> why people pay for 3rd party VPNs? It's far more secure to create your own wireguard/openvpn/whatever with a cheap VPS

Your comment seems to infer that you're unable to empathize with people who might think/understand differently than you. It also seems to negate that you avail of other services/non-self-controlled processes without worrying about the threat models, there.

Just hand-waiving with a "Why don't people just do 'x'?" is ironic - in the sense of "Why do you do your own medical care?" or "Why don't you grow your own food and slaughter your own animals?" or "Why don't you manufacture your own phone, it's operating system - oh, and the cellular tower closest to you?".

Threat models exist, _everywhere_, and it's impossible for someone to build all of the pieces, themselves, to prevent all threat models at every possible avenue/point.

In other words, at a non-arbitrary point, doing _everything_ yourself is untenable and that's precisely why services in society exist, today (that and ease of access, use, required foreknowledge, and - most notably - cost).

Not everyone is savvy enough to do it, even though the process has been simplified with many hosting providers providing preconfigured VPN servers.

And it doesn't anonymize you that well. When you post a message that draws the attention of law enforcement, the IP will lead them to a VPN provider that hopefully doesn't keep any logs.

But if it leads them to a specific server, the hosting provider will disclose your account and payment data, since it is linked to your private server. Unless they accept fully pseudonymous accounts and let you pay for your VPS in cash, Monero or tumbled Bitcoins, finding you is much easier now.

My €5 VPN allows me to use 500 IPs in 50 countries. Give me the VPS that allows me to do that.

You have to trust someone somewhere. You're simply placing your trust in the VPS provider instead of a third party VPN provider.

Not to mention the other stuff the VPN providers give you as standard which you'd have to implement and maintain yourself.

It really depends on why are you trying to do. It is not easy (or just impossible) to get the same amount of ip with that $5/mo or $10/mo VPN services by renting your own VPS at the same price.

Oftentimes, it's not about security but about circumventing censorship. A cheap VPS comes with a fixed IP located in one fixed part of the world. Many VPN providers allow switching.

Because most people are not techies.

Compared to the rest of the world, the number of people who even know what a VPS is is microscopically small.

And even those that do, the number of them with the time, desire, or skill, to do as you suggest, is even smaller.

I myself was into this sort of thing just 10 years ago. Now, as I start looking at hitting the big 6-0 in just a few years time, I’m already working on divesting myself of all this complexity,

Ah, good 'ole trustworthy Swiss companies! Like Crypto AG![1]

Realistically, all VPNs are compromised. But for most people's threat model, that's irrelevant anyways.

Proton for instance revealed the location of a climate activist leading to his arrest[2], with the inspiring message from the CEO that "privacy protections can be suspended", silently on a per-user basis at any time.

Haven't seen anything like that for Mullvad, but it's probably the same. At least the company takes crypto. But these things are always just surface level obscurity at best.

[1]: https://en.m.wikipedia.org/wiki/Crypto_AG

[2]: https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

Mullvad is not Swiss, it's Swedish.

Thankfully, gag orders are not permissible in Switzerland, so the scenario you are describing is impossible.

Almost all public statements about App Store review security, for example

Not a law.

Imho, the correct way to evaluate corporate potential corporate trust is on self-interest.

In Microsoft, Google, and Apple's cases, they all have substantial enterprise business that would shit a brick if they were caught doing this.

Ergo, it's not in their best interest to do it.

Safer to rely on a company's desire to make money than any sense of "good".

> FB did not clearly request to be able to read all traffic (encrypted and nonencrypted) so how could they get consent.

I can't find the consent page/legalese shown to users, do you have a link?

Yes they did. Participants were even compensated for it IIRC

Now obviously my comment is not about "just a CDN provider" right?

The SSL stuff that Cloudflare offers to protect your websites/APIs etc so you don't have to, their DNS products. The fact that iCloud Private Relay uses Cloudflare under the hood (and so all browsing there happens through their gateways etc).

Here’s how I see it. This is akin to opening your USPS mail and reading your correspondence with a friend. When instead they could’ve checked who the mails were addressed.

If Facebook wanted to learn the protocol Snapchat uses, they only needed a single test device. If they only needed to learn usage patterns, they could’ve checked where the traffic is sent to or app usage time etc.

Installing a root certificate is very intrusive and they behavior shows that if they are ever given the opportunity to be become a root certificate authority, they are likely to issue malicious certificates. As far as I know, no website can pin their certificates, so this takes us back to pre-HTTPS days where ISPs and network operators had a lot of fun reading user traffic.

That box on your TV would have been a Nielsen box which sat on your TV and was connected to your landline. It didn’t collect anything automatically: every time you turned the TV on you were contractually obligated to press a button every 20 minutes to have the box call Nielsen and log a datapoint.

Those boxes have been phased out in favour of “Personal People Meters”[0], which are basically a pager with a SIM card that you wear which has a microphone listening 24/7 for TV broadcasts. You must keep it on you, listening at all times.

Nielsen will pay you $250/year (less than a dollar a day) for the data you provide.

[0] https://en.wikipedia.org/wiki/Portable_People_Meter

They would because the communications involve 2 parties. Your consent to someone snooping on my calls with you should not be enough, because for example, you still need my consent to record calls I have with you.

Now, Meta decides to MITM the communications that I intentionally encrypted so that it can gain a competitive advantage…well, remember when meta kicked out researchers what had obtained consent from users to perform research on its platform? That was not even illegal. This is.

