If they didn't try so hard to fight it, people might care less.
Now that I launched a verifiable VPN, they are once again sending legal threats [1].
The key point, you don’t have to trust us, and we don’t want you to. Trust code, not people. That’s the foundation of the entire effort.
As for the Freenode situation, the popular narrative has been repeatedly misrepresented. The core claims were debunked and the receipts are here: http://techrights.org/wp-content/uploads/2021/05/lee-side.pd....
To clarify a few historical points:
1. The so-called “takeover” was being organized long before my involvement, as shown by domain registration dates and internal meeting notes. I was a more convenient target than Christel, which might explain why she asked me to buy it from her.
2. False narratives were already being circulated to open source projects before any administrative changes occurred. The subsequent channel topic changes were a reaction to those actions, though I’ve acknowledged those decisions weren’t ideal in hindsight.
On broader context, much of what’s now called “funding FOSS” doesn’t reach active developers. It tends to reward organizers and promoters rather than those writing meaningful code. Supporting individual developers directly remains a better way to sustain real innovation.
Ironically, several of the ex-staff I defended for years against serious allegations (search “OldCoder” if you’re unfamiliar) went on to form Libera, attempted to seize the freenode IRC domain, and created a false narrative about events. It’s disappointing, but not surprising given the leftist politics at play.
If you want to understand the larger trends affecting open source today, I recommend Lunduke’s Journal and similar analyses. Most major FOSS projects are no longer developer run… just look at Mozilla for an example.
https://cyberinsider.com/private-internet-access-kape-crossr...
Re verifiability: the point isn’t trust us, it’s that you don’t have to.
We built it so anyone can independently confirm what’s running.
1. All server and client code is published.
2. Builds are reproducible.
3. Each node provides cryptographic attestations of its runtime and routing identity.
4. Enclaves are used for verifiable isolation.
You can peruse the code yourself to see exactly why the transparency we bring makes legacy “trust based” VPNs obsolete: https://github.com/vpdotnet/vpnetd-sgx
Is there some indication the user has that your server isn't simply hard coded to return the right magic number? I don't understand how this provides any assurance of anything.
When the client connects to the server, the server presents a tls certificate that includes an attestation (with OID 1.3.6.1.4.1.311.105.1) which certifies a number of things:
- the TLS certificate's own public key (to make sure the connection is secure) - The enclave hash
It is signed by Intel with a chain of custody going to intel's CA root. It's not "just a magic number" but "a magic number certified by Intel", of course it's up to you to choose to trust Intel or not, but it goes a much longer way than any other VPN.
In 2016, Proton created its own subsidiary, and these people are now employed by Proton. But for this historical reason, the ProtonVPN keystore on Android still lists Tesonet as the organization name, even though it is fully controlled by Proton.
None of this is "debunking"; these are just the facts. You can make of them what you will, but you should be honest about what actually happened when you talk about it.
Entirely normal behaviour for a competitor to provide “HR assistance”.
In Proton's case, they already knew each other because Tesonet had previously offered to provide infrastructure during a DDoS attack against Proton.
So maybe it's a conspiracy, or maybe it's just how things go. You can make up your own mind, but you should provide the facts when you make sinister insinuations.
The point is: we don't know.
Here's the Handelsregisterauszug for Proton, which shows ownership: https://www.zefix.admin.ch/en/search/entity/list/firm/118926...
Proton's peering relationships: https://bgp.tools/as/62371#asinfo
I'm not sure what exactly you're looking for.
It doesn‘t. It’s a joint-stock corporation and while the shareholders are registered, the register is not public.
But I guess they could be lying.
So either:
1. Tesonet/Nord are loose with their private keys.
2. Proton isn’t being truthful.
Anyone who understands crypto and key management knows “not your keys, not your _____.”
If those staffers worked for Proton and not Nord, why did they have Nord’s key?
This level of negligence with private key management really can’t be explained away.
https://redlib.catsarch.com/r/ProtonVPN/comments/8ww4h2/prot...
I suppose you're free not to believe them, but I'm unsure what exactly you believe is happening here and what exactly Proton is lying about. Tesonet secretly owns them and has been running a decades-long misinformation campaign to trick you into thinking they don't? To what end? It's not like Tesonet is some nefarious company we should all be afraid of. What would they gain from lying about this if it were true?
And how can they make such an obvious mistake with their certs and then not make another one for the next decade? It's just not plausible.
At some point, you've gotta use some common sense.
