Mullvad for phones and personal computers because its app gets updated often and is generally very good on phones especially, air for seedbox because it has port forwarding, something else to use in automated scraping.

I ended up with that many active at one time because I wanted to try some of the stuff that gets recommended all the time and between a full crontab of content grabbing scripts and a couple of hermes instances I was running up against some of the guardrails of a normal user account too often for comfort but some of these VPNs fucking suck. I’m getting my money out of em but damn.

@inlandempire@jlai.lu , I think you may be inadvertently making a mistake excluding mullvad and bitwarden.

Mullvad is an excellent vpn service that provides unparalleled security, privacy and anonymity. If security, anonymity or privacy could have an effect on your safety then consider weighing that safety against your concerns about its founders political donations.

I currently have active subscriptions to mullvad, windscribe, proton, ivpn and airvpn. If I had to go down to one it would be mullvad, if I had to go down to two I’d add air for piracy.

Windscribe is the one I won’t be renewing. It’s complex, confusing, frankly expensive for what you get, has an awful app and config file generator, constantly seems to radiate incompetence and I think their style in general is cringey.

Proton is what you’re leaving and to be honest I’m probably gonna replace it with Nord. It’s “fine” but I can’t effectively automate its use on headless systems so it’s gotta go.

Ivpn is pretty good with a couple of caveats: it’s still possible to screw up and make an account with pii that the company can be forced to divulge, there are many examples of this vector causing people problems with other services. The company has not faced the same scrutiny as mullvad, however that’s a very high bar. What truly is a dealbreaker is how few servers & locations ivpn has and how not great the speeds are.

Airvpn is a piracy service. Theres no two ways about it and it’s great for that. I wouldnt bet my life on it but it sure does allow port forwarding at a decent price!

Mullvad in comparison is simple, reasonably priced, has plenty of servers and locations with good speed, has the best vpn apps I’ve seen, you literally can’t make an account that’s not anonymous and has passed the most intense possible scrutiny I know of for a vpn.

If your life or freedom depends on it, you should pick mullvad.

Many companies with some tie to politics I disagree with produce extremely high quality products and services that I rely on. It is particularly hard to avoid in the gun market but is certainly present in security as well.

Of course if the vpn is for getting past the company firewall so you can look at pornography on company WiFi or something, feel free to disregard this.

I brought up bitwarden but I’m tired of tippa tapping out a post so just imagine an equally long description of how it’s good and the problems always seem to turn out to be overblown.

Seeing slopsayers and rust aficionados fight in the comments is like coming across a baron and revenant going at it in melee.

Hell yeah.

I think again, that you are perhaps a bit too idealistic here.

The secret fisa courts run by handpicked judges mediating pushback against demands that someone or some company give up any data they have only apply to Americans.

So the fake made up process to keep the us government from performing bulk data collection on citizens only applies to citizens. Noncitizens have no similar protection under law, fake or otherwise.

Not to break out the rasp and put too fine a point on it: noncitizens have no protection under law, fake or otherwise.

We already know that us telecommunications infrastructure has hardware (not software, baseband level) backdoors built into it by design in order to facilitate spying. I can say this for a fact because it was a low key huge deal that the lawful intercept backdoor was compromised a year or two ago.

Anti communists like to scream about huawei telecom equipment being compromised by the evil ccp, but rarely make the factual statement that it is all designed with built in backdoors to meet the requirements of the nations who order it. All those nations also use telecom equipment backdoors just as much as American intelligence agencies do. When nations rip out Chinese made stuff and replace it with something from what passes for an ally at the moment they aren’t giving up their backdoors.

Just off the top of my head, and this post likely has some awkward phrasing I owe you an apology for because it is all off the dome, the English had to do a heavily redacted investigation into their own complicity with telecom spying that was done on British soil by Americans as part of the prism program with no us oversight to protect British citizens.

All that is to say: even if you live in a nation outside the five, nine, fifteen, ct, club du berne, special committee or any other intelligence sharing organization and your data never flows into American jurisdiction and you run some ideal operating system and service compliment that has no surface for interface with the authorities, you are not safe from the bulk collection of encrypted data under prism.

Which is what prism is. Bulk collection of encrypted data for processing at a later date.

The two possible ways to get safe about it are to be in and be accessing systems in the Russian federation or the prc. Neither is a good shield because China isn’t trying super hard to keep spooks out and the Russians are currently in the Treehouse Made from Old Pallets stage of their new Internet.

You cannot escape prism because it does not require access to your device and is not constrained by borders. I encourage you to investigate which Android systems can be hardened to the extent of ios. I have concluded after years of observation that it is graphene and only graphene.

Okay with that mega downer out of the way:

When I brought up the phenomenal amount of long running vulnerabilities in the kernel (which I hate other people pointing to because it doesn’t reflect the extent to which ai tooling has allowed much more extensive and expansive testing but coincides with a change in the maintainers policy around the cve system!) and the lz fiasco, I was hoping it would be clear that vulnerabilities and bugs often are backdoors and interference, we have recent examples of that as well as a historical record of explicit attempts to insert bugs and vulnerabilities as literal backdoors and interference and there is a frightening pattern present even in my own favorite distribution Debian that alludes to that process.

