I don’t know about others, but when a company pushes its engineers to do things they wouldn’t (or shouldn’t) because of concern for “meeting revenue goals”, the company has either lost the plot or has been lying about the plot…
10 Likes
Board needs to step in. He & the CTO are in AI psychosis.
“The CEO is in full AI psychosis and has been for a while now,” one of the sources told 404 Media.
Edit 1:
- Is anybody able to confirm that he mentions he want’s to move the company to the US or China?
- Complaining about employees prioritizing safety is exactly how Boeing blew all it’s trust.
- The only sentence in the whole article helping me calm down (I’m still furious): “One employee stressed that engineers still strive to build in a secure way.”
- CTO AI manifesto:
11 Likes
I’ve had my frustrations with some of the products over the years, but this is the first time I’m considering switching. My two-year business plan renews in January; I’ve been a subscriber for nearly 6 years. I was actually considering a more expensive plan.
Between now and then I’ll be looking into alternatives. Hopefully things change at Proton in that timeframe, but I don’t expect them to.
7 Likes
I interpret this as a company pushing the boundaries, just like we did in Software Programming when RAD (rapid application development) and Agile were the push - to name a few (versus the slow structured development practices of the past)
Yes, the fear of crap code, privacy and security risks are always present but I think this is just pushing the boundaries vs any type of overt corruption. (please do correct me where I am wrong)
Currently, proton’s AI Lumo, appears to allow us to use it in “Ghost mode” and not keep track of a persons searches. (is this just privacy by policy again?)
3 Likes
In the last few months, Yen set up an email address for employees to contact if they come across anything blocking adoption of AI at Proton, so leadership can “ruthlessly smash everything that stands in the way of AI velocity;” Proton installed software on workers’ computers that track how much AI code the company is generating; and Yen said this is the last year that Proton will hire engineers at all, and instead only hire people to build things with AI.
→ What the FUCK … Proton a company dedicated to privacy … surveils their employees. I have two subscriptions on Proton (Proton Mail and SimpleLogin.io which also includes Proton Pass) and after this line alone I just want to cancel this shit.
Workers describe an environment where employees have genuine concerns about security or being asked to develop security products with AI, but feel unable to voice them
→ yeah … thats called a toxic work relation and my status to this is if a company is like that I submit my resignation from the position. I’m aware that many people do not have the
opportunity to do so, however this sounds like security engineers who should have not a huge problem finding a new job. If they look more to SMB/SME.
, lest Yen berates them in front of everyone or threatens their employment at the company.
→ Not sure what “berates” in this context means? Like insulting them or correcting them? As far as I read the definition of it, it can mean both?
Initially, using AI was banned inside Proton, but the company has since approved AI for all sorts of use cases internally, including processing financial data, drafting customer-facing responses on Reddit and LinkedIn, and writing code “except when that source code contains information that would give immediate advantage to a competitor
→ ohh … yeah … security is definitely not important … but company secrets are …
Much of that code is written with Anthropic’s Claude, multiple employees told 404 Media. And Yen tells employees in Slack chats to use Claude, too.
→ Is this a god-damn joke???
I work in a place where we use LLMs a lot for different tasks, however we are capable of hosting our own LLM model (qwen:125B) on our own hardware on our own mini-datacenter (we have one mini-datacenter inside the office building and one rented datacenter, the LLM parts are inside the mini office datacenter), but Proton … a company with more than 100x bigger capital and cash flow is not capable of doing so. …
Yes, QWEN is not as good as Opus5.5, however in 85%, if you use your brain and are a professional in the field, you do not need the full power of Opus5.5, except if you are just a shitty vibe coder …
12 Likes
The issues is with that, people with good faith still wrote the code.
- An LLM is not a human and has its limits, like for example accounting. Everything that is related with accounting and general ledger entries … here LLMs are still not good.
- If an attacker would try to compromise the code base of Proton it is far more difficult to do this with a human than an LLM. For now a government just needed to get Antrophic to plant spyware or backdoor in the code, and I’m sure no one would notice it.
I work with LLMs personally and professionally a lot and if you come into this “vibe codding” mode you are unable to monitor, check, verify or test the code. In addition, you can get into this pretty fast. For example if I actively work with an LLM on my code, I can do this for about 10 minutes, than I must stop. Otherwise, I start drifting away from quality code and get into this vibe coding shit. And I know from a lot of coworker that they have the same issue. - I tried using LLMs on bigger code project (20.000+ lines) and most of this went pretty shitty after some time. The LLM started creating modules, functions, classes etc.–that already were in the code base and could be reused–again. I suspect that the code base, thinking and prompting was too big and the LLM ran out of the context windows which let it forget about some parts of the code.
