this post was submitted on 10 Apr 2024
311 points (97.3% liked)

Technology

34125 readers
70 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.

Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.

Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
[email protected]
311
Proton picks up Standard Notes to deepen its pro-privacy portfolio (techcrunch.com)
submitted 4 months ago by [email protected] to c/[email protected]
78 comments fedilink hide all child comments
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 56 points 4 months ago (1 children)

I was really dissatisfied that notes are always somehow weirdly shared with a propriatary backend. There is jtx Board which uses your CalDAV calendar (Nextcloud, Radicale, etc.) as a backend which is really cool. The UI is also OK, but there seems to be no (Linux) desktop app for that.

So I started https://github.com/jeena/JNotes because I was curious about developing for GNOME anyway. It's going very slowly - because I am a stay at home dad with a one year old who demands all my attention :D - but it's going forward, but I guess it'll take another year before it's usable ^^.

Actually I was hoping that there would be more notes apps using standard backends like CalDAV or IMAP, but it's almost impossible to find something, everyone seems to want to implement their own backend and then charge for the synchronization.

[–] [email protected] 12 points 4 months ago (2 children)

None of those standards are e2e

load more comments (2 replies)
[–] [email protected] 46 points 4 months ago* (last edited 4 months ago) (1 children)

So... this was the plan of the Standard Notes guys all along? Now it makes sense why they never made open-source and self-hosting a true priority.

Let's see what Proton does with this, but I personally believe they'll just integrate it in Proton and further close things even more. The current subscription-based model, docker container and whatnot might disappear as well. Proton is a greedy company that doesn't like interoperability and likes to add features designed in a way to keep people locked their Web UI and applications.

Standard Notes for self-hosting was already mostly dead due to the obnoxious subscription price, but it is a well designed App with good cross-platform support and I just wish the Joplin guy would take a clue on how to design UIs from them instead of whatever they're doing now that is ugly and barely usable.

[–] [email protected] 11 points 4 months ago* (last edited 4 months ago) (2 children)

Doesn't proton open source everything they do? Iirc, proton mail, calendar, vpn, drive, and simplelogin are open source under GPL v3 on github.

[–] [email protected] 13 points 4 months ago (1 children)

Yes the clients are open source but the server part is closed and it's a big missing part

Now, better to be 50% oss than 0%, but it's not a community effort. Most commits are done behind the scenes and then published when app is released. This causes most pull releases to be rejected as the problem was already fixed internally months before. It's more like "source available"

[–] [email protected] 3 points 4 months ago

Ah ok, yeah they should definitely be more transparent then.

[–] [email protected] 4 points 4 months ago* (last edited 4 months ago) (3 children)

There’s no vendor lock in until you realize your emails are essentially hostage of their apps and a bridge that may be shutdown at any point. If you can’t simply setup a regular email client then there’s vendor lock in, not even Microsoft does that.

[–] [email protected] 7 points 4 months ago (1 children)

Huh? This is not true. Proton have an app that exports all your emails for reimport into the platform of your choice.

[–] [email protected] 6 points 4 months ago

The issue not that you can’t export in bulk, you’re locked into their apps daily. Every other email provider out there uses standard protocols that allow for any client to be used.

Besides, the export feature is all fun until you actually have to use it. There’s a bunch of metadata that gets lost, contacts, calendars and notes are exported in JSON with propriety structures that other systems can’t deal with. Note that there’s also CardDAV/CalDAV as open and interoperable solutions for those issues and they device not to use them.

[–] [email protected] 6 points 4 months ago (1 children)

They say the reason for needing their bridge is the encryption at rest, but I feel like the better way to handle wanting to push email privacy forward would be to publish (or better yet coordinate with other groups on drafting) a public standard that both clients and competing email servers could adopt for an email syncing protocol for that sort of zero-access encryption that requires users give their client a key file. A bridge would be easier to swallow as a fallback option until there's wider client support rather than as the only way.

A similar standard for server-to-server communication, like for automatic pgp key negotiation, would be nice too.

Still, Proton has a easy to access data export that doesn't require a bridge client or subscription or anything. I think that's required by GDPR. It's manual enough to not be an effective way to keep up-to-date backups in case you ever abruptly lose access but it's good enough to handle wanting to migrate to another provider.

