5 ms·

> Finally, for those of you who do security research: when you find a security or privacy issue, please consider notifying the maintainer/vendor before publishi

> Finally, for those of you who do security research: when you find a security or privacy issue, please consider notifying the maintainer/vendor before publishing your findings How to report a bug or vulnerability ... we (currently) have no bug bounty program ... send an email to support@mullvadvpn.net https://mullvad.net/en/help/how-report-bug-or-vulnerability https://mullvad.net/en/help/how-report-bug-or-vulnerability / https://archive.vn/BeHhr https://archive.vn/BeHhr

wren6991 5mo ago
To support? Oof.
- kfreds 5mo ago
  I'm not sure what you mean by "Oof". We don't have a dedicated security team because security and privacy are integral to all aspects of our service. It doesn't make sense to centralise it. As for our support team they are responsive and experienced. Several of them have worked with us for many years and do offensive security research in their free time. Unlike many organisations we don't see customer support as a cost center, just like we don't see security as a cost center. Our support team represent our customers, and as a consequence contribute a lot to how we prioritise our roadmap.
  - traceroute66 5mo ago
    > I'm not sure what you mean by "Oof". I second this. Clearly the person who wrote "Oof" has never emailed Mullvad support. Whenever I have emailed Mullvad support I have received a prompt reply from a human being who clearly actually cares about taking ownership of the question and seeing it through to resolution. I have also witnessed first-hand the support person taking the question to an internal team member where it requires additional input. So there are clear paths for escalation if circumstances require it. Finally the support mail allows for PGP encryption of communications too. (I am not a Mullvad shill. Not a Mullvad employee. Just a satisfied customer)
  - fragmede 5mo ago
    Human psychology is weird and some things are just cultural. If you have the ops team make the security@ email alias just forward to support, you could avoid having to go into all that. "Just email support@" feels like you don't care. That you do, and that your support team is awesome, doesn't change the fact that there are other companies out there who's aren't. Security people are human with human egos, and they want to feel special, so giving them a special way to reach you, even if it's the same thing behind the scene, makes a world of difference.
  - nananana9 5mo ago
    It still probably makes sense to alias it to security@mullvadvpn.net for privacy/security concerns. I'm not familiar with how you run your company -- without the context you gave most people would hesitate emailing support@ for security issues.
  - wren6991 5mo ago
    You're right, that was a knee-jerk reaction. Sorry, I take it back.
  - Stefan-H 5mo ago
    "We don't have a dedicated security team because security and privacy are integral to all aspects of our service". Do you have people whose role is explicitly security? Who are the security SMEs in your organization if not? I personally find the "Security is so important to us that we don't have a team dedicated to it" argument weak, and often results in misaligned incentives - if individuals have to alternate hats from "deliver results" to "properly vet security", the business push to deliver tends to win out. I'd be very curious to hear how you ensure your team doesn't fall into that trap.
dust-jacket 5mo ago
Not having a bug bounty or dedicated email address does not make it OK to go public immediately
- mvdtnz 5mo ago
  Yes it does actually.
  - dust-jacket 5mo ago
    I don't feel like its hard to come up with examples where (I would say) its ethically wrong to disclose immediately. If you spotted a company's mistake that might endanger their user's lives or safety, would you put those users at risk simply because there was no obvious financial reward? If so, I guess we just have different opinions on the ethics involved here.
    - alt227 5mo ago
      If you are talking about some open source project then I would fully agree. But when it comes to money making corporations then personally I dont agree that revealing flaws in their product comes into ethics at all. A companies paid product is flawed, their own paid engineers didnt figure that out, why should I do it for free becasue 'ethics'? This is the entire reason bug bounty programs exist in the first place.
      - fn-mote 5mo ago
        You seem to have a very bright line between the acceptable behavior for “no money involved” and “money involved”. For me, it’s more subtle than that. Everybody (“almost all software”) has exploitable bugs. Are you a fool for not finding the ones in yours? Maybe. Sometimes. There is a huge difference between Project Zero finding a trivial vulnerability almost identical to one reported months earlier (close to negligence) and Mullvad having the CEO personally posting a response here in a very calm tone.
        5mo ago
abanana 5mo ago
Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?
- embedding-shape 5mo ago
  Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)
  - trelane 5mo ago
    > Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset American culture is highly varied. For some this is true, for others this is wrong and highly insulting. Maybe try a narrower brush next time.
    - mrpopo 5mo ago
      I think the "others" should open their eyes to the world around them, then.
      - trelane 5mo ago
        > should open their eyes to the world around them Amazingly brazen assumption right there.
    - embedding-shape 5mo ago
      It's OK for the country to have a pervasive culture yet not every resident or citizen of the country to be a part of that culture, or even actively work against it. If you're not one of them matching that description, it shouldn't be insulting, as it's not about you in the first place. Maybe not everything is aimed towards you, especially if you don't feel like the description actually matches you :)

wren6991 5mo ago

To support? Oof.

