71 comments

[ 0.67 ms ] story [ 35.5 ms ] thread
I'm a security guy. I know a lot of these privacy-minded folks.

They are not the types to accept enshittification and they are the types to read these news. As soon as they discover something else, they're off.

Good luck proton.

yep, Proton is in the business of trust as a service. Surprised that they think differently.
There's still a pipeline of them coming to Proton from Google and Microsoft, with about as little research as when they decide to leave Proton.
Proton has always been a sham. Their users may be privacy-minded, but not privacy-competent.
Please teach us your ways privacy guru (no, really) (also make it convenient and easy to use)
Yeah, I don't know about their expanded suite nowadays, haven't paid attention, but their original mail service was mostly just marketing.

"Encrypted email" as if all of your mail isn't in plaintext anyways because no one is using PGP. And if you're emailing Proton to Proton... well there are more convenient encrypted messaging platforms.

> they're off.

Help me out here — to where?

I have good experience with mailbox.org. I've heard good things about tutanota.

I'm not the most privacy-minded guy though.

> an engineer asked for a few days to pentest new code before shipping it, and CEO Andy Yen answered that it was “bullshit and loser thinking”

Wow my first exposure to Andy Yen shouldn’t have been this one.

It's a really bad look, I saw that Proton issued some sort of half-baked apology. But nothing from Andy.
Yeah, I don't care what the social media account manager's crisis management position is, I care about the direction the company is being steered in and the person doing the steering.
> Wow my first exposure to Andy Yen shouldn’t have been this one. I’m seeing a loser here and it’s not the engineer…

Yeah, I have no horse in the race as a non-user of Proton, but even if you completely removed AI from the situation entirely, if I worked for a CEO that ever used the term "loser thinking" non-sarcastically that would be enough to get me looking for another job.

And if I were a customer, get me looking for another provider.

I thought it was more, devs refused to use AI that caused the ceo to respond (in a bad way)

I agree, you cant just let AI take over critical projects, but to not use AI, is just letting the bad guys use AI against you. Its a tool, use the tool, make the tool work for you.

What is it about AI psychosis that makes leaders act like assholes?

I'm a technical co-founder. I definitely think that me and my team need to push ourselves to rethink how we work. Sometimes I have to push top-down, but I'd rather this happen in a measured way that's a combination of bottoms-up and top-down.

The sycophancy I would say
Putting aside the comment on slack this guy made, because I haven’t seen the full context, have you read the internal memo on AI the Proton CEO put out? It was surprisingly reasonable to me, which made it kinda funny that 404 was breathlessly sharing it as some kind of gotcha. Made me really distrust the rest of their reporting on this.

But maybe that’s just my own AI psychosis talking…

> Beyond the clumsiness, it shows a leadership that now treats the constraints that made Proton worth paying for as the thing slowing it down.

Exactly. The product is security and privacy. The thing being sold is that. If anyone could justify being slower to pentest, it is Proton.

I do wonder who would be demanding that Proton move faster. Would any user of their service ask them to sacrifice these attributes?

I hazard a better reasoning: The walled garden made it's users too valueable to not sell out to whatever forces it can find.

Apple is deeply in this camp; all it takes is one MBA's desire for bonuses to break the damn.

Corporations in unregulated waters are only as solid as the last captain.

> I do wonder who would be demanding that Proton move faster.

Whenever I see "hosted in Switzerland" my mind immediately goes to the Crypto AG scandal.

From 404's reporting,

> “Due to insufficient velocity,” Proton is not on track to achieve its annual recurring revenue target by the end of the year, one internal document obtained by 404 Media reads. Proton’s year-over-year growth is also “far away from what the market today considers to be good,” and, “By all metrics that matter, we’re an underperforming company.”

So, the "market" is demanding it?

They aren’t public, so these are their own lines in the sand.

They are cash flow positive.

I guess capitalism just needs constant, unsustainable growth. Until your product and ideals are a hull of what it once was.

