Mozilla bundles its VPN and email relay services for $7 per month

All of this can be achieved through a person VPN rather than a commercial subscription one by ssh -D whateverPort user@ip_address and setting up a SOCKS proxy in Firefox on that same port.

>there are often posts which criticize the use of a VPN

Often they specifically critique the likes of NordVPN etc. The off the shelf solutions rather than personally setup VPNs. What disgusts me is that they charge fees that are multiples of what it costs to run a basic Linode or DO Droplet for a month and a virtual machine is far more useful than a commercial VPN.

The one and only thing a VPN does is that it switches your IP to another. It has absolutely nothing to do with privacy or security. An IP-address is just a single metric among hundreds that are used on the web to track users. IPs are also typically not equal to a user. It is common that an IP is a set of users and IPs often change when it comes to consumer ISPs. VPN makes sense in TCP-scenarios like Bittorrent but for web it is pretty much useless in itself.

My primary use case for a VPN is staying relatively secure while connected to wifi in a coffee shop. Maybe I am just basic though.

I have had this argument too many times. It is a combination of cargo-culting and a flawed understanding of basic security principles.

I use paid VPN services a lot as well as cloudflare warp. I understand and accept the risks the anti-vpn crowd keeps repeating. In the US, your local ISP and like you pointed out sites that sell and mine info about you are much higher risk of compromising your privacy or posing a security risk.

My traffic enters hostile network territory once it is delivered to my ISP router or the remote end of a VPN tunnel. Take NordVPN for example, I don't use them but it is more difficult but still possible for law enforcement or surveillance/ad companies to coerce or collude with Nord than with site owners and ISPs. TLS metadata including timestamp, SNI and other details along with my IP are known to Nord. To my ISP, they know my current location, usually social security number , birthday and whatever info their router can gather is known to them. Sites I visit without a VPN have my IP user-agent and whatever they collect with JS. A VPN removes the IP collection by sites and traffic sniffing by ISPs that can and do sell to whoever can pay them a fee.

VPN providers pause a significantly reduced risk than ISPs and they reduce risk from sites you visit. If you research a VPN provider and pick ones that have the most to lose by working against your interest, you reduce the risk even further.

Setting up a VPS and maintaining is a hard dealbreaker for me since I don't have the time and even if I did there is a shit-tom of more productive things I would rather do. But even if that is the case, which VPS provider should I trust more than a VPN provider? Digitalocean or cloud providers?

You know, few months ago I needed to setup a VPS fast, I must have tried 5+ including DO amd OVH. They needed to collect my email, some of them were picky about what card I used, others like DO wanted my phone to be valid, it was crazy! Only one weird vps provider let me but they didn't provision it after waiting a while. OVH wanted more info back and forth eventually after a few days supposedly they let me have a VPS but I no longer needed it after wasting money at so many places. Whether for anti-abuse reasons or anti-privacy VPS providers these days are hostile, they need too much info from you so how can you trust them with all your traffic?

Mullvad, PIA and Proton along with many others let you sign up with cash or giftcards and you can use a fake name/address. The only info they have TLS sni/metadata and your IP. They purposely get the least amount of identifying information from you.

I said cargo-culting because the people that oppose VPNs had some setup work for them and they think that and only that is ideal.

I see extremely talented security folk say that and similar cargo-culting on other subjects like how you shouldn't have an AV/EDR or just use only mac and Linux if you want to be secure lol.

If you compete with iCloud and Google you'll always be a niche player.

But I think if a brand name like Mozilla would offer a standards based "internet suite" (think: mail and notes over IMAP, file cloud over WebDAV, calendars and todo's over CalDAV, VPN over WireGuard etc. so basically your online stuff without the proprietary device-locked walled garden implementation) it could become at least a sustainable business for people who:

- Care about not being locked in

- Do not want the hassle of self hosting

- Feel less comfortable about using a non-brandname NextCloud provider

There are other options for that too, like paying for MDN[1].

1: https://developer.mozilla.org/en-US/plus#subscribe

True, though the mozilla client is their own, and seems to be somewhat customized, like using only wireguard.

Is that bad, or good?

My poorly informed understanding is that they are not interchangeable.

The Mozilla Foundation exists to support internet freedom. Firefox is a means to that end, but if they fired every Firefox developer and replaced them with a skin on top of Chrome that wouldn't be against Mozilla's goals.

Which means: if you want to support Mozilla you should sign up for this and some of that money will trickle down to Firefox. If you want to support Firefox then you should convince people to use it more.

Whatever the default search engine currently is, don't change it. Moz earns a kickback every time you use it.

It's probably still Google and I generally encourage people to get weaned off the Google product teat as much as possible, but that search engine integration is how Moz makes most of their money from what I understand.