kfreds 5mo ago
I'm not sure what you mean by "Oof". We don't have a dedicated security team because security and privacy are integral to all aspects of our service. It doesn't make sense to centralise it. As for our support team they are responsive and experienced. Several of them have worked with us for many years and do offensive security research in their free time. Unlike many organisations we don't see customer support as a cost center, just like we don't see security as a cost center. Our support team represent our customers, and as a consequence contribute a lot to how we prioritise our roadmap.
- traceroute66 5mo ago
  > I'm not sure what you mean by "Oof". I second this. Clearly the person who wrote "Oof" has never emailed Mullvad support. Whenever I have emailed Mullvad support I have received a prompt reply from a human being who clearly actually cares about taking ownership of the question and seeing it through to resolution. I have also witnessed first-hand the support person taking the question to an internal team member where it requires additional input. So there are clear paths for escalation if circumstances require it. Finally the support mail allows for PGP encryption of communications too. (I am not a Mullvad shill. Not a Mullvad employee. Just a satisfied customer)
- fragmede 5mo ago
  Human psychology is weird and some things are just cultural. If you have the ops team make the security@ email alias just forward to support, you could avoid having to go into all that. "Just email support@" feels like you don't care. That you do, and that your support team is awesome, doesn't change the fact that there are other companies out there who's aren't. Security people are human with human egos, and they want to feel special, so giving them a special way to reach you, even if it's the same thing behind the scene, makes a world of difference.
- nananana9 5mo ago
  It still probably makes sense to alias it to security@mullvadvpn.net for privacy/security concerns. I'm not familiar with how you run your company -- without the context you gave most people would hesitate emailing support@ for security issues.
- wren6991 5mo ago
  You're right, that was a knee-jerk reaction. Sorry, I take it back.
- Stefan-H 5mo ago
  "We don't have a dedicated security team because security and privacy are integral to all aspects of our service". Do you have people whose role is explicitly security? Who are the security SMEs in your organization if not? I personally find the "Security is so important to us that we don't have a team dedicated to it" argument weak, and often results in misaligned incentives - if individuals have to alternate hats from "deliver results" to "properly vet security", the business push to deliver tends to win out. I'd be very curious to hear how you ensure your team doesn't fall into that trap.

dust-jacket 5mo ago

Not having a bug bounty or dedicated email address does not make it OK to go public immediately

mvdtnz 5mo ago
Yes it does actually.
- dust-jacket 5mo ago
  I don't feel like its hard to come up with examples where (I would say) its ethically wrong to disclose immediately. If you spotted a company's mistake that might endanger their user's lives or safety, would you put those users at risk simply because there was no obvious financial reward? If so, I guess we just have different opinions on the ethics involved here.
  - alt227 5mo ago
    If you are talking about some open source project then I would fully agree. But when it comes to money making corporations then personally I dont agree that revealing flaws in their product comes into ethics at all. A companies paid product is flawed, their own paid engineers didnt figure that out, why should I do it for free becasue 'ethics'? This is the entire reason bug bounty programs exist in the first place.
    - fn-mote 5mo ago
      You seem to have a very bright line between the acceptable behavior for “no money involved” and “money involved”. For me, it’s more subtle than that. Everybody (“almost all software”) has exploitable bugs. Are you a fool for not finding the ones in yours? Maybe. Sometimes. There is a huge difference between Project Zero finding a trivial vulnerability almost identical to one reported months earlier (close to negligence) and Mullvad having the CEO personally posting a response here in a very calm tone.
      - 5mo ago

abanana 5mo ago

Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?

embedding-shape 5mo ago
Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)
- trelane 5mo ago
  > Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset American culture is highly varied. For some this is true, for others this is wrong and highly insulting. Maybe try a narrower brush next time.
  - mrpopo 5mo ago
    I think the "others" should open their eyes to the world around them, then.
    - trelane 5mo ago
      > should open their eyes to the world around them Amazingly brazen assumption right there.
  - embedding-shape 5mo ago
    It's OK for the country to have a pervasive culture yet not every resident or citizen of the country to be a part of that culture, or even actively work against it. If you're not one of them matching that description, it shouldn't be insulting, as it's not about you in the first place. Maybe not everything is aimed towards you, especially if you don't feel like the description actually matches you :)