Side note: The context windows of the LLM I used was about 256K - There is a difference between vibe coding and using LLMs in programming. LLMs can be used to help and fasten up projects (write a .rtf → .md converted … LoL)
4 Likes
Cool article, 404 are good at their job.
The main issue is that it plays to a rage-bait audience while not making the story clear enough. They frame it as pro-AI management vs anti-AI staff, and a lot of readers love that picture.
But from the quotes and the manifesto it’s clear the story is different. The quotes say 90% of the code in Proton is already AI-generated, and the manifesto says everyone in the company already uses AI. The conflict is about speed and different views on how exactly AI should be used to perform better.
Well, show me a company where these discussions aren’t happening these days. And show me a company where managers don’t demand running faster while staff tries to keep a comfortable pace. From this perspective, I’m not even sure there’s a topic to discuss.
5 Likes
I don’t know the medium as well as you, it seems. So I will assume that this 404media article is as whole a hyperbole, with exceptions of the quotes.
But from the quotes and the manifesto it’s clear the story is different. The quotes say 90% of the code in Proton is already AI-generated, and the manifesto says everyone in the company already uses AI. The conflict is about speed and different views on how exactly AI should be used to perform better.
I would disagree here. There are three things I see as well as the point you wrote.
- The communication between the people. I’m working myself, and I know conflicts can happen and the word bullshit can be hurting or is okay to say depending on which context. However, to say in front of all other people someone is a looser, that is something that crosses a line, regardless of the context. Especially if we have a power dynamic in play (CEO vs. employee).
- The priority. The messages have the underlying tone, that security is not the priority right now. Which is, for a company who claims to protect the one who need protection, a no-go.
- Surveillance. I know a company has compliances to full-fill, has profits to make and needs security. I do not expect to have privacy on the working device as on my private phone. However, this is something that, for me, crosses the line between needed surveillance and “evil”¹ surveillance. And if the company I work in, would do that, I would seriously consider leaving.
1: evil is not the fitting word, however I don’t find a better word right now.
3 Likes
Show me a company that openly rejects the advice of their security engineer.
Edit: I’m aware there’s an Equifax joke to be made here.
3 Likes
I kind of agree, but… this part was hard to read, because I felt like I’d been in the same conversation with managers a few times. It wasn’t about AI, but the attitude was similar: I tried to make something we’d be proud of, while management wanted an MVP ASAP. Can’t say I was always right in those conversations. It’s very hard for both sides to handle such a conversation well, because the conflict touches our essential motives, like really tough.
The messages have the underlying tone, that security is not the priority right now
That’s interesting, because I don’t actually get from the text how this works in Proton. Most of the quotes look like managers trying to avoid this choice, like saying that choosing between security and speed is a false choice: use the fkn tokens so you don’t have to make this choice. Which is generally a nice attitude, and finding a way to avoid hard choices is a common engineer’s job.
At the same time, there’s an employee saying that “security is low in our prioritization.” Obviously I can’t argue with them about priorities inside Proton. I probably also don’t think security is their main priority, but I’m not sure that’s a new thing. Email encryption was never a good or secure idea, and “the truth doesn’t matter if you don’t win on perception” is probably deep in Proton’s DNA.
However, this is something that, for me, crosses the line between needed surveillance and “evil”¹ surveillance.
Yeah, I remember the exact same thing happening with Meta devs. I don’t know how they’re going to comment on this. Probably “We’re here to preserve democracy, not practice it” will work.
1 Like
Just another comment concerning Corporate Management people (yes, it does come down to an individual and their personality).
Had an Executive make a decision to move people back to physical desks. We tried to explain that the company had sold many buildings to save money and there weren’t enough physical spaces. The response was “You are either with me or against me” and the implication was that we would be fired for resistance. (I simply told folks to pick a desk on a map, but not to move yet).
Fast forward to the entire activity imploding because of lack of building and desks.
This Exec then turned and blames all of us saying, “You are fault for this because it is your responsibility to inform me if the plan is wrong.”.
I couldn’t help but laugh and be puzzled by such a flip/flop to cover for such arrogance.
Security engineers exist to reject their choices. If we alway could just do what security engineer says, we would call them CEO and not security engineer.
