2,639 karma · joined June 16, 2012
Obsessed with building more trustworthy systems.
Let me offer a counterexample - VPN services. They didn’t get a cent from Mullvad, which they declared the winner. Number two was IVPN, which also doesn’t have an affiliate program.
The review: https://www.nytimes.com/wirecutter/reviews/best-vpn-service/
I'd love to hear what you think about a log a few colleagues and I have designed. We've tried to get to the essence of transparency logging. It's a minimalistic design, and it doesn't require trusting the log operator.
www.sigsum.org
Cheers, Fredrik Strömberg, cofounder of Mullvad.
Please elaborate! How do you handle complexity?
It was meant to be about the importance of reducing the computing power of recognizers / parsers / interfaces / meaning-makers, as the author brings up PEM, ASN.1, and X.509. It grew a bit. Enjoy.
<rant>
In my opinion security exists to facilitate trust, and security has a lot to do with managing complexity.
One of the most powerful security technologies we have is math. Especially math that is easy to do in one direction and very difficult to do in the opposite direction. RSA, Ed25519, Diffie-Hellman, and SHA256 all rely on this concept.
Another power tool is combining these cryptographic primitives to build protocols that provide e.g. authentication, forward secrecy, confidentiality, and integrity-protection.
When using cryptographic primitives directly it is easy to make mistakes. For example, before Ed25519 there were other similar signature schemes that, in addition to a message to be signed, required a number that must not be repeated for different messages, called a nonce. If this number was repeated, an attacker could collect signatures and combine them to get the private key. Ed25519 removes this sharp corner by essentially using nonce=SHA512(message) internally.
When designing a protocol like TLS, SSH, Signal, or WireGuard, multiple primitives of different types are combined to get the desired security properties.
Cryptographers work hard to combine primitives such that the resulting construction is easy to reason about, and ideally prove that the construction will only break if one of the primitives break.
Unfortunately this key insight is often ignored further up the stack. Many protocols, file formats, etc are unnecessarily complex. This makes them harder to reason about, which makes it harder to build a safe recognizer / parser / interface / meaning-maker for them. Complex parsers lead to incorrect mental models, which lead to security vulnerabilities.
If you are ever tasked with building a protocol, file format, or API, consider making it only as complex as it must be. We will suffer for a long time with the complex beasts that have already been standardized. Let’s not make more of them.
Remember that security, trustworthiness, understanding, and managing complexity are intertwined. Don’t use more complexity than necessary.
</rant>
P.S. If anyone is curious about Ed25519 I can highly recommend the following article: https://blog.mozilla.org/warner/2011/11/29/ed25519-keys/
Check out IVPN for instance. They do a lot of things right:
Not for all types of services. ISPs are sometimes under obligation to log, but VPN services don't belong in that category.
I can't speak for others but we have contacts with legal experts (in a few jurisdictions) that alert us to changing laws. Ultimately if a country required us to start logging we would just cancel all of our machines there and leave.
On the topic of trustworthiness, you are completely right of course that VPN users put a lot of trust in their VPN provider. There is also the lemon market aspect - the information and competence asymmetry between user and operator. That begs the question of how to ascertain trustworthiness.
We think things like this help:
https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns...
https://mullvad.net/blog/2019/6/3/system-transparency-future...
There are plenty of VPN clients, some by big enterprise-y networking companies, that at least historically have behaved in ways that leaks the user's traffic when interfaces change, on DHCP issues, tunnel disconnections. It's just easier to make our own app and be able to say what it does and doesn't. And that nothing will change tomorrow because of someone else's design decision. :)
I can't speak for Mozilla, but we have our own desktop and mobile apps because it enables us to do more privacy-preserving things with a higher assurance. Consider for instance DNS leaks, Teredo leaks, IPv6 leaks, esoteric DHCP directives that can hack your routing tables, and so on.
And these are just a few of the things we were early in mitigating correctly. Consider also the tight relationship between UX and security, and it is clear that we can't rely on "generic VPN clients" to always agree with our design and security preferences. That doesn't mean they are wrong and we are right of course. It's just that we have a very specific mission.
One architecture decision we made for our app was to write its backend in Rust, and integrate tightly with the firewalls on Windows, macOS, and Linux. It facilitates stability and therefore reduces the risk of states where data leak outside of the tunnel. Check it out, it's open source. As all security-related things should be.
Good question. As an organization probably helping each other ensure we stay focused on what needs to be done and what is right for the organization, weighing Time/Cost/Quality, and so on.
I'm not saying we're bad at it, it's just that remaining vigilant on keeping the feedback-adaptation loop short seems key, regardless of layer on the reality stack so to speak. On that subject, check out complexity science if you want your mind blown on the extent of recurring themes in physics, chemistry, biology, economics, computer science, etc.
Personally I have definitely struggled with perfectionism in the past, and still do to some extent. This greatly impacted my productivity, and those around me. Thankfully we hired a great CEO four years ago and I've since focused mostly on strategy and research. I've also rectified my perfectionism issue a bit :)
This is what I've been doing for the past two years, and anticipate spending time on for another few: https://mullvad.net/en/blog/2019/6/3/system-transparency-fut...
Related, I definitely agree with others in the thread that profit can be a measure of social impact. Whether your impact is positive or negative however depends on what solution you offer as an entrepreneur, and to what problem. Two farmers might have the same profit, but one is selling ecological greens, and the other one is selling high-fructose corn syrup. One is contributing to the obesity epidemic, the other one isn't.
In any case, the core of entrepreneurship is solving problems for people and organisations. The more people value and use your products and services the more profit you'll make, assuming your business model is economically sustainable. And you should want it to be! If your costs grow faster than your revenue, there's going to be a point where you have to shut down and can't help more people.
