Infrastructure audit completed by Radically Open Security
1–10 of 290 posts
Re: Infrastructure audit completed by Radically Open Security
#2My biggest professional regret is not joining Mullvad when their founder emailed me.
A seriously large chunk of their values aligns with my own, and it's woefully few technical enthusiasts that continue to place liberty over convenience -- meaning most of us tend to use hyperscaler cloud providers under the purview of the US Government. -- and before anyone mentions it; yes that has been an issue for me in my professional career as the cloud providers must adhere to US sanctions, meaning if you are from Cuba, Iran or Crimea you can't play the games I made. -- which is annoying because you could buy our game legally in Russia and Ukraine, but if you happened to be in occupied territory then no play time for you.
Sidetracked a bit, but it's really refreshing from the outside to see a company that isn't scummy that values liberty.
Re: Infrastructure audit completed by Radically Open Security
#3Thought experiment: design an architecture that passes this audit scope as written that allows for logging of user activity.
I can think of at least one.
Re: Infrastructure audit completed by Radically Open Security
#4Picked up Mullvad a couple months ago, I love it's concept of just paying for the time I use.
Re: Infrastructure audit completed by Radically Open Security
#5> by Radically Open Security
HN title stripping strikes again, OP can you please fix the title to correct the company name?
Re: Infrastructure audit completed by Radically Open Security
#6Picked up Mullvad a couple months ago, I love it's concept of just paying for the time I use.
Is that an option? I've been paying 5 euros a month for a number of years and probably use it for 10 minutes a month, on average. I would love to just plunk down 20 euros and be good for the foreseeable future, if it was a couple cents per minute.
Re: Infrastructure audit completed by Radically Open Security
#7Title is missing the word "Radically". I didn't know "Open Security" but "Radically Open Security" is the place I've written a thesis at
Edit: u/progbits is 1 minute faster than me https://news.ycombinator.com/item?id=37060828
Re: Infrastructure audit completed by Radically Open Security
#8It appears in this audit. They only reviewed test production servers.
Playing devils advocate, what would be stopping Mullvad from providing the Open Security team with a version of Mullvad stripped of logging features? I hate to be this skeptical, but shouldn’t an actual audit review customer facing servers (within bounds to prevent the auditors from logging info).
Maybe I’m wrong someone pls lmk. But I’m not convinced a test of this calibre demonstrates Mullvads claims of no logging.
Re: Infrastructure audit completed by Radically Open Security
#9Picked up Mullvad a couple months ago, I love it's concept of just paying for the time I use.
Is that an option? I've been paying 5 euros a month for a number of years and probably use it for 10 minutes a month, on average. I would love to just plunk down 20 euros and be good for the foreseeable future, if it was a couple cents per minute.
It's not on the pricing page (I was surprised too) - I think maybe GP means that it's rolling monthly, and that they no longer do card subscriptions (on a pro-privacy stance, not wanting to store them, Know their Customer, etc.) so you can pay (say, Amazon) for the time (1 month, 94 months, however many months) you need.
Re: Infrastructure audit completed by Radically Open Security
#10My biggest professional regret is not joining Mullvad when their founder emailed me. A seriously large chunk of their values aligns with my own, and it's woefully few technical enthusiasts that continue to place liberty over convenience -- meaning most of us tend to use hyperscaler cloud providers under the purview of the US Government. -- and before anyone mentions it; yes that has been an issue for me in my profess…
[flagged]