I know someone making tens of thousands a month from shilling VPNs. They have site where they "review" and "rate" VPNs.

The reality is that the customers of those products barely understand them and are buying into the BS of "stay anonymous" and "be private online". It's an easy market, especially considering you don't even need to develop the VPN software, just run instances on some cloud/VPS provider and do a ton of marketing.

The person doing the shilling is marketing himself as a "privacy & crypto expert" and having a masters degree in cybersecurity, reality is dude barely graduated high school. He actually works for a friend of his who runs a whole variety of these sites and is about to clear $10M+ this year alone.

What I've learned from this is that if you Google for some popular product, the first 5 pages are going to be SEO-optimized shilling sites. Just skip to page 10.

>Just skip to page 10.

I thought that was the running joke:

Q: Where's the best place to hide a body?

A: Page ten of Google.

But, joking aside, you can install greasemonkey/tampermonkey and get the googlemonkeyr script to manage your search results to be a bit more effective.

https://greasyfork.org/en/scripts/31607-googlemonkeyr-fix-ju...

Get out, that script is huge. I could install small convenience scripts that I can audit, but this monster is 3K+ lines. Too risky.

> What I've learned from this is that if you Google for some popular product, the first 5 pages are going to be SEO-optimized shilling sites. Just skip to page 10.

This is a big problem with Google, today. Say I want to search for something - not to buy it - just some facts. The immediate first pages are all sites on how to buy, costs, online stores. I have to go to 8 or 9 to start seeing what I want.

This is today's Google.

I find myself just searching what I want + "reddit", to avoid the seo crap.

Can you trust reddit, though? There's plenty of social media campaigns out there that have people plugging stuff on reddit to promote some company or agenda.

Reddit is very useful for niche results that are normally functionally impossible to find any information on at all. If that is not the case, it's not really the shilling that's the biggest trouble, it is that people on Reddit have just become a cross-slice of regular society now. That means that when they answer questions about anything that even remotely requires domain knowledge, you can be entirely certain that they will be wrong in ways that you do not expect.

Try it and see. It’s good for fixing many problems that relate to coding too, but are of the type closed on Stack Overflow. Sure, the problem is basic, but when I’m stuck a ‘duplicate closed’ is unhelpful.

the per-community moderation makes marketing spam much harder

Blatant spam, yes, but if it’s like what’s being discussed here I’d be hesitant that it goes much better than amazon reviews. It’s just too easy to create fake accounts and you don’t need to be that smart to avoid telegraphing this.

Yes but at least Reddit has downvoting. I still take the results with a grain of salt, but most times the Reddit user points you in the right direction.

> What I've learned from this is that if you Google for some popular product, the first 5 pages are going to be SEO-optimized shilling sites. Just skip to page 10.

Is a less SEO-optimized site less likely to be a scam?

If shilling sites are more likely to be SEO-optimized, yes. One of the implications of Bayes' Theorem is that if observing A makes B more likely, then observing B also makes A more likely. A worked example:

Given:

P(shill) = P(!shill) = 0.5

P(optimized|shill) = 0.8

P(optimized|!shill) = 0.6

Then:

P(optimized) = P(shill) * P(optimized|shill) + P(!shill) * P(optimized|!shill) = 0.4 + 0.3 = 0.7

P(shill|optimized) = P(optimized|shill) * P(shill)/P(optimized) = 0.8 * 0.5/0.7 ≈ 0.57

P(shill|!optimized) = P(!optimized|shill) * P(shill)/P(!optimized) = 0.2 * 0.5/0.3 ≈ 0.33

Yes, because knowledge isn't SEO-optimized by default. It takes time to do so. And time is money. And 99% of the time, those who are willing to spend a lot of time to get on the first page of Google are doing it to gain money, not to spread knowledge.

I don't disagree with your main point, but spreading knowledge and making money aren't mutually exclusive.

> Yes, because knowledge isn't SEO-optimized by default.

Isn't it? I thought Google was trying to optimize their search engine for finding useful information, so if someone were to make an honest website that just tries to provide useful information (anachronistic as that may seem) wouldn't they hypothetically have the full manpower of Google's search team optimizing for finding it?