Not the market, the overall market, at least not directly. Their shareholders. Proton Foundation is the majority owner, so essentially they are demanding it as they have the power to set the ARR target that success is being judged by.

So basically: money, and their desire to have more of it, is demanding this.

Not shareholders. The CEO of the company and the CEOs of top investment firms are making the operation decisions to enrich themselves. The shareholders that paid money for their stock are the bag holders. The people getting rich whether a company succeeds or fails didn't invest a dime of personal money into the company.
A company like Proton shouldn't be for-profit to begin with.

But in the case it is, it should be run as a careful privately owned business, that takes pride in their products, not a profit machine.

It seems the majority owning "foundation" does little to ensure that, if they're not the ones pushing for more profit and faster delivery of crap

"Proton was created to serve the world, and the non-profit Proton Foundation ensures that this can never change. As Proton’s primary shareholder, the foundation exercises its control to ensure that Proton does not deviate from our mission to build a better internet that serves the interests of all of society. Our legally binding purpose is to further the advancement of privacy, freedom, and democracy around the world."

You actually can be for profit and profitable. It's the ever increasing shareholder growth that pushes you. Once shareholders demand compromise of the company values, the company values are compromised.

Sorry for the corpo speak, but this time I'd say it's clear and warranted.

One of the saddest things with these companies is that they can't be "done". Run a sufficiently profitable business for long term. Instead it is always more growth. I think we could have companies that don't grow more than say inflation and still make reasonable profit. But sadly it is not enough so running them to ground is inevitable.
I think Proton leaderships saw that 'email with pgp wrapper outside hyperscaler servers' is a crowded space today, so now they are doing the whole 'proton workspace365' and they are falling short at it (I'm a paying user and for my own personal needs the workspace like features are bearable, but not good, unlike email/pass which are ok) so they are getting nervous.

If it was any other company we wouldn't even care, but if your marketing is 'big cloud is bad look at us we are so moral and so caring and respectful with you and your data' and they shit the bed like this in front of the users that are paying because they bought on this vision...

As a paying customer, I wish they would first the products they already have. E.g. shortcuts rarely work in the Proton Mail web interface last time I tried it. Or if I share folders with a family member, they don't get actually synced by the Proton Drive client (they can only be accessed through the web interface).
Has their honeypot money dried up due to USAID cuts?
This just confirms to me that the devs who are furthest from users (platform and security folks) are still in denial about AI for coding. The idea that they continue to react to security and privacy threats by relying on hand-crafted code is ostrich-like denial of the reality of daily security breaches at much larger, better resourced companies.

AI is a tool - like a compiler or a pen-testing tool or maybe like an uber-tool that can do all those things and more. It's not hard. 24 hours - put your best pentester against GLM-5.3 abliterated (host locally, so there's no data leakage to LLM providers). You know who will win and it won't even be close.

> like a compiler

Quite unlike a compiler. I don't know about yours, but nobody destroyed thousands of books, started gas powerplants or illegally cut hundreds of thousands of trees to make mine.

> AI is a tool - like a compiler or a pen-testing tool or maybe like an uber-tool that can do all those things and more.

With expert supervision, absolutely.

I use AI daily. It still makes plenty of mistakes and need plenty of oversight to be useful.

"For most companies, trading some caution for speed is a reasonable call. Proton is a privacy company, though, and what its users pay for is the confidence that the people building it are careful. Shipping slowly and carefully is part of what they’re selling"

This is the core of it for me. There are many, maaany companies that don't want to be what they are. For example: Meta doesn't want to be a social media company - so it lets facebook rot, makes 10% of its total revenue from scammers advertising to its customers, which seem to mostly be vulnerable old people and focuses on VR and AI.

I guess Proton is having that same problem. I don't really want to be part of that though.

Don't know if Proton has any shareholders, but I they do, I hope they understand the CEO's position has become untenable, no matter his other real or imaginary qualities. It is (surprisingly) not uncommon for CEO's to have no clue about the business they are leading, but most of them at a minimum understand they should not spook their own customers. If Proton wants to restore trust, they need a leader that at least does not openly trash the company's own offerings.

