I’m fine with AI being used in development, but AI or not, a company selling a secure/private service who has a CEO dismissing the value of pentesting is absolutely deranged behaviour. I genuinely believe exposing a bunch of tech executives who abuse stimulants to AI is wreaking havoc on the industry.
7 Likes
They’re not “anti-AI” in the Codeberg-like way. These days they keep saying they’re evaluating the use of AI to move faster. And honestly, seeing how hysterical social media is, I don’t expect them to be very open about it: probably not the best moment to tell people how you use LLMs.
off-topic:
idk what is more humiliating for humanity: stop reading code ourselves or not being able to fix dark theme for 2 years
1 Like
Apologies if this has been posted previously but if anyone want to vote on this topic then link is…
3 Likes
Yeah I’m with you. It’s not only about AI being effective or not, it’s also about e.g. holding on to human understanding of programming languages.
2 Likes
This was a great answer, thank you for taking the time! Clearly demonstrates that it’s the kind of complicated that Yen’s comments don’t seem to take into account.
I’ll take a look at this The Morpheus channel!
Sorry this might be the wrong tread for this, but didn’t Ente just use a vibe audit startup for the recent crypto audit? Our Rust crypto was reviewed. The real find was the auditor.
I think I’ll cancel my plan. That is a toxic culture. “Perception is more important than truth, the truth doesn’t matter if you don’t win on perception.” yeah maybe that’s why you lied for ages about Calendar [1] and Lumo [2] being open source and generally over-promise. The core Mail product is pretty solid but this stuff always frustrated me.
The CTO’s AI manifesto doesn’t bother me much but Andy Yen’s leadership is juvenile. You can invest in AI without being delusional about its actual present capabilities and berating your employees over it.
[1] Reddit
[2] Proton markets Lumo as "open source," but support calls it a "long-term intention, not the instantaneous state"
1 Like
The re-interviews were canceled:
I’ll still be keeping a close eye on things between now and my renewal date. Hopefully employees continue to speak up, both internally and externally to journalists.
2 Likes
Ente has done two security audits with Cure53, in 2023 and 2025.
But keeping in mind that we exist in a world where agent swarms are attacking open source infrastructure and exposing vulnerabilities across the board, it would be short-sighted to not leverage those same tools to mitigate gaps and improve existing protocols.
I like the term ‘vibe audit’ though. It makes it sound like fun 
5 Likes
Andy Yen on Reddit:
A message to the community
A lot of you probably don’t want to hear from me right now. But I spoke to the Proton team earlier today, and you also deserve to know what was said, because I’ve let you down, too.
First of all, I take responsibility for the failure of communications that has led to such uncertainty, confusion, and hurt within the staff. We’ll be bringing in an internal communications lead to help keep this from happening again.
More personally, I shouldn’t have said some of the things I did to the people who helped build this company. They were hurtful, I’m sorry, and I am determined to do better.
I want to address some points that have raised concerns.
First, the “re-interviews” that have been publicly discussed will not take place, and no one will lose their jobs because of them.
Second, Proton does not install tracking software on employees’ laptops to measure how much AI-generated code they produce. This is false and stems from someone’s misunderstanding about how MDM software works.
But most importantly, I need to categorically state that **our use of AI will never be at the expense of security**. In the past year, contrary to what has been alleged, actually additional layers of security review have been added to meet the threat posed by hostile AIs scanning Proton’s open source code for vulnerabilities. Fast and secure need not be mutually exclusive. We also leverage AI to find vulnerabilities in our own code before attackers do. Our code is open source, and its security remains open for all to verify.
I recognize that the burden of proof about this is on us, and therefore, I’m recommitting to Proton’s deeply held belief in transparency. We will lift the hood on how we use AI internally at Proton. This includes publicly releasing and open sourcing several of the internal tools that we use, including more advanced versions of Lumo with greater capabilities, which have never been made available outside of the company.
