3 ms·
Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working
by yencabulator 3y ago
Mullvad is trying pretty darn hard to be as far from "just trust me bro" as is feasible. If you do take their word for how they run their systems (/are working toward), their servers are diskless (what logs?), will only run software signed by their infrastructure team, and will remotely attest that their software has not been tampered with.
This is so very, very, far away from the typical VPN company that any such comparison sounds ridiculous to me.
Just the pretense of doing all this work costs so much that a greedy biz bro simply wouldn't.
https://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency
https://www.system-transparency.org https://www.system-transparency.org
https://news.ycombinator.com/item?id=29903695 https://news.ycombinator.com/item?id=29903695
- kfreds 3y agoThank you for noticing! System Transparency is taking way longer to figure out, design and build than I expected. On the other hand the project is quite ambitious, and our work on ST has sprouted two additional OSS projects: - https://www.sigsum.org https://www.sigsum.org (a transparency log with witness cosigning) - https://tillitis.se https://tillitis.se (an open-source hardware FPGA-based security key with measured boot)
- fragmede 3y ago> a greedy biz bro simply wouldn't. On the other hand, if it were an NSA honeypot, doing all that work would easily be worth the cost. Personally, I don't think they are, so I'm merely pointing out that there are angles other than totally above-board honest legitimate reasons, and "greedy biz bro".
- yencabulator 3y agoFor sure. Them being Swedes with a long track record decreases that probability a lot.