1 Like
That’s certainly true. But the fire marshal doesn’t own the building. I just hope that when the building goes up in flames, the fingers are pointed at the right person when it’s time to explain the inferno to the insurance company.
1 Like
Proton installed software on workers’ computers that track how much AI code the company is generating; and Yen said this is the last year that Proton will hire engineers at all, and instead only hire people to build things with AI.
???
That’s bullshit and loser thinking
So maybe you can enlighten me on which of the two shitty choices we will take
In the future there are two options. Either you guys are confident enough to not fuck this up, or you get my advice to make sure it is not fucked up
If all of these quotes are what Andy truly said, I unfortunately misjudged him. Not that I assume I could accurately judge anyone I didn’t know personally… but still. I would not want him as my boss, that’s for sure.
Anyone who interviews Andy Yen from here on out ought to confront him on his behavior here. No one should be talking like that to a coworker.
All of this is really re-contextualizing Proton’s “re-interviewing”…
5 Likes
I agree that they are hard to manage, I agree that it can get loud, I agree that some word might have gotten thrown.
For example “bullshit” is a word that might slip pretty easily. Mostly it does not attack the person, instead it attacks something that the person made. It can still hurt people, but it isn’t directed on the person. The same goes for the words “crap” or “dogshit”.
But there are other words that attack the person, such example would be “looser”.
And if a manager, ceo or any person in a leading position can not manage, to have a respectful tone with someone, than this person should not be in the position.
“I think by the end of this year most developers stop programming and start writing specs for tests that AI will code and run, to validate AI written code that humans will no longer be able to review. This will be the last year that we hire engineers, and starting next year we hire what we used to call product managers, to build things with AI.”
That’s the quote I’m referring to. There is a difference between vibe coding and programming with LLMs. LLMs can be helpful, but only if you know how it works.
I see the difference already between people who are in the software engineering position for multiple years and are using LLMs and people who just use LLMs. The quality of it is far superior.
And a “product manager” is not an engineer it is someone that says what should be done and not how. Especially the “how” can be pretty critical for security decisions, because an LLM does not use always the best option.
A person who does not understand how things work can not esses if an LLM did things correctly. They are still pretty good in hiding mistakes.
All they have to do is be a boring company that does emails without harvesting data and with some cool features like proton-2-proton encryption or a way for you to password protect the c content.
Sure, Password Manager and Cloud Storage is nice too, and maybe even the VPN occasionally. They can do no further development and I’d still be paying $200 every 2 years for the same boring services, but memos like this make me want to decommission the ‘ecosystem’ and move to something else.
4 Likes
It is 100% possible to get your message of importance and need across without resorting to ad hominem attacks, character assassination and general assholery. Were your conversations peppered with the boss implying that you were stupid or that you may not belong at that company if you didn’t agree with them?
I’ve worked for both kinds of bosses and I can assure you that that honey draws more flies than vinegar.
2 Likes
That’s what I respond to Lumo with anytime it gives me its output.
But it’s unprofessional conduct. Publicly belittling employees has legitimate concerns about leadership. When multiple employees describe a workplace where they’re afraid to challenge management, that gives the allegations more power I feel than the Slack messages.
I think it’s normal to be intimidated by your boss, but when you’re bringing up concerns, you shouldn’t be walking on eggshells. You especially shouldn’t be insulted for it.
2 Likes
“So go on there with your personal account and comment to set the record straight,” he wrote. “Perception is more important than truth, the truth doesn’t matter if you don’t win on perception.”
Given how much Andy allegedly prioritizes perception, he must be aware of this forum, no? I wonder if that is why Proton created the @Proton_Team account. I wonder if he’s reading these recent threads.
2 Likes
However, to say in front of all other people someone is a looser
To be fair, they didn’t call people losers. They called the attitude, the way of thinking, loser. I understand that’s not an excuse and it can still hurt someone, but at least it’s aligned with the main message: we can’t move to the USA, we can’t fire everyone, so we’ll try to change us. If I were an employee at Proton, that would make me push back rather than help changing my attitude, so I don’t believe such words work. But it wasn’t as bad as just calling someone a loser.
And a “product manager” is not an engineer it is someone that says what should be done and not how
Look, isn’t this the same discourse we’ve had for decades, way before AI arrived? “Engineers think too much about the engineering stuff, they should think more about getting the job done, we should think about the customer’s pain and business goals and not about bytes” and so on. That’s what I was trying to say about the weak part of 404 Media’s approach: they wrapped a real but old af problem in an AI conflict, when it has little to do with AI, or AI implications for security.
1 Like