This is a very brief blog blurb linking the original Tech Radar article that got fairly extensive discussion on HN a week and a half ago [0]. Potentially quite an important one though so a second go around may still be very justified for those who missed it last time. Amidst a lot of negative moves around the net recently it's nice to see some sanity at least once in awhile.
Perhaps people missed that, and would like to start a new discussion?
It didn't know there was a quota on discussions of any particular topic, perhaps we should give out tickets to the event in the future to ensure no-one misses their opportunity to join the discourse?
If I were a governmental body I would do everything I could to keep citizens using paid VPN's and big CDN's. Money trails are easy to follow and the majority of people are just paying with their bank. It makes people feel safe and more likely to expose certain behaviors. Paid VPN's can say they do not have logs whilst having real time lawful intercept API's. A handful of VPN providers become a one stop shop to get the data of what used to be hundreds of ISP's just as a few big DNS over HTTPS providers become a one stop shop to get the DNS of what used to be hundreds or thousands of ISP's all over the world.
Ban VPN's and people will fall back to the myriad of open source alternatives that can be a bit harder to peel back and get logs assuming any exist in the first place. This was a thing some time ago. Many of the malware and pirate groups were sharing Tinc meshes though as expected there would at times be one person in the group that would be the weakest link and expose the entire group. Expand the numbers of people doing this and the probability of a few groups using decent operational security will increase.
Add to that that half of these companies are registered in obscure offshore locations where it is practically impossible to even find out who are the ultimate owners.
Interesting theory. My own theory is that the big corporations want to siphon off more data from people. That is, I think, the main agenda. See android recently stating that everyone has to give up their age. Next step will be ID (though probably, in order to verify the age, one has to give up the ID anyway, so age sniffing could be called ID sniffing).
This looks like a very narrow ruling regarding copyright. It doesn't guarantee that EU bureaucrats won't try to ban VPNs that don't verify user age (for starters to make NPCs support the bans, then they will inevitably attempt to enforce some kind of KYC or logging to "catch terrorists and pedos".)
In particular for "hot" topics like this people should use the search function at the bottom of every HN page before rushing into post.
The last thing everyone needs is yet another duplicate post with hundreds of comments re-hashing the exact same comments that people already made before. It is not helpful for anyone.
Hurray and good. A technology shouldn’t be treated as unlawful simply because it can be used to bypass restrictions. Restrictions which are stupid in the first place in the majority.
I hope VPNs are not becoming the next battleground between online safety and civil liberties. I'm sick of the current ongoing attacks on civil liberties in the Western World under the fake veil of online safety.
VPNs are just tools that sketchy people use for sketchy means. There's no legitimate use for someone who isn't trying to break the law. Allowing these tools let's underage people access porn, and do all manner of undesirable behaviors like accessing region locked content.
I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites.
There are of course some people on the other side who think VPNs are a guarantee of privacy and secrecy on the internet, but that's pretty rare in my anecdatal experience. I largely blame the rampant ads on podcasts for this view.
I think an issue VPNs face is that while your first paragraph is not objectively true, it ends up being truer than I might like because the other use cases are not well covered. If you've got one of the things the HN gestalt would call a non-sketchy use case, you've also got the problem that it's rather hard to verify that any VPN you are using actually fulfills your goals. They can say they do, but you have a very hard time proving it.
On my current fiber provider, I'm already behind a very large CGNAT install. To a large degree, de facto that's already a lot of the "non-sketchy" use cases for VPN covered for me. IP addresses are already one of the weaker signals for tracking people as it is. Mobile networks have been letting you shift IPs for years just by how they work. Other internet providers that don't slap thousands of people at a crack behind one IPv4 with CGNAT didn't necessarily guarantee stable IP addresses, hence the need for dynamic DNS for decades.
The hole VPNs plug is necessary, but not even remotely sufficient if you are trying to actually protect yourself from some attack. Slapping a default Windows 11 install on a VPN to a first approximation protects you from nothing.
