For what it's worth, this company was spawned by Mullvad: https://mullvad.net/en/blog/mullvad-creates-a-hardware-compa...
There's also Glasklar Teknik AB and Karlstad Internet Privacy Lab AB.
Glasklar does:
- Sigsum, a transparency log design
- System Transparency, a security architecture for transparent systems
- Hosts and maintains the Debian Snapshot service, an archive of the past decade of released Debian packages
KIPL does traffic analysis defense against AI-based classifiers, which Mullvad recently integrated into the VPN app.
They're a model company for data-minimization. No account names, no passwords, can pay by cash in an envelope, RAM-only infrastructure, thorough and frequent 3rd-party auditing, etc.
They provide back, fund privacy initiatives, have a history of being unable to provide user data when requested by governments, all of their stuff is well documented. You'd be hard-pressed to find anyone privacy & security conscious speak poorly about them.
There are 6 other providers that do offer static IP, and one of those uses AWS nitro to ensure that mappings aren't available to LEO. So this wasn't a technical limitation.
What were they deceptive about? Their announcement is straight forward.
"Regrettably individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers. This has led to law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us.
The result is that it affects the majority of our users negatively, because they cannot use our service without having services being blocked."
https://mullvad.net/en/blog/removing-the-support-for-forward...
I'm not saying you have to agree with the decision, but I don't see any deception. They even gave a months notice.
https://web.archive.org/web/20230530003202/https://mullvad.n...
But if I may put my cynical hat on (I think this is fair for any VPN provider), mullvad states in HN[0]
> Port forwarding needed to be removed on moral grounds.
Fair enough, however such moral grounds only came to light when extreme and immediate pressure was applied to their business model. The same post does talk about abuse, but only in terms of how it created a negative experience for "some" users (no details). The blog post does go into those negative effects, good, and doesn't try to whitewash it in moral reasons, also good. I think I mistook the official blog with an official statement here on HN.
There was another HN post apparently by a mullvad engineer that didn't pull any punches. I can't find it anymore, but I remember that it was that post that somehow led me to kfred's post and then left a very bad taste in my mouth. Maybe someone else is a better researcher than me and can dig it up.
I'll retract my "character" criticism, since mullvad clearly cares deeply about privacy, regardless of my perceived problems with their public communications.
Personally, iCloud Private Relay ticks all the boxes for my use cases, so I should have just kept my mouth shut.