This is a very brief blog blurb linking the original Tech Radar article that got fairly extensive discussion on HN a week and a half ago [0]. Potentially quite an important one though so a second go around may still be very justified for those who missed it last time. Amidst a lot of negative moves around the net recently it's nice to see some sanity at least once in awhile.
Perhaps people missed that, and would like to start a new discussion?
It didn't know there was a quota on discussions of any particular topic, perhaps we should give out tickets to the event in the future to ensure no-one misses their opportunity to join the discourse?
Yeah I'd hate for multiple comments re-hashing the exact same comments that people already made before, but sometimes there's value in it...I'm sure you'd agree?
If I were a governmental body I would do everything I could to keep citizens using paid VPN's and big CDN's. Money trails are easy to follow and the majority of people are just paying with their bank. It makes people feel safe and more likely to expose certain behaviors. Paid VPN's can say they do not have logs whilst having real time lawful intercept API's. A handful of VPN providers become a one stop shop to get the data of what used to be hundreds or thousands of ISP's all over the world in many jurisdictions just as a few big DNS over HTTPS providers become a one stop shop to get the DNS of what used to be hundreds or thousands of ISP's all over the world in many jurisdictions.
Ban VPN's and people will fall back to the myriad of open source alternatives that can be a bit harder to peel back and get logs assuming any exist in the first place. This was a thing some time ago. Many of the malware and pirate groups were sharing Tinc meshes though as expected there would at times be one person in the group that would be the weakest link and expose the entire group. Expand the numbers of people doing this and the probability of a few groups using decent operational security will increase. This probably deserves it's own write-up.
Add to that that half of these companies are registered in obscure offshore locations where it is practically impossible to even find out who are the ultimate owners.
No need to roll your own. There are many open source VPN's, proxies and much more. When dozens, hundreds or thousands of people share and forward load balance their traffic across hundreds of self hosted networks it gets a lot harder to perform attestation and attribution. The reason to cycle through many VPN/proxy networks would be the assumption that a percentage of them are vigilante owned and operated.
That's the easy part. The harder part is to encourage people to be fearless, keep their mouth shut and let their lawyers do all the talking.
Interesting theory. My own theory is that the big corporations want to siphon off more data from people. That is, I think, the main agenda. See android recently stating that everyone has to give up their age. Next step will be ID (though probably, in order to verify the age, one has to give up the ID anyway, so age sniffing could be called ID sniffing).
For what it's worth, two or more things can be true or even partially true. I think all options should be on the table to discuss potential mitigations. Incentives and incentive driven laws can be difficult to prove out. Probably best to just find mitigating options and controls.
This looks like a very narrow ruling regarding copyright. It doesn't guarantee that EU bureaucrats won't try to ban VPNs that don't verify user age (for starters to make NPCs support the bans, then they will inevitably attempt to enforce some kind of KYC or logging to "catch terrorists and pedos".)
In fact this makes it more likely. Now that a court has ruled that current copyright law does not make a VPN provider liable, the European Council (all heads of state of European countries) will propose a law that makes VPN providers liable for copyright-infringing traffic
In particular for "hot" topics like this people should use the search function at the bottom of every HN page before rushing into post.
The last thing everyone needs is yet another duplicate post with hundreds of comments re-hashing the exact same comments that people already made before. It is not helpful for anyone.
Primary use I have for it is hosting internal services that I don't want on the public internet - do the same at work, it reduces the attack surface hugely
That is the exact thing , I asked that because its primary a personal choice, and I support EU regulator decision on it, If you need VPN for usage like keeping your personal information intact its perfect but if someone else is using for other purpose then again it should personal choice rather than government regulation ( this might not sound good to some).
I know what you mean, but I think most people are not thinking of it in this way. They are thinking of VPN as a service provided by companies such as Nord VPN, and mostly used to get around region locked content or keep your ISP from being aware you are downloading things you shouldn't be.
Answers are there ! that was the whole point of my question, using or not using should be Personal choice not government Ban , everything on internet has pros and cons.