And since the "non-sketchy" uses are rather dubious, that really does sort of leave just the sketchy ones. I don't think it's a coincidence that when they pay a YouTuber to advertise them, the YouTuber generally ends up talking vaguely about the protections but fairly concretely about the sketchy uses, with screen shots showing them using Netflix in a different country. The companies know what they're getting used for and what they can provide.
Probably should have put a `>` before the first paragraph, because it reads like an 8/8 bait and most people won't continue to the next one.
Regarding the misleading podcast claims, at least all the podcast and youtube ads made the VPNs popular on the mass market so now they are more difficult to be silently outlawed.
Or saying that his view is also shared by people he considers intelligent, and thus can only be rejected by others, who first need to proof to him, that they are actually intelligent. Aka. an indirect ad hominem.
If the poster agreed with the opinion, they wouldn’t have included “actually” (indicating that they think the reader will be feeling incredulous at that point) and “otherwise intelligent.”
Yes correct, I vehemently disagree with people who say things like the first paragraph. I definitely should have been more clear that that was not my opinion, but it's too late to edit now
VPN is what a smart person uses when they are at an internet cafe or somewhere else with public internet where you can’t trust that the traffic isn’t sniffed by someone for giggles and your bank credentials are going to leak.
Let’s say a hacker hooks up the hotel internet to a firewalla and opens a free wifi spot. You log in and it sees from your traffic that you’re a customer of ABC bank and Gmail and ATT from the traffic - next thing you know you get a text message from your “bank” that someone has stolen your credentials in “XYZ Arizona” and you have yourself a phishing attack. The exposure scenarios are only limited by the imagination of humans and modern LLMs.
This doesn't seem novel in any way, given the amount of data available online you can already be targeted by fake bank texts, no need for the free wifi hotspot.
I just use my home router as VPN to not care if the 100 apps om my phone have a working encryption. I also use it to access my home services so that they are not exposed to the internet. I also use it to limit exposure on my VMs on a cloud hoster.
Not only that, but the iOS and Android APIs for HTTP requests make it really difficult to accidentally use unencrypted HTTP:
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
Redundancy is not detrimental to security and privacy. On the contrary, having more layers would protect you in case one of them fails (zero-day, bugs, etc.)
If there's a zero-day in TLS there would be a huge amount of problems that a VPN wouldn't protect you against. Even if you're using a VPN (or just a trusted ISP from your home), as soon as your data leaves their hands it would be vulnerable.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
I want to applaud your choice to not include anything like quotes here. That would be misleading because it isn’t an actual literal quote. And, we’re too used to just skimming posts here before jumping right in to argue against them.
Meta: your first paragraph could really use a quotation indicator / mark. I suspect it was intentional: the ragebait was very effective on me before reading the rest of your comment (I was ready for defend my usage of tailscale to access my iot stuff).
>I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites
This is an illusion we really need to remove from our collective consciousness. Running a popular website while being an ops genius, being a neurosurgeon who saves lives every day or being the world's best architect doesn't mean someone has sound opinions on topics right outside their area of expertise.
In fact, nowadays it seems to be all about appeals to authority which IMHO makes us more ignorant because many people seem to not think critically anymore. Instead, it's just "an expert said so" - then you look into the "expert" and in many cases they either aren't actually an expert or they're a paid shill. But that's a topic for some other day.
I wanted to respond with something of substance (I still don't understand if it was a paraphrase or not) but every reply here is a meta reply, so hello to all fellow meta reply guys.
Maybe put some quotes around that first paragraph. Seems like some people downvote you before they get to the part where you reveal you don't think that way
His whole comment contains a view, that some people, including elected officials hold. I don't see an aspect, that actually hints, that he means that in a sarcastic way(, besides that he is on HN).
You can't do much with VPNs these days, almost any website now has antibot systems and it's actually kid's play to detect whether you are on VPN or not.
Jup, if you are using any mainstream VPN provider (the ones shilled on every tech YouTube channel) or anything that results in a datacenter IP, it is trivial to discover and block.