Which doc and which link are you referring to? This isn't anywhere in the class action discovery documents as far as I can tell.

TC reported back in 2019 on Facebook using various third-party testing services to distribute their first-party Facebook Research app, so I'm not even convinced that point is new (or that they paid the third parties to do any actual research).

https://techcrunch.com/2019/01/29/facebook-project-atlas/

Facebook would probably have run up against app store policies by trying to install their root cert on existing apps, which seems to be the most likely justification for installing this additional app through third-party channels. It's also a lot easier to avoid suspicion when it's part of a bunch of click-through screens as part of app setup (especially when you're dangling money in front of users, even just $20/month).

it's almost as if there wasn’t an ethics class in the CS majors’ required courses!

Perhaps we could require a simple "nutrition facts" on each article about the journal's conflicting interests: for example, a ragebait article about big tech? Then the disclosure of the ad revenue conflict between big tech and media industry must be required up front (at the beginning of the article.)

We could also require a list of the journalist's qualifications to be posted clearly at the beginning of each article. If the journalist, for instance, does not have an education in the subject, the article must be prefaced with a "journalist is not experienced or qualified in this field." This would encourage traditional journalism to end, and for journalism to become more of a mandatory consultancy with experts.

Finally, we could strengthen libel and defamation laws rather significantly. For example, in Emily Steel's article[1] about ATC, she should not have named and shamed a particular controller. Furthermore, the ATC group should be able to easily sue her for inaccuracies in her article[2] misrepresenting ATC as a whole. If you can get easily litigated, you're more likely to stick to just the facts.

Ultimately a formulaic approach will not solve this problem, it can only help a little bit by discouraging nonfactual reporting. Unfortunately, this problem fundamentally comes down to journalists as an industry thinking they're paragons of righteousness, and then going on to write horrible things.

[1]: https://www.nytimes.com/2023/12/02/business/air-traffic-cont...

[2]: https://www.reddit.com/r/ATC/comments/175pwim/the_nyt_articl...

They had explicit consent to do it?

No. Its written as a set of negatives- it shall be unlawful for someone not x to do y

Here it is saying it’s illegal unless you are an official acting under color of law and there is one party consent

It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular.

It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group.

So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved).

It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.

From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself.

It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point.

Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?

They don't see the traffic unless they analyze the memory of your running server, because the SSL termination happens inside the server. Encrypted traffic passes through their network, which they don't have the keys for. Cloudflare, on the other paw, literally offers to do the SSL termination for you, as in they hold the private keys and perform the decryption on their servers that they control. Then they pass the decrypted traffic through their network in order to do things like "optimize" your images, or inject JavaScript into your pages. Website owners consent to this, but I guess the question here is whether users should need to consent to this website's traffic being handled in decrypted form by Cloudflare before that is actually done.

Or educate grandma on why she should use signal and that fools use WhatsApp since meta is balls deep inside the app and watching what you do.

> Furthermore, the app has been extensively RE'd by third parties to validate it's doing what it says on the tin.

thats a freaking lie and you should feel bad for repeating it.

it was barely reviewd years ago. before all the shady features that even caused the original founder to leave the company (and a few billions worth of golden handcuffs) with an open letter about how fb destroyed privacy in WhatsApp.

EU and all sane state actors forbid its use (some recommends signal)

all recent political leaks was from fb (e.g. brazil, italy)

It's not that hard for VMI and harder than you think for network.

I did work for a public cloud and we did think of VMI for diagnostics and malware checks. Once deployed and automated, it would be trivial to reuse for other purposes. I don't expect public cloud to use that daily, but I'd be surprised if they didn't have the process ready.

On the other hand, you want to process the LB traffic as fast as you can and any monitoring/reporting delay would have bad effects. Reconfiguring the filters / sinks at runtime takes effort too.

With experience in both areas, I can tell you they're comparable overall. You have to go out of your way to do it, but it's not too far.

This was news … 5 years ago, I think, I don’t know why it blew up again. But context matters:

Onavo provided a compression + VPN service for people traveling; they let users use little or no data while roaming, and still get internet access. I do not know what their original business plan was, but Facebook bought them for the ability to spy on users.

Their MITM was, in fact, the raison d’etre of Onavo. And then, they were bought by Facebook. And then there was just some more analytics added. At no point, as I understand it, was it built explicitly for evil - and I suspect very few employees were in on the real reasons.

Plausible deniability works for many things.

Nah, I've met enough amoral people over the course of my career to know that's not the case. However, the overwhelming majority of people I've worked with are people who do have morals and do care about the outcomes they're creating, and that gives me great hope.

I understand that things are often more nuanced than they may appear, and in questions of moral judgement there will always be room for fuzziness. Personally I think the idea of compromising security for everyone in order to make life a little easier for the TLA's is not something I'd feel comfortable doing. I consider an individuals right to privacy paramount, something without which we risk unbounded tyrannical rule. Others will probably feel differently when presented with 'think of the children' style arguments. I'm glad to hear though that you were at least conflicted enough to be asking questions.

You simply legislate that if a company is building anything that will be used regularly by more than eg. a few thousand people, then the work must be designed and/or signed off by a licensed engineer, who will a) be subject to a code of ethics and b) be professionally liable for any failures causing loss or damage to the public.

We seem to be able to manage this with bridges, planes, electrical & hydro installations etc. No reason it shouldn't be the same for critical software infrastructure.