers people's concerns by saying "Please don't worry, please trust us!", but I also wonder: if they were trying to be evil, why make it so obvious by putting known bad people in C-positions? Why not just have these people work as anonymous "consultants", doing all the evil under the radar?
    - rasengan 7y ago
      I don’t want anyone to trust us. I want people to verify [1]. If you rely on trust in any system, be it VPN or other, you’re going to have a bad time. Secondly, Mark was not hired to PIA. He was hired to LTM and I posted a blog post about it to fully explain the world I am a part of. I stand behind my decisions, and no matter how many times people try to make up some conspiracy around it, I will make the same decision everytime; because I want a world that gives second chances, even if I have to build it myself. [1] https://www.privateinternetaccess.com/blog/2019/12/dont-trust-verify/ https://www.privateinternetaccess.com/blog/2019/12/dont-trus... [2] https://www.privateinternetaccess.com/blog/2018/04/why-i-hired-mt-gox-ex-ceo-mark-karpeles-as-cto-of-london-trust-media/ https://www.privateinternetaccess.com/blog/2018/04/why-i-hir...
      - miked85 7y ago
        I read your blog, but how does one actually verify PIA logs or not for example? It seems there is always going to have to be some level of trust involved.
  - rasengan 7y ago
    PIA never hired Mark as the CTO, and he never worked at PIA.
    - tmpz22 7y ago
      Correct I was wrong, Mark is the CTO of the parent company who in their own copy describes "LONDON TRUST MEDIA, Inc. is the world's first privacy and security focused accelerator and owners/operators of Private Internet Access, the world's leader in privacy online." Who doesn't trust a name like London Trust Media.
rasengan 7y ago
This is exactly why we have become the most transparent VPN and are continuing to become even more so. 1. No other VPN provides its financials and management/ownership info publicly. We do. 2. All of our apps are open source. 3. We are introducing a random audit program. We want verification, not trust [1]. [1] https://www.privateinternetaccess.com/blog/2019/12/dont-trust-verify/ https://www.privateinternetaccess.com/blog/2019/12/dont-trus...

Thorentis 7y ago

So they've open sourced all their clients? The clients weren't the issue. I'm glad to know there is less likely to be a problem with getting data from my computer to their servers ... but what happens on their servers is the issue. How do I know they don't save logs, snoop on data, log DNS requests, etc.? No amount of Open Source software they release will be able to prove that, since we will never know with 100% certainty what software is running on their servers.

Barrin92 7y ago
pretty much by definition you have no idea what happens on someone else's server, it is always a trust issue. the fact that there haven't been any cases involving leaked data is as good as it is going to get. I don't really understand this line of questioning though because the use case of a VPN isn't you hiding Iranian nuclear secrets from the NSA, it's mostly just useful for circumventing region logs or sending DMCA requests to /dev/null
- craftinator 7y ago
  > the fact that there haven't been any cases involving leaked data is as good as it is going to get. No. No proof of leaked data is a basic requirement for trust, but at the end of the day, PIA is now associated with known criminals. Unless they can continuously provide impartial audits of their server operations (they can't), then they have lower trustworthiness than any other VPN I know of.
  - rasengan 7y ago
    Good luck with other VPNs. Let me know how that works out for you. Meanwhile, we will continue to stand true to our principles at PIA as the only proven no log VPN provider. I’m biased because I know PIA doesn’t log, but given all the VPNs caught logging and/or overall operating with remedial practices (IPvanish and PureVPN caught logging, NordVPN using default passwords, etc.), even if I wasn’t biased, I would choose the VPN who has a proven no log policy and proven technical know-how. And that’s Private Internet Access - that won’t be changing while I’m here.

justlexi93 7y ago

Can it bypass VPN if it has the IP address of the device?

commoner 7y ago

Thank you for following up on your comment from November. https://news.ycombinator.com/item?id=21613267 https://news.ycombinator.com/item?id=21613267 Some of the repositories are a couple versions behind, but this is a nice effort, and I appreciate it. Now that PIA, Mullvad, and ProtonVPN all offer open source clients, this should eventually become a baseline expectation for all VPN services.

rasengan 7y ago
You’re welcome! Next up is transparency to our servers and the random audits!
- commoner 7y ago
  On closer inspection, it doesn't look like PIA's Android client is open source. This repository does not appear to be the Android app, despite the name and description: https://github.com/pia-foss/android-openvpn https://github.com/pia-foss/android-openvpn