benedikt

> it's a cat and mouse game now between content providers and VPN providers

It's not the content providers but the movie studios, music labels and rights holders and so forth. Netflix doesn't really care about users circumventing geo restrictions, otherwise it wouldn't be so easy

For Europe, there's the Hetzner server auction in Germany.

Let's do this

Jerry Seinfeld on comediansincarsgettingcoffee.com

Is there an European equivalent of MicroConf?

So what?

I founded (and still run) a VPN provider, Lokun.is. Just as this paper mentions, most of the providers make very bold claims. I've tried to avoid that, but entering this space without promising (seemingly) nonsensical things means that you won't gather much traction.

And I'm OK with that. I will rather build good tech and be honest with my users, rather than giving them a false sense of security. As I mentioned in another HN comment the other day[0], I have mostly been operating in a niche market in Iceland, circumventing dual pricing for bandwidth on home connections.

VPNs are good for some things, but they are not tools made to give you absolute privacy as some claim. I've been running Tor exit nodes and tried to be as clear as I can about what a VPN is and what it is not.

I have also tried to keep most of my code on GitHub[1] with AGPL as license, and I'm not aware of any other provider that does this. Of course, it won't help with the issues outlined in this paper and I probably should have published server configs as well. But this project is nearing it's end for me, so it's probably too late for that. Although I'm not opposed to cleaning up that repository and publishing on GitHub.

Since starting this project I have watched about a dozen VPN providers start up, make ridiculous claims (this paper mentions some VPN providers claiming to provide better privacy protections than Tor) and often disappear just as quickly as they appeared. This market boomed after Snowden and a lot of the providers will not shy away from outright lying to their customers. I'd like to give them the benefit of the doubt because maybe they don't fully understand themselves what a VPN is. But thats even worse.

This entire market is weird. A recent example that comes to mind is a certain VPN provider posted on reddit[2] claiming that even themselves cannot see the IP address of their clients. The reddit thread was deleted shortly after I responded, but the claim remains on their blog.

Of course not all providers do this. I have on purpose not been naming the providers I have been talking about. As always, be careful about who you trust and what you trust them with.

I have shared this paper in the capacity of Lokun.

[0]: https://news.ycombinator.com/item?id=9791770

[1]: https://github.com/benediktkr/lokun-record

[2]: https://www.reddit.com/r/VPN/comments/3aecvi/how_we_keep_you...

I'm just curious how others have their setup. :)

Do you have a smartphone connected to this setup? Do uyou use a password over SSL to authenticate your email clients?

How do you authenticate your mail clients with your SMTP server? Do you use the same SMTP server for incoming and outgoing mail?

Indeed. But there are also dual pricing schemes in datacenters. They don't want you to peer with RIX (Eeykjavík Internet Exchange) and charge those who do a higher price (hence forcing one hosting provider to change their routing.

Usually, home users would by a fiber/dsl connection which includes an unlimited amount of domestic bandwidth and a set amount of "international bandwidth", typically from 10GB to 2000GB. When exceeding this quota, users would typically be billed somewhere around $15 for each 10GB increment they went over the quota.

The size (measured in GB) of the international bandwidth "addon" determined the price of the connection far more than the speed of it.

By hosting my servers in Iceland, the traffic through the VPN would not count towards the "international bandwidth" of my users. And since I was hosting in datacenters, I would be paying less for the bandwidth than at a typical home connection.

I also used OpenVPN. We started out by making a wrapper over the OpenVPN client on windows. Hindsight being 20/20, I would recommend for someone starting out with building a VPN provider to start on focusing on building a great infrastructure and not worrying about having your own client applications from the start. Stand on the shoulders of giants, the OpenVPN client(s) are great.

We didn't realize this but in creating this application we sort of inherited all usability problems from OpenVPN, without inheriting their solutions and known workarounds.

Iceland is not free from censorship (and is far from the freedom of speech haven people seem to think it is).

The largest ISPs in Iceland were forced to block access to The Pirate Bay and Deildu.net (icelandic torrent site). These blocks were of course hugely ineffective and at most an annoyance.

Hi there,

I did the same. I founded a VPN provider[0] in my free time. It is still running, but I have at times been close to shutting it down.

Most of my code has been open the whole time and is on github[1]. Some internal tools and the website are not on github though. I went with AGPL for license. It'll make my day if someone forks my code and founds their own provider.

I operate out of Iceland and most of my clients are Icelandic. The biggest use case for my service was ISPs in Iceland charging extra for international bandwidth. By having my servers in Icelandic datacenters, I was able to provide my customers with significantly lower prices for bandwidth, thereby lowering the cost of internet for a lot of people. Considering the huge time investment that has gone into this side project, I have not made much money from it. But knowing that I helped my internet usage more affordable is something that has made this project meaningful for me.

Since I started, lots of things have changed. Some ISPs are now offering unmetered connections (this was unheard of before). Others have lowered their prices. I have heard people attributing part of these changes to me and my company.

I have not experienced DDoS attacks like you, but I have been the subject of meetings at some regulatory boards in Iceland, as well as at the monopoly behind the submarine cables[2] connecting Iceland to the world (the source of this dual-pricing schemes). One hosting provider was forced to change their core routing shortly after I starting hosting with them, to make me unable to host there. Other providers have come under preassure from this monopoly to kick me out. Like you said, you feel like your service was real -- someone with a vested interest against it was watching me.

Some time in the near future I will shut down the service. It's just time to move on to other projects and time to recognize that it's fulfilled it's usefulness. I know I will walk away from this project with a great sense of accomplishment, I am proud and happy with the work I did.

[0]: www.lokun.is

[1]: https://www.github.com/benediktkr/lokun-record

[2]: https://en.wikipedia.org/wiki/FARICE-1

Why be OK with bad crypto?

Is it supposed to run alongside uBlock Origin or is it indended as a replacement?

What about Disconnect or Lightbeam? (as alternatives to Ghostery)

Tor also has a clever thing called "pluggable transport" that was made to solve exactly this problem.

Not only that, but Excel is the worlds most popular functional programming language.

I saw your talk at FOSDEM this year and Mandos was one of the biggest take-aways this year for me.

Did the email you got contain the same "investment address"?

www.greenqloud.com in Iceland

What about the VPS provider being coerced into logging network traffic to the VPS? Then incoming un-encrypted mail is compromised..

Seems like you have a similar use-case as me. How do you deal with sent messages between the POP client and the IMAP clients? How and where do you store the authorative copies of the sent mail?

What logs were this?

How are you planning on proving that no records are kept? I'm currently engaged in a project that takes privacy very seriously and that also makes that very promise (amongst others). I would be very interested in hearing about your approach.

Kernel panic on Ubuntu 12.04

* Linux bk-ak 3.2.0-40-generic #64-Ubuntu SMP Mon Mar 25 21:22:10 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

This is just faulty logic.

openssh is one of the most secure projects. It's developed by the security obsessed (and I mean it in a kind way) folks at OpenBSD.

I, for one, am ready to place for more trust in openssh than in any VPN daemon. The most commonly used ones are propitiatory.

What if there is a 0-day vuln (not exploit) for these VPN daemons? That far more likely. "Securing" ssh with a VPN is just one step beyond of security by obscurity.

If you are afraid of script-kiddies and scanners, let your sshd listen on a non-standard port.

> The VM was rebooted on Jan 7, apparently in an attempt to get things working again.

Who rebooted the VM? If it was the attackers, this implies that they had root. But the post only states that they could execute code as the moin user.