Hacker News Reader

Comment by deknos | Hacker News Reader

they should at least opensource their implementation. they may have errors there. should we just trust everything?

Why the entitled attitude? They do a lot of open source contributions already so maybe just give them some time instead of immediately disregarding the whole improvement? Small steps into the right direction.

https://mullvad.net/en/help/open-source

Making a suggestion isn't entitlement. Maybe reconsider the foul void that accusation came from.

If someone suggests something to me they usually don't say "you should at least". This sounded more like an entitled comment you see every day on open source repositories and making it sometimes not fun to be an open source maintainer.

They are just using wireguard.

You can connect with wireguard and not run any mullvad software on the client side.

Though that's generally the case with VPN providers, whether openvpn, wireguard, etc.

I guess they could introduce some vulnerability on the server side if they rolled their own wireguard implementation or patched it. Though it seems unlikely to me.

https://mullvad.net/en/help/easy-wireguard-mullvad-setup-lin...

Pretty sure they have been audited recently.

Indeed: https://mullvad.net/en/blog/tag/system-transparency

If I were a Mullvad customer this is what I would want: regular audits and closed source until everyone was convinced the code was bulletproof.

Their infrastructure kind of is their USP. It'd be like giving their competition their work for free. And it's not about absolute trust, it's about trusting them more than your ISP and other VPN providers. You still have TLS over Mullvad

I'd argue that Mullvad's USP/moat is their reputation, far more than the software they run.

They have open sourced a good deal of the infrastructure:

https://github.com/mullvad/system-transparency

Reply on news.ycombinator.com