by jtanderson on 10/16/20, 2:58 AM with 129 comments
by woodruffw on 10/16/20, 4:11 AM
Some observations:
* It's not actually a virtual private network, at least by the traditional definition. They route HTTP(S) and DNS traffic only; other protocols (presumably) get routed in the clear.
* IPv6 isn't supported at all.
* I might be missing it, but I can't find any cryptographic design documents or a threat model anywhere. A quick repo search doesn't even bring up any cryptographic primitives, which makes me wonder about malicious peers.
It's good to have more competition in this space, so I'd like to be wrong (or eventually wrong, feature-wise) about all of the above. But if I'm right, this is roughly the same as using a SOCKS proxy (and maybe a bit worse, if any other peer can futz with your traffic).
by anderspitman on 10/16/20, 4:17 AM
It would be cool if there was a reputable open source project that would let people share/buy residential proxy usage, but at the end of the day there's no way to guarantee people aren't doing horrible things with your IP.
by FreshFries on 10/16/20, 11:43 AM
If you for a minute think this / your IP address will not be misused to scrape, grief, DDoS, up & download "questionable content", you are very wrong.
by eightails on 10/16/20, 4:02 AM
Their answer to the question of 'what happens when a bad actor has their illegal activity routed through my connection' seemed illogical. They claimed that as more people signed up, the proportion of bad actors would decrease [0], which makes no sense to me.
Also, I'm not entirely sure what methods they have taken to stop a bad actor from collecting packets from other users that are routed through the bad actors exit node.
The worst thing IMO is the way it's being presented and marketed. The impression the website gives is that its just like all other VPNs but free, which is very misleading.
[0] https://www.reddit.com/r/Ubuntu/comments/f5y6qg/update_launc...
by api on 10/16/20, 3:18 AM
That's risky. What happens to me if someone does something illegal via my connection? How could I prove it wasn't me? Maybe I could win in court by citing my use of something like this, but I really don't want to be dragged into court in the first place even if I end up walking out.
by piracy1 on 10/16/20, 5:29 AM
by jmarbach on 10/16/20, 4:03 AM
by rntksi on 10/16/20, 8:36 AM
ZeroTier is actually quite good. I've used it successfully in/for enterprise-grade services.
by _znkz on 10/16/20, 5:41 AM
Love hearing the feedback from everyone here — some very valid criticisms from a lot of folks — and on a lot of points that have been brought up here, we actually have plans to address. A few bullet points on where we are as an organization / project:
— the marketing copy isn’t set in stone — I’ve been working on the site a bunch recently & it’s very much in flux (we’ve been posting in a few Linux communities to see what the response looks like) — when we posted a few months ago about the project, in all honesty, it was a demand test to see if this would be something worth pursuing — but we’ve been trying to take the feedback from those posts to heart in our development process — we market ourselves as a VPN, but to be clear we _are_ a dVPN (distributed VPN). The peer-to-peer VPN wording on our site is mostly for the sake of simplicity. I’d point most folks to our project README on GitHub for more in-depth technical details. — right now FreePN is structured as a 1-to-1 peer connection, but we eventually plan to build in multi-tenant peer support as well as optional multi-hop routing (similar to Tor) and selective whitelisting of domains so that as a peer you can elect to categorically block certain types of sites — say torrenting. These blocklists would draw from open-source category site-lists like Fortiguard. — we do currently only route web traffic (+ DNS) — so only traffic on ports 80 and 443 is being routed (optionally port 53) — we don’t currently support IPv6 (though we have plans to add support in the future) — we don’t log traffic (you can see in the repo), and while peers logging traffic is a potential concern, that’s only true if you’re using non-HTTPS connections (we have plans to bake in something similar to HTTPS Everywhere, automatically upgrading connections).
As far as our vision for the product — our goal for FreePN is to eventually become a ‘privacy all-in-one’. We started FreePN because we care deeply about internet privacy — but trying to protect yourself online practically is a very technical and time-consuming endeavor (basically — it’s really hard to protect your privacy online, and we’re trying to make it easy). In terms of features, we’re working on building in ad-blocking as our next major milestone.
I’ll do my best to respond to everyone’s questions and concerns here this evening / in the morning & tomorrow as I’m able!
by zwilliamson on 10/16/20, 5:04 AM
by illuminati1911 on 10/16/20, 3:28 AM
by bawolff on 10/16/20, 4:48 AM
At a glance sounds like a reinvention of Tor, but less secure.
by parliament32 on 10/16/20, 4:25 PM
by alvarlagerlof on 10/16/20, 5:35 AM
by aero-glide on 10/16/20, 6:04 AM
by dhaavi on 10/16/20, 6:56 AM
What is your business model?
I understand that you don't need servers, because your users supply that part, but who pays for development, support, and all that stuff?