Re:Swing VPN app is a DDoS botnet
by moffkalast on Sunday June 18, 2023 @03:13PM
(#36383359)
Yeah, Nord is for example infamous for pimping out their users as scraping proxies: https://oxylabs.io/pricing/residential-proxy-pool
[ Parent
| on HN ]
> While the lawsuit names Lithuania-based Teso LT, UAB as a defendant rather than “Tesonet”, this is as a result of a corporate restructuring several years ago. Aside from its link to Oxylabs, Tesonet also advertises itself as a creator and investor of a number of online services, including NordVPN, Hostinger and others.[0]
[0] https://www.techradar.com/news/judge-orders-mediation-after-...
Re:Swing VPN app is a DDoS botnet
by jvanderbot on Sunday June 18, 2023 @03:16PM
(#36383388)
I don't know why, but I did not expect a completely public, normal looking pricing page for something this nefarious-seeming.
Gosh.
"We are a market-leading web intelligence collection platform, driven by the highest business ethics"
I think that's a bit debatable!
I own some IPv4 space and get constant spam from these companies with pitches like "monetize your IP addresses". It's funny how upset they get when you respond and use the word "botnet" to describe their operation, or suggest that the traffic they generate is illegitimate.
I think it's known as 'touching a nerve'!
It’s difficult to get a person to understand something when their income depends on them not understanding it. —Upton Sinclair
business ethics. these words seem contradictory haha. not to say theres no ethical businesses, but it just sounds funny to me :D
Re:Swing VPN app is a DDoS botnet
by earleybird on Sunday June 18, 2023 @03:59PM
(#36383839)
There are no ethical businesses. A lawn mower can give you a nicely manicured lawn or a trip to the ER. The lawn mower doesn't care.
Re:Swing VPN app is a DDoS botnet
by moffkalast on Sunday June 18, 2023 @04:06PM
(#36383915)
It would take quite a while to drive to the ER on a lawn mower. You're supposed to call the ambulance /s
Re:Swing VPN app is a DDoS botnet
by friendly_wizard on Sunday June 18, 2023 @04:15PM
(#36384011)
Reminds me of Bryan Cantrill's Fork Yeah talk about the acquisition of Sun by Oracle
this seems a bit besides my point, but perhaps i am not as deeply into this topic as you. how about the baker at the end of the street. making bread for people, selling it at a profit margin which just allows him/her to continue their work as a non super rich person. (replace baker with barber or whatever). i dont see this as unethical. am i wrong?
[dead]
But if you take that point of view, there are ethical dilemmas in pretty much everything.
Which then makes this viewpoint not that useful at all.
And this issue already been long summed up as “nothing is free in life.”
[dead]
I don't think for example capitalism is always dilemmas. If someone choses to work for you, they chose to accept such a salary and participate. Its not some bad thing. If you truly pay them an unfair wage, they can chose not to participate. This might sound harsh, but people always have a choice. I work for an employer, i don't think its unfair simply because my boss is turning a profit. I am happy and thankful i have the job. If i didn't want it, there's plenty of space in the rainforest to try and forage for food (and yes i wouldn't last a day :P).
You might not like something, but does it really make it a dilemma in the sense of 'having to pick which of the 2 bulls horns will impale you?' - i don't think so. (interesting points though, and perhaps i am still missing your point!)
The lawn mower is not a business. It is a piece of machinery. The business that designed the lawn mower can ensure the design is safe, at least within reason, through the proper engineering of the product and by instructing its users on the proper use and maintenance of the machine. There is nothing inherently unethical about manufacturing lawnmowers unless you consider the practice of mowing lawns unethical (which there are legitimate arguments for, but I don't think that was your point).
There may be no ethical businesses, but some are definitely better than others. All the more reason to make a difference.
Nord as in NordVPN? Source in that case please?
Re:Swing VPN app is a DDoS botnet
by moffkalast on Sunday June 18, 2023 @03:24PM
(#36383480)
It's not "well-known"- because your links don't say what you're claiming they do, and this is a conspiracy theory that's been shut down on here a thousand times before.
https://news.ycombinator.com/item?id=22532682
NordVPN used residential proxies at one point to enable access to Disney+ and other streaming services; that's a world apart from hijacking end-user connections.