Primary use I have for it is hosting internal services that I don't want on the public internet - do the same at work, it reduces the attack surface hugely
I know what you mean, but I think most people are not thinking of it in this way. They are thinking of VPN as a service provided by companies such as Nord VPN, and mostly used to get around region locked content or keep your ISP from being aware you are downloading things you shouldn't be.
My ISP Comcast (rebranded to Xfinity to avoid all the negative associations with it's actual name) does man in the middle attacks on HTTP connections and injects javascript code into webpages. I actually had this happen to the steam browser back in ~2013 and I had to restart it. But they still do it today in 2026. I don't use a commercial VPN because I host from home. But I do tunnel my HTTP browsing to a remote VPS I rent.
I just loaded up Bluesky this morning to discover it demanding proof of my age bc I live in Texas. First thing I did was turn on my out-of-state vpn and try again. not today, satan!
There is a big discrepancy here. EU courts babble about lawful xyz. While they are doing so, national legislation goes downhill, e. g. mandatory age sniffing and other restrictions to come (I claim the age sniffing will come on the OS level, Google recently announced Android will do so, so you can already see the corporate agenda being pushed into democracies here). So I consider the EU courts to just act as decoy, aka "look how everything is legal". Well, a few years later, VPN will be banned. And the EU courts will be in agreement with that.
Are you implying the EU court is (secretly) cooperating with national legislative bodies to implement surveillance tools while pretending to uphold civil liberties?
Why is something like ublock origin not enough for your needs? Is it more about the principle of not wanting to share any fingerprint across the Internet, or some specific tracking concern?
This is a very brief blog blurb linking the original Tech Radar article that got fairly extensive discussion on HN a week and a half ago [0]. Potentially quite an important one though so a second go around may still be very justified for those who missed it last time. Amidst a lot of negative moves around the net recently it's nice to see some sanity at least once in awhile.
----
0: https://news.ycombinator.com/item?id=48997221
Yeah, please could everyone not pile in and start re-hashing the extensive comments that have already been made only a week and a half ago.
Whatever you're thinking of posting has almost certainly already been said more than once on the original HN discussion.
Perhaps people missed that, and would like to start a new discussion?
It didn't know there was a quota on discussions of any particular topic, perhaps we should give out tickets to the event in the future to ensure no-one misses their opportunity to join the discourse?
Gatekeeping through the voting system is preferable to gatekeeping by random comments, if you feel you must gatekeep.
With due the greatest respect: it is not up to you to decide on what others deem worthy of commenting or not.
If I were a governmental body I would do everything I could to keep citizens using paid VPN's and big CDN's. Money trails are easy to follow and the majority of people are just paying with their bank. It makes people feel safe and more likely to expose certain behaviors. Paid VPN's can say they do not have logs whilst having real time lawful intercept API's. A handful of VPN providers become a one stop shop to get the data of what used to be hundreds of ISP's just as a few big DNS over HTTPS providers become a one stop shop to get the DNS of what used to be hundreds or thousands of ISP's all over the world.
Ban VPN's and people will fall back to the myriad of open source alternatives that can be a bit harder to peel back and get logs assuming any exist in the first place. This was a thing some time ago. Many of the malware and pirate groups were sharing Tinc meshes though as expected there would at times be one person in the group that would be the weakest link and expose the entire group. Expand the numbers of people doing this and the probability of a few groups using decent operational security will increase.
Most of the big VPN companies known from advertisments all over the internet are probably honeypots of the usual countries.
Add to that that half of these companies are registered in obscure offshore locations where it is practically impossible to even find out who are the ultimate owners.
if you didn't roll it yourself you need to assume that someone is snooping on you
maybe mullvad is legit but their leadership keeps leaning to dubious causes
[delayed]
The point of VPNs often is hiding in the mass. Rolling your own kind of defeats that purpose.
Even very basic browser fingerprinting will still identify you. The IP address is just one of many data points.
Interesting theory. My own theory is that the big corporations want to siphon off more data from people. That is, I think, the main agenda. See android recently stating that everyone has to give up their age. Next step will be ID (though probably, in order to verify the age, one has to give up the ID anyway, so age sniffing could be called ID sniffing).
