Live data from Hacker News

NordVPN library and client code open-sourced

github.com

71–80 of 276 posts

Re: NordVPN library and client code open-sourced

#71
NordVPN are far too aggressive about youtube marketing to not be sketchy imo. Open source client doesn't really help because whatever sketchy shit they're up to is probably mostly on the server side anyway.

I wonder what their total youtube sponsor spot expenditure has been. It must be a ridiculous amount of money.

Re: NordVPN library and client code open-sourced

#72
post #20

Earlier quoted context omitted.

I hear there's a dirty secret that more and more companies are doing this to make things like Netflix that block VPNs "just work" though their services. Not sure how true this is or how widespread, though.

This has been brought up before, Netflix does not work with a VPN on. It knows you’re using a VPN and blocks you (asks you to disable it.) Yes this is true even with NordVPN, which I bought specifically to be able to watch Netflix on when expressVPN didn’t work.

That is an exceptionally broad statement. I think it's probable that Netflix doesn't work with large-scale VPN providers because it's broadly easy to identify the traffic source. However, using a wireguard tunnel from my ipad back to my house, netflix works fine.

Re: NordVPN library and client code open-sourced

#73
post #27

So, should we, or should we not use a VPN? If most sites nowadays are on HTTPS, is vpn still needed for daily use I think the only reason now to use a vpn, is to login to a site as if from a different location, if the site blocks your region, or sensor some of its content Any other good reason to use a vpn

Correct me if I'm wrong, but origin and destination are still visible to your ISP and any snoopers on your network. The content is encrypted, but not the origin and destination of the request. I use Mullvad because they seem to be a company with insanely good ethics and it's only $5/month. Mozilla VPN uses the under the hood I think.

That's right, origin and destination are still visible. Even if you use encrypted DNS to hide hostname to IP lookups, your actual traffic has to be routed somehow by someone. Whether that's your ISP or a VPN provider + their ISP.

Re: NordVPN library and client code open-sourced

#74

NordVPN are far too aggressive about youtube marketing to not be sketchy imo. Open source client doesn't really help because whatever sketchy shit they're up to is probably mostly on the server side anyway. I wonder what their total youtube sponsor spot expenditure has been. It must be a ridiculous amount of money.

I don't think its sketchy, it's just that the VPN business has extremely large revenues compared to costs of the service, which means A LOT of money remains for marketing. They can spend exorbitant amounts on youtube ads and affiliate review sites.

It's a bit of a unique market in this way, people are willing to pay $5-$10 per month for something that costs $1.

Re: NordVPN library and client code open-sourced

#75
post #27

So, should we, or should we not use a VPN? If most sites nowadays are on HTTPS, is vpn still needed for daily use I think the only reason now to use a vpn, is to login to a site as if from a different location, if the site blocks your region, or sensor some of its content Any other good reason to use a vpn

Correct me if I'm wrong, but origin and destination are still visible to your ISP and any snoopers on your network. The content is encrypted, but not the origin and destination of the request. I use Mullvad because they seem to be a company with insanely good ethics and it's only $5/month. Mozilla VPN uses the under the hood I think.

Your ISP doesn't get the full URL: they can tell which website you're visiting, but not the specific content you're accessing. The amount of information that is leaked by this, depends on which kind of site you're visiting. In the end, I occasionally use a VPN only if I'm connected to a public hostspot.

Re: NordVPN library and client code open-sourced

#76
post #20

Earlier quoted context omitted.

I hear there's a dirty secret that more and more companies are doing this to make things like Netflix that block VPNs "just work" though their services. Not sure how true this is or how widespread, though.

This has been brought up before, Netflix does not work with a VPN on. It knows you’re using a VPN and blocks you (asks you to disable it.) Yes this is true even with NordVPN, which I bought specifically to be able to watch Netflix on when expressVPN didn’t work.

If Netflix can see that your traffic is coming out of an AWS datacenter, then yeah they'll block it.

If Nord VPN is really bouncing your traffic out of some other residential customer's connection, that would be a lot harder to detect. And a lot more ethically questionable if the other user doesn't realize they're doing it.

Re: NordVPN library and client code open-sourced

#77
post #52

Well, the client code certainly isn't great. Reading through it random, I see a lot of undocumented code, functions with 20 positional arguments (who wants to bet some call sites silently swap two of them?), a file called constants.go where random strings are defined far away from where they're used, etc. There are also random, mostly undocumented, interfaces lying around /everywhere/, in all kinds of places not conn…

Apart from being sloppy, any worrying bits of code throwing up security red flags to you?

No that is why they are nitpicking about recently open sourced code that is "undocumented"

Re: NordVPN library and client code open-sourced

#78
post #16

Earlier quoted context omitted.

I am not related to them, I'm just a user of it. But Mullvad.net is the only decent VPN. (They're the one Mozilla chose to provide their VPN infrastructure) They've been audited https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found... I have no financial incentive to vouch for them. But what do you care, I'm just a random guy on the internet.

Never forget though, Auditing is only proof that it was secure at the moment of the audit . That applies to all VPNs and services.

Auditing might not even cover the entire codebase.

For example, this is the writeup of the DeFi Euler hack yesterday by one of the sites listed auditors, who didn't actually audit the code that caused the bug...

https://medium.com/@omniscia.io/euler-finance-incident-post-...

Re: NordVPN library and client code open-sourced

#79
post #27

So, should we, or should we not use a VPN? If most sites nowadays are on HTTPS, is vpn still needed for daily use I think the only reason now to use a vpn, is to login to a site as if from a different location, if the site blocks your region, or sensor some of its content Any other good reason to use a vpn

I'm using VPN to pay for the movies that are blocked for me otherwise (as a Ukrainian viewer).

Re: NordVPN library and client code open-sourced

#80
post #9

Since there is so much criticism here of NordVPN (in general, not for open-sourcing), what are the VPNs that people like?

I set up my own VPN with https://github.com/trailofbits/algo

Hosted on DigitalOcean and the setup was completely automatic, it deletes its own access after its done.

Note you're still beholden to ToS of your host, but tbh they don't seem to care no matter what I do with it.

I know it from here.

Post reply on HN