> Just skip to page 10

Results not from top 1M (1K, 10K, 100K) sites: https://millionshort.com/

Is it really easy market? I thought about running a VPN service, but how do I deal with abuses? People would use VPN for all kinds of things including bad ones. And investigators will come at me.

They will come at you, and you will help them or go to prison. That is the be-all end-all of running a VPN. If that bothers you, don't run one.

How do other companies deal with it?

I watch a bunch of tech related YouTube channels and the amount of NordVPN shilling is outrageous. Some fine folks making good content telling their audience that "your ISP is seeing everything you do but if you use a VPN you are safe, it's totally not like the VPN provider is then able to do exactly what the ISP could before!"

Even worse the VPN provider is usually operating from some country with much less regulation regarding privacy. If it were revealed that some ISP here in Germany is sniffing traffic and selling your data, shit would hit the fan, but if your trusty VPN provider from whoknowswhere does this, good luck going after them.

I mean, there’s something left unsaid in all of those VPN advertisements, that goes something like this:

> You live in the US, right? And you pirate stuff, right? Or maybe you Google things that would get you put on the TSA no-fly list? Well, with a VPN, it won’t be your US ISP that has access to your traffic—and then has to give it over to the MPAA and the NSA—but rather a VPN company from some foreign country, who has no such obligations. Sure, they can sell your data to anyone they like... but it’s not like the USGOV or the various media cartels are buying data. If they can’t compel it for free, they don’t bother (and they certainly couldn’t fully trust data sourced from a company headquartered in a non-allied country anyway, so why would they bother?) Someone somewhere might know about your VPN traffic, but it probably won’t be someone out to get you. Just someone out to sell you stuff.

Or, if you prefer:

> You live in Hong Kong, right? And you have some vocal opinions about Chinese sovereignty, right? Well, with a VPN, it’s not the Chinese government that sees your traffic, but rather....

In the US, we know that ISPs and government agencies are harvesting data for their own proposes.

So using a VPN comes down to the fair gamble that someone who promises not to log and use your data is possibly better than the guys who definitely log and use it.

don't forget the "military grade encryption" NordVPN makes the youtubers include sometimes.

But if you take a closer look at many of them, they actually do TLSv1.1 with weak primitives, have weak CA certs or other problems in their system.

eh. I wouldn't take that as a strike against them. It's pretty impossible to communicate crypto to laypeople using technical language, like AES or even SSL. You have to use analogies, to banks or militaries. For better or worse, that's just how it goes.

> For better or worse, that's just how it goes.

No, it isn't.

You don't have to use "bank-grade", "military-grade", etc. in your marketing. They don't actually mean anything, and only serve as a red flag for "we don't know what the fuck we're doing".

You can use almost-equally meaningless phrases like "state of the art", "industry standard", etc.

You can sell on a "proven track record" of not selling out to data brokers or yielding to government search warrants (although that mostly hinges on "never been subpoenaed" rather than "resisted a subpoena" in practical terms).

There's lots of other paths to take besides using "${DUMB}-grade" in your marketing copy. Saying "that's just how it goes" is yielding to a lazy cop-out with another lazier cop-out. It absolutely isn't just how it goes.

I fail to see how using "equally-meaningless phrases" is worse than using other "equally-meaningless phrases."

Nord also says they never hold logs, and locate in Panama to avoid gov't subpoenas. It's not either/or. You can (should) put the technical information on a 'security' page for the people who know enough to find it and read it.

Yes I can confirm VPNPRO is most likely owned by NordVPN. The site itself wrote a hit piece trying to defame me (falsely claiming I work for one of there competitors). Ironically, lots of Nord shills also think I am the CEO of PIA or something. This article lines up perfectly with Nord's "MO" of casting blame around at other companies to deflect themselves from the bad PR.

Now NordVPN is trying to remove my reviews on my Youtube: https://youtu.be/gZdQx9iv_1U, and they've been caught blackmailing another VPN provider.

The site always rushes to NordVPN's defense when any bad news is going on, and there are several shills on Reddit trying to spread this article around.

The article you cited, to support your claim that NordVPN is owned by a data harvesting company, says the opposite. It says that Tesornet only provided general business consulting to Nord, and that Nord users have nothing to worry about.