This looks like a very narrow ruling regarding copyright. It doesn't guarantee that EU bureaucrats won't try to ban VPNs that don't verify user age (for starters to make NPCs support the bans, then they will inevitably attempt to enforce some kind of KYC or logging to "catch terrorists and pedos".)
Discussion on 21-jul-2026 https://news.ycombinator.com/item?id=48997221 141 comments
Yeah.
In particular for "hot" topics like this people should use the search function at the bottom of every HN page before rushing into post.
The last thing everyone needs is yet another duplicate post with hundreds of comments re-hashing the exact same comments that people already made before. It is not helpful for anyone.
Isn't the parent comment almost a duplicate of your other comment?
https://news.ycombinator.com/reply?id=49109868
> VPNs in particular have been tossed around as something that the UK government would like to ban (citation needed/lacking!)
It was widely covered (like at https://www.express.co.uk/news/uk/2217934/vpn-ban-table-july...) and tech sec. Liz Kendall is on the record with BBC talking about July.
Hurray and good. A technology shouldn’t be treated as unlawful simply because it can be used to bypass restrictions. Restrictions which are stupid in the first place in the majority.
I hope VPNs are not becoming the next battleground between online safety and civil liberties. I'm sick of the current ongoing attacks on civil liberties in the Western World under the fake veil of online safety.
VPNs are just tools that sketchy people use for sketchy means. There's no legitimate use for someone who isn't trying to break the law. Allowing these tools let's underage people access porn, and do all manner of undesirable behaviors like accessing region locked content.
I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites.
There are of course some people on the other side who think VPNs are a guarantee of privacy and secrecy on the internet, but that's pretty rare in my anecdatal experience. I largely blame the rampant ads on podcasts for this view.
I think an issue VPNs face is that while your first paragraph is not objectively true, it ends up being truer than I might like because the other use cases are not well covered. If you've got one of the things the HN gestalt would call a non-sketchy use case, you've also got the problem that it's rather hard to verify that any VPN you are using actually fulfills your goals. They can say they do, but you have a very hard time proving it.
On my current fiber provider, I'm already behind a very large CGNAT install. To a large degree, de facto that's already a lot of the "non-sketchy" use cases for VPN covered for me. IP addresses are already one of the weaker signals for tracking people as it is. Mobile networks have been letting you shift IPs for years just by how they work. Other internet providers that don't slap thousands of people at a crack behind one IPv4 with CGNAT didn't necessarily guarantee stable IP addresses, hence the need for dynamic DNS for decades.
The hole VPNs plug is necessary, but not even remotely sufficient if you are trying to actually protect yourself from some attack. Slapping a default Windows 11 install on a VPN to a first approximation protects you from nothing.
And since the "non-sketchy" uses are rather dubious, that really does sort of leave just the sketchy ones. I don't think it's a coincidence that when they pay a YouTuber to advertise them, the YouTuber generally ends up talking vaguely about the protections but fairly concretely about the sketchy uses, with screen shots showing them using Netflix in a different country. The companies know what they're getting used for and what they can provide.
Probably should have put a `>` before the first paragraph, because it reads like an 8/8 bait and most people won't continue to the next one.
Regarding the misleading podcast claims, at least all the podcast and youtube ads made the VPNs popular on the mass market so now they are more difficult to be silently outlawed.
Oops yes, definitely should have done that. Looks like it's too late to edit though
A whole thread could have been prevented with " and ", haha
Putting a '>' would make it look like it's a quote from the article, which it isn't.
Well yeah, it's a strawman, but not unattached to reality.
Lol your comment made me do a double take, I had stopped reading after the first sentence
Logging into my work computer, to work in the company network: yeah very sketchy.
Many people reading this are going to stop at the first sentence without realizing you're paraphrasing a position you apparently don't agree with.
That's amazing. I didn't even realize but it seems I read the first paragraph and the last sentence, concluded "moron" and scrolled down.
