Tuta and Proton: An Open Source Client Does Not Result in an Open Source Service

Tuta and Proton: An Open Source Client Does Not Result in an Open Source Service(danb.me)

9 points by thunderbong 3 hours ago | 2 comments

With the client code being open source, everybody can build the client themselves, run it locally and verify that the open source code is being used. If we published the server code open source, this would not be the case: No one would be able to verify that the open source server code is actually running on our server - so publishing it is a bit pointless.

- Tuta

So we continue in the reality where Tuta runs code on their sever and it is a mystery. It could be an amazing application. It could be a cellular automata that runs an email server.

I think I might start calling these organic tech. Because they take a word we know, "open source", and then use it like the food companies used "organic" stickers.

tcyrus 1 hour ago |

The E2EE behind Tuta Mail and Proton Mail are designed around vendor lock-in. While I understand the reasoning behind the decision, it shows the intent behind both products.

Proton Mail supports PGP encryption for external communications, but I believe Proton Mail Bridge still blocks users from sending PGP encrypted emails.

The vendor lock-in is so bad that some Proton Official Emails (specifically Zendesk Support and Standard Notes) still don't use any form of E2EE (not even PGP).

If you're interested in E2EE emails that you can host yourself, I recommend looking into Delta Chat (chatmail) and the smtp-e2eesign draft.