iVPN dual jurisdiction?

[ignoramous]

@jonah

I am not sure this really matters outside of just being more precise on our site

The dual-jurisdiction would matter in terms of iVPN’s Gibraltar as the only legal seat claim. PG discourages jurisdiction shopping, but it does demand a transparent ownership structure for this particular category. Also, it comes to down to just how much such marketing claims must be put under scrutiny.

imo, as a community-driven project, PG would do well to hold its recommended products to a higher bar in some of the categories, if not all. Especially since PG is usually hesitant in replacing existing recommendations.

May be that discussion needs its own thread.

@jonah

our community is not obligated to support every new privacy startup just because they look promising. I’d rather focus on products are going to be useful for a large number of people, and a big part of that is longevity. Maybe I’m off base with this desire and people do want us to shine a spotlight on all the newcomers to the space with our recommendations, but I don’t think so.

And I keep going back to what @epoberezkin suggested about “privacy impact assessments”, too:

@epoberezkin

Coincidentally, I am currently working on the proposal about what I believe are really important criteria for assessing the communication products (I am aware of course that your scope is wider than that, but this is the space I am interested in) from the perspective of their positive or negative impact on the privacy and security of the users, including technical parameters, operations and distribution parameters, licensing, governance, funding and sustainability. All these things need to be carefully assessed for the correct evaluation of both the current status quo of the project and also its future potential to improve and risks to become worse, and then such assessment has to be repeated annually, or at least after 2 years, similarly how security assessments are reasonably expected every 2 years.

We could call it “Privacy impact assessment” - that would result not just in a decision to recommend or not, with a one-paragraph summary, but in a long-form document, similar to “Technology security assessment” - both should be based on a holistic multi-faceted framework, and not just on formal criteria. I think in the same way projects are funding their “security assessments”, they would fund “privacy impact assessments”, if the criteria are understood and agreed in advance.