Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN library and client code open-sourced

github.com

Post reply on HN
Print view View original

271–276 of 276 posts

Re: NordVPN library and client code open-sourced

#271

Post by dhaavi »

LoganDark wrote: post #259
dhaavi wrote: post #197

Earlier quoted context omitted.

If you're up to trying something new, we've built a technology to replace consumer privacy VPNs: https://safing.io/spn/ Technical summary of the SPN (Safing Privacy Network): - A Privacy Network aimed at use cases "between" VPN and Tor. - Uses onion encryption over multiple hops just like Tor. - Routes are chosen to cover most distance within the network to increase privacy. - Exits are chosen near the destination se…

Just so everyone knows: only Safing hosts exit nodes. Only relays (the intermediate hops) can come from the community.

Thanks for providing additional information to readers. However, this is not entirely correct. Let me clarify:

- Community nodes are used to diversify server ownership and strengthen the privacy of connections.

- Community nodes may technically act as entry, middle and/or exit nodes.

- Community nodes will never be used for unencrypted connections, only for encrypted connections. We are thinking about a concept of trusted partners, which will also be allowed to handle unencrypted connections - but this is currently not the case.

- We publish advisories [0], which are automatically applied by all clients. This gives us the ability to quickly react to changing situations. Currently, community nodes _are_ being selected as exit nodes, but not as entry nodes.

I hope this cleared things up. I am happy to go into more detail.

[0] https://github.com/safing/intel-data/blob/master/spn/main-in...

Re: NordVPN library and client code open-sourced

#272

Post by Birkalo »

ashirviskas wrote: post #266
maxloh wrote: post #257

Earlier quoted context omitted.

How about ProtonVPN?

Same company (no matter how hard they try to hide it), so unless it has better pricing or features, if you don't trust Nord, there's no reason you should trust Proton. Though I do trust both, as Tesonet is based from here (Lithuania) and from my experiences with people who worked there, they have full trust in them and continue to use their services years after leaving the company.

> Same company (no matter how hard they try to hide it)

Do you mean that NordVPN and ProtonVPN are the same 'spiritually' in that they're both companies selling a VPN for profit? Or is there genuinely some business connection between them that I've missed?

Re: NordVPN library and client code open-sourced

#273

Post by jcssy19 »

cyclecount wrote: post #126
VonGuard wrote: post #82

Earlier quoted context omitted.

They, and ALL VPN PROVIDERS, sell your DNS data, as well. That's the real business model.

I don't believe Proton or Mullvad sell user data; both purposefully avoid collecting user data. I believe NordVPN's open sourcing effort here (whether genuine or not) is motivated by pressure from Proton's open source.

Nord is approaching Kape Technologies, owner of ExpressVPN, Cyberghost and PIA with a potential takeover bid. If the deal to go through, no actions from competition would matter as there wouldn't be any. This new unit would be way bigger than the rest of the industry together. Even now, I doubt that NordVPN is pressured by Mullvad or Proton.

Re: NordVPN library and client code open-sourced

#274

Post by t8sr »

noncoml wrote: post #196
ashwagary wrote: post #85

Earlier quoted context omitted.

I don't see it as a nitpick. The review can be valuable to people working on the code and users wondering how competent the Nord team is.

I hate this kind of “reviews” at work. 0 contribution to the actual functionality of the code, but strong opinions about superficial matters. The OP clearly just skimmed through the code without any interest in understanding how it actually works. Just a code bashing. Sad

Yeah, I said I just read through it at random.

I know that some programmers hate getting their code reviewed. All I can say is that code reviews are, in my experience, strongly correlated with code that's cheaper to maintain and operationally less surprising.

Seeing this code certainly makes me think that the team writing it either doesn't have a culture of taking code reviews seriously, or that they don't have a lot of people who know the best practices in this language (Go). Either way, if they're not catching the easy stuff, I don't trust them to catch the subtle stuff either.

Re: NordVPN library and client code open-sourced

#275

Post by t8sr »

gliiics wrote: post #186
t8sr wrote: post #52

Well, the client code certainly isn't great. Reading through it random, I see a lot of undocumented code, functions with 20 positional arguments (who wants to bet some call sites silently swap two of them?), a file called constants.go where random strings are defined far away from where they're used, etc. There are also random, mostly undocumented, interfaces lying around /everywhere/, in all kinds of places not conn…

I honestly think answers like this one are the reason more software aren't open-sourced

NordVPN is a professional business making wild claims about the security properties of their product. We are not talking about bashing an amateur gamedev for their coding standards - we're talking about something that supposedly protects your privacy online. I think it's OK to expect a high standard of code review.

Re: NordVPN library and client code open-sourced

#276

Post by ashirviskas »

Birkalo wrote: post #272
ashirviskas wrote: post #266

Earlier quoted context omitted.

Same company (no matter how hard they try to hide it), so unless it has better pricing or features, if you don't trust Nord, there's no reason you should trust Proton. Though I do trust both, as Tesonet is based from here (Lithuania) and from my experiences with people who worked there, they have full trust in them and continue to use their services years after leaving the company.

> Same company (no matter how hard they try to hide it) Do you mean that NordVPN and ProtonVPN are the same 'spiritually' in that they're both companies selling a VPN for profit? Or is there genuinely some business connection between them that I've missed?

In the sense that there's a huge overlap of people who created Nord that are now working on Proton. Might be under the same employer indirectly (Tesonet or whatever they're called now). Whether officially they're under a different company/jurisdiction, that's a different thing.

From Tesonet[1]:

>We also provided ProtonVPN(opens in new tab) with operational and HR support when they decided to open an office in Vilnius.

>Contrary to all the myths and rumors, operations by different services have never been related to each other. The only common resources are the centralized HR and legal teams. We have strictly relied on this philosophy from the beginning in order to avoid any possible conflict of interest.

[1] - https://www.techradar.com/news/moving-the-vpn-industry-forwa...

Post reply on HN