I said those things to illustrate that to the extent there is a community reading the source it’s either merely equivalent to the private software world, infiltrated by operatives or populated with useful idiots like the eos knucklehead who said graphenes security is for pedophiles.

That situation combined with the fact that there is no pretense of legal protection for a person running open source means that it’s a pretty hard sell for regular people to rely on code reading instead of recognizing that the control causes a change to happen.

Again my point is that you are making a wild, indefensible leap of reasoning and judgement when you say that the only way to tell if a control is doing something is to read the code.

I also maintain that you are mistaken about antivirus. Even if the third party program relies eitirely on the hooks within the defender subsystem and only provides recognizable warnings that don’t slide off the users frontal lobe like butter across a skillet that is safety.

You even admitted that antivirus could be “implementing real safeguards”.

There are terrible antivirus programs and some that are pretty good. The presence of data collection in a eula doesn’t mean it’s a bad program. People choose to use Facebook knowing that it’s a nightmare panopticon because they want what it’s providing.

I don’t think you’re arguing in bad faith or being oppositional, what it sounds like to me is that you believe in the ability to escape bulk surveillance of encrypted transmissions and that it’s possible for all users to aspire to understand what’s going on at all (or enough to make informed decisions!) times and therefore a method of securing oneself that doesn’t provide 100% protection from that spying or put all those controls in front of the user with as much granularity as possible doesn’t count.

To bring it all the way back to the start though, ios hardening is real.

Yes! I been in the Broadcom world so freshtomato calls it aqm.

Hang on, if a social service doesn’t get paid for how does it exist?

Money.

Set up aqm or whatever it’s called on openwrt.

It makes a huge difference.

I don’t think you’re arguing in bad faith or being oppositional at all and I think it’s good you care about this stuff. I care about it too.

TBH I kinda get the impression you have a bit more of an idealist take on things than I do.

PRISM is not something companies or individuals choose to comply with. The NSA demands data under color of law (section 702!) with disputes mediated in secret courts run by judges handpicked for those roles.

Avoiding the possibility of data collection through the cloud service vector doesn’t protect the user because every telecommunications company I am aware of is known to have complied with fisa demands, most germane to our topic: Verizon very famously. So even if a user isn’t using any cloud service that handles their data, their data still gets handled by telecom companies doing the exact same bulk collection of encrypted transmissions for processing at a later date.

No American can escape PRISM without completely leaving all telecommunications behind no matter the manufacturer of their computer or the programmer of its operating system and software.

I use Linux everyday and have as a main os for a long time.

The Linux kernel is not safe. In the past year there have been high cvss bugs and vulnerabilities discovered which were present for decades (yes, with an “s”). There are first party accounts of direct infiltration attempts and evidence of covert ones with varying degrees of success from nothing to long con winners like lz.

All operating systems have bugs and vulnerabilities which impact their security and safety.

From a laypersons perspective even assuming they are familiar with the concept of open source, how can they be expected to put their trust in a community that can’t even keep itself safe?

Remember that interactions between a person and some company are mediated by law. If Google or Apple screws them over there’s at least the pretense of some recompense. If your average user gets hit by a deserialization error in Linux they can’t come back on kernel.org, they’re just flapping in the breeze!

I do not use proprietary antivirus on windows and generally point people away from it except for some unique situations.

You are mistaken about proprietary antivirus on windows. While recently there has been a big effort to kick them out of ring0, they do actually perform a task with measurable degrees of completeness using real techniques for securing code execution and user data. You might think as I do for my own purposes that they’re not doing you any good but no matter how much we both might hate norton, it is doing something.

Specifically for many users third party antivirus is a trusted secure process they can rely on when they have no baseline of trust for the operating system.

The above is not gibberish. Many people fundamentally do not trust windows and cannot make a clear determination how to proceed when some dialogue box pops up (think uac of olde). You and I hate the bright orange, yellow and red windows of third party antivirus but they’re using those colors to make them clearly stand out from the os’ warnings.

We may see an intermediary between us and links in our emails as a waste of time but for a lot of people the process of clicking only the links with the big green checkmark next to them (indicating the destination has been vetted by the third party antivirus and isn’t malicious) is one that keeps them safe.

Could that be accomplished with retraining? Yes but no one is doing it and generally retraining efforts in organizations don’t actually do a good job and leave users feeling confident enough.

Ios hardening is effective and is not a half measure unless evaluated against a bar for security that excludes using public telecommunications networks.

Those are morrowind menus.

Pia is owned by kape technologies, a company founded by former Israeli intelligence officers that buys up VPNs.

I tend to recommend airvpn for cheap port forwarding but bear in mind you may recognize the need for a separate normal service because of airs unique position in the marketplace.

Anyone handling (incredibly insecure! This cannot be understated!) push notifications can be secretly compelled by force of law to hand them over. That’s not unique to Apple or ios.

To bring that all the way back to what I said, that the claim “ios hardening is a myth” is not true: you can turn off push notifications in ios. Because of the nature of the technology there are other controls around it that are not part of the receiving devices operating system and need to be handled separately.

If you haven’t already, disable push notifications.

I think there’s a fundamental lack of understanding amongst people in general about the purpose of our networks. The Internet, like cable television and broadcast tv and radio before it, is a propaganda and surveillance technology overlaid on military command and control.