It might be that PIA is not going to start doing anything shady, and they'll still be a (relatively) well-respected VPN company after the merger. But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back.
There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens.
I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing.
I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards.
In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).
> I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't
Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is.
Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.
> But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back.
how will they prove it in a year?
and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?
So what’re the recommendations for alternatives? It seems like quite a lot of VPNs play their cards close to the vest - and at the end of the day, all I want is a modicum of privacy and to safely torrent a movie for my PLEX server instead of having to dig up my Blu-ray reader and rip it myself once in a while.
If we're talking spending extra for switching flexibility, just abandoning PIA midway through your year-long subscription term and writing off whatever you paid, works too.
Fully agree with all of the above. I've been a happy customer of PIA's for years now and, as such, they've built up relatively solid trust with me (for a third-party VPN company). Even still, I only renewed only a yearly basis because a) things in tech, especially security, change quickly and b) companies also change quickly and like today, that change can be greatly for the worst.
I can't personally understand buying in to such a service for a timespan measured in years.
20 months later, PIA open sourced its iOS app, older versions of its browser extensions, and 2 Swift libraries. Everything else is still closed source.
Thanks for bringing this up commoner and really appreciate your patience. You are absolutely right that we are open sourcing our software - there were some delays as we completely rewrote our desktop application from scratch.
This was a major concern from our new partners as well, as they have been asking us to release the code as well - we are all on the same page here.
While I can’t give an exact date, I’m confident that the rest of the code will be released in 2 weeks or less. Along with our QT/CPP cross platform application, we will also be open sourcing our search engine, private.sh!
Hope this helps and sorry again for the delay,
Andrew
Usually, Subreddits are created by fans of the service. This is the first time I'm noticing a complete corporate subreddit. All the moderators are the staff of PIA. [1]
It will be interesting to see how much they accept criticisms on the subreddit about PIA.
The Go language subreddit had been modded by Google employees. They lost interest and decided to shut it down and there was a bunch of hubbub. In the end they thankfully decided to give the subreddit to the community.
Happens a few times. For the Endless Space/Legends series of games, we made their community manager a mod (they are essentially running the subs, but don’t have founder status and technically we could intervene if they behave in questionable way). It usually depends on who created the sub. Some of them are set up as official channels, others are community-run but with good relationship with the company (an example for the latter would be the paradox subreddits, they are independent but have a good relationship with Paradox).
Whether critical or loving, we really appreciate any and all feedback from our users and the community. We accept all criticism with open arms and, furthermore, will not be censoring our subreddit as that would undermine free speech - the very thing we are fighting for.
I lost faith in PIA caring about privacy of its customers when I noticed how they use unique tracking codes in their newsletter emails. I never received a response when I asked about it.
We had an issue with PIA's Android VPN breaking our app, they never responded to our PGP'ed ticket and the email address embedded in their PGP keyblock bounces.
Thank you for bringing this to our attention mehhh. I will get into this PGP bouncing issue immediately. In the meantime, please feel free to contact me with PGP - my public key is pasted below and you can mail me at a at londontrustmedia.com:
Freenode is a non profit organization that benefits from support from Private Internet. It is not owned by Private Internet. We are serious fans of IRC and the open source community, so it makes sense for us to divert profits to orgs like freenode among others.
Any recommendations? This looks bad really bad. Cybergoast a previous VPN bought by Kape went to shit.
For the Pia engineer who ends up reading this.
I have bin a Pia user for 5+ years. I have recommended it to friends and family. Now I have to tell them all to cancel.
Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. Azure even has a preconfigured option in their marketplace that's easy to set up in a legal jurisdiction of your choice.
Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is
https://github.com/microsoft/service-fabric/). After the free year, a minimal always-on VM costs about $13/mo.
Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP.
Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content).
Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead)
Fivth, some sites block you if you use cloud provider IPs
Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically).
Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss.
VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation.
For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.
If the reason you are using a VPN is to avoid potentially untrustworthy middlemen, sure. But if you are after the privacy benefits of sharing an IP address with thousands, then a self hosted VPN won't help you.
Digital ocean would be $5 per month. I’m not sure what their logging/privacy policy though because I found their terms documents so broad and confusing
This is the same PR blabbering that occurs with any acquisition. It means nothing just like any other. I’m cancelling and changing providers. Does anybody have recommendations?
