4 ms·
Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?
by abanana 5mo ago
Are you seriously suggesting people shouldn't operate with a bit of common decency unless they're going to get some money out of it?
- embedding-shape 5mo agoMost of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset. Meanwhile, Mullvad is Swedish, and we tend to assume we all want to help build a better world together. Mix the two, and you get this conversation :)
- trelane 5mo ago> Most of HN readers/writers are American, of course they won't do anything unless they personally profit off it, the entire culture is built around this mindset American culture is highly varied. For some this is true, for others this is wrong and highly insulting. Maybe try a narrower brush next time.
- mrpopo 5mo agoI think the "others" should open their eyes to the world around them, then.
- trelane 5mo ago> should open their eyes to the world around them Amazingly brazen assumption right there.
- embedding-shape 5mo agoIt's OK for the country to have a pervasive culture yet not every resident or citizen of the country to be a part of that culture, or even actively work against it. If you're not one of them matching that description, it shouldn't be insulting, as it's not about you in the first place. Maybe not everything is aimed towards you, especially if you don't feel like the description actually matches you :)
- WarmWash 5mo agoSweden, the entire country, has the population of New York City, and is about 3/4 the size of Texas.
- embedding-shape 5mo agoDon't forget about Sri Lanka, whose population is around 21 million.
- trelane 5mo agoThat is a lot of words for "my negative steroetypes about you and your country are fine, actually. Don't take it personally, bro. Maybe you're one of the few good ones!"
- retrochameleon 5mo agoI'm American. It's the pervasive culture. The brush doesn't need to be narrower.
- stavros 5mo agoEvery time someone makes a cultural comment here, the reply is always "America is a big country". America can be a big country and still have common cultural elements. It's not inaccurate to say that citizens of a large country mostly share some common characteristics. Those characteristics are what makes them one country.
- rafram 5mo agoI would hesitate to make generalizations like that about a country with a population 35x larger than yours. There’s no US monoculture.
- embedding-shape 5mo agoGreat, thanks for the tip. I'd hesitate assuming what country people live in :) Seems we all have something to learn from each other.
- rafram 5mo ago> Meanwhile, Mullvad is Swedish, and we tend to [...]
- embedding-shape 5mo agoSo what, suddenly Swedes can't live outside of Sweden? Kind of interesting to make complaints about generalizations and in the same comment falling for the same trap yourself.
- rafram 5mo agoCome on.
- embedding-shape 5mo agoAnnoying, isn't it?
- nickburns 5mo agoYou identified as Swedish, and then shifted the goal post to the country where you (apparently) currently reside. What's your point again? Something about all Americans whether they live in the US or not? Are you trying to be incoherent? Daft? Representative of all Swedes by origin?
- rpdillon 5mo agoMany Americans have contributed substantially to open source and free software over the past decades. What are you trying to say?
- Cytobit 5mo agoInteresting, I hadn't considered the bigot angle.
- threatofrain 5mo agoThis ought not be considered anything close to common courtesy. This is work. Mullvad is engaged in the business of making money. They should show how serious they are with your money. Since when do you have professionals giving you examinations out of common courtesy? Out of courtesy can I get a free cancer screening?
- SauntSolaire 5mo agoIf I doctor performed a cancer screening on me, for free and without me asking, then yes — as a matter of courtesy I would still expect that doctor to tell me if he found cancer, rather than reading about it on his blog later.
- alt227 5mo ago> If I doctor performed a cancer screening on me, for free and without me asking But that would never happen, so the point is moot.
- catlikesshrimp 5mo agoThat is legally allowed as part of studies, to which a patient must agree after being proposed. Otherwise, it is illegal.
- alt227 5mo agoWhen their 'common decency' is directly benefiting a money making corporation with shareholders and directors then yes they should definitely get some money out of it.
- buellerbueller 5mo agoOn the other hand, the lack of common decency can endanger innocent 3rd parties.
- alt227 5mo agoIf you create a 3rd party app to some closed source insecure back end, thats on you for trusting them or not doing your due diligence. Time and time again private companies have rug pulled things like api access for 3rd party apps (such as twitter/X). Building 3rd party clients for private systems should already be approached with heavy scepticism and always be prepared for the worst.
- buellerbueller 5mo agoYou are correct, but none of that absolves the person of their responsibilities to others with regard to common decency. Notify, then publish
- Peaches4Rent 5mo agoBull. This is the best VPN regarding security and privacy there is. I did my research
- bushwart 5mo agoI've got a Proton VPN sub, what would you say are the biggest reasons to switch to Mullvad?
- everforward 5mo agoI dislike it here because I like Mullvad, but yes, I think it’s fair to go straight to public disclosure. Someone with likely substantial qualifications put in time to find this. The company is in it for profit (at least partially). What’s fair for the company is fair for the individual. The company can either offer to pay for bugs under the terms they want, hire more security folks to find the bugs themselves, or just accept that researches get to do whatever they want with their findings. I’d tell Mullvad, but there are companies I don’t respect enough to feel compelled to give them a heads up. Perhaps the author feels that way about Mullvad, it’s entirely within their right to use this to publicly shame Mullvad.
- Tech_User_Stat 5mo agoThere was a recent discussion about disclosing publicly if the vendor ignores you. https://x.com/ZackKorman/status/2052427327418556679 https://x.com/ZackKorman/status/2052427327418556679 Those who do bug bounties full-time ignore programs with no rewards. Those who want to gain experience or pad their resume can submit reports to programs with no rewards because they are not as competitive as those with rewards. Another issue that is often talked about is the size of the bounty. Most are small <$10K so for users in developed countries, it's not sustainable to go full-time. https://www.theregister.com/security/2019/01/15/want-to-get-rich-from-bug-bounties-youre-better-off-exterminating-roaches-for-a-living/613376 https://www.theregister.com/security/2019/01/15/want-to-get-...
- everforward 5mo agoI tried watching that but X either broke their video controls or disabled them so I can’t skip ahead and the first couple minutes are _slow_. The whole bug bounty thing is a mess, admittedly, but lacking a bug bounty program entirely feels like immediately losing the moral high ground on “you should have told us first”. There’s a lively debate about what bugs are worth, but it’s objectively not $0 for many classes because a botnet developer will buy them for some amount. Personally, a big part of my view is formed by the educated assumption that security practices will never improve unless poor security becomes a liability. That’s unlikely to happen with “responsible disclosure” because it gets swept under a rug. Immediate public disclosure changes that risk calculus a lot. I think wed see a lot more downward pressure from vendors to their suppliers if $RandomSaaS had to worry about losing their pants because Oracle had a vuln published.