33
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Jul 2024
33 points (100.0% liked)
TechTakes
1441 readers
45 users here now
Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.
This is not debate club. Unless it’s amusing debate.
For actually-good tech, you want our NotAwfulTech community
founded 1 year ago
MODERATORS
Proton, who I use for mail and various other services, has gone against the wishes of the majority of their userbase as measured by their own survey and implemented an LLM writing assistant in protonmail, which is a real laugh given Proton’s main hook is its services are end-to-end encrypted
(supposedly this piece of shit will run locally if you meet these incredibly high system requirements including a high end GPU or recent, high end Apple M chipset and a privacy-violating Chromium-based browser. otherwise it breaks e2e by sending your emails unencrypted to Proton’s servers, and they do a lot to try to talk over that fact)
Who is the target audience for this?
People who use Proton are privacy-conscious and mostly (I would argue) tech literate, and yet they shove spicy autocomplete that no one ever needed until two years ago and most people don’t want now because it produces complete horseshit, and spellchecking that every browser under then sun has built in by now.
And then they quietly say you need to use Chromium, so the people who use anything but (like, I don’t know, the majority of privacy-conscious folks who should be their main user base, lol) have their e2e broken?
I really hope they catch a raging firestorm for this.
(Also I’m really pissed right now because used to recommend them to people and now feel like a total jackass for doing that.)
don’t feel bad for making the best choice you could with the information of the past. until we get a workable, interoperable, federated, encrypted communication/online services platform, the choice was to recommend one of the centralized e2e providers. we both chose to recommend Proton and they did this shit, but it could have just as easily been tutanota.
now my brain’s going “e2e encrypted federated email but it preferably uses activitypub as a transport and classic email as a fallback, is that anything”
@mii @self the blog post mentions 70% of "business users"
Edit: it's "more than 75%" of hot air producers
yep! that’s the game they’re playing. I really don’t give a fuck about Proton’s relatively tiny number of enterprise whales, but they make Proton a shitload of money in the short term.
the depressing part is, historically, online services that remain uncompromisingly user-focused tend to stick around roughly forever, while the ones that chase short-term gains and compromise everything else almost always enshittify and fizzle out pretty quick.
Saw this in passing earlier and I just laughed
Until indicated otherwise I’m going to presume it was some bizbro PM/PO/whatever pushing it because they really think it should be there “to be able to compete” (because of some laughably idiotic misunderstanding of their own value proposition and pitch)
Tangent: while I mostly run my own servers and services I did a recent assay on who’s reasonable for service shit. Proton kept popping up massively recommended while some occasional critical mentions from folks in anarchist circles, etc - made me a bit 🤨 and want to dig in more, but also just their product offerings aren’t great. Others I poked into are fastmail and tuta - both seem a fair bit better. Might be worth a look
No surprise that folks in anarchist circles are skeptical of Proton ha. That said, I do know quite a few people in the email "industry" who are broadly skeptical of Proton's general philosophy/approach to email security, and the way they market their service/offerings.
Fastmail has a great interface and user experience imo, significantly better than any other web client I've tried. That said, they're not end-to-end encrypted, so they're not really trying to fill the same niche as Proton/Tuta.
From their website:
I honestly don't know enough to separate the wheat from the chaff here (I can barely write functional python scripts lol - so please chime in if I'm completely off base), but this comes across to me as an understandable (and fairly honest) compromise, that is probably adequate for some threat models?
Last time I used Tuta the user experience was pretty clunky, but afaik it is E2EE, so it's probably a better direct alternative to Proton.