The submitted title was "PIA bought by company known for distributing malware". We changed it to the article title in accordance with the site guidelines: https://news.ycombinator.com/newsguidelines.html, which ask "Please use the original title, unless it is misleading or linkbait; don't editorialize." One reason we have that rule is that we're not in any position to decide the truth or falsehood of contentious claims.
[+] [-] danShumway|6 years ago|reply
There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens.
I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing.
I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards.
In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).
[+] [-] bscphil|6 years ago|reply
Well said. I would add that they're also useful in situations where you don't care about privacy at all. E.g. you don't care if your ISP logs that you're watching Netflix, you don't care if your VPN logs that you're watching Netflix, but you (and to some extent Netflix) have an interest in making it seem like your computer is located in a different country than it is.
Region-shifting and preventing non-government adversaries from discovering your real identity from your IP address are both valid reasons to use a commercial VPN. I suppose the reason why those who oppose commercial VPNs discount these two is that they're mostly used for IP infringement.
[+] [-] sigstoat|6 years ago|reply
how will they prove it in a year?
and what threat is it you think the shady guys are going to pose? they'll start spending more money to keep logs? i guess they could get in bed with law enforcement but i doubt that pays well. maybe the RIAA/MPAA will pay them off?
[+] [-] arkades|6 years ago|reply
[+] [-] rdiddly|6 years ago|reply
[+] [-] LMYahooTFY|6 years ago|reply
What is "regular internet browsing"?
[+] [-] cmdshiftf4|6 years ago|reply
I can't personally understand buying in to such a service for a timespan measured in years.
[+] [-] AndrewKemendo|6 years ago|reply
[+] [-] commoner|6 years ago|reply
https://www.privateinternetaccess.com/blog/2018/03/private-i...
20 months later, PIA open sourced its iOS app, older versions of its browser extensions, and 2 Swift libraries. Everything else is still closed source.
https://pia-foss.github.io/
[+] [-] rasengan|6 years ago|reply
This was a major concern from our new partners as well, as they have been asking us to release the code as well - we are all on the same page here.
While I can’t give an exact date, I’m confident that the rest of the code will be released in 2 weeks or less. Along with our QT/CPP cross platform application, we will also be open sourcing our search engine, private.sh!
Hope this helps and sorry again for the delay, Andrew
[+] [-] vincengomes|6 years ago|reply
It will be interesting to see how much they accept criticisms on the subreddit about PIA.
1. https://old.reddit.com/r/PrivateInternetAccess/about/moderat...
[+] [-] donatj|6 years ago|reply
[+] [-] bla3|6 years ago|reply
[+] [-] Semaphor|6 years ago|reply
[+] [-] sneak|6 years ago|reply
[+] [-] rasengan|6 years ago|reply
[+] [-] syshum|6 years ago|reply
[+] [-] spilk|6 years ago|reply
[+] [-] xrftghvb|6 years ago|reply
