4 ms·

Not everyone telegraphs if they're in it for the money. In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for

by Groxx 3y ago

Not everyone telegraphs if they're in it for the money. In some lines of business, like (purely hypothetically) security, it might actually be a bad thing for your business if you do. I also use mullvad because I don't really think this is the case, but bad actors are generally hard to conclusively identify by design. And VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior.

reaperman 3y ago
I think legally they would have to change their ownership directive document in Switzerland to allow the board of directors to allow the two founders to sell more than 50% of their shares. So you might get a heads up!
- blowfish721 3y ago
  They arent based in Switzerland but in Sweden.
yencabulator 3y ago
Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with. This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me. Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't. https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency https://www.system-transparency.org https://www.system-transparency.org https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695
- kfreds 3y ago
  Thank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects: - https://www.sigsum.org https://www.sigsum.org (a transparency log with witness cosigning) - https://tillitis.se https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
- fragmede 3y ago
  > a greedy biz bro simply wouldn't. On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
  - yencabulator 3y ago
    For sure. Them being Swedes with a long track record decreases that probability a lot.
kfreds 3y ago
> VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior. Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?
- fragmede 3y ago
  You'd have to invent this one at least, as it currently doesn't exist. As the DNS server operator, you can view all my DNS queries. In a zero-trust environment where I don't trust you not to log all user queries and forwards them to the NSA, you'd need to use homomorphic encryption and create a DNS client and server than can do a lookup, without you, the DNS server operator, from finding out what the DNS lookup was of. https://github.com/menonsamir/spiral-rs https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server. Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product. This is on the extreme end, but you asked for a fun challenge! :)
  - kfreds 3y ago
    Thanks! :) I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
    - fragmede 3y ago
      Thank you for your hard work. You've spent way more time on the problem than I. Didn't realize it was rhetorical! Mostly I wanna see homophobic encryption happen in practice. :p

by Groxx 3y ago

reaperman 3y ago

I think legally they would have to change their ownership directive document in Switzerland to allow the board of directors to allow the two founders to sell more than 50% of their shares. So you might get a heads up!

blowfish721 3y ago
They arent based in Switzerland but in Sweden.

yencabulator 3y ago

Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with. This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me. Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't. https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency https://www.system-transparency.org https://www.system-transparency.org https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695

kfreds 3y ago
Thank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects: - https://www.sigsum.org https://www.sigsum.org (a transparency log with witness cosigning) - https://tillitis.se https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
fragmede 3y ago
> a greedy biz bro simply wouldn't. On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
- yencabulator 3y ago
  For sure. Them being Swedes with a long track record decreases that probability a lot.

kfreds 3y ago

> VPNs are pretty far out in the "just trust me bro" realm of handing over all your browsing habits with no ability to check their real behavior. Yes. It is quite an interesting situation, really. It's also a fun challenge! To what extent can we prove that we are trustworthy, and using what tools? Do those tools exist or do we have to invent them?

fragmede 3y ago
You'd have to invent this one at least, as it currently doesn't exist. As the DNS server operator, you can view all my DNS queries. In a zero-trust environment where I don't trust you not to log all user queries and forwards them to the NSA, you'd need to use homomorphic encryption and create a DNS client and server than can do a lookup, without you, the DNS server operator, from finding out what the DNS lookup was of. https://github.com/menonsamir/spiral-rs https://github.com/menonsamir/spiral-rs claims to have implemented this at a level that's practical for real world applications, with a demo for a wikipedia server, but it's far too slow, as demoed, for use as DNS server. Now, the fact of the matter is that you can map my account ID back to the IP I'm connecting from, but with very limited way to map from my IP to my identity protects that in many ways, but data-mining at scale, knowing how many users connecting to one proxy server from city X, would be worth something to advertising and related companies who are more interested in large habits of users. If it turns out no one uses the pirate bay anymore, but use torrent site XYZ, I know where I'd place my advertising dollars for, say, a VPN product. This is on the extreme end, but you asked for a fun challenge! :)
- kfreds 3y ago
  Thanks! :) I should've been more clear. The questions I posed above are rhetorical. I've spent well over half a decade obsessing over them. See my mention of System Transparency, Sigsum and Tillitis elsewhere in this thread.
  - fragmede 3y ago
    Thank you for your hard work. You've spent way more time on the problem than I. Didn't realize it was rhetorical! Mostly I wanna see homophobic encryption happen in practice. :p