re fastmail, david mentioned a thing I wasn't aware of so they're off the list now, more or less just going to forget they exist except as a counter-recommendation
they're sorta saying "yeah just use external GPG like before"
albeit I will say their reasoning is a bit fucked in the head imo: that "if you can't trust the server" shit applies equally for whether it's serving you up the page elements to do message cryptography, or whether it's serving you up a normal webmail client. I think I know/understand where they meant to go with it, but the wording they picked is quite shit
I set up a tuta domain for a thing about a month ago. it could've been a bit smoother (esp. domain/dns state checks) but I didn't find anything immediately jarringly bad - and I was even drunk at the time (which means my diy-able supergrump comes out about this sort of shit). will see how it goes over some longer use :)
I’ve posted at Proton on Mastodon about this with some details on why it’s real bad; no reply yet
I linked to your masto post on twitter https://x.com/fasterandworse/status/1813994815991980204
I was reported for posting Eamon's twitter handle on masto
there really are some weird-ass reports from people on fedi sometimes. I imagine it also hits on other platforms, but there we don't get to see them
I imagine it was reported by proton because they were directly @ in the post :)
fucking wow. so that kinda confirms that:
that’s exactly why it’s the point of no return for me — I can’t trust a company that does this, and I’ll actively advocate against using them
maybe privacy and security are just too precious to trust to something as malicious as a corporation, and I say that knowing Proton just re-incorporated as something that can be called a non-profit but shouldn’t
Jesus fucking christ...
So where do I switch now? Is this the moment I build my own email server and handle this shit myself? I really don't wanna...
I use tuta and they seem mostly ok.
they have apparently promised they don’t plan on implementing anything AI-related which is good, though I’m honestly hoping for a system where our privacy isn’t entirely reliant on the promises of a single authority
and I’m not saying we should do our own federated e2e email service, but somebody should
…more realistically, I’ll probably switch to tuta when my proton account nears renewal, as I’m not a fan of how much pure unfiltered horseshit I’m seeing them output with the money I paid them
Setting up an email server is really straightforward with simple-nixos-mailserver, highly recommend. No idea how likely you are to be classified as spam though from a new domain
I host my own email and for my day job I run an institutional email system that handles ~50 million messages per week. I can't recommend hosting email at either end of that scale (or anywhere in between), and I find it difficult to believe that anyone with experience running a mail server would claim it's reasonable or straightforward.
i host my mail services for the last twenty seven years, and yeah, you're talking shit. starting the smtp daemon is not the same as managing mail server.
this is one of the circles of hell Dante didn’t comprehend when he wrote Inferno
coming up on 18y on mine. my postfix config is almost of legal drinking age in a lot of countries.
modern email ecosystem is a fucking mess.
chance is near 100% though
it's also really, really fucking unpredictable, in the the-other-parties-do-not-reliably-behave-the-same way
used to hate having to debug mail failing to deliver to yahoo, and now lately google has started filling that niche..
eh, nix is experiencing a chudpocalypse at the moment, which might be why you're catching strays
Not to downplay what proton mail is doing, but they're saying that you can run this locally with a 2 core, 4 thread CPU from 2017 (the i3 7100, which is a 7000 series processor), and a RTX 2060, a GPU that was never considered high end. Perhaps they changed the requirements while you weren't looking. Or Am I reading this wrong?
only one of the 8 computers I own (and I’m not being cheeky here and counting embedded or retro systems, just laptops and desktops) is physically capable of meeting the model’s minimum requirements, and that’s only if I install chromium on the Windows gaming VM my bigger GPU’s dedicated to and access protonmail from there. nothing else I do needs a GPU that big, professional or otherwise — that hardware exists for games and nothing else. compared with the integrated GPUs most people have, a 2060’s fucking massive.
do you see how these incredibly high system requirements (for a webmail client of all things), alongside them already treating the local model as strictly optional, can act as a funnel redirecting people towards the insecure cloud version of the feature? “this feature only works securely on one of the computers where you write mail, at best” feels like a dark pattern to me.
Unfortunately, "extremely expensive" and "high-end" aren't really synonyms, thanks to, y'know, bitcoin. Of course, I don't disagree with your argument that having to buy a GPU just to ensure your webmail does what it's advertised to do is, well, dumb.
What I don't know is what the LLM even is. Did they just tack on Llama to their webmail app and call it a day? Did they train a model? Was it trained on emails? If so, whose emails? What an advertisement that would be: "Use Protonmail to encrypt your emails so that companies like Protonmail can't use them to train an LLM."
David’s article has some details on what the LLM is. I don’t think it’s trained on emails, but that doesn’t make me feel much better.