380 karma · joined April 6, 2021
A good position to take from Patagonia, especially now after the rebrand to Meta and the change in direction they promised. If everything goes as Zuck is planning, we are in for a mighty bad rid; I hope something will be the stick in Meta's gears for the sake of humanity or that there's a way to stop Zuck's Metaverse phantasizing.
I am not a shill...
They advertised themselves with a 'no-log policy'. This policy however used the phrase "by default, [...]" and and said that they don't store IP data. This is true, that statement was never breached as far as we know. The court requested Proton to start logging data for this single account in question for the investigation, because the account owners had broken swiss national law.
"[Proton] could not appeal because a Swiss law had actually been broken and because "legal tools for serious crimes" were used. ProtonMail does not believe the tools were appropriate for the case at hand, but the company was legally responsible to comply with their use nonetheless." [0]
What would you want Proton to do in this case? Close down shop and not give out PII or rather comply and keep operating? You can't just discard an entire operation of this size bcause one of one account.
We are on the same side here, we both want Proton to do better and to have an email service that is actually secure. As long as any company or organization operating an email service is inside any jurisdiction it will face these issues. But the jurisdiction is also the enabler to these companies or organizations like this. I don't think we are ever going to get the perfectly secure mail service that protects our privacy, resists governments and threat actors to an absolute degree, and operates servers and services at the same time like Proton does. If anything, FOSS self-hosted options are probably the closest to the above we are going to get.
edit: If Proton designed their services to not collect data from the start, like a lot of commenters here are proposing, that could be a real opportunity. This strategy however only works in very stable democratic systems, as unstable ones are always at the mercy of their governments and as such are vulnerable to privacy intrusions.
[0] https://arstechnica.com/information-technology/2021/09/priva...
If your threat actor is a nation-state intelligence community you might want to consider using higher level security systems like PGP.
For ever other threat actor, this ruling is a great win for privacy. As long as your threat actor is your ISP, (anti-) social media as I've begun to call it, or your employer, ProtonMail (or Proton services) are really at the forefront of digital privacy.
Again, if you're up against the government, use PGP to communicate securely.
Apple makes a gadget that has an explicit mode for good samaritans to locate the original owner. This mode has a security flaw (lack of input validity checks, I thought we overcame this stuff last decade?) that opens up the good samaritan to abuse by means of phishing. And somehow you want to explain to me that that is not a problem? Just because I can take a random car and drive into people doesn't mean a self-driving car having a bug that drives into people isn't an issue, to give an example of why your logic doesn't pass.
Apple cares about one thing only, and that is market capitalization and profits.