My ISP Comcast (rebranded to Xfinity to avoid all the negative associations with it's actual name) does man in the middle attacks on HTTP connections and injects javascript code into webpages. I actually had this happen to the steam browser back in ~2013 and I had to restart it. But they still do it today in 2026. I don't use a commercial VPN because I host from home. But I do tunnel my HTTP browsing to a remote VPS I rent.
I just loaded up Bluesky this morning to discover it demanding proof of my age bc I live in Texas. First thing I did was turn on my out-of-state vpn and try again. not today, satan!
Instead of an out-of-state vpn, why not an out-of-state home? Why do people put up with the lack of freedom there? People complain about European countries but then praise states like Texas.
(Realistically, moving is easier said than done, of course.)
VPNs are just tools that sketchy people use for sketchy means. There's no legitimate use for someone who isn't trying to break the law. Allowing these tools let's underage people access porn, and do all manner of undesirable behaviors like accessing region locked content.
I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites.
There are of course some people on the other side who think VPNs are a guarantee of privacy and secrecy on the internet, but that's pretty rare in my anecdatal experience. I largely blame the rampant ads on podcasts for this view.
Probably should have put a `>` before the first paragraph, because it reads like an 8/8 bait and most people won't continue to the next one.
Regarding the misleading podcast claims, at least all the podcast and youtube ads made the VPNs popular on the mass market so now they are more difficult to be silently outlawed.
I think an issue VPNs face is that while your first paragraph is not objectively true, it ends up being truer than I might like because the other use cases are not well covered. If you've got one of the things the HN gestalt would call a non-sketchy use case, you've also got the problem that it's rather hard to verify that any VPN you are using actually fulfills your goals. They can say they do, but you have a very hard time proving it.
On my current fiber provider, I'm already behind a very large CGNAT install. To a large degree, de facto that's already a lot of the "non-sketchy" use cases for VPN covered for me. IP addresses are already one of the weaker signals for tracking people as it is. Mobile networks have been letting you shift IPs for years just by how they work. Other internet providers that don't slap thousands of people at a crack behind one IPv4 with CGNAT didn't necessarily guarantee stable IP addresses, hence the need for dynamic DNS for decades.
The hole VPNs plug is necessary, but not even remotely sufficient if you are trying to actually protect yourself from some attack. Slapping a default Windows 11 install on a VPN to a first approximation protects you from nothing.
And since the "non-sketchy" uses are rather dubious, that really does sort of leave just the sketchy ones. I don't think it's a coincidence that when they pay a YouTuber to advertise them, the YouTuber generally ends up talking vaguely about the protections but fairly concretely about the sketchy uses, with screen shots showing them using Netflix in a different country. The companies know what they're getting used for and what they can provide.
Or saying that his view is also shared by people he considers intelligent, and thus can only be rejected by others, who first need to proof to him, that they are actually intelligent. Aka. an indirect ad hominem.
If the poster agreed with the opinion, they wouldn’t have included “actually” (indicating that they think the reader will be feeling incredulous at that point) and “otherwise intelligent.”
Yes correct, I vehemently disagree with people who say things like the first paragraph. I definitely should have been more clear that that was not my opinion, but it's too late to edit now
VPN is what a smart person uses when they are at an internet cafe or somewhere else with public internet where you can’t trust that the traffic isn’t sniffed by someone for giggles and your bank credentials are going to leak.
Let’s say a hacker hooks up the hotel internet to a firewalla and opens a free wifi spot. You log in and it sees from your traffic that you’re a customer of ABC bank and Gmail and ATT from the traffic - next thing you know you get a text message from your “bank” that someone has stolen your credentials in “XYZ Arizona” and you have yourself a phishing attack. The exposure scenarios are only limited by the imagination of humans and modern LLMs.
This doesn't seem novel in any way, given the amount of data available online you can already be targeted by fake bank texts, no need for the free wifi hotspot.
I just use my home router as VPN to not care if the 100 apps om my phone have a working encryption. I also use it to access my home services so that they are not exposed to the internet. I also use it to limit exposure on my VMs on a cloud hoster.