They've got an open source client. Where's the code that's turning end users into endpoints?
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:51PM
(#36383782)
> NordVPN used residential proxies at one point to enable access to Disney+ and other streaming services
I'm sorry but that's incredibly sketchy
It really is of course, but I can honestly see them resort to this only to be able to offer a competitive edge because when it all comes around, this stuff is what many use VPN for rather than privacy. As streaming sites keep clamping down on VPN providers, the low hanging fruits of dodging via mere national IP addresses are blacklisted by them and these providers need to go even further to fool them and compete.
But yes, it's also sketchy with the other implications and all, and not the least what kind of traffic that people want to hide that you're unknowingly a proxy to!
https://github.com/NordSecurity/nordvpn-linux/tree/main/mesh...
The standard linux vpn client clearly has some exitnode capabilities.
That's for Meshnet: https://nordvpn.com/meshnet/
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @04:34PM
(#36384177)
Oh interesting. Is that tailscale but worse?
Interesting as related to tailscale? Please tell me your insight. Legitimately interested.
i think users in a vpn dont expect other users traffic being redirected over their systems, even if its just to enable access to some streaming services... or are residential proxies systems in residential ranges that are used as proxies, but actually part of nord vpn infra, rather than its users?? (sorry i dont wanna read all the code, and am a bit confused)
It's the latter case; Nord used a third-party residential proxy service that they sent traffic through, but there's no serious evidence that they used their own users as proxy nodes or endpoints.
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:31PM
(#36383545)
I always thought nord seemed incredibly sketchy. Thanks for the confirmation.
Skimmed it and I don't see anything about Nord making their users into proxies, second link is questionable (since its deleted and you linked to an archive)
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:32PM
(#36383567)
> Aside from its link to Oxylabs, Tesonet also advertises itself as a creator and investor of a number of online services, including NordVPN, Hostinger and others.
Where else would they get the 100 million users?
Why don't you try installing Nord in a VM and monitoring traffic yourself, instead of taking low-quality blogspam Medium articles at face value?
If they're truly hijacking end user clients, why don't you point to the section of their open source client that's responsible for that?
https://github.com/NordSecurity/nordvpn-linux
Easy enough to prove.
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:42PM
(#36383667)
I didn't even read the medium article, only the first one. That's what I quoted from. I agree, investigating traffic would be an excellent idea, but I don't intend on putting my credit card into nord's sketchy site (they apparently don't accept paypal)
They do accept paypal, I just checked their site.
Credit or debit card, Klarna, PayPal, Google Pay, Cryptocurrencies
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:45PM
(#36383711)
Where? I'm presented with "Credit or debit" (direct input), AmazonPay, ACH Transfer, and Crypto https://imgur.com/G4j1DB8
Maybe possible it differs by country then:
Exactly, I'd love to see some proper proof other than "the parent company owns a residential proxy service"
Re:Swing VPN app is a DDoS botnet
by internetter on Sunday June 18, 2023 @03:43PM
(#36383679)
Honestly, "the parent company owns a residential proxy service" is more than enough to deter me from the product.
If I were evil, I don't implement proxy feature on open Linux VPN client that geeks use, but just implement on closed Windows/Android client. Traffic monitoring is better.
Yeah I saw that part but it does not mean they are using the users from NordVPN for Oxylabs, there's nothing explicitly showing so.
I'll be honest, the fact that they're directly linked to Oxylabs alone is enough to deter me. I can't see how else they'd get 100 million+ residential customers on Oxylabs side... sure, I'm not going to go around claiming I have direct proof, but that's more than enough for me to not use their services.
luminati.io, similar for hola. guess they rebranded now as that one redirects :p but its still the same. this should be illegal really...
Re:Swing VPN app is a DDoS botnet
by codedokode on Sunday June 18, 2023 @03:26PM
(#36383506)
And why is there need for scraping proxies? Because greedy capitalists do not allow to scrape their sites.
