It wasn't AI that flipped Proton's charge | Hacker News Reader

It wasn't AI that flipped Proton's charge

blog.raed.dev

149 pointsRaed66784 comments

> Beyond the clumsiness, it shows a leadership that now treats the constraints that made Proton worth paying for as the thing slowing it down.

Exactly. The product is security and privacy. The thing being sold is that. If anyone could justify being slower to pentest, it is Proton.

I do wonder who would be demanding that Proton move faster. Would any user of their service ask them to sacrifice these attributes?

I hazard a better reasoning: The walled garden made it's users too valueable to not sell out to whatever forces it can find.

Apple is deeply in this camp; all it takes is one MBA's desire for bonuses to break the damn.

Corporations in unregulated waters are only as solid as the last captain.

> I do wonder who would be demanding that Proton move faster.

Whenever I see "hosted in Switzerland" my mind immediately goes to the Crypto AG scandal.

From 404's reporting,

> “Due to insufficient velocity,” Proton is not on track to achieve its annual recurring revenue target by the end of the year, one internal document obtained by 404 Media reads. Proton’s year-over-year growth is also “far away from what the market today considers to be good,” and, “By all metrics that matter, we’re an underperforming company.”

So, the "market" is demanding it?

They aren’t public, so these are their own lines in the sand.

They are cash flow positive.

I guess capitalism just needs constant, unsustainable growth. Until your product and ideals are a hull of what it once was.

Not the market, the overall market, at least not directly. Their shareholders. Proton Foundation is the majority owner, so essentially they are demanding it as they have the power to set the ARR target that success is being judged by.

So basically: money, and their desire to have more of it, is demanding this.

Not shareholders. The CEO of the company and the CEOs of top investment firms are making the operation decisions to enrich themselves. The shareholders that paid money for their stock are the bag holders. The people getting rich whether a company succeeds or fails didn't invest a dime of personal money into the company.

A company like Proton shouldn't be for-profit to begin with.

But in the case it is, it should be run as a careful privately owned business, that takes pride in their products, not a profit machine.

It seems the majority owning "foundation" does little to ensure that, if they're not the ones pushing for more profit and faster delivery of crap

"Proton was created to serve the world, and the non-profit Proton Foundation ensures that this can never change. As Proton’s primary shareholder, the foundation exercises its control to ensure that Proton does not deviate from our mission to build a better internet that serves the interests of all of society. Our legally binding purpose is to further the advancement of privacy, freedom, and democracy around the world."

You actually can be for profit and profitable. It's the ever increasing shareholder growth that pushes you. Once shareholders demand compromise of the company values, the company values are compromised.

Sorry for the corpo speak, but this time I'd say it's clear and warranted.

https://proton.me/blog/proton-non-profit-foundation

I think Proton leaderships saw that 'email with pgp wrapper outside hyperscaler servers' is a crowded space today, so now they are doing the whole 'proton workspace365' and they are falling short at it (I'm a paying user and for my own personal needs the workspace like features are bearable, but not good, unlike email/pass which are ok) so they are getting nervous.

If it was any other company we wouldn't even care, but if your marketing is 'big cloud is bad look at us we are so moral and so caring and respectful with you and your data' and they shit the bed like this in front of the users that are paying because they bought on this vision...

Don't know if Proton has any shareholders, but I they do, I hope they understand the CEO's position has become untenable, no matter his other real or imaginary qualities. It is (surprisingly) not uncommon for CEO's to have no clue about the business they are leading, but most of them at a minimum understand they should not spook their own customers. If Proton wants to restore trust, they need a leader that at least does not openly trash the company's own offerings.

Aside, with age becomes a deeper understanding of how realistic the Dilbert cartoons are.

They do have shareholders, but the majority is held by the Proton Foundation.

I think that trust is burned already. I moved away from Proton to a German provider that sponsors its own infrastructure to be developed as FOSS (yes that means they are commoditizing their own product, but it is the SERVICE that's paid for).

Having shareholders means that the company WILL NOT continue to serve their customers. Any company that has external shareholders is untrustworthy. Everybody should consider them as disposable. It doesn't mean that you cannot have a deal with them, now but the parties should be aware that anything that you share will be misused. So if Proton has any external shareholders, it is already untrustworthy to me.

Therefore, they cannot really gain any trust by being activist shareholders and change leadership. They already supported a certain "persona" to make them money.

If you don’t mind sharing: what provider did you switch to?

Not the OP, but my guess is its Tuta Mail (https://tuta.com/). Very solid looking service and FOSS focus

Looks like Andy Yen, the CEO, was one of the OG founders back in 2014?

