Ownership is a big problem with VPNs. A bunch of them are owned by the same two or three companies, and those companies are not good.

I really have no idea what to trust nowadays. A few years ago, Mullvad and Proton were the industry darlings, but they BOTH have far-right ties. Mullvad’s founder donates to far-right organizations, and Proton’s CEO has AI psychosis and doubled down on some ridiculous comments praising Trump.

It really boggles the mind how anyone can purportedly value privacy and also support any far-right politics. Makes me think they’re all honeypots.

For mail, a few things I’d look for:

• Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that’s not controlled by the service provider.

• Easy E2EE setup with PGP/GPG.

• Custom domain support.

• Email alias support (though this can be done with a third-party service, potentially).

• Server-side filter rules for incoming mail.

Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn’t mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you’re using a web client or apps from Google/Apple stores, that’s never going to be verifiable.

For VPN:

• No-logs policy.

• Independent audits.

• Port forwarding support.

• Anonymous payment options.

These are not exhaustive lists, just off the top of my head.

I think the big takeaway here is that if you’re using Tor, or a VPN, or really the internet in general, you always need to think about MITM attacks. There are a lot of standard protections against exactly this kind of attack.

…users who ignored warnings that the SSH host key had changed…

SSH keys are one of those protections. Don’t ignore the warnings. That’s a big red flashing DANGER sign.

…block ports … used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections…

TLS connections are another of those protections; don’t use apps or services that allow plaintext communication.

I’d be interested to know which email clients will downgrade connections by default. That is an absolutely insane thing to do. I don’t think my email provider even accepts unencrypted connections anymore.

This is scary but really, nobody’s supposed to trust Tor exit nodes in the first place. This doesn’t drastically change my comfort level with Tor. But it’s a good reminder that you need to be mindful of how your apps are configured.

Sounds interesting, thanks for the link. It’s a little over my head tbh but I’ll definitely take a closer look.

I’m not aware of any realistic way to vet published model weights like that.

It works for some open-source software, because you can download the source and compile it yourself. But most of the “open” models don’t publish their entire training set, or enough details on the training for it to be truly reproducible. DeepSeek doesn’t publish their data sets, and they probably couldn’t, legally, since they “collaborate with third-party data providers to obtain proprietary datasets”. And even if they did, it would be prohibitively expensive to train it on your own, unlike simply compiling open-source code.

The actual code for training LLMs is relatively trivial. The secret sauce is the training data and fine-tuning.

It’s still a risk. You can train an LLM to respond maliciously to a very narrow range of requests that would not be easy to spot in general testing. If you know how the LLM is used, you can target that very specifically. It doesn’t have to be as blatant as “always deny the Tiananmen Square massacre ever happened”.

Given how thoughtlessly people use AI, and how opaque some of the systems are, I think this is a legitimate concern.

And yes, every government outside America should ban the use of ChatGPT and Claude. Obviously.

Yes and yes.

I don’t think TikTok is really comparable though, unless there are somehow people using it for important government work.

Honestly, reasonable.

I mean, I sure don’t trust OpenAI or Anthropic any more than I trust DeepSeek, but that’s because I don’t have legal control over them. The US government does, and it is correct to ban tools that are controlled by adversaries.

No problem until they make every other method more and more difficult. Which is already happening.

I only use passkeys when the alternative is an onerous song and dance.