I’m not your bro, guy!

You are not my pal, friend!

Yeah, I imagine the USPS would would have some concerns about transporting biological samples across international borders. Lol.

Same. I’d love to know any privacy-respecting companies…that is, if they even exist.

Here’s hoping they stick to it.

I imagine a lot of people switch, see how hard it is (due to it not being how they’re used to things), and then go back.

And, as advised, watch for unusual activity (but forever, not just a few months, that’s just a false sense of security).

Alternatively, pay a service (one that’s actually reputable!!!*) to watch your shit for you. (Still keep an eye out, of course, but this at least takes a LOT of the load off.)

For example, I pay a 12.95 USD a month for a service provided by my credit union (way better than a bank) and I can input whatever information I want monitored. They do that and let me know as well if they detect any shit going down. They also give me an update email every month letting me know that something has changed (or, likewise, if nothing hasn’t changed :) ).

I started doing this way back in 2018 when my wallet (containing my ID, debit card, social security card, everything) was stolen. (Gods, that was a fucking nightmare.)  

*None of that LifeLock bullshit. AFAIK that’s just marketing fluff mainly. (Somebody correct me if I’m wrong on that.) In any case, I don’t trust any service that is provided by the same fucking company that owns Norton. shudder

Oh that is a SHAME.

DuckStation is such a wonderful piece of software too. :(

• “Because Proton are not accepting contributions, they own all the copyright, so can make the code closed source again if they want to (that wouldn’t affect the already released versions, but future versions)”

They can’t do that actually. They can close the source, yes, but if they do they can’t then release the new closed-source version to the public.

From the GPL FAQ page:

Does the GPL require that source code of modified versions be posted to the public?

The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program’s users, under the GPL. [Emboldened by me.]

Alternatively:

Can the developer of a program who distributed it under the GPL later license it to another party for exclusive use?

No, because the public already has the right to use the program under the GPL, and this right cannot be withdrawn.

• “They could likely take down any derivative on iOS, since Apple will always take instruction from the copyright holder, for GPL’d code”

Does the license prohibit this? Definitely. Could they get away with it? Probably. Though I’m uncertain Proton would go that far. I mean, if they wanted to prevent forks, they wouldn’t have released the source, let alone with the GPL3 license, which requires the right to make modifications (as that’s one of the Four Freedoms).

• “Since the builds are not reproducible, there’s no guarantee that the binaries they distribute are built from the source code”

Technically true, I suppose, though again why they would do that is beyond me. If they didn’t want forks, they likely wouldn’t have allowed forks.

Again, this is all assuming I’m understanding the GPL FAQ page correctly. If I’m wrong, I would welcome someone smarter than me to correct me. :)

Well yeah. I mean, computers back then weren’t just spyware in a Scooby Doo mask.

That’s how I see it, too.

First make it so you can eat. Then you can deal with any privacy holes you need to fill.

Ah, that makes sense. That link was very enlightening. Thank you!

(On a side-note, I felt absolutely flashbanged by the sheer light mode of that page. Jesus Christ on a motorbike…)

I also haven’t. What is it?

How is it that no matter what the damn topic is, Linus always seems to be the most level-headed in the room? I really admire him for that…

Edit: Lol, Linus, not Linux. Linus. xD

There’s a certain point where it just comes down to trust. And if you distrust a company enough that you think they aren’t posting the same code to the git repository that they say they are, then maybe that’s when you shouldn’t be doing business with them.

This is the case with all organizations, corporate or otherwise.

My apologies. Your comment came off (to me anyway) as the former.

So, I just looked it up and apparently their official stance is that auditing is questionably effective and thus unnecessary:

Our software is free and open source, while we repute at the moment [it’s] not acceptable to provide external companies with root access to our servers to perform audits which can not anyway guarantee future avoidance of traffic logging or transmission to third parties. On the contrary, we deem very useful anything related to penetration tests. Such tests are frequently performed by independent researchers and bounty hunters and we also have a bounty program.

In other words, their reasoning seems to be:

1. Their software is free and open source, so if it does logs anything, the community would find out, so in this sense the community is the independent auditors;
2. There’s no stopping an audited party from ceasing to log right before the audit and start up again after the audit ends, so an audit is kind of toothless anyway;
3. Regarding penetration tests, they already have independent testing done as well as a bounty program.

Personally, I don’t entirely agree with points #2 and #3 (though I can see their points), but point #1 is fair I suppose. In my opinion, though, it should not be up to the users to hold the company accountable; and there is a difference between penetration tests and log auditing, as the former I believe are merely to check the resilience against outside hacking.

My end impression is that judging from their other documentation and forum posts, the fact that their software is fully open-source, and their past behavior in accordance with their stated values, I think I’m inclined to believe them. However, it is somewhat worrying nevertheless that there isn’t log auditing involved regardless of their actions.

Edit: Clarification

What do you mean? Are they not good for privacy or security? They seem definitely more zealous about that on their FAQs and forum pages than, say, ProtonVPN, for sure.

That is so weird. Haha.

I didn’t know that. Thanks!

Which distros, out of curiosity?

Maybe. I’m busy right now.

I might do it later. Maybe I’ll do it on

🎵 FRIDAY FRIDAY GOTTA GET DOWN ON FRIDAY 🎵