YHK - yet another hacker news clone

I'm a security guy. I know a lot of these privacy-minded folks.

They are not the types to accept enshittification and they are the types to read these news. As soon as they discover something else, they're off.

Good luck proton.

> an engineer asked for a few days to pentest new code before shipping it, and CEO Andy Yen answered that it was “bullshit and loser thinking”

Wow my first exposure to Andy Yen shouldn’t have been this one. I’m seeing a loser here and it’s not the engineer…

Related:

"Manifestos, Fear, and 'Loser Thinking': Inside Proton's AI Reckoning" https://news.ycombinator.com/item?id=50289692 90 comments

"Proton goes all in on using AI" https://news.ycombinator.com/item?id=50296602 117 comments

"Proton to 'Re-Interview' Staff About AI to See Who Gets to Keep Their Job" https://news.ycombinator.com/item?id=50251062 48 comments

"Proton's CEO Cancels AI 'Re-Interviews" https://news.ycombinator.com/item?id=50307183 254 comments

What is it about AI psychosis that makes leaders act like assholes?

I definitely think that me and my team need to push ourselves to rethink how we work. Sometimes I have to push top-down, but I'd rather this happen in a measured way that's a combination of bottoms-up and top-down.

> Beyond the clumsiness, it shows a leadership that now treats the constraints that made Proton worth paying for as the thing slowing it down.

Exactly. The product is security and privacy. The thing being sold is that. If anyone could justify being slower to pentest, it is Proton.

I do wonder who would be demanding that Proton move faster. Would any user of their service ask them to sacrifice these attributes?

This just confirms to me that the devs who are furthest from users (platform and security folks) are still in denial about AI for coding. The idea that they continue to react to security and privacy threats by relying on hand-crafted code is ostrich-like denial of the reality of daily security breaches at much larger, better resourced companies.

AI is a tool - like a compiler or a pen-testing tool or maybe like an uber-tool that can do all those things and more. It's not hard. 24 hours - put your best pentester against GLM-5.3 abliterated (host locally, so there's no data leakage to LLM providers). You know who will win and it won't even be close.

"For most companies, trading some caution for speed is a reasonable call. Proton is a privacy company, though, and what its users pay for is the confidence that the people building it are careful. Shipping slowly and carefully is part of what they’re selling"

This is the core of it for me. There are many, maaany companies that don't want to be what they are. For example: Meta doesn't want to be a social media company - so it lets facebook rot, makes 10% of its total revenue from scammers advertising to its customers, which seem to mostly be vulnerable old people and focuses on VR and AI.

I guess Proton is having that same problem. I don't really want to be part of that though.

Don't know if Proton has any shareholders, but I they do, I hope they understand the CEO's position has become untenable, no matter his other real or imaginary qualities. It is (surprisingly) not uncommon for CEO's to have no clue about the business they are leading, but most of them at a minimum understand they should not spook their own customers. If Proton wants to restore trust, they need a leader that at least does not openly trash the company's own offerings.

Aside, with age becomes a deeper understanding of how realistic the Dilbert cartoons are.

FWIW the team is receptive to bug reports with concerns about the direction the company appears to be heading.

> A lot of the reactions treat this as an AI story, as if any AI-written code poisons the well, and I think that misses the point. Engineers using AI to write code is the new norm.

It is not the norm for any engineer, or any company, who cares about the quality of the product. I will not say there are zero people who care who are trying to use LLMs to write code, because that isn't true. But neither is it true that most engineers find the tool useful. It is still wildly controversial in the programming community, contrary to what you state here.

> For most companies, trading some caution for speed is a reasonable call.

That isn't a reasonable call for any business, but it is an especially bad call for a business which sells itself on offering greater security.

My issue with what happened at Proton is twofold: first, the CEO treats his workers like dirt. That isn't a company I wish to do business with no matter how good their product is. Second, the CEO is in the full grip of AI psychosis, telling his engineers to use the tool just because it's trendy, not because it actually produces good results. That suggests that the product Proton produces will, sooner rather than later, turn into AI slop, full of bugs. I wouldn't wish to do business with such a company even if the CEO were a nice guy. So Proton now has a product going downhill, and a CEO who is a jerk. I'm not sticking around for that. I could just pay Microsoft if I wanted that kind of experience.