1. Either Nord/Teso are loose with keys (horrible)
Or
2. Proton isn’t being truthful.
I don’t think it’s a conspiracy or anything that it is Tesonet/Nord. Rather, the problem is you cannot trust someone with your privacy if they can’t even manage their own keys.
[1] The explanation is poor at best and doesn’t explain why they worked so hard to try to delete all of the evidence (all of which was archived already). Additionally, nothing can explain away the lack of security with key management across these two orgs.
> worked so hard to try to delete all of the evidence
The cert is still there. Apparently, they didn't work nearly hard enough.
As pointed out on this reddit post [3], Proton's appears to contradict itself a number of times.
It's a good thing trust based VPN's are obsolete. After all, trust isn't constant [4] as seen in this article showing how ProtonVPN supplied IP addresses to "authorities."
[3] https://www.reddit.com/r/technology/comments/8x9aik/protonvp...
[4] https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
This is a hilarious way to start an ostensibly serious investigation. It's not as if you could easily figure out the answer to that.
At some point, you have to acknowledge that you're a clown.
You're on the Internet. How are you surprised that someone is repeatedly responding in a thread about a very obscure topic, especially when people are posting conspiracy theories?
It's interesting to have these discussions. But it is funny that people's conspiratorial thinking now makes me a part of the conspiracy merely for pointing out easily verifiable facts.
>What is your relationship to either company?
I subscribe to Proton's services, so I was originally interested in finding out what actually happened. Now I'm interested in pointing out people's flawed reasoning because I think Proton is doing something valuable, and I don't want these attacks against them to go unanswered.
Since we're now part of this thread, as the attack on Proton was orchestrated initially by a competitor and seemed to use bot accounts on Twitter, how much do they pay you to try to discredit me?
Just kidding, see above. You and I, we are the same. We do it because it is interesting.
How? it is obvious.
> During Proton's expansion into Eastern Europe, Tesonet initially assisted Proton with HR, payroll, and local regulation, so for a period of time, people working for Proton were employed by Tesonet, since Proton had no local subsidiary that could hire them. These were not "shared employees", they worked exclusively for Proton.
So basically same people managed teams, same people paid the employes, but my "Links to" is doing heavy lifting and in the previous sentence you say "ProtonVPN is owned by Proton, which has no legal ownership ties with Tesonet."? Who is doing the heavy lifting here?
How much is Tesonet or Proton paying you to post in here?
Sadly, they're not paying me anything, but I would suggest that any belief system in which information contradictory to your belief reinforces your belief is inherently problematic.
So how much is Nord paying you to post here?
Lithuania is a really small country and IT has been a huge economic strategy since early 00s as a way to become economically independent specifically because of Russia and it worked out really well.
From what I can tell, Tesonet seems like a very patriotic group (as much as a corporation can be personified at all), and genuinely puts resources, both human and financial, towards raising up the local communities.
It's interesting to me that Tesonet has concentrated the most popular VPNs under one roof and is involved in so many companies that could be described as "dual-use" (white hat/black hat) such as residential/mobile proxies, ai-powered scraping, etc. It tells me that Tesonet has a very sharp understanding of gray-hat landscapes. It does seem like their portfolio could be leveraged as a valuable asset to any powerful interest, regardless if they are benevolent or malicious or misguided.
I mentioned Tesonet's stance towards Ukraine because Lithuania has a number of wealthy ex-soviet/Russian citizens and business-owners with differing politics, and wanted to clarify that for any readers who might wonder.
Additionally, I've always been very impressed with Estonia's digital infrastructure and Ukrainian software engineering - not just JetBrains but also other vendors that I've worked with personally. Seems like there are a lot of highly skilled people concentrated in your region.
Here..
> Additionally, I've always been very impressed with Estonia's …
Before that you were talking about Lithuania exclusively.
And then:
> … Estonia's digital infrastructure and Ukrainian software engineering - not just JetBrains …
I think it was founded in CZ and is now HQed in NL. Right?
A typo? Or there's some relation between the two countries and whether JetBrains has some history with these two that is missing here?
(I am not trying to nitpick, really interested in knowing whether there's some angle/twist here, since the post itself is about hidden connections and what not).
Honestly that shone through even from the first sentence.
I mentioned Estonia because Lithuania/Latvia/Estonia have a bit of shared identity, kind of similar to Sweden/Norway/Finland or USA/Canada.
> I think it was founded in CZ and is now HQed in NL. Right?
Yes I was just wrong. I was convinced it was Ukrainian for some reason.
I agree that the combination of those two points made my post particularly confusing.
Some part of management were in CZ. Most of the technical team were in three buildings in St.Petersburg.