Open discussion of Bitcoin is at r/btc. https://www.reddit.com/r/btc/comments/9lfjrb/frequently_aske...
[+] [-] eng_monkey|6 years ago|reply
[+] [-] jammygit|6 years ago|reply
[+] [-] system2|6 years ago|reply
[+] [-] mehhh|6 years ago|reply
I wonder what will happen to Freenode now: https://freenode.net/news/pia-fn
[+] [-] ryanlol|6 years ago|reply
Well, they're already pushing this cryptocurrency scheme https://freenode.net/news/spam-shake
[+] [-] rasengan|6 years ago|reply
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBE28x2gBEACdADSTytv3SNIpOfwQqnWauesXCPgCrOar+Qjt9JITwxZLj/eiYtynG3HNwSo+ VZRQIQqTVO3mtov++Bx7/ZiQC7aylEr4l4g8cL1Y0KtVGWG5GtIBmbP7r4xHZaSlWf0mbNRrjEoT Bn4rQaLuGE8jvPDR9ZszXzgQmDjIXwx1/NJP2+XJ8MghJX3eH7nPyAjDMKM9TsF6KbYrKUPPsH4F jqINMW9Yo24RLdhHnJpLEJLDQNsvakUz8r+YqFTuKsiZcS7BrWWQODTCmWq//HoUUW7UfE76E8Qi mAh8CoRvJktY8cJoHK6fm9oVpKVMp2bhbnha7HbggOdcEnawUqsdjPMY6iA6gx9aqIZ32bjfBx6+ N/XLDh1cLjVLQonRov4DQAve0o4nxKBp6drozhUD8Yw4ROv+vJPxp1wxqq4L0+FEXpORB1rvNewn zyEXNGd8JX3YuStj87isGCytnzcYOc8wa1zhbmF+iM0YIi2DWu9EeWv80oNCA0i+aVcpr3jkARhf ii8w7vSHt3SzaT1TAqtgkH0i9LCXng8jieGgEGWMTXnjcMWeg0tNfAwsUd3ikLw77dN/o/6d0X5S JkDy8003XesclKoJgsVK3l/9yfFVTChHjWJNqx8By2OwRA8ITAaJHb1e/sbqiF+nf1B4A031SxLE xbESOszXuVtJjwARAQABtChBbmRyZXcgTGVlIChyYXNlbmdhbikgPGFuZHlzbEBnbWFpbC5jb20+ iQI4BBMBAgAiBQJNvMdoAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRABYTG6kOhpIQAB D/9HMeFMIWMkYk6dY+039vxlQq2sGl93+/VyCrlgoGm0BFw3oV7xm/uAI1jxJHG2Slt34p7Vzi4w nGi+k65Tj5CwbuPy91zeSpIgh7FPszvZACxg4jR+Rza37sj9FV6CLYQsQ2JWyaiqPOVM4Ejr384a lFkJfItCXxpeGHo42BefIci4NNdCiIWB0xvg38i2y8m9w1/3IaMezjix5QZKfOrD50lQCW5i6M1H FjFwXrE/yL4esUnJamRCSwCfZmCa3PZi+5RWr4vNBXktiUc0Aum/zHsKLHLEKuGoB3bqn9TMEpVE 6akCZnKh4T7oCn3Ou+u5tyi6DFfHbM8qnORl2qf9siJ794+FOdmbrcmxis0MoMRtdCKHLZdYQAol 8X266nKWWm/JFLqM2CcmBuQKWLb4LfAUBhXklnc+606Si4rI02eBcsMEvc/pLB+gZ4eF9dM7n47O PuLTeS0W0khsXvspneDmWN5fYr5hkxsg7FKBjQX6nx4ImnwpBc/ZDCbCEDLvIIXPEDf0pUkNUmh8 6Zh7cx6JKdKgn3GPxHP3sLzOzP7UXsaMdet3/Vcm476nTnHwjDXF5pQJG3hPhcqG1vIjDS/k53xD TDXiK+Ll4oyyNnNhUkFOBhnV3TDUC8+AImoBMhkTRLRlBvmVI5Z45cpPQFx8TLXV52zpT10Q/swC TbkCDQRNvMdoARAAtp38Gnxna31fkzbdXPBlsw9khwHO2AUajJZoDh16HaovFMX4O+T5ILXJxz26 Cd3OD76yhl3mo7gLNiYB8hHjPkftXopGsEWMpsSuID58z7/vz90qvDPCSEGM0EEaI2YZcjgLPNIm KDAe3DDYy7bVkkQR47rzLmFC2HF5IwhwTnpBpYpW2ZjQkAx/H0zwPph1AdxozLHu/yzo+hUhmr8n z2G5B92u04CPhcm4VwCoaP6FSYvpO/12Fc0gN8jvjZgOfYvbhcsA76Snt3u5UtxW2cYx5xlJsRcE bRsowiajc15pZaPxEV/Od5yUFTun6NztGinRmWN0zIhoBaM3dwTDOV0cOuFP6TroYSTyvRAznvpe vqHnxJy42luAHyfc8SeBtVYtCV6dDMOi8ervfa8YWFIjiVpcYAXCkFga1gzNJu14yJkVDFHHEttv VqFids5AoscxyfvT2m46KCH85rHqm6jvkH1cQQkkB6/WiIj5aQhBv3cOJ3R3dsmdTk+/OdIPbVDr oHdrTbxQsmm3AnE4pex5WiGxDt7vh8hvdT272eV6vZaGNZcM9pfFDwQVab1wWamSJ/VGxKEOXckV 2hVzEfmXhe7nmHGQ1hUI0JAZiTREAoDqxYvTOLkKqhb8piVenThwqPoLZyvTLYuVd9daOVPrDDBb M49L0+HctG6Ite0AEQEAAYkCHwQYAQIACQUCTbzHaAIbDAAKCRABYTG6kOhpIQABD/0bH/nYM72c BnSZH/6nYVaT9/xVkFC4er7xhiDQosQlUwv+nwEt9jt6zt7R++jCAefsV2DwybtXo8l0ZXLTOCND Hvq5GEzt+C9lVJffcp8EFl4HGUyc42X3/XtGSiArp1LN7vH9T+BjW7BLhEgtpWYYozaaf5SslqeO EWHdU0hdjSabvD9i1H1JV78TL27WvNXBO5MyDnFiHAB3W8ANI6mtV6o0YrvJRyiuU+P27ML4EoDo ew0BR1kYnCq6zJk6cyGa+i47NrjiSewomAQVGvB8Wk986KiSASzYCkStlIA9Tau/yeLdUkhXk9XD f7ueOggPC4jhIknzGXEMgJgufIfHfXDqxHvKwibU3F9wM6pjB/NrH1Fx6SGruELZvNy4kvKd+L6B Ba5ZAiYtkx7ZcLx/bcfxMcu2dg+sRWW698Vb9KN05kwblXwUPkEw4+00G+OFHJZx9KpezrgnJ0pR Sbv5VscBHyFWsGtzsxRs5dh1OHgnSnqoLsXhP4cT5vYSyvUXKP8jFMqUItVljAt/E3ePXIffIRq7 sreHnGsdDp0DyGZXLW78HnJp6/1QXRzq/URlWarVc98YjPgEkXJviV1o5GAVLsuvN+xRC6Llz2rD bKOq/Tzb1SaHtJOPJomcRP6691h0CHMI4ind71KhyJD2vmHwBA/enYuh0ank5J4LTw== =P6L+ -----END PGP PUBLIC KEY BLOCK-----