[–] [email protected] 2 points 4 months ago (13 children)

I agree 100% with your ideia. The best path for this would've been for them to actually design that system you describe and THEN implement it on Dovecot and Postfix in their own fork or a Dovecot extension / Postfix add-on so others would start using them. Eventually after some times and other providers also optionally supporting the thing an RFC could be written. This is the usual course we see with protocols/extensions and is what should've happened here.

I want to share another thing, before Snowden there was Lavabit, they also did "encryption at rest" and the user password involved for some parts of the information and it was proven to be effective. It wasn't a perfect model but it was certainly better than the havoc Proton did to e-mail by opening the precedent that is okay not to run on standard protocols.

What Proton is doing to e-mail is about the same that WhatsApp, Messenger and others did to messaging - instead of just using an open protocol like XMPP they opted for their closed thing in order to lock people into their apps. People in this community seem to be okay with this just because they sell the "privacy" cool-aid.

server-to-server communication, like for automatic pgp key negotiation, would be nice too.

I'm not sure if this is required. Any decent e-mail server uses TLS to communicate these days, so everything in transit is already encrypted.

Still, Proton has a easy to access data export that doesn’t require a bridge client or subscription or anything. I think that’s required by GDPR.

Yes, they have it because GDPR does require it. It works, but it's not a real time sync alternative to anything and it is some kind of vendor lock-in.

As I said in other comments, not using standard protocols only makes thing worse. I used iOS as an example, for Android you can get a bridge but that’s just going to be one more thing going for your battery.

Now, consider this, there’s a TON of situation where having a standard SMTP-capable provider is interesting. Maybe you’re running in iOS, maybe you want to have an ESP32 to send a few emails, or some custom software in your computer. All those use cases are impossible or require more coding and more non-standard solutions just because Proton decided to be the first provider ever not to use standard protocols.

[–] Croquette 2 points 4 months ago (1 children)

Do you have a privacy oriented email provider alternative to proton?

I have my domain name, but I don't want to manage an email server on my server.

load more comments (12 replies)
[–] [email protected] 5 points 4 months ago (3 children)

I think proton bridge is open source as well. I have all my emails locally on thunderbird

https://github.com/ProtonMail/proton-bridge

load more comments (3 replies)
[–] [email protected] 37 points 4 months ago (1 children)

good for them, love to see proton continuing there growth I pay for protonmail plus and definitely am happy to do so, for actual private email

[–] [email protected] 10 points 4 months ago (3 children)

I pay for the same but may go down to their free tier. After a purge of email and emails with larger attachments I'm down to less than 500mb. The only thing I dislike on the free tier is their automated signature to advertise proton. I hardly ever send emails though so not too much of an issue.

[–] PiJiNWiNg 9 points 4 months ago (1 children)

I went with Pro for the custom domains and catch-all inbox. Now I can give out [email protected] and it will get back to me. It's nice for easily identifying phishing, plus you can set up filters to trash emails to a particular address automatically, so if one of your addresses gets compromised you can just filter them out. Also, it's nice to see who's selling your info!

[–] [email protected] 2 points 4 months ago (3 children)

I do pay for SimpleLogin and will continue to do so. The only place my actual proton email address is exposed is on SimpleLogin. Every site I use on the internet has its own alias. That's 350+ sites currently.

The only downside to a catchall, as I see it, is someone could just start creating any random email address knowing it will find your legitimate mailbox. Also sending as any of the aliases can be a pain.

[–] [email protected] 3 points 4 months ago

Compared to simplelogin (or proton pass aliases, addy, firefox relay, etc), one other downside of a catchall is in associations across accounts. Registering with a @passmail.net address implies that I use Proton; registering with [email protected] implies I have access to that domain. If 10 data breach leaks have exactly one account matching the latter pattern then that's a strong sign the domain isn't shared. If one breached site has my mailing address, my real identity can be tied to all the others.

load more comments (2 replies)
[–] [email protected] 5 points 4 months ago

Keep paying so some other poor fuck has a free vpn and e-mail

[–] [email protected] 2 points 4 months ago (1 children)

honestly half the reason I pay is mainly just to support proton. But I do also like having the ability for the more than 1 Email

[–] [email protected] 2 points 4 months ago (1 children)

More than one email?