It seems there are a lot of back and forth allegations about this topic on the internet. I don't know the truth. That article doesn't really demonstrate anything, though, and your tone seems unhelpful.

As a general rule of thumb, adjectives are often a crutch for weak arguments.

>"Shifty panamanian company"

But they explicitly chose to locate in Panama because it is exempt from 5 Eyes government data spying. That seems the opposite of shifty.

> "Suspicious links to data harvesters"

Have you ever used Google or Facebook? Run a service on GCP? If you run a service on GCP I could say you have "suspicious links to data harvesters." This seems like a scare tactic, lacking substance.

Yeah, the article I cited concedes all the facts, but tries to play it off. I thought it would be funny to cite that website specifically because it's another website sponsored by NordVPN and is literally doing exactly what I claim - playing down the exact behaviour that the original article is playing up about their competitors.

All I'm saying is that if you're predisposed to buy into the concerns this website is pushing about NordVPN's competitors, then you should absolutely have the exact same worries about NordVPN themselves.

This is why I self host algo vpn. I seriously doubt my hosting provider would jeopardize their business by snooping on/messing with a vpn given the breach of trust would cause large customers to ditch them.

I feel like thats just trading one ISP for another. At least with a VPN service they can do things like not keep logs and make torrenting email nastygrams go to /dev/null, because they honestly cannot forward it to the right person.

Unfortunately, your hosting provider gets to see

1. Tunnelled & encrypted (and in most cases, easily identifiable as VPN) traffic coming from your VPN client to your server

2. Untunnelled traffic from your server to whatever server endpoint you're visiting.

Correlating the two, even when it's a massive multi-user service, is not difficult for a hosting provider with half a clue to do. Especially when handed a police order (which they usually have an obligation to not tell you about).

Running your own VPN server doesn't provide you with anonymity, but if configured right, it'll give you more privacy compared to just blindly trusting some random VPN companies with your data. Your data that passed through your own VPN server will only be seen by you and your vps vendor (as opposed to your VPN provider and whatever vendors they used to run their services).

Completely agreed, however the parent comment suggests that they aren't aware that their vps provider's underlying network infrastructure is 'snooping' on them by default:

> I seriously doubt my hosting provider would jeopardize their business by snooping on ... a vpn given the breach of trust would cause large customers to ditch them.

Any half decent network provider logs sampled flow data by default. This is all that is needed to de-anonymise any vpn session. Even on a host that is shared by hundreds of VPN sessions.

> This is why I self host

Goals are to hide your traffic from ISP (1) and your real IP from internet (2). Self host VPN achieves (1) but not (2), your VPN's IP is yours truly.

How do you know my goals? :)

Maybe I just can't always trust my ISP (ex: public wifi).

If I want to also hide my IP I can use Tor with or without a VPN.

VPNs are the best data mining solution out there. You're literally giving them all traffic plus using their DNS. TLS helps a lot now but DNS hurts.

better yet it makes it really easy to pinpoint traffic to a single person despite all other measurements to make this harder. I would guess being an IP transit provider would be a lot more beneficial for them otherwise with regards to the amount of traffic they would handle....

If you tunnel 0.0.0.0/0 or equiv through it, sure. You don't have to, though.

I just run my own VPN server on my cable internet. It allows all my roaming devices Pi-Hole access, and the same privacy as my cable internet.

And that is different from your ISP how? The distribution is less international?

There's nuances. ISP is whole household, VPN is device. ISP has a business, VPN might be interested in selling data especially the many free ones. You can VPN over ISP but can't hide VPN on VPN.

> For example: NordVPN, one of their "Top VPN providers" is run by the same guy who runs a Lithuanian data harvesting company [2]

Did you even read the article you linked? Nowhere in that article it says that NordVPN is ran by the same guy as data harvesting company. Also the same article you linked says in the end: "However, after thoroughly investigating this recent “scandal”, we still feel confident that NordVPN is still one of the safest VPNs around. It’s quite possible that its rapid growth and increasing popularity are part of the reason it’s being attacked by other VPN providers."

I am a bit confused -- are you saying that the article in your second reference is one of those "credulous write-ups" that we should be wary of or are you using it as a genuine reference?

Are those mattress startups any good or is it all hype? I keep seeing them pop up everywhere...