Comment by giobox | Hacker News Reader

Comment by giobox | Hacker News Reader

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too.

The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country - this can be a vast quality of life improvement for many browsing scenarios.

~5-6 years ago a self-hosted VPN exit node in AWS worked so much better than today in my experience, so many services have since added IP range blocks. This really matters for the common use case of trying to access TV streaming services in other countries, as one example.

I still run a private WireGuard setup at home to take advantage of my personal residential IP, but that's only good for content in my home country naturally - still handy when traveling, or to get more secure access on public wifi.

> The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country

This is almost always not true.

There are "residential" VPN providers, but they are scammy AF. The only way to get access to a true residential IP is via some proxy/gateway software run by a customer of a real home ISP. These are usually obtained via botnets of infected PCs.

Users of residential VPNs are usually using them to scrape sites which try to prevent scraping and so are probably happy to turn a blind eye to where they get their IPs from.

They're also much more expensive then traditional VPNs.

I'd dispute that most access is obtained through botnets. I see it as generally obtained through the user themselves. I will agree that the provider may not be clearly notifying the user what they are agreeing to by utilizing their software, hiding it in their lengthy Terms of Service, but the user is agreeing to it by installing their software and accepting their ToS.

This was a huge controversy not long ago. The biggest issue I see from it is that it opens the user up to a fair amount of legal liability for what other users of the VPN service do while connected to the VPN service. If the user failed to understand what they agreed to in installing the VPN service and agreeing to it then it can make for some very awkward conversations when law enforcement comes knocking.

As a cybersecurity person I also think users fail to understand what information they are potentially making available to some rando running the VPN software on their PC. I can (and have before) see any traffic that you are sending through that VPN, and potentially tamper with that traffic. If you thought Nord or PIA could not be trusted with your traffic then how do you feel about Joe Random being able to see and tamper with your traffic?

> This is almost always not true.

If you read my statement, "they can give you a residential IP in the target country" - I never said this was universal.

Some private VPN companies will offer you a residential IP or dedicated IP, sometimes for additional fee - I'm paying for such a service right now. I perhaps should have broadened statement to "dedicated IP" etc, but it remains true you can get a far more "useable" IP from some private VPN providers.

One such example - and I know from my own testing this dedicated IP has far fewer issues with region locked content such as the BBC iPlayer or Netflix, where as almost every IP AWS has assigned me, including elastic IPs, has been blocked in the last few years:

˜ https://nordvpn.com/features/dedicated-ip/

Same thing, different vendor:

- https://www.privateinternetaccess.com/vpn-features/dedicated...

And another...

- https://surfshark.com/dedicated-ip

etc etc

Fair comment on getting a residential IP. I'm not necessarily looking down on commercial VPN providers. I do think a lot of their users don't understand the transfer of trust they are engaging in. As long as you understand that then great.

Another benefit is that your traffic can be pooled with other users coming from an exit IP which can be useful (as opposed from a single endpoint you control as I wrote about in this article). Tradeoffs.

But there is also the transfer of trust to the VPS provider, no?

The cloud provider may have a less favorable privacy policy.

I think you touch on a valid point: we should be focusing less on where our traffic egresses and more on ensuring all of our traffic is end-to-end encrypted as much as possible, as well as ensuring any "meta data" (i.e. DNS) is encrypted too.

This is arguably too narrow a way to think about this, as where you traffic egresses can directly affect what sites or services will work - this isn't hypothetical. Both are important!

If you need access to regional services, a common VPN use case and one outlined in the original article, its the single most important factor.

Another reason to host your own VPN is that you want all your devices to be on the same network.

Reply on news.ycombinator.com