Hacker News Reader

Comment by DCKing | Hacker News Reader

This is exactly my rationale. The fact that you have to explain that the company that bought you is not shady is writing on the wall, even if you have a good explanation. For the record, I think the explanation is pretty decent. But PIA is a commodity product from a technical perspective. It's the trust and reputation that's not the commodity, and being bought by a shady company (even if it's "formerly shady") you discard this right away.

I bought PIA because it had stellar reputation back in 2015 or so. Now it went from stellar reputation to "just another VPN provider". Mullvad appears to be prime candidate now, they're not based in the US if that means something to you, and they even have Wireguard to play with. Let's go.

View on HN

Trust is a fleeting concept. If you used PIA only for the trust and not for the verifiable transparency, then we have failed you.

You can't trust some random VPN on internet. Anyone could have set it up.

You can only verify. Don't trust. PIA will continue on its mission to increase transparency and set a new standard and expectation in the industry.

With PIA, we will make sure you know what you're getting. Some may choose not to go with PIA, and that is beautiful freedom. For the rest, I'm confident people will choose verifiable transparency over blind trust.

Transparency is not verifiable, just as it's impossible to prove the non-existence of something.

PIA could appear to be 100% transparent while secretly creating and backing up logs, or passing them through a third-party. An auditor is less likely to be fooled, of course.

The bottom line is that it's reasonable for us to choose our VPN based on both transparency and trust, and we have no reason to trust the new owners.

And what, practically, does this verifiable transparency look like? What stops it from being just another _unverifiable_ promise on the internet?

How do you propose we verify the transparency? I legitimately have no idea how I can verify what specifically is running on your servers.

It seems to me that the entire VPN industry has a huge inherent information asymmetry since it is incredibly difficult for an end consumer to confirm any claims a provider makes about the quality of their product. Economic theory tells us that results in a market for lemons [1]. We just end up with a bunch of low price and low quality products provided by shady companies because it simply isn't cost effective to compete against those options with a quality product whose quality can't be verified. For a technically savvy end user, you are probably better off rolling your own VPN with open source software you compile yourself rather than trusting any of these black box VPN providers.

[1] - https://en.wikipedia.org/wiki/The_Market_for_Lemons

Much like a conflict of interest, appearance of mistrust is akin to mistrust. You are associating with groups that have demonstrated minimal trust and ethics and allowed abuse of their platform. Worse than that, you are passing you business, product, and any existing or future data to a mistrusted group. I won't be part of that transition.

You intentionally placed your product in the hands of this group knocking your own reputation down several pegs below competitors if not out of the picture entirely. Lip service won't win me back.

Speaking for myself, you have indeed failed me. Before I read your comment, I had now idea that PIA offered "verifiable transparency". I still do not know what you mean by that phrase and how I as a mere user can even begin to verify your transparency.

I did use PIA for the trust, I lost that trust and I will therefore stop using PIA.

The PIA clients are closed source, and can't be verified. (They also run as root....)

You can manually set up the VPN connection with the OpenVPN client, NetworkManager, etc etc

if you are really all about transparency then would you like to explain why someone from your company was caught red handed trying to smear other VPN providers?