Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad: Diskless infrastructure using stboot in beta

mullvad.net

Post reply on HN
Print view View original

51–60 of 135 posts

Re: Mullvad: Diskless infrastructure using stboot in beta

#51

Post by codethief »

y4mi wrote: post #47
codethief wrote: post #45

I've been following Mullvad for a long time and my impression (from countless reviews and comments here on HN) has been quite positive. But here's what I don't understand: Why are the servers located in Sweden, a country that's known for online surveillance[0] like no other country in the EU? From the Wikipedia article[1]: > The law permits the signals intelligence agency, National Defense Radio Establishment, to mon…

Because it's a swedish company? The location of the servers is kinda irrelevant in that regard. They'd have to provide government access if there is a lawsuit that demands it. If there isn't one than your critique is entirely pointless

> Because it's a swedish company?

I'm not sure what point you're trying to make. If online privacy is as important to them as they say, they could have easily registered their company (or a subsidiary) in a different EU member state.

> They'd have to provide government access if there is a lawsuit that demands it.

IANAL but I am not entirely sure this is true in the EU. Either way, my question was "Why are the servers located in Sweden?" Whether or not this due to the company owning the servers being in Sweden is irrelevant.

Re: Mullvad: Diskless infrastructure using stboot in beta

#52

Post by throwaway984393 »

It's a trade-off. If you have no disk, the disk can't fail, but the network can, and the remote PXE server can, and the remote SAN can. You can get into a state where you have to pray no servers reboot. Intermittent errors can be real annoying when it makes provisioning fail. (used to work a server farm that'd do server rebuilds over PXE, and ran a few diskless cluster projects)

An alternative is you use a RAID array and mount your disks in read-only mode, or use physically read-only disks and when you have to replace a disk, you pre-mirror the replacement disk. In this way the local disks can be replaced as they fail and there's never a point when the server is at risk of not being able to boot.

......or they could boot from CDROM :)

Re: Mullvad: Diskless infrastructure using stboot in beta

#53

Post by Terry_Roll »

npteljes wrote: post #50
Terry_Roll wrote: post #33

Earlier quoted context omitted.

>ie. large number of users sharing the same IP and protects against correlation attacks Depending on where you are based in the world (see https://www.submarinecablemap.com ) realtime throttling of vpn traffic can still identify a user and where they are going in some cases. You can get a degree of privacy from visiting websites located on servers in big data centres, but nothing a search warrant couldnt find out ret…

>There is no privacy! I think this is a good message. In the same vein, there's no security either. All you can do is make your and your adversaries' life harder, and balance the different tradeoffs.

> there's no security either.

Dont buy that, care to elaborate?

Re: Mullvad: Diskless infrastructure using stboot in beta

#54

Post by akerl_ »

codethief wrote: post #51
y4mi wrote: post #47

Earlier quoted context omitted.

Because it's a swedish company? The location of the servers is kinda irrelevant in that regard. They'd have to provide government access if there is a lawsuit that demands it. If there isn't one than your critique is entirely pointless

> Because it's a swedish company? I'm not sure what point you're trying to make. If online privacy is as important to them as they say, they could have easily registered their company (or a subsidiary) in a different EU member state. > They'd have to provide government access if there is a lawsuit that demands it. IANAL but I am not entirely sure this is true in the EU. Either way, my question was "Why are the server…

I think you’re overthinking this. The people who run the company are based in Sweden. So they registered the company in Sweden, because that’s where they are. Then they hosted the servers in Sweden, because that’s where they are and where the company is registered.

Registering the company somewhere else wouldn’t do them any good when they’re living in Sweden, because the legal system isn’t fooled by sleight of hand like that. Likewise, hosting the servers elsewhere from where they’re based. Both would expand the number of entities with the ability to compel them to disclose data, because as long as the company owners live in Sweden, Sweden has that ability.

Unless you’re asking why they didn’t move to another country to start their company, which is surely a larger ask than the “easily” you suggest.

Re: Mullvad: Diskless infrastructure using stboot in beta

#55

Post by Hnrobert42 »

codethief wrote: post #51
y4mi wrote: post #47

Earlier quoted context omitted.