Freenode is a non profit organization that benefits from support from Private Internet. It is not owned by Private Internet. We are serious fans of IRC and the open source community, so it makes sense for us to divert profits to orgs like freenode among others.
To be clear, we also donate to other orgs:
https://www.privateinternetaccess.com/pages/companies-we-spo...
Our new merged company will continue to do the same as we are in fact the same company going forward - just much better resourced.
[+] [-] prawnsalad|6 years ago|reply
[+] [-] throwawaypiawhy|6 years ago|reply
For the Pia engineer who ends up reading this. I have bin a Pia user for 5+ years. I have recommended it to friends and family. Now I have to tell them all to cancel.
[+] [-] dmclamb|6 years ago|reply
I'm not sure there are any companies left to trust.
[+] [-] ohthehugemanate|6 years ago|reply
Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is https://github.com/microsoft/service-fabric/). After the free year, a minimal always-on VM costs about $13/mo.
[+] [-] badrabbit|6 years ago|reply
Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP.
Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content).
Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead)
Fivth, some sites block you if you use cloud provider IPs
Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically).
Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss.
VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation.
For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.
[+] [-] calcifer|6 years ago|reply
[+] [-] dbeley|6 years ago|reply
The bandwidth on Azure might be better, but the first tier on OVH, DigitalOcean and Scaleway begins at 3$/mo and you still have 100mbps.
[+] [-] gruez|6 years ago|reply
No, it's not. Both have zero or very low amount of free egress (5GB max). After that you're paying $0.1 per GB of egress traffic.
[+] [-] swebs|6 years ago|reply
It's $5 at Linode, and that's not run by a company known for spying on users.
[+] [-] ignoramous|6 years ago|reply
Also see a recent news.yc discussion on cheaper hosting: https://news.ycombinator.com/item?id=21172818
[+] [-] Havoc|6 years ago|reply
You lose the benefit of your traffic being aggregated with lots of other traffic.
[+] [-] homero|6 years ago|reply
[+] [-] jammygit|6 years ago|reply
[+] [-] imafish|6 years ago|reply
I could simply not have asked for a better day for this to surface on HN :D
[+] [-] nullc|6 years ago|reply
[+] [-] Phylter|6 years ago|reply
[+] [-] MatthiasP|6 years ago|reply
[+] [-] anonymousse1234|6 years ago|reply
[+] [-] dang|6 years ago|reply
[+] [-] eyeball|6 years ago|reply
[+] [-] pkaye|6 years ago|reply
[+] [-] unknown|6 years ago|reply
[deleted]
[+] [-] sizzle|6 years ago|reply
https://mullvad.net/
[+] [-] Kurd|6 years ago|reply
[+] [-] unknown|6 years ago|reply
[deleted]