It's only because of your comment that I re-read the their post.
What is the sign, that he does not?
"I have actually heard otherwise intelligent people say things just like that"
Meaning the poster finds it surprising that intelligent site operators would honestly think that.
Or saying that his view is also shared by people he considers intelligent, and thus can only be rejected by others, who first need to proof to him, that they are actually intelligent. Aka. an indirect ad hominem.
If the poster agreed with the opinion, they wouldn’t have included “actually” (indicating that they think the reader will be feeling incredulous at that point) and “otherwise intelligent.”
Yes correct, I vehemently disagree with people who say things like the first paragraph. I definitely should have been more clear that that was not my opinion, but it's too late to edit now
VPN is what a smart person uses when they are at an internet cafe or somewhere else with public internet where you can’t trust that the traffic isn’t sniffed by someone for giggles and your bank credentials are going to leak.
How would your banking credentials leak? Every banking app uses encryption. In fact, I'd wager every app uses encryption nowadays.
I've also argued this on the past, it just seems redundant, but people eat the VPN ads like they were gospel.
Let’s say a hacker hooks up the hotel internet to a firewalla and opens a free wifi spot. You log in and it sees from your traffic that you’re a customer of ABC bank and Gmail and ATT from the traffic - next thing you know you get a text message from your “bank” that someone has stolen your credentials in “XYZ Arizona” and you have yourself a phishing attack. The exposure scenarios are only limited by the imagination of humans and modern LLMs.
This doesn't seem novel in any way, given the amount of data available online you can already be targeted by fake bank texts, no need for the free wifi hotspot.
I just use my home router as VPN to not care if the 100 apps om my phone have a working encryption. I also use it to access my home services so that they are not exposed to the internet. I also use it to limit exposure on my VMs on a cloud hoster.
Not only that, but the iOS and Android APIs for HTTP requests make it really difficult to accidentally use unencrypted HTTP:
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
thats why we have https and certs. VPN is redundant
Redundancy is not detrimental to security and privacy. On the contrary, having more layers would protect you in case one of them fails (zero-day, bugs, etc.)
If there's a zero-day in TLS there would be a huge amount of problems that a VPN wouldn't protect you against. Even if you're using a VPN (or just a trusted ISP from your home), as soon as your data leaves their hands it would be vulnerable.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
TLS exists.
I want to applaud your choice to not include anything like quotes here. That would be misleading because it isn’t an actual literal quote. And, we’re too used to just skimming posts here before jumping right in to argue against them.
Meta: your first paragraph could really use a quotation indicator / mark. I suspect it was intentional: the ragebait was very effective on me before reading the rest of your comment (I was ready for defend my usage of tailscale to access my iot stuff).
>I have actually heard otherwise intelligent people say things just like that, including site operators who run nontrivial websites
This is an illusion we really need to remove from our collective consciousness. Running a popular website while being an ops genius, being a neurosurgeon who saves lives every day or being the world's best architect doesn't mean someone has sound opinions on topics right outside their area of expertise.
In fact, nowadays it seems to be all about appeals to authority which IMHO makes us more ignorant because many people seem to not think critically anymore. Instead, it's just "an expert said so" - then you look into the "expert" and in many cases they either aren't actually an expert or they're a paid shill. But that's a topic for some other day.
This is going to get some interesting responses by people commenting immediately after only reading the first paragraph.
I wanted to respond with something of substance (I still don't understand if it was a paraphrase or not) but every reply here is a meta reply, so hello to all fellow meta reply guys.
> Allowing these tools let's underage people access porn
You can't imagine how much crime I committed in my teenage years. You don't wanna end up like me, punks! Stay off that crap!
Region locking content is the undesirable behavior. Accessing it is very desirable.
I'm genuinely considering whether the people replying to you are bots now.
Bots wouldn't miss the middle paragraph.
Maybe put some quotes around that first paragraph. Seems like some people downvote you before they get to the part where you reveal you don't think that way
TIL every corp in the world are sketchy people for using VPN.
yes, assuming your laws are like "Only blue eyed males are allowed to have internet"
This is the must absurd take possible. Most business use VPNs for their day to day operations.