I've had one eye on the Proton exit since they made it clear they were not disintangled from Big Tech nor politically neutral. Then they kept blocking discussions about it on their reddit: https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...

related: not touting to be the most secure (yet), but gnomail dot io exists.

The company is cooked due to the CEO being a complete a-hole. AI or not, his behavior is unacceptable for ANY organization. Behavior like that is to be severely punished.

Crypto AG is Swiss encryption company that was revealed to be selling compromised chips for decades also had engineers raise security issues, only to be dismissed and redirected to work on something else, over and over again as different people found the same things

It was revealed to be owned by the CIA and German intelligence, formed in 1952 and secretly purchased by intelligence agencies in 1970

The customers relied on Crypto AG for their industry trusted privacy claims and “because Switzerland”

Looks exactly like everything wrong with Proton and its customer base despite so many obvious flaws to how Proton behaves, how their customers talk, justifications for how their anti spam measures undermine all of their privacy and records claims, and now the CEO dismissing engineers security concerns

I'm a paying proton customer, I migrated last year from the horror that is Office365 (or Copilot 365 or whatever they call it now) and before that I migrated from Google Workspace. In direct comparisson, proton is the best product for me - and that does not include privacy or security things, just stuff like generall UX and featureset. Yes, they have some annoying bugs, but so did the others.

I think the AI backlash against Proton so far is unwarranted. It is purely speculative and based on make-belief. I am a dev myself, I use AI more and more, and I have no more long-term experience than the next dev. But so far the claim that using AI in your corp and workflow will result in buggier, shitty code is not true on a broad scale. It is certainly not true for proton, at least I don't see service quality detiorating for my service. I think it is a tool, and what you get out of using it still depends on the skill of the craftsman.

As a customer, I do demand stable service and the promised saftey and security. But I also demand low prices and a product that can compete with the market. Now, the market is Google and Microsoft - two companies we don't even need to question if they lay off people due to AI usage. Proton is kind of under pressure to compete on a product level in a pretty much david-against-goliath situation. We see AI-assisted exploits such as the Linux use-after-free from Anthropic and can't blame Proton for restructuring their dev process to incorporate AI to find exactly these kind of security issues. I wouldn't even feel comfortable as a client if proton whipped on a "human code only" label on their services.

As a proton customer myself, I've changed email providers before, and it isn't easy.

When I recommend for someone to try proton, I recommend they do so with a custom domain for their email address.

That way, if something goes awry at proton, they can set up service elsewhere while keeping their same email address.

I only considered Proton for security/privacy.

Their lots of half-baked products added since already reminded me of the Mozilla slide to irrelevance.

This seals the deal. I am OK if they use AI to enhace their productivity. I do care if they want to use AI to "move fast and break things" not giving a damn for stability and careful testing, think craftmanship and careful development is for losers, or speak to their employees like that.

This CEO reminds me of Martin Shkreli. He should be laid off. Do they have a board that cares? An ideal company for services like Proton's shouldn't be for profit to begin with.

I believe the harm is irrevocably done now. In the middle of cybersecurity frenzy hearing about that verifications, making sure something is done properly at a security focus organisation has lower priority than speed, that left a mark in a very sensitive spot. Central one. I pay more than I use because of getting comfy after a capabilities exploration, and some idealistic reasons too, despite a few UX matters I found clumsy (this word from the article resonates with my feelings) and I never got to fully like the way they present the service. But this is now beyond ideals and comfort. I lost trust with their attitude shining through and their clumsy way in general. I should first switch to a base subscription, loosing one or maybe two aspects I use from a higher tier. It did not come at a fortunate time when I lack any spare time and energy for this, figuring out how much I will miss exactly, but I will have to do it. Figuring out what happens exactly on degrading my subscription. Some guide about 'what happens if' would be very handy now.

> Yen was fine with pentesting, as long as it didn’t slow down the pipeline.

Wash me but don’t get me wet.

That's why you don't have to share with the head honchos what you are doing in your time. They don't know the domain, so if they act like that, you don't share with them the details. It took this much time. At the end of the day he can brag about AI blabla and the engineers will sleep well. End of story.

Proton mail already starts to become confusing. So much clutter and useless dialogs. The latest is that when you try to logout it asks something about potential identifiers left on the computer and if you are curious you have to read a wall of blabla text. Complete nonsense.

Engineers are already way much faster with the help of AI... so the CEO might have had a tad bit too much cocaina this time.

Put the CEO in a cage, and no food for 3 days :D.