Also the place seems to have quite a few rebellions under its belt.
Common-sense like a complete ban for entering the country for red passport holders.
Lithuania is a wonderful, beautiful country and I understand the need to push the hardliner stance in the EU, but their decisions during the conflict have been strictly political, not in the slightest "common-sense".
Context here is Russian Federation.
Why? OP decided to use Russians, as they're free to do so. No need to bring your objections to personal feelings here.
Israel is an abuser to neighboring countries, and yet, you won't dare to say the same thing about Jews that you say about Russians.
If you can't say the same about Jews that you say about some other group without sounding racist, you are racist. Period. Everything else is just an excuse for your racism.
It's not about Russian people, you assumed that. There are well known connections between any company doing business in or with Russia who are basically extorted to hand over all information about customers or financials to the government. This is no secret.
If any company is working from or with Russian ties, you can assume the government will have access to that data. Given the sensitive nature of VPN's, antivirus software, deployed software in general, its completely fair to say you don't want to work with people with ties in Russia. I'm the same. You're conflating things, and then throwing in some 'what-about-ism' for good measure. Nothing but an argument will come from this discussion so it's not welcome here. You could try your hand on Twitter.
I assumed that because it's what has been said.
>> ... but they're lovely people that would 100% walk out if there were some real Russian ties involved.
> If any company is working from or with Russian ties, you can assume the government will have access to that data. Given the sensitive nature of VPN's, antivirus software, deployed software in general, its completely fair to say you don't want to work with people with ties in Russia.
Many major VPN companies have Israeli ties. Now, tell me, how is that better than having Russian ties? You trust Netanyahu's government more than Putin's?
> You're conflating things, and then throwing in some 'what-about-ism' for good measure.
No, I'm just exposing your hatred of Russians and your double standards.
> Nothing but an argument will come from this discussion so it's not welcome here.
Who are you to say that? You started with the racist remarks and got called out. If you don't want to discuss it anymore, you are free to stop, but I won't let your racism go unanswered.
> You could try your hand on Twitter.
Not sure about Twitter, but there are many platforms that would welcome your racism and your hatred. You would have a much better time somewhere else, so feel free to act upon your advice.
We're talking business connections here not personal friendships. Russian businesses and business people are not to be trusted as Kremlin retains full control over them and Kremlin is an enemy of Lithuania. It's basic safety and risk assestment to not integrate compromised systems and every russian system is compromised. Same applies to any other actor but guess what, no other actor is threatening invasion of Lithuania so the math adds up here, no?
Now they have got more money than they know what to do with so are making VC investments.
Ukrainian ties with government and tech in the US have been a serious source of problems; our last President was haunted by business ties with Ukraine; our current President was impeached for refusing to sell weapons quickly enough to Ukraine; we funded neo-Nazi groups in Ukraine in order to bring down its elected government and replace it with a puppet government that immediately set its sights on eradicating the Russian presence from Ukraine; Crowdstrike, a company of Ukrainian origin, was the company whose analysis was taken as gospel for the Democratic Party email leaks, and that report was used to market Russia into the greatest enemy the world has ever known, creating an entirely fictional narrative now referred to as Russiagate; and during this entire process the West and the US have been sending palletloads of cash and weapons to Ukraine to the tune of tens or hundreds of billions of dollars, and becoming personally financially entangled with Ukrainian oligarchs.
Why should I be worried that they Russians are eavesdropping on my proxy again? They're not going to send it to anyone who cares about what I'm doing, and they certainly don't care what I'm doing. Ukraine is the most corrupt, poorest country in Europe, completely tied up in our intelligence services, and is "run" by a tv actor.
> The Republican-led Senate Intelligence Committee investigation released their report in five volumes between July 2019 and August 2020. The committee concluded that the intelligence community assessment alleging Russian interference was "coherent and well-constructed", and that the assessment was "proper", learning from analysts that there was "no politically motivated pressure to reach specific conclusions".[11][12] The report found that the Russian government had engaged in an "extensive campaign" to sabotage the election in favor of Trump, which included assistance from some of Trump's own advisers.
Painting "armed invasion" as "Russian presence" is like calling "stabbing someone in an alley" a "medical procedure".
We get it; you love Mother Russia.
They don't seem to have Russian ties: "In 2022, CyberCare opened an office in Lviv, Ukraine. Although planning for the move started before the war, according to Dainius Vanagas, CEO of CyberCare, one of the reasons why it was followed through was a desire to help Ukraine rebuild."[0]
They also donated money to help arm Ukraine.
0: https://en.wikipedia.org/wiki/Tesonet