My cofounder Daniel and I viewed it as direct political action through entrepreneurship. In particular we wanted to protest Swedish surveillance legislation (FRA), which is partly why we chose a Swedish name for the service.
So far we have refused at least five serious offers of investment and acquisition, because we would rather retain control, even if that meant slow growth or obscurity.
As time went by the company grew and so did our capabilities to affect change. So far we have reinvested all profit in things we believe move the needle in the right direction. Some are direct donations, others are pure investments, others should probably be classified as "high-risk bets that might make things better, but not necessarily for us".
The fact that we retain 100% ownership in the company enables us to engage in strategic behavior that is unavailable to competitors who accept outside investment. All VCs have investment horizons. If we invited one onboard they would eventually want us to sell, or commit to handing out dividends.
We'd rather build some kind of institution. Even better if we can obsolete VPN services as a concept. Then we could move on to other problems. It's not like there's a shortage. We have explored the idea of moving our shares to a foundation. Unfortunately that is an action that can't be undone. It's kind of the point, but by retaining the shares we retain maximum strategic flexibility.
Edit: I don't identify as a social entrepreneur, but thought you might enjoy the story anyway, as we're also sort of optimizing for impact. Whatever that means.
You are probably already aware, but what you describe bears many similarities to mindfulness, Buddhistic philosophy, and Stoicism.
From a neurological perspective I personally focus on quality sleep, exercise, and fasting as a way to increase neuroplasticity to speed up adaptation. On that note, it's amazing how feedback and adaptation seems to reoccur on most abstraction levels of reality.
Recommendations:
* What Makes an Effective Executive
* Nine Things Successful People Do Differently
* The Obstacle is the Way
* On the Shortness of Life
Time, money, and mood seems to me like the three most important limited resources we have. The next natural step is to apply cognitive tools from economics on each of them. The etymological origin of the word is basically "allocation of limited resources" after all. I've found this to be immensely useful.
We can’t affect where we are, but we can affect in which direction we go. There is a space between stimulus and response, as Viktor Frankl said.
Some of the feelings and thoughts we have are automatically generated by our mind based on previous experience. They are the homo sapiens equivalent of speculative execution. To the extent that we choose to listen to them they will continue to weave the story of our life. Some of our neural networks are pattern matching for an environment that no longer exists. We should accept their presence for what they are, optional perspectives with an uncertain basis in reality.
I remind myself of this daily. Knowing that I have the ability to grow, cope, and learn new things. This wisdom has given me the courage and temperance to adjust the patterns in my life that are no longer serving me.
Does anyone else think like this? Comments are much appreciated.
Audits are good and definitely have a place. There’s much more that can be done. I agree open source is also an important one.
We’ve tried to identify strong signals of trustworthiness together with a few other services here: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns...
A technical solution Mullvad is working on is something we call System Transparency. You can read more about that here: https://mullvad.net/blog/2019/6/3/system-transparency-future...
To quote https://fpn.firefox.com/vpn - “The VPN is built by Firefox and runs on a global network of servers powered by our partner Mullvad using the WireGuard® protocol.“
Regarding using us directly or through Mozilla, I think both are good options. If you pay directly to us we will put your money to good use. Same goes for Mozilla. And they are not mutually exclusive. You could also sign up directly with us AND set up a monthly donation to Mozilla for Firefox development :)
Please tell me - What makes a VPN provider trustworthy, and how do you _know_?
Personally I believe a trustworthy provider is _characterized_ by consistent actions that show transparency, honesty, and conscientiousness. Nevertheless, such consistent action doesn’t actually prove trustworthiness.
A good VPN honeypot, or reseller of your network traffic, is publicly indistinguishable from a trustworthy one. So what can the users do? What tools, technology, process, or ecosystem do they need to tell honest and dishonest apart? What do we need to build?
We all recognize that VPN providers are in a great position of power over their users. How do we tilt the scales in the users’ favor? What are _strong_ signals of trustworthiness?
Disclosure: I co-founded Mullvad.
Could the submitter or a moderator also change the title to "Open-source firmware is the future"?
As for the privacy issues with a "standard" WireGuard deployment we are well aware of them and are working with others to develop a standard which will hopefully be adopted by privacy-focused operators. Unfortunately we only highlighted them to others in January this year. Note that no criticism of WireGuard's privacy seems to be older than this email: https://lists.zx2c4.com/pipermail/wireguard/2019-January/003...
We have deployed solutions for some of WireGuard's privacy issues while others are in the pipeline. It should however be noted that some of the attack vectors are somewhat esoteric and quite unlikely, so we don't consider them critical. The devil is in the details, as you can read in my email above. On the whole we think WireGuard is where the industry should be heading, fast, for many reasons, and that's why we are spearheading it: https://mullvad.net/en/blog/2017/9/27/wireguard-future/
At the moment IVPN is slightly ahead of us in terms of privacy features in WireGuard, but they are the provider we probably have most in common with, and we frequently discuss projects like this one, so they are definitely the one we most expect competition and collaboration from: https://www.ivpn.net/knowledgebase/253/Using-WireGuard-for-P...
As for choosing this board, I alluded to it in a post down below. Note that I'm not a firmware expert though. Support for x86 was obviously already there, as well as for the microarch if I recall correctly, so "all" our technology partner 9eSec ( https://9esec.io ) had to do was support the specific board. Had we chosen another microarch or something with multiple CPUs we could have spent months on it. Just another example of how important it is to work with experts.
I'm not a firmware expert so take the following with a grain of salt. In general the more your target platform has in common with currently supported mainboards the easier it will be. First of all there obviously needs to be support for the instruction set architecture, then the CPU microarchitecture, and finally for the components on the specific mainboard you are targeting.
Given what has now been done by 9elements and others for SuperMicro boards based on Kabylake I expect more boards to be ported in the coming year.