It has nothing to do with greedy capitalists. I don’t want anyone scraping my site at all. I don’t charge anything for it.
Re:Swing VPN app is a DDoS botnet
by codedokode on Sunday June 18, 2023 @03:41PM
(#36383663)
Let's take as an example a website which compares prices in different stores and shows which has the cheapest price. You can do it manually, but using automation it is faster and more convenient. Is doesn't make sense to read websites manually when you can use a script or a language model.
Obviously for consumer it is better to be able to scrape sites. It is only those store owners (greedy capitalists) who do not want consumer to know that their prices are inflated.
Another thing is looking for some information, it is better just to have a language model go around the web and summarize the data for you rather than read someone's site with white letters on black background and weird font.
It's not uncommon that companies ask other companies to scrape their site as they don't have the tech resources to build an API / integration for whatever they want to have.
if u run a small site and ppl scrape it aggresively that can rack up ur bills.depending on where u host ur site. ofcourse not an issue for billion dollar companies, but a line needs to be drawn somewhere. also, whats the purpose of the scraping? usually its greedy capatalist purposes, so.then ur point is a bit moot, dont u think?
Re:Swing VPN app is a DDoS botnet
by codedokode on Sunday June 18, 2023 @04:12PM
(#36383970)
Let's say someone makes a site that compares prices in different stores. It needs a lot of scraping, but is useful for consumers. Obviously, the only ones who are against it will be the store owners.
Unless you go full blown DoS you will not be able to scrap 100.000 of articles multiple times a day. Geizhals for example compares prices every 10 minutes. It does this by working with the stores (they provide a price list) not against them.
If a store owner doesn't want the reach, it's their loss. IMHO no need for a DoS attack.
And then someone else makes another site that also compares prices in different stores. Instead of scraping all the stores they can just scrape the first comparison site and invest the time saved into SEO :)
Sites have a right to try to block scrapers. Scraping can incur significant costs and users may not want it - as a LinkedIn user, I want my profile to be indexed and able to viewed without logging in from the Web, but I also don’t want my entire profile scraped and resold/rehosted for marketing. It’s also often the case that the website put in significant working acquiring/curating/cleaning their data, and they are being scraped by other commercial entities trying to just resell it (blocking that isn’t being greedy, the data is basically being stolen for other commercial entities). So it’s not just being greedy.
Individuals also, IMO, have a right to sell access to their network for scraping-via-proxy. But they should be prepared to deal with the consequences, like a potential IP ban. Most people using VPNs that resell their residential network for scraping probably don’t know that’s happening, and many scrapers are indeed doing something bad, which is why there is a disdain for the practice.
Re:Swing VPN app is a DDoS botnet
by withinboredom on Sunday June 18, 2023 @05:56PM
(#36384924)
I guess secret shoppers are illegal too.
Secret shoppers are paid by the company in question. How is that in any way relevant?
Not only did I not say anything about legality, I did not even say scraping is “bad”, just that it often is.
Not to worry linkedin already packages and sells your data no scrapers needed.
Re:Swing VPN app is a DDoS botnet
by scarface_74 on Sunday June 18, 2023 @09:57PM
(#36386474)
The difference is why else would I use LinkedIn except for my job data to be available for recruiters and employers?
Well part of that is just the direct value prop of the platform, by having a profile there I’m creating a channel for recruiters and stuff and I suppose making it easier to get bank loans/have people verify my identity. What I don’t want is for the data to be hosted elsewhere and resold to every Tom, Dick, and Harry. Fortunately LinkedIn also wants to prevent that because it undercuts their monetization schemes.
Nord offers OpenVPN configs. Those configs don't seem to allow nat/routing from Nord VPN network?
I never looked into that, but always used Nord VPN via the official OpenVPN client.
Re:Swing VPN app is a DDoS botnet
by Timber-6539 on Monday June 19, 2023 @12:48AM
(#36387410)
While old OpenVPN configurations still work, NordVPN stopped providing username and password for OpenVPN configs in the account dashboard.