Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN library and client code open-sourced

github.com

Post reply on HN
Print view View original

51–60 of 276 posts

Re: NordVPN library and client code open-sourced

#51

Post by acatton »

DeathArrow wrote: post #35
acatton wrote: post #7

Reminder that it looks like NordVPN does shady stuff: https://news.ycombinator.com/item?id=29285988 Allegedly, they are using their customers as botnets to resell traffic from residential IPs, mostly for scraping, through their other business "Oxylabs".

Is this legal? What is someone else is doing illegal things using your IP?

I used to buy residential IPs from a competitor of Oxylabs in a previous life. Nothing illegal, just scraping data from websites using cloudflare. (Cloudflare has some anti-scraping-scraping protection, even if you do 1 request per 15 second)

I asked this question, the answer from this other company was "we would close your account". But they were unable to explain clearly to me how and if they monitored this.

In fine, I think this is your responsibility, you basically voluntarily installed some malware.

Re: NordVPN library and client code open-sourced

#52

Post by t8sr »

Well, the client code certainly isn't great. Reading through it random, I see a lot of undocumented code, functions with 20 positional arguments (who wants to bet some call sites silently swap two of them?), a file called constants.go where random strings are defined far away from where they're used, etc.

There are also random, mostly undocumented, interfaces lying around /everywhere/, in all kinds of places not connected with either the call site or the implementation. My favorite is a custom bools library called "strings".

I haven't found any obvious bugs, but the coding standards are poor. Good on them for open sourcing it, but man, did nobody stop and think "hang on, is this code gonna make us look bad?"

Re: NordVPN library and client code open-sourced

#54

Post by risyachka »

mistrial9 wrote: post #4

why do they spend so much money on ads? seems like more budget than could be explained via sales to civilians

Because they have huge margins and high LTV.

Every company who has these spend as much as they can on user acquisition. Why wouldn't they?

Re: NordVPN library and client code open-sourced

#55

Post by ivann »

irrational wrote: post #31
systems wrote: post #27

So, should we, or should we not use a VPN? If most sites nowadays are on HTTPS, is vpn still needed for daily use I think the only reason now to use a vpn, is to login to a site as if from a different location, if the site blocks your region, or sensor some of its content Any other good reason to use a vpn

I was wondering the same thing. How would my ISP even know that I am using a site like z-library if everything is over HTTPS?

By looking at the SNI [0] if the connection does not use TLS 1.3 and ESNI.

[0] https://en.wikipedia.org/wiki/Server_Name_Indication

Re: NordVPN library and client code open-sourced

#57

Post by DeathArrow »

msla wrote: post #5

https://www.youtube.com/watch?v=WVDQEoe6ZWY That's a video about NordVPN's dishonest advertising and how deeply it's infected YouTube. https://www.pcmag.com/news/nordvpn-ad-banned-for-exaggeratin... > The UK's Advertising Standards Agency(Opens in a new window) has banned a NordVPN commercial for misleading viewers about the privacy risks of using a public Wi-Fi network without also having a VPN. In essence: HTTPS al…

HTTPS is not going to hide your IP or the IP of the websites you access. Beside HTTPS there are other network protocols people are using.

Re: NordVPN library and client code open-sourced

#58

Post by rwc »

t8sr wrote: post #52

Well, the client code certainly isn't great. Reading through it random, I see a lot of undocumented code, functions with 20 positional arguments (who wants to bet some call sites silently swap two of them?), a file called constants.go where random strings are defined far away from where they're used, etc. There are also random, mostly undocumented, interfaces lying around /everywhere/, in all kinds of places not conn…

This is not a snarky response, but is it possible the answer is simply "who cares?"

I see NordVPN ads all over youtube, podcasts, and TV. Those overwhelmingly non-technical customers certainly don't care about the code quality, documentation, or constants defined far from where they're used.

It seems to me this is about marketing the product to be perceived as transparent and secure, which is certainly what those customers care about.

Re: NordVPN library and client code open-sourced

#60

Post by jakear »

gjsman-1000 wrote: post #23
acatton wrote: post #16

Earlier quoted context omitted.

I am not related to them, I'm just a user of it. But Mullvad.net is the only decent VPN. (They're the one Mozilla chose to provide their VPN infrastructure) They've been audited https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found... I have no financial incentive to vouch for them. But what do you care, I'm just a random guy on the internet.

Never forget though, Auditing is only proof that it was secure at the moment of the audit . That applies to all VPNs and services.

Rather, auditing is only proof that the parts the auditors looked at were secure against what the the auditors knew to look for, at the moment of the audit.
Post reply on HN