"Manifestos, Fear, and 'Loser Thinking': Inside Proton's AI Reckoning" https://news.ycombinator.com/item?id=50289692 90 comments

"Proton goes all in on using AI" https://news.ycombinator.com/item?id=50296602 117 comments

"Proton to 'Re-Interview' Staff About AI to See Who Gets to Keep Their Job" https://news.ycombinator.com/item?id=50251062 48 comments

"Proton's CEO Cancels AI 'Re-Interviews" https://news.ycombinator.com/item?id=50307183 254 comments

"For most companies, trading some caution for speed is a reasonable call. Proton is a privacy company, though, and what its users pay for is the confidence that the people building it are careful. Shipping slowly and carefully is part of what they’re selling"

This is the core of it for me. There are many, maaany companies that don't want to be what they are. For example: Meta doesn't want to be a social media company - so it lets facebook rot, makes 10% of its total revenue from scammers advertising to its customers, which seem to mostly be vulnerable old people and focuses on VR and AI.

I guess Proton is having that same problem. I don't really want to be part of that though.

>Meta doesn't want to be a social media company - so it lets facebook rot, makes 10% of its total revenue from scammers advertising to its customers, which seem to mostly be vulnerable old people and focuses on VR and AI.

Are you just going to ignore the rest of advertising that isn't "scammers advertising to its customers", and makes up the overwhelming majority of their revenue?

Speaking personally and on behalf of everyone using Ad Blockers: No. That bridge was burned ages ago.

If you think meta is doing a great job with facebook another example could be Gamestop - which wants to be Ebay for some reason. Tesla wants to build robots now instead of making cars. Supposidly Dunkin' Donuts really wants to be a coffeeshop so they rebranded to Dunkin' and tried to shift that way.

Any advertising is a net-bad for the world.

It definitionally manipulates people into buying stuff they didn't want before, leaving them poorer and our world devoid of more resources.

This is bullshit. How would people know that a new cafe has opened without advertising? Those greedy baristas and bakers, trying to leave poor customers poorer for enjoying a morning coffee with croissant.

By talking to their neighbors? By walking past it?

What are you talking about??

The cafe putting up a sign, hours, and a menu in the window are forms of advertising. Based on your other comment, I suspect you are painting with a brush of "all" when you mean digital advertising or targeted digital advertising.

I think if you extend it to be that broad, then sure, those specific examples are fine and exempt from my above statement.

But offline advertising generally isn't exempt. Screw billboards cluttering up cities. Screw flyers cluttering up my mailbox. Screw print ads cluttering up magazines.

It's all an assault on the senses in service of extraction. It's a non-consensual invasion of the mind.

While we are approaching this with different modes, we broadly agree that advertising is cognitive pollution.

Implying even having the budget for prolific advertising isn't a signal that something is already on the value extraction slide.

No, I disagree. I'm a strong cynic of advertising returns generally. However, basic notification that something exists brings business.

This applies to the mom-and-pop selling something around the corner, not Coca-Cola. For Coca-Cola, their advertising money likely has negative returns at the scale they spend it.

If a mom and pop shop opens around the corner, people generally notice organically.

If it's good, their friends may even tell them about it.

Why does it need a whole manipulative extraction industry around it?

> Why does it need a whole manipulative extraction industry around it?

It doesn't, especially at the aggregate scale it is at!

> basic notification that something exists brings business

That's an abstraction, though. The real-world logic behind that statement is that by bringing net benefit to The Whole (through your chosen acts), you will be duly recognised as a contributor of value, and accordingly you will be busy.

The way that modern formal terminology (like Notification Brings Business) has become a set of self-standing tenets in its own right has let humanity forget that our entire motivation for this whole practice of being busy ("busi-ness") is to make everybody happier. Preferably by doing things that don't suck.

Not to 'Maximise Our Business'.

What do you mean by "real world logic"? Observed behavior, logical abstraction, or handwavy ivorytoweredness?

Increasingly whenever I see a product advertised, I look around a bit and find a better, cheaper product that wasn’t advertised as heavily. Almost to the point where excessive advertising makes me suspect the product.

I've had one eye on the Proton exit since they made it clear they were not disintangled from Big Tech nor politically neutral. Then they kept blocking discussions about it on their reddit: https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...

> Proton is a privacy company, though, and what its users pay for is the confidence that the people building it are careful. Shipping slowly and carefully is part of what they’re selling.