Not only that, but the iOS and Android APIs for HTTP requests make it really difficult to accidentally use unencrypted HTTP:
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
Redundancy is not detrimental to security and privacy. On the contrary, having more layers would protect you in case one of them fails (zero-day, bugs, etc.)
If there's a zero-day in TLS there would be a huge amount of problems that a VPN wouldn't protect you against. Even if you're using a VPN (or just a trusted ISP from your home), as soon as your data leaves their hands it would be vulnerable.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
I’d expect the mail carrier who goes from the mail center to the bank to be slightly more trustworthy than the one who visits me off in the middle of nowhere. Or at least, if that carrier is untrustworthy, it is a big problem for a lot of rich people who have the time and money to think about this sort of stuff.
Meta: your first paragraph could really use a quotation indicator / mark. I suspect it was intentional: the ragebait was very effective on me before reading the rest of your comment (I was ready for defend my usage of tailscale to access my iot stuff).
I want to applaud your choice to not include anything like quotes here. That would be misleading because it isn’t an actual literal quote. And, we’re too used to just skimming posts here before jumping right in to argue against them.
>I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites
This is an illusion we really need to remove from our collective consciousness. Running a popular website while being an ops genius, being a neurosurgeon who saves lives every day or being the world's best architect doesn't mean someone has sound opinions on topics right outside their area of expertise.
In fact, nowadays it seems to be all about appeals to authority which IMHO makes us more ignorant because many people seem to not think critically anymore. Instead, it's just "an expert said so" - then you look into the "expert" and in many cases they either aren't actually an expert or they're a paid shill. But that's a topic for some other day.
I wanted to respond with something of substance (I still don't understand if it was a paraphrase or not) but every reply here is a meta reply, so hello to all fellow meta reply guys.
Maybe put some quotes around that first paragraph. Seems like some people downvote you before they get to the part where you reveal you don't think that way
His whole comment contains a view, that some people, including elected officials hold. I don't see an aspect, that actually hints, that he means that in a sarcastic way(, besides that he is on HN).
Hurray and good. A technology shouldn’t be treated as unlawful simply because it can be used to bypass restrictions. Restrictions which are stupid in the first place in the majority.
I hope VPNs are not becoming the next battleground between online safety and civil liberties. I'm sick of the current ongoing attacks on civil liberties in the Western World under the fake veil of online safety.
You can't do much with VPNs these days, almost any website now has antibot systems and it's actually kid's play to detect whether you are on VPN or not.
Jup, if you are using any mainstream VPN provider (the ones shilled on every tech YouTube channel) or anything that results in a datacenter IP, it is trivial to discover and block.
There is a big discrepancy here. EU courts babble about lawful xyz. While they are doing so, national legislation goes downhill, e. g. mandatory age sniffing and other restrictions to come (I claim the age sniffing will come on the OS level, Google recently announced Android will do so, so you can already see the corporate agenda being pushed into democracies here). So I consider the EU courts to just act as decoy, aka "look how everything is legal". Well, a few years later, VPN will be banned. And the EU courts will be in agreement with that.
Are you implying the EU court is (secretly) cooperating with national legislative bodies to implement surveillance tools while pretending to uphold civil liberties?
Why is something like ublock origin not enough for your needs? Is it more about the principle of not wanting to share any fingerprint across the Internet, or some specific tracking concern?
----
0: https://news.ycombinator.com/item?id=48997221
Whatever you're thinking of posting has almost certainly already been said more than once on the original HN discussion.
It didn't know there was a quota on discussions of any particular topic, perhaps we should give out tickets to the event in the future to ensure no-one misses their opportunity to join the discourse?
It’s in the FAQ: https://news.ycombinator.com/newsfaq.html#reposts
“Are reposts ok?
If a story has not had significant attention in the last year or so, a small number of reposts is ok. Otherwise we bury reposts as duplicates.”
Alternately, here are comments by moderator dang that mention reposting: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
I had one such post that deserved comments but didn't get any, then someone reposted it and dang put the original back into the pool.
https://news.ycombinator.com/item?id=49109440#49109857
Is it even preferable to necro an 8-day old topic? New developments are going to lead to new talking points, right?
