Remove ProtonVPN

[ignoramous]

@ph00lt0

Apple’s architecture makes it nearly impossible to make a functioning kill switch.

This is a misleading statement. NetworkExtension docs do mention that for VPNs using includeAllNetworks (a form of a ‘killswitch’) will prevent traffic from bypassing the VPN for advertised routes, for example, when apps may “scope” their traffic to a particular network interface.

@jonah

Proton specifically says to bind programs like torrent clients to the tunnel interface directly, which does solve this problem

If programs can bypass a VPN tunnel by merely binding to a specific interface, then that’s a leak, and definitely a ‘killswitch’ that’s horribly broken.

---

@dngray

There’s also a lot of spam in this thread. I’m not reading 272 replies

I linked to @xe3 reply for that reason. And there’s 2 or 3 other TLDRs similar to xe3’s.

Also see:

@jonah

• Has the poster failed to provide reasoning for their criticism, and demonstrated an unwillingness to learn or discuss the topic?
• Is the poster writing something as if it is true and informed, when they’re actually just speculating?

Btw, I encourage the mods to remove spam, and ‘the team’, who retain the ultimate responsibility for the content, read the thread if they want to arrive at an informed conclusion.

---

@dngray

They work as much as some application you run

Agree. This is the thread where the community has been having that discussion: Mention kill switch leaks caused by OS limitations

@dngray

VPN’s don’t provide high assurance and certainly not software apps running on the client. I certainly would not stake my personal security on the integrity of any of these apps from any VPN provider

I am of the same opinion, btw. I find this refreshing coming from a “team member”. PG should consider posting this on its VPN pages.

@dngray

It works but it’s a lot easier to ensure connections are protected when forwarding from one interface to another or dropping packets if the interface is down

What I meant to say was, one doesn’t need a VM to accomplish this. Up thread, @lyricism pointed this out, if you’d care enough to read the replies.

@dngray

none of these kill switches can be truly relied upon on any platforms as there have been issues on Android and other platforms

OS’ killswitch limitations must be addressed by OS developers. VPN client’s limitations must be addressed by the client developers:

• Some OSes (ex: Android, iOS/macOS) require VPN clients to be compatible with their (OS-provided) killswitch.
  • If there are leaks, the OS developers are on the hook to fix these.
• Some OSes (ex: Linux-based, macOS) provide mechanisms to setup (OS-assisted) killswitch which the VPN clients may use (these may require privileged APIs).
  • If there are leaks, the client developers may be need to use different APIs.

@dngray

No software is perfect and that’s the world we live in.

Only if there ever was a slippery slope not this slippery…

@dngray

worth noting that ProtonVPN is the only provider that supports port forwarding with natpmp.

Believe those “P2P” VPN servers exist in a separate pool plagued with bad IP reputation, no?

@dngray

thread has been brigaded from the people over at /r/privacy so consensus doesn’t really mean a lot

Why do you say so? The earliest mention of this thread on r/privacy I see is 3 days ago?

(funny that mods who admit they can’t be bothered to read the thread can reply immediately while those who have the context have to wait for 3h).

---

@jonah

over 100 unreasonable posts since my last reply a day ago.

I’m sorry but this reply reeks of total disrespect to folks who have been making the effort and taking the time to contribute here.

@jonah

@anonymous549

Could we atleast get an SLA

Sure, what is your budget?

Wrong question. There’s folks here who care about PG and would be more than happy to volunteer as team members or mods. How these folks get appointed or elected isn’t clear, however.

@jonah

I’m not sure what people expect here.

Think the expectation is, if there’s substantial discussion, the team weighs in more proactively. Especially when the team is very eager to make claims like…

@jonah

… generally stand by the idea that every statement on the site is accurate …

@Niek-de-Wilde

whats written on the site is generally perceived as the truth

---

@jonah

would encourage more community members to volunteer

Some of us do.

• On Android, "OS files are left unencrypted" · Issue #3179 · privacyguides/privacyguides.org · GitHub (open since Dec 2025)
• style: encrypted DNS prevents manipulation not spoofing by ignoramous · Pull Request #3166 · privacyguides/privacyguides.org · GitHub (open since Nov 2025)
• docs/os: AVB does not prevent evil maid by ignoramous · Pull Request #3183 · privacyguides/privacyguides.org · GitHub (closed because … “think with the input of GOS I’m going to go ahead and close this” with zero proof for that justification @fria made )

What’s the SLA, if any? It takes time and effort from volunteers, too, to engage with the team.

---

@dngray

Not really, and removing it would make us lose more credibility

This is an astonishing statement. Though, I have seen this movie before with NextDNS.

@dngray

@ignoramous

NextDNS’ “log storage location” feature is misleading in light of their use of all these other global service providers

This is largely speculation that GCP is logging everything regardless of a downstream privacy policy.

I do agree though they should be clearer about their sub processors though. Their Privacy policy is likely brief for brevity reasons (and maybe too much so).

Hopefully we hear back from them soon.

Hear back from them?

And, just who does PG prioritise building credibility with? Its readers or the corps?

@jonah

the kill switch on Linux is fully functional, unless an application specifically binds to the physical network interface. This, to me, seems like an issue which would warrant using something like Qubes

No.