Totally agree. I pay for Proton because I choose to trust their business practices more than Google. If Proton continues to move in this direction and hemorrhage trust, they will lose not just my business, but a significant portion of their client base [0]

See also ongoing annoyance amongst privacy community over decisions to prioritize feature bloat over bug fixes [1,2], add to that bad political takes by leadership[3], and some data retention choices which resulted in Proton indirectly supplying user information to US intelligence [4]. Not a good look.

[0] https://protonmail.uservoice.com/forums/945460-general-ideas...

[1] https://discuss.privacyguides.net/t/how-should-we-handle-pro...

[2] https://youtu.be/831ndXv65CM

[3] https://mastodon.neat.computer/@jonah/113833858219604994

[4] https://web.archive.org/web/20260305204857/https://www.404me...

As a proton customer myself, I've changed email providers before, and it isn't easy.

When I recommend for someone to try proton, I recommend they do so with a custom domain for their email address.

That way, if something goes awry at proton, they can set up service elsewhere while keeping their same email address.

This a thousand times. Having your own domain makes all kinds of migrations easier. My blog had 3 providers, my emails have 2. It still works without a hiccup.

If something happens? I'm ready to pack bags and migrate again.

I only considered Proton for security/privacy.

Their lots of half-baked products added since already reminded me of the Mozilla slide to irrelevance.

This seals the deal. I am OK if they use AI to enhace their productivity. I do care if they want to use AI to "move fast and break things" not giving a damn for stability and careful testing, think craftmanship and careful development is for losers, or speak to their employees like that.

This CEO reminds me of Martin Shkreli. He should be laid off. Do they have a board that cares? An ideal company for services like Proton's shouldn't be for profit to begin with.

> an engineer asked for a few days to pentest new code before shipping it, and CEO Andy Yen answered that it was “bullshit and loser thinking”

Wow my first exposure to Andy Yen shouldn’t have been this one. I’m seeing a loser here and it’s not the engineer…

It's a really bad look, I saw that Proton issued some sort of half-baked apology. But nothing from Andy.

There's a half-baked apology posted to reddit by Andy's account: https://www.reddit.com/r/ProtonMail/comments/1xjo8d4/a_messa...

(I don't know his writing style, so I have no idea if this is actually written by him or just posted by him.)

Yeah, I don't care what the social media account manager's crisis management position is, I care about the direction the company is being steered in and the person doing the steering.

> Wow my first exposure to Andy Yen shouldn’t have been this one. I’m seeing a loser here and it’s not the engineer…

Yeah, I have no horse in the race as a non-user of Proton, but even if you completely removed AI from the situation entirely, if I worked for a CEO that ever used the term "loser thinking" non-sarcastically that would be enough to get me looking for another job.

And if I were a customer, get me looking for another provider.

I switched to proton about 5 months ago but I switched back after a couple of months, I found the UX in their apps to be pretty poor. Seeing the reports that came out around this I'll be staying away.

I'm a security guy. I know a lot of these privacy-minded folks.

They are not the types to accept enshittification and they are the types to read these news. As soon as they discover something else, they're off.

Good luck proton.

yep, Proton is in the business of trust as a service. Surprised that they think differently.

There's still a pipeline of them coming to Proton from Google and Microsoft, with about as little research as when they decide to leave Proton.

Proton has always been a sham. Their users may be privacy-minded, but not privacy-competent.

Please teach us your ways privacy guru (no, really) (also make it convenient and easy to use)

Yeah, I don't know about their expanded suite nowadays, haven't paid attention, but their original mail service was mostly just marketing.

"Encrypted email" as if all of your mail isn't in plaintext anyways because no one is using PGP. And if you're emailing Proton to Proton... well there are more convenient encrypted messaging platforms.

> they're off.

Help me out here — to where?

I have good experience with mailbox.org. I've heard good things about tutanota.

I'm not the most privacy-minded guy though.

The company is cooked due to the CEO being a complete a-hole. AI or not, his behavior is unacceptable for ANY organization. Behavior like that is to be severely punished.

I’m not especially turned off by a CEO getting aggressive about AI adoption. First off all, I get it, it’s shockingly slow especially with my mostly non technical staff. Secondly I’m pretty allergic to this type of cancel culture. Aggressive ceo of a multi million dollar company bullying his staff and pushing past safety and ethics norms to make line go up, and bolster his ego. I don’t buy it. There’s not enough evidence. It’s a salacious story, and i consider it a semi credible data point.

But for all the people on Reddit clutching their pearls over some imagined moral panic, there were just as many a week ago shouting about wanting more features and product lines. The point is, i don’t believe it’s a simple story as some would make it out to be.

