31–40 of 116 posts
> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?
> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?
- If the computer is powered off, moved or confiscated, there is no data to retrieve.
- Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved.
https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...
Earlier quoted context omitted.
Non-persistence of any data is a positive in terms of data at rest, how is that not a defense against surveillance? Regardless of the fact that it's not verifiable, assuming it were true, would it not be a good thing?
How is an anonymous, non-attributable, non-verifiable statement, from a company trying to sell you a product, worth anything? Why assume it's true when it is so contrary to even basic common sense, for anyone who has ever stood up a LAMP stack?
Please note that I am not arguing in favor of their advertising or to say that it is successfully avoiding surveillance. But, do you believe that no-disk boot, assuming it actually takes place, is a positive thing, or not?
I admit I misconstrued your original comment to be a criticism of the technology rather than the fact that this VPN company advertises as such. Nonetheless I do think no-disk-boot is not useless as a technology and if you have any disagreement I would love to hear it, as someone who uses a VPN (not expressVPN) that says they use the same setup.
> With virtual locations, the registered IP address matches the country you have chosen to connect to, while the server is physically located in another country. How does this work then? How can you have a Indian IP address, while the server is located in the UK?
They must control ranges of "indian" IP addresses but announce BGP routes for them in Singapore and the UK. GeoIP says India, BGP takes you somewhere else. Easy peasy
Earlier quoted context omitted.
Non-persistence of any data is a positive in terms of data at rest, how is that not a defense against surveillance? Regardless of the fact that it's not verifiable, assuming it were true, would it not be a good thing?
How is an anonymous, non-attributable, non-verifiable statement, from a company trying to sell you a product, worth anything? Why assume it's true when it is so contrary to even basic common sense, for anyone who has ever stood up a LAMP stack?
> Not only is it our policy that we would not accept logging, but we have also specifically designed our VPN servers to not be able to log, including by running in RAM. Do people really believe this bullshit? Empty claims of servers running "in memory" as a meaningful defense against surveillance?
these claims aren't necessarily empty, but pointless because ISPs still log everything, as they're required by law pretty much everywhere. it would require a bit more digging to through, but the data is still there - even with some clever routing with on-premise equipment, there's still more than enough data to deduce which inbound connection corresponds to which outbound connection if your threat model is three lett…
This is one of the use cases for why you might want a VPN, if you trust a VPN company more than your ISP.
A VPN is just paying for putting your trust in a VPN brand rather than an ISP brand. I don't see why that's such an offensive business to so many HN users.
ExpressVPN now belongs to Kape Technologies, which has a colorful history: https://www.cnet.com/tech/services-and-software/what-is-kape... https://www.reuters.com/technology/kape-technologies-buys-ex...
Pepsi and Coca cola.
Earlier quoted context omitted.
How is an anonymous, non-attributable, non-verifiable statement, from a company trying to sell you a product, worth anything? Why assume it's true when it is so contrary to even basic common sense, for anyone who has ever stood up a LAMP stack?
I don't mean to assume it's true to validate their advertising. For the sake of argument, if a server uses only a RAM disk, is that an improvement over having disks? Of course a network can still have sneaky equipment in between but that is still possible without RAM disks, so is it not beneficial to have a RAM disk? Please note that I am not arguing in favor of their advertising or to say that it is successfully avo…
> Rest assured, our users will still be able to connect to VPN servers that will give them Indian IP addresses and allow them to access the internet as if they were located in India. These “virtual” India servers will instead be physically located in Singapore and the UK. Wondering why anyone is still using ip-based geolocation. The most popular use for VPN's is mocking your location to Steam and Netflix. Could be th…
It seems pretty clear to me at least for the Netflix case. - Content providers care because they want to sell exclusive per-region licenses. - Netflix doesn't really care, in fact the may benefit from more content available to their users. The end result is that Netflix will do the bare minimum to keep the content providers satisfied. Steam is more of a concern because they have different prices per region. But IIRC…
Geolocation is largely a feature in products and in licensing because there is big purchasing power difference between rich and poor countries.
Netflix has been more tolerant in the past of region bypass than others for the same reason they didn't crackdown on password sharing but won't be in the future.
[1] The actual prices we pay might vary in both countries depending on promotion and tie ups etc, but these are list prices of which those components would be applied.
Earlier quoted context omitted.
these claims aren't necessarily empty, but pointless because ISPs still log everything, as they're required by law pretty much everywhere. it would require a bit more digging to through, but the data is still there - even with some clever routing with on-premise equipment, there's still more than enough data to deduce which inbound connection corresponds to which outbound connection if your threat model is three lett…
I agree a VPN won't help against a three letter agency. But it will help against an ISP, who has a legal right to sell your browsing data in the US. This is one of the use cases for why you might want a VPN, if you trust a VPN company more than your ISP. A VPN is just paying for putting your trust in a VPN brand rather than an ISP brand. I don't see why that's such an offensive business to so many HN users.
Because the assertion VPNs - apparently unlike every other ISP - do not log or monetize your data is simply laughable, especially as so many are based in third-world countries, set up by shell entities and have almost no accountability for any of their claims.