I think you need to read the second sentence.
His whole comment contains a view, that some people, including elected officials hold. I don't see an aspect, that actually hints, that he means that in a sarcastic way(, besides that he is on HN).
"I have actually heard otherwise intelligent people say things just like that" I think that is the indicator.
His second sentence is "There's no legitimate use for someone who isn't trying to break the law."
I'm not trying to break the law, I use it for my corporate usage, therefore it is legitimate use.
What are you trying to say?
I think they're trying to say you need to read the whole comment before taking it apart.
> What are you trying to say?
Pretty sure they meant “second paragraph” instead of “second sentence”.
Yeah, basically. To me it sounded like he was doing a sarcastic quote, then shutting that opinion down.
flagged for intentional ragebait, if this wasn't ragebait you would have used quotes
This is the dumbest thing I've read in a while
You didn’t manage to read the entire comment, did you?
"You don't have to eat the whole egg to know that it is rotten." (G. B. Shaw)
How do you think you can work from home with a VPN for access of the companies network?
Edit: missed the second paragraph
You can't do much with VPNs these days, almost any website now has antibot systems and it's actually kid's play to detect whether you are on VPN or not.
Jup, if you are using any mainstream VPN provider (the ones shilled on every tech YouTube channel) or anything that results in a datacenter IP, it is trivial to discover and block.
The detection tech has been around forever: https://focsec.com/
Week old post OP;
[dupe] Discussion on source: https://news.ycombinator.com/item?id=48997221
First question that need to asked from everyone including ownself , why you need VPN?
Primary use I have for it is hosting internal services that I don't want on the public internet - do the same at work, it reduces the attack surface hugely
I know what you mean, but I think most people are not thinking of it in this way. They are thinking of VPN as a service provided by companies such as Nord VPN, and mostly used to get around region locked content or keep your ISP from being aware you are downloading things you shouldn't be.
https://femboy.beauty/P1iUdl
You must be blessed to live in a country that has no website blocks.
My ISP Comcast (rebranded to Xfinity to avoid all the negative associations with it's actual name) does man in the middle attacks on HTTP connections and injects javascript code into webpages. I actually had this happen to the steam browser back in ~2013 and I had to restart it. But they still do it today in 2026. I don't use a commercial VPN because I host from home. But I do tunnel my HTTP browsing to a remote VPS I rent.
Is that really a question that needs to be asked in 2026?
I just loaded up Bluesky this morning to discover it demanding proof of my age bc I live in Texas. First thing I did was turn on my out-of-state vpn and try again. not today, satan!
FYI, this recently changed to only apply to the mobile app. Browser access and 3rd party apps are not restricted.
To bypass geo-locked content and age restrictions of course. What else???
There is a big discrepancy here. EU courts babble about lawful xyz. While they are doing so, national legislation goes downhill, e. g. mandatory age sniffing and other restrictions to come (I claim the age sniffing will come on the OS level, Google recently announced Android will do so, so you can already see the corporate agenda being pushed into democracies here). So I consider the EU courts to just act as decoy, aka "look how everything is legal". Well, a few years later, VPN will be banned. And the EU courts will be in agreement with that.
It's a step-by-step strategy.
Are you implying the EU court is (secretly) cooperating with national legislative bodies to implement surveillance tools while pretending to uphold civil liberties?
The UK government recently said it was not going to ban VPNs
https://www.independent.co.uk/extras/indybest/gadgets-tech/v...
privacy is a right, until you don't have a voice to say so.
I don't connect to internet without VPN nowdays. Too much tracking today.
Why is something like ublock origin not enough for your needs? Is it more about the principle of not wanting to share any fingerprint across the Internet, or some specific tracking concern?
Your webbrowser is not the only application connected to the internet
Server side tracking.
How are you not blocked by banking, shopping, even sometimes google search?
There are inconveniences, but some protection is better than no protection. Trying to protect your privacy online is not a zero-sum game.