I'm not a particularly PC person but if someone in leadership where I worked referred to someone's thinking and ask for more time to ensure security as "loser thinking".. It would raise eyebrows, including my own, and likely trigger some sort of coaching at a minimum. This combined with the interviews to keep their jobs that was nix'd after the bad publicity..

Maybe this person was always an asshole, maybe it's the current job market. When the market is cold it brings out the worst in certain people. When their employees are "captive", they can finally treat them how they always viewed them; bottom feeders blessed to be employed.

What is it about AI psychosis that makes leaders act like assholes?

I definitely think that me and my team need to push ourselves to rethink how we work. Sometimes I have to push top-down, but I'd rather this happen in a measured way that's a combination of bottoms-up and top-down.

Leaders acting like assholes is not an AI phenomena

I see it as before leaders were assholes in a variety of random ways. Now they are synchronized

Because it consistantly tells narcissists what they want to hear.

Before there were other voices of reason but these all get drowned out...

It normally takes years for a reasonable CEO to have the entire St staff around them to be replaced with sycophants (via natural selection).

AI can do it in a few hours.

AI psychosis + "founder mode". Deadly combo.

Presumably the same effect that made every fashion designer at every sports shoe company decide simultaneously and “independently” to put the players they were sponsoring in pink shoes during the recent World Cup, despite each of these companies having incentive for their design to stand out.

Ask AI (roughly) the same question; get (roughly) the same answer. Regardless of what model you’re talking to.

(Why? Because every AI company consumes the same whole-Internet corpus and distillations of all their competitors’ models; of course all their models’ answers will converge, especially about anything subjective where they haven’t supplied a specific “right answers for domain X” training dataset to override the “base consensus.”)

The sycophancy I would say

Putting aside the comment on slack this guy made, because I haven’t seen the full context, have you read the internal memo on AI the Proton CEO put out? It was surprisingly reasonable to me, which made it kinda funny that 404 was breathlessly sharing it as some kind of gotcha. Made me really distrust the rest of their reporting on this.

But maybe that’s just my own AI psychosis talking…

> Yen was fine with pentesting, as long as it didn’t slow down the pipeline.

Wash me but don’t get me wet.

Crypto AG is Swiss encryption company that was revealed to be selling compromised chips for decades also had engineers raise security issues, only to be dismissed and redirected to work on something else, over and over again as different people found the same things

It was revealed to be owned by the CIA and German intelligence, formed in 1952 and secretly purchased by intelligence agencies in 1970

The customers relied on Crypto AG for their industry trusted privacy claims and “because Switzerland”

Looks exactly like everything wrong with Proton and its customer base despite so many obvious flaws to how Proton behaves, how their customers talk, justifications for how their anti spam measures undermine all of their privacy and records claims, and now the CEO dismissing engineers security concerns

FWIW the team is receptive to bug reports with concerns about the direction the company appears to be heading.

meh, we still have to wait for Proton's response before taking the story circulating at face value

It's not like Proton has had so many security breaches like we've been constantly seeing hit so many other sites in other posts (I don't think?), nor that they have so many other problems that exist at other companies

Hoping people keep perspective and that Proton bounces back even better with adaptations to named criticisms

Maybe the "loser" engineer who wanted to do the pentest should be the CEO. He at least still remembers what the company's customers actually want.

Also, doesn't this news paint a fairly large target on them. There is now a rumour that they released a feature that hasn't been properly pen tested, where an engineer was concerned enough to be called a loser.

I believe the harm is irrevocably done now. In the middle of cybersecurity frenzy hearing about that verifications, making sure something is done properly at a security focus organisation has lower priority than speed, that left a mark in a very sensitive spot. Central one. I pay more than I use because of getting comfy after a capabilities exploration, and some idealistic reasons too, despite a few UX matters I found clumsy (this word from the article resonates with my feelings) and I never got to fully like the way they present the service. But this is now beyond ideals and comfort. I lost trust with their attitude shining through and their clumsy way in general. I should first switch to a base subscription, loosing one or maybe two aspects I use from a higher tier. It did not come at a fortunate time when I lack any spare time and energy for this, figuring out how much I will miss exactly, but I will have to do it. Figuring out what happens exactly on degrading my subscription. Some guide about 'what happens if' would be very handy now.

related: not touting to be the most secure (yet), but gnomail dot io exists.

> A lot of the reactions treat this as an AI story, as if any AI-written code poisons the well, and I think that misses the point. Engineers using AI to write code is the new norm.