I don't disagree but paying £40 a year to remove a signature seems excessive. I'd actually like to go for Unlimited but can't justify the cost.

load more comments (1 replies)
[–] [email protected] 36 points 4 months ago (1 children)

Proton's alternative to Google Docs getting closer? 👀

[–] [email protected] 13 points 4 months ago (3 children)

It will really hard or impossible to reach the level of development that ms and google have in their cloud collaborative products. They don’t have the resources like the mentioned two monsters.

[–] [email protected] 22 points 4 months ago (1 children)

A single coder made photopea which is near feature parity of photoshop. I think the Proton team can figure out a docs suite

[–] [email protected] 18 points 4 months ago (1 children)

It may require intense passion and a manic episode to do something like that with one coder or a small team, which is hard to arrange bureaucratically.

[–] [email protected] 17 points 4 months ago

Or a burning hatred of proprietary systems

load more comments (2 replies)
[–] [email protected] 24 points 4 months ago (1 children)

Not surprising. Proton seems to be exploiting the niche of “privacy” . I haven’t seen anything to the contrary other than turning over metadata due to court order.

[–] [email protected] 13 points 4 months ago (1 children)

exploiting

Yes, that's the right word for it. :)

[–] [email protected] 3 points 4 months ago

True Swiss style

[–] [email protected] 19 points 4 months ago (1 children)

Mixed feelings on this, as a user of simplelogin, proton and standard notes as individual services for the last 4+ years I love them all, and trust proton.

However one of the key reasons for choosing those services was they were isolated, and without risk of vendor lock in or single points of failure... Depending how this goes it could be great, I just hope they don't force/push integration with proton too much. Maybe I'm just being a FUD pusher. Certainly equally a chance this is great for both proton and StandardNotes. SN has lacked development on a fair few plugins recently so hopefully this aids that.

[–] [email protected] 8 points 4 months ago (2 children)

I appreciate this perspective and that was also my immediate reaction. Then I realized, as long as I can easily export my data and move elsewhere, I shouldn’t be too concerned.

[–] [email protected] 3 points 4 months ago* (last edited 4 months ago) (1 children)

I dunno, Google Takeout exists, and I still have plenty of concerns about their offerings.

Oddly, Google Keep Notes isn't included in Takeout...

[–] [email protected] 4 points 4 months ago

Google nearly went through trouble to make sure that takeout is a pain in the ass to import anywhere else.

As a matter of fact anytime I use any company's product and try to export it from there and import it somewhere else it goes horribly wrong.

I don't want my text documents in HTML.

load more comments (1 replies)
[–] [email protected] 17 points 4 months ago

I feel so wise now for having landed as an user of both independently

[–] [email protected] 8 points 4 months ago* (last edited 4 months ago) (1 children)

Ahhhh!!!!

I literally, just purchased a subscription to Joplin Cloud! I already pay for Proton Unlimited and was tossing up between Joplin and Standard Notes.

What a bummer... I bet Proton adds this as an additional service to Proton Unlimited.

[–] [email protected] 15 points 4 months ago

It'll probably take time though until it's available

[–] [email protected] 6 points 4 months ago

This is the best summary I could come up with:

In a press release announcing the move, Proton emphasized the pair’s “shared values,” including the use of E2EE; a commitment to open-source technology; and how neither has relied upon venture capital to drive growth.

This includes building on its first acquisition — email alias startup SimpleLogin, which it acquired in 2022 — as well as developing and launching fully fledged password manager app Proton Pass in June.

So the company is evidently not allergic to user acquisition and other consolidation-based growth opportunities where it sees enough philosophical overlap plus the chance to deepen its technical bank.

“The deal is a strategic decision designed to benefit users by bringing to market secure, easy to use, private products that anyone can access,” Proton wrote.

“Standard Notes and Proton engineers will begin working together immediately to ensure their combined skills and experience bear fruit for users as soon as possible.”

Asked about the sustainability of pro-privacy business models that don’t rely on exploitation of user data — when so much of mainstream tech still continues to roll in the opposite, data-mining direction — Yen emphasized the need for long-term thinking by privacy startups.

The original article contains 967 words, the summary contains 190 words. Saved 80%. I'm a bot and I'm open source!

load more comments
view more: next ›