Ban VPN's and people will fall back to the myriad of open source alternatives that can be a bit harder to peel back and get logs assuming any exist in the first place. This was a thing some time ago. Many of the malware and pirate groups were sharing Tinc meshes though as expected there would at times be one person in the group that would be the weakest link and expose the entire group. Expand the numbers of people doing this and the probability of a few groups using decent operational security will increase. This probably deserves it's own write-up.
maybe mullvad is legit but their leadership keeps leaning to dubious causes
That's the easy part. The harder part is to encourage people to be fearless, keep their mouth shut and let their lawyers do all the talking.
It’s to hide along the journey there.
In particular for "hot" topics like this people should use the search function at the bottom of every HN page before rushing into post.
The last thing everyone needs is yet another duplicate post with hundreds of comments re-hashing the exact same comments that people already made before. It is not helpful for anyone.
https://news.ycombinator.com/reply?id=49109868
It was widely covered (like at https://www.express.co.uk/news/uk/2217934/vpn-ban-table-july...) and tech sec. Liz Kendall is on the record with BBC talking about July.
You must be blessed to live in a country that has no website blocks.
Bypass censorship
Get treated the same by websites when traveling
Avoid bad laws
Gain good laws
(Realistically, moving is easier said than done, of course.)
European countries have restrictions on freedom of speech which is a strongly held value in America.
I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites.
There are of course some people on the other side who think VPNs are a guarantee of privacy and secrecy on the internet, but that's pretty rare in my anecdatal experience. I largely blame the rampant ads on podcasts for this view.
Regarding the misleading podcast claims, at least all the podcast and youtube ads made the VPNs popular on the mass market so now they are more difficult to be silently outlawed.
Your comment was even dead for a while, before I (and others?) vouched for it.
On my current fiber provider, I'm already behind a very large CGNAT install. To a large degree, de facto that's already a lot of the "non-sketchy" use cases for VPN covered for me. IP addresses are already one of the weaker signals for tracking people as it is. Mobile networks have been letting you shift IPs for years just by how they work. Other internet providers that don't slap thousands of people at a crack behind one IPv4 with CGNAT didn't necessarily guarantee stable IP addresses, hence the need for dynamic DNS for decades.
The hole VPNs plug is necessary, but not even remotely sufficient if you are trying to actually protect yourself from some attack. Slapping a default Windows 11 install on a VPN to a first approximation protects you from nothing.
And since the "non-sketchy" uses are rather dubious, that really does sort of leave just the sketchy ones. I don't think it's a coincidence that when they pay a YouTuber to advertise them, the YouTuber generally ends up talking vaguely about the protections but fairly concretely about the sketchy uses, with screen shots showing them using Netflix in a different country. The companies know what they're getting used for and what they can provide.
It's only because of your comment that I re-read the their post.
Meaning the poster finds it surprising that intelligent site operators would honestly think that.
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
This is an illusion we really need to remove from our collective consciousness. Running a popular website while being an ops genius, being a neurosurgeon who saves lives every day or being the world's best architect doesn't mean someone has sound opinions on topics right outside their area of expertise.
In fact, nowadays it seems to be all about appeals to authority which IMHO makes us more ignorant because many people seem to not think critically anymore. Instead, it's just "an expert said so" - then you look into the "expert" and in many cases they either aren't actually an expert or they're a paid shill. But that's a topic for some other day.
You can't imagine how much crime I committed in my teenage years. You don't wanna end up like me, punks! Stay off that crap!
I'm not trying to break the law, I use it for my corporate usage, therefore it is legitimate use.
What are you trying to say?
Pretty sure they meant “second paragraph” instead of “second sentence”.
Edit: missed the second paragraph
I hope VPNs are not becoming the next battleground between online safety and civil liberties. I'm sick of the current ongoing attacks on civil liberties in the Western World under the fake veil of online safety.
The detection tech has been around forever: https://focsec.com/
[dupe] Discussion on source: https://news.ycombinator.com/item?id=48997221
It's a step-by-step strategy.
https://www.independent.co.uk/extras/indybest/gadgets-tech/v...
Use Brave search instead, Google search has terrible a privacy policy.