It is not the norm for any engineer, or any company, who cares about the quality of the product. I will not say there are zero people who care who are trying to use LLMs to write code, because that isn't true. But neither is it true that most engineers find the tool useful. It is still wildly controversial in the programming community, contrary to what you state here.

> For most companies, trading some caution for speed is a reasonable call.

That isn't a reasonable call for any business, but it is an especially bad call for a business which sells itself on offering greater security.

My issue with what happened at Proton is twofold: first, the CEO treats his workers like dirt. That isn't a company I wish to do business with no matter how good their product is. Second, the CEO is in the full grip of AI psychosis, telling his engineers to use the tool just because it's trendy, not because it actually produces good results. That suggests that the product Proton produces will, sooner rather than later, turn into AI slop, full of bugs. I wouldn't wish to do business with such a company even if the CEO were a nice guy. So Proton now has a product going downhill, and a CEO who is a jerk. I'm not sticking around for that. I could just pay Microsoft if I wanted that kind of experience.

Sorry friend, this is just blatantly false in late 2026. 92% of software engineers use AI coding tools every day. The list of luminaries in our field now coding with AI is much longer than the list who are avoiding it.

The flip side is that only a third of devs trust the AI code, which is wise depending on what that means exactly, but that’s a different claim than the idea that if you care, you don’t use LLMs to code, and that it’s wildly controversial in our field to code with AI. It was, like two years ago. It’s not anymore. Sorry.

And I have no idea where to start on the idea that it’s never reasonable to trade caution for speed. I can only conclude you’ve only ever been one of those employees who doesn’t understand your actual job: to deliver value to the business so it can make money. Your job isn’t to be careful and build a beautiful elegant system so it can exist. You’re there to solve a problem in a timeframe where the ROI of paying you is positive. If you exercise endless caution and never ship anything, you will have thus failed at the actual job.

You are rightly tearing his argument apart, but you have swung too far.

It is possible to sell trust and security as the major feature. If that's the case, then skipping security testing in favour of more features is not what most of your customers want. Especially if the CEO is so arrogant about it.

And maybe such a product is not the best money extracting operation. That can be ok, if the company/shareholders is ok with it... If not, things are misaligned somewhere.

Again the hypocrisy of "AI code doesnt matter...until it does" comes straight through.

"proton is a privacy company though..." Oh So when it matters to YOU, AI slop is a bridge too far.

AI code is not the new norm. Anywhere.

This just confirms to me that the devs who are furthest from users (platform and security folks) are still in denial about AI for coding. The idea that they continue to react to security and privacy threats by relying on hand-crafted code is ostrich-like denial of the reality of daily security breaches at much larger, better resourced companies.

AI is a tool - like a compiler or a pen-testing tool or maybe like an uber-tool that can do all those things and more. It's not hard. 24 hours - put your best pentester against GLM-5.3 abliterated (host locally, so there's no data leakage to LLM providers). You know who will win and it won't even be close.

> like a compiler

Quite unlike a compiler. I don't know about yours, but nobody destroyed thousands of books, started gas powerplants or illegally cut hundreds of thousands of trees to make mine.

Talk about ostrich-like denial of reality.

> AI is a tool - like a compiler or a pen-testing tool or maybe like an uber-tool that can do all those things and more.

With expert supervision, absolutely.

I use AI daily. It still makes plenty of mistakes and need plenty of oversight to be useful.

I'm a paying proton customer, I migrated last year from the horror that is Office365 (or Copilot 365 or whatever they call it now) and before that I migrated from Google Workspace. In direct comparisson, proton is the best product for me - and that does not include privacy or security things, just stuff like generall UX and featureset. Yes, they have some annoying bugs, but so did the others.

I think the AI backlash against Proton so far is unwarranted. It is purely speculative and based on make-belief. I am a dev myself, I use AI more and more, and I have no more long-term experience than the next dev. But so far the claim that using AI in your corp and workflow will result in buggier, shitty code is not true on a broad scale. It is certainly not true for proton, at least I don't see service quality detiorating for my service. I think it is a tool, and what you get out of using it still depends on the skill of the craftsman.

As a customer, I do demand stable service and the promised saftey and security. But I also demand low prices and a product that can compete with the market. Now, the market is Google and Microsoft - two companies we don't even need to question if they lay off people due to AI usage. Proton is kind of under pressure to compete on a product level in a pretty much david-against-goliath situation. We see AI-assisted exploits such as the Linux use-after-free from Anthropic and can't blame Proton for restructuring their dev process to incorporate AI to find exactly these kind of security issues. I wouldn't even feel comfortable as a client if proton whipped on a "human code only" label on their services.

Reply on news.ycombinator.com