Because it's a swedish company? The location of the servers is kinda irrelevant in that regard. They'd have to provide government access if there is a lawsuit that demands it. If there isn't one than your critique is entirely pointless

> Because it's a swedish company? I'm not sure what point you're trying to make. If online privacy is as important to them as they say, they could have easily registered their company (or a subsidiary) in a different EU member state. > They'd have to provide government access if there is a lawsuit that demands it. IANAL but I am not entirely sure this is true in the EU. Either way, my question was "Why are the server…

Really? How easy is it to create a company in another EU country.

In the US, it is mostly painless to create a company in another state. Fill out some forms online and pay a few hundred. If you don’t have a presence there, you have to pay for a registered agent in the state. That’s about $100/yr. You may also need a mailing address, but you can get a post office box that will accept and scan your mail for another hundred bucks a year. Star and local taxes.

What about the EU?

Re: Mullvad: Diskless infrastructure using stboot in beta

#57

Post by kfreds »

codethief wrote: post #45

I've been following Mullvad for a long time and my impression (from countless reviews and comments here on HN) has been quite positive. But here's what I don't understand: Why are the servers located in Sweden, a country that's known for online surveillance[0] like no other country in the EU? From the Wikipedia article[1]: > The law permits the signals intelligence agency, National Defense Radio Establishment, to mon…

Thank you for asking.

> Why are the servers located in Sweden,

We have 762 servers spread across 38 countries. Less than 10% of our servers are located in Sweden [0].

> a country that's known for online surveillance

My cofounder and I started Mullvad as a protest against the growing mass surveillance of Sweden as well as other countries. Our intent was direct political action through entrepreneurship. Incorporating the company in Sweden was the obvious choice, since we are both Swedes. We felt that incorporating elsewhere would have been more risky, complicated, and costly.

Mullvad has excellent lawyers who continuously monitor the legal situation in Sweden. Right now there is no Swedish law that can compel Mullvad to start logging [1]. Should the situation change we have contingency plans.

[0]: https://mullvad.net/en/servers/ [1]: https://mullvad.net/en/help/swedish-legislation/

Re: Mullvad: Diskless infrastructure using stboot in beta

#58

Post by Chris2048 »

akerl_ wrote: post #54
codethief wrote: post #51

Earlier quoted context omitted.

> Because it's a swedish company? I'm not sure what point you're trying to make. If online privacy is as important to them as they say, they could have easily registered their company (or a subsidiary) in a different EU member state. > They'd have to provide government access if there is a lawsuit that demands it. IANAL but I am not entirely sure this is true in the EU. Either way, my question was "Why are the server…

I think you’re overthinking this. The people who run the company are based in Sweden. So they registered the company in Sweden, because that’s where they are. Then they hosted the servers in Sweden, because that’s where they are and where the company is registered. Registering the company somewhere else wouldn’t do them any good when they’re living in Sweden, because the legal system isn’t fooled by sleight of hand l…

You are allowed to start companies in other countries, and thereby avoid local laws, without moving i.e. changing you country of residence.

If you believe any different, please say why so. Just "wouldn’t do them any good" is pretty meaningless.

Re: Mullvad: Diskless infrastructure using stboot in beta

#59

Post by kfreds »

TomSwirly wrote: post #42
kfreds wrote: post #26

Earlier quoted context omitted.

Correct! Thank you for highlighting that. Here are some additional details for those interested. We intend to make use of TPM for remote attestation of the current boot chain, reproducible builds to provide a strong link from source code to build artifacts, and a transparency log for a historical record of previously used boot chains, artifacts, WireGuard server keys, and related signatures. As dtx1 mentioned elsewhe…

If you're from Mullvad, let me tell you that I love your service. I had one technical support question, and I got an immediate response from an actual person who knew this problem, gave me a simple workaround (toggle between wireless connection and not), and told me that a permanent fix was in the works. Likely that fix rolled out because I haven't seen the issue in months. The idea of an account that doesn't need a…

Thank you!

Re: Mullvad: Diskless infrastructure using stboot in beta

#60

Post by franga2000 »

oefrha wrote: post #10

For people wondering how the hell a user can audit the server is diskless or whatever, the goal appears to be using TPM to provide remote attestation for all code in the boot path. See https://www.system-transparency.org/ .

Damn it, this is a really cool use case for TPMs! So far, every use case I've heard has made me wish they were never invented, but this made me reconsider...
Post reply on HN