4 ms·

they should at least opensource their implementation. they may have errors there. should we just trust everything?

by deknos 3y ago

dewey 3y ago
Why the entitled attitude? They do a lot of open source contributions already so maybe just give them some time instead of immediately disregarding the whole improvement? Small steps into the right direction. https://mullvad.net/en/help/open-source https://mullvad.net/en/help/open-source
- zlg_codes 3y ago
  Making a suggestion isn't entitlement. Maybe reconsider the foul void that accusation came from.
  - dewey 3y ago
    If someone suggests something to me they usually don't say "you should at least". This sounded more like an entitled comment you see every day on open source repositories and making it sometimes not fun to be an open source maintainer.
k8sToGo 3y ago
Pretty sure they have been audited recently.
- dewey 3y ago
  Indeed: https://mullvad.net/en/blog/tag/system-transparency https://mullvad.net/en/blog/tag/system-transparency
- willis936 3y ago
  If I were a Mullvad customer this is what I would want: regular audits and closed source until everyone was convinced the code was bulletproof.
lillecarl 3y ago
Their infrastructure kind of is their USP. It'd be like giving their competition their work for free. And it's not about absolute trust, it's about trusting them more than your ISP and other VPN providers. You still have TLS over Mullvad
- yjftsjthsd-h 3y ago
  I'd argue that Mullvad's USP/moat is their reputation, far more than the software they run.
dfc 3y ago
They have open sourced a good deal of the infrastructure: https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency
jcul 3y ago
They are just using wireguard. You can connect with wireguard and not run any mullvad software on the client side. Though that's generally the case with VPN providers, whether openvpn, wireguard, etc. I guess they could introduce some vulnerability on the server side if they rolled their own wireguard implementation or patched it. Though it seems unlikely to me. https://mullvad.net/en/help/easy-wireguard-mullvad-setup-linux https://mullvad.net/en/help/easy-wireguard-mullvad-setup-lin...

they should at least opensource their implementation. they may have errors there. should we just trust everything?

by deknos 3y ago

they should at least opensource their implementation. they may have errors there. should we just trust everything?

Why the entitled attitude? They do a lot of open source contributions already so maybe just give them some time instead of immediately disregarding the whole improvement? Small steps into the right direction. https://mullvad.net/en/help/open-source https://mullvad.net/en/help/open-source

zlg_codes 3y ago
Making a suggestion isn't entitlement. Maybe reconsider the foul void that accusation came from.
- dewey 3y ago
  If someone suggests something to me they usually don't say "you should at least". This sounded more like an entitled comment you see every day on open source repositories and making it sometimes not fun to be an open source maintainer.

k8sToGo 3y ago

Pretty sure they have been audited recently.

dewey 3y ago
Indeed: https://mullvad.net/en/blog/tag/system-transparency https://mullvad.net/en/blog/tag/system-transparency
willis936 3y ago
If I were a Mullvad customer this is what I would want: regular audits and closed source until everyone was convinced the code was bulletproof.

lillecarl 3y ago

Their infrastructure kind of is their USP. It'd be like giving their competition their work for free. And it's not about absolute trust, it's about trusting them more than your ISP and other VPN providers. You still have TLS over Mullvad

yjftsjthsd-h 3y ago
I'd argue that Mullvad's USP/moat is their reputation, far more than the software they run.

dfc 3y ago

They have open sourced a good deal of the infrastructure: https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency

jcul 3y ago

They are just using wireguard. You can connect with wireguard and not run any mullvad software on the client side. Though that's generally the case with VPN providers, whether openvpn, wireguard, etc. I guess they could introduce some vulnerability on the server side if they rolled their own wireguard implementation or patched it. Though it seems unlikely to me. https://mullvad.net/en/help/easy-wireguard-mullvad-setup-linux https://mullvad.net/en/help/easy-wireguard-mullvad-setup-lin...