We will also publish how code reviews and security reviews at Proton are done, and detail our AI policies, including where AI is permitted, and where it is not, and our rationale. Instead of just being able to see the final open source code that we produce to verify security, third parties will also be able to assess how that code is produced.
Even if we might wish it wasn’t, AI is here, and it will unquestionably change how software is developed forever, and Proton must also change. But **we’re committed to proving to you that we’re doing it in a responsible and safe way.**
The past few days have been humbling, to say the least. When you see your words reflected back at you, all at once, you can’t help but see yourself in a different light. I’ve made mistakes, but I will learn from them.
The coming days, weeks, months, and years will be difficult, not just for us, but for all the people who will be impacted by the changes brought on by AI and automation. Proton will not go the distance with an army of agents, but with an army of smart, thoughtful people, who care deeply about our mission, our users, and this community.
1 Like
I enjoyed learning that the concerns and values that have led me to spend hundreds of dollars on Proton over the years are “loser thinking”.
5 Likes
Vibing’s always fun
I agree, that’s not what I meant. It’s just that I wouldn’t call blindly trusting LLMs particularly mindful. This is the idea that Yen seems to have, which makes me lose my trust in Proton as a company (if they follow through).
What do I trust when I trust technology? First and foremost I trust the skills, resources and intentions of the makers and the maintainers of that technology. When they externalize their work to LLM’s, they’re asking me to trust those LLMs by extension. The problem is that I don’t. Sure in the case of open source one could say that anyone can go and verify the code, but practically speaking my trust still lies in the maker.
That said, I hope Ente will continue with rigorous audits as well. You’re doing such great work otherwise 
1 Like
Personally, I’ve never trusted Proton which is why I only use a free account with them and it’s not used for any sensitive accounts. Proton’s just a more private alternative to suites such as Google or Microsoft, but I’ve always had my doubts about them being the most “private” privacy company.
One reason that I’ve always felt that way is it seems anytime I read an article about some ransomware or hacker group that the Feds were finally able to nab & the court documents become public, it’ll say how the law went after some server somewhere and shutdown a couple of vpn’s no one’s ever heard of
Yes he sounds like saying customers (who think privacy as important) are losers.
Hi guys, I’m new here. I signed up because I had an idea that I wanted to share. I’ve been a Proton customer for a long time, I think it’s been at least 7 years. Likely more. With some of the talk about switching providers, I started to wonder, are we over-complicating what Proton does?
Because for the average user, I would estimate 99%+ of email is usually not from Proton to Proton. Which means that it arrives at Proton’s servers unencrypted. So let’s forget about that 1% for now.
What if we wrote an open-source script, application or even a Thunderbird plugin (or whatever mail client) that downloads new mail and then encrypts it and uploads it back into the inbox or any other folder? And then deletes the unencrypted one of course.
I didn’t know this until some years ago, but you can write stuff to IMAP inbox folders too, so I figured why not just write back the email encrypted?
If you think about it, what exactly is different between this and what Proton does? Maybe with Proton it happens faster (possibly in RAM) than the few seconds it would take your local machine, but isn’t that essentially the only difference? Because if Proton wanted to intercept those emails they could anyway. And if they do it in RAM, then we’re only taking their word for it.
We could also import keys on our phones and read our emails on the go, while another device does the encryption. Nor would we need to host it ourselves, we just need any provider with IMAP.
Would love to hear any thoughts on this. We may be able to broaden our potential providers by doing this, as we’d be doing the encryption ourselves. Without running the email server ourselves as that can be difficult with spam filters.
1 Like
Fwiw this is exactly what Stalwart does from our recommendations.
Yeah i am with you here. I think Andy is right, the company needs to adopt AI. We are in the arms race already. That being said there are different ways of commucating that to your employees and the management style here seems to be the real problem.
4 Likes
Forgoing pentesting is a bit much though. And I actually like using AI for getting new stuff off the ground; but for goodness sake at least make sure the code isn’t punching a hole in the firewall.
Not disagreeing here
3 Likes
A staff member in Proton has a clarification on Reddit: Reddit
1 Like