Remove ProtonVPN

[Overall-Bet3743]

You are bending over backwards to invent excuses for ProtonVPN, its quite shocking honestly.

You say:

@dngray

What is unclear is if there were specific technical reasons why they chose not to use pf and instead use Network Extension. Perhaps it has something to do with: TN3165: Packet Filter is not API | Apple Developer Documentation which expressly tells VPN provider to use it instead.

@dngray

It is not a favored VPN provider, and now that I’ve looked into it in more detail, its obvious why ProtonVPN chose to do it the supported Apple Way rather than relying pf which has other known issues. Apple very clearly say not to use pf for widely distributed applications.

How so is it obvious? The TN3165 documentation you linked to was first publish in February 2024, yet there are reported cases of this exact network switching issue that date back 3+ years (source) (source). So this issue was occurring before Apple provided this guidance to developers and is thus not a result of said guidance.

@dngray

Nothing specific, beyond “it doesn’t happen with pf, but it happens with Network Extensions”. Nobody managed to dig up that Apple technical notice (TN3165) which actually points out very clearly pf is deprecated with wording like:

This is completely irrelevant, operating systems evolve, but to say that a privacy provider should sit back and not fix blatant issues because the current functioning method will eventually be deprecated is ridiculous, especially when other providers are putting in the hard work to resolve the issue. Again - if Mullvad VPN can bypass this issue, then it is NOT a platform issue, how do you not understand this?

@dngray

I don’t think we should be punishing VPN providers which provide excellent infrastructure and audited open source applications because of limitations in the operating system and more specifically one specific platform which has a habit of being quite forceful about how things are done.

Do you not see the irony in what you are saying? The other VPN providers that are recommended also have excellent infrastructure etc. etc. - and guess what? They also have functioning kill switches for macOS. So by carving out recommendation requirements to keep ProtonVPN you are in fact punishing those other VPN providers that have put in much more work and are objectively better.

I will quote myself from much earlier in this thread, and I hope you have the intellectual honesty to recognize this concept:

@Overall-Bet3743

@anon82422799

Just because there may be an issue with a VPN on one operating system does not mean that it cannot be fixed in a future software update

Is this site recommending VPNs based on potential future software updates?

Listen folks. The reason this thread is so ridiculous is because nobody can decide what they think the problem actually is. I think there are really three problems here, while everything else seems irrelevant to Proton VPN itself. Pick the problem you actually care about and talk about it there:

What is going on with Proton’s kill switch on Linux?:

ProtonVPN Additional note: Killswitch failure and IP Leakage on Linux

This topic remains an issue. I think the community is generally of two minds about this: Thank you for your analysis. I will share the most likely counterpoint for people to consider: I think it’s probably fair to argue that on Linux you should be aware of what you are installing and what those programs are doing. A kill switch in this scenario that applies to the default network configuration is mainly going to protect you from random disconnects, while an intentionally misconfigured progr…

What is going on with Proton saying their kill switch works on macOS?:

How should we handle Proton's misleading marketing?

Currently, Proton’s kill switch documentation is incorrect, which seems fairly severe: Now, we can certainly note this ourselves, and I have a PR open to do so: Do we want to take stronger action against Proton for this?

What can we reasonably expect people to do about macOS/iOS limitations anyways?:

What should we require of VPN providers on macOS?

The discussion surrounding Remove ProtonVPN - #332 by ph00lt0 is so random and all over the place, that I am not even going to attempt to sort it out and try to move some posts over here. See: I think the main question is: Should we require providers to use hacky workarounds like pfctl filters on macOS instead of standard tools the OS provides? It feels like the answer is probably no, but if anyone wants to continue this discussion then this is a fine place to do so.