Aside, with age becomes a deeper understanding of the realness of the Dilbert cartoons were.

They do have shareholders, but the majority is held by the Proton Foundation.
I think that trust is burned already. I moved away from Proton to a German provider that sponsors its own infrastructure to be developed as FOSS (yes that means they are commoditizing their own product, but it is the SERVICE that's paid for).

Having shareholders means that the company WILL NOT continue to serve their customers. Any company that has external shareholders is untrustworthy. Everybody should consider them as disposable. It doesn't mean that you cannot have a deal with them, now but the parties should be aware that anything that you share will be misused. So if Proton has any external shareholders, it is already untrustworthy to me.

Therefore, they cannot really gain any trust by being activist shareholders and change leadership. They already supported a certain "persona" to make them money.

Looks like Andy Yen, the CEO, was one of the OG founders back in 2014?
FWIW the team is receptive to bug reports with concerns about the direction the company appears to be heading.
> A lot of the reactions treat this as an AI story, as if any AI-written code poisons the well, and I think that misses the point. Engineers using AI to write code is the new norm.

It is not the norm for any engineer, or any company, who cares about the quality of the product. I will not say there are zero people who care who are trying to use LLMs to write code, because that isn't true. But neither is it true that most engineers find the tool useful. It is still wildly controversial in the programming community, contrary to what you state here.

> For most companies, trading some caution for speed is a reasonable call.

That isn't a reasonable call for any business, but it is an especially bad call for a business which sells itself on offering greater security.

My issue with what happened at Proton is twofold: first, the CEO treats his workers like dirt. That isn't a company I wish to do business with no matter how good their product is. Second, the CEO is in the full grip of AI psychosis, telling his engineers to use the tool just because it's trendy, not because it actually produces good results. That suggests that the product Proton produces will, sooner rather than later, turn into AI slop, full of bugs. I wouldn't wish to do business with such a company even if the CEO were a nice guy. So Proton now has a product going downhill, and a CEO who is a jerk. I'm not sticking around for that. I could just pay Microsoft if I wanted that kind of experience.

Sorry friend, this is just blatantly false in late 2026. 92% of software engineers use AI coding tools every day. The list of luminaries in our field now coding with AI is much longer than the list who are avoiding it.

The flip side is that only a third of devs trust the AI code, which is wise depending on what that means exactly, but that’s a different claim than the idea that if you care, you don’t use LLMs to code, and that it’s wildly controversial in our field to code with AI. It was, like two years ago. It’s not anymore. Sorry.

And I have no idea where to start on the idea that it’s never reasonable to trade caution for speed. I can only conclude you’ve only ever been one of those employees who doesn’t understand your actual job: to deliver value to the business so it can make money. Your job isn’t to be careful and build a beautiful elegant system so it can exist. You’re there to solve a problem in a timeframe where the ROI of paying you is positive. If you exercise endless caution and never ship anything, you will have thus failed at the actual job.

You are rightly tearing his argument apart, but you have swung too far.

It is possible to sell trust and security as the major feature. If that's the case, then skipping security testing in favour of more features is not what most of your customers want. Especially if the CEO is so arrogant about it.

And maybe such a product is not the best money extracting operation. That can be ok, if the company/shareholders is ok with it... If not, things are misaligned somewhere.

(comment deleted)
related: not touting to be the most secure (yet), but gnomail dot io exists.
The company is cooked due to the CEO being a complete a-hole. AI or not, his behavior is unacceptable for ANY organization. Behavior like that is to be severely punished.
Crypto AG is Swiss encryption company that was revealed to be selling compromised chips for decades also had engineers raise security issues, only to be dismissed and redirected to work on something else, over and over again as different people found the same things

It was revealed to be owned by the CIA and German intelligence, formed in 1952 and secretly purchased by intelligence agencies in 1970

The customers relied on Crypto AG for their industry trusted privacy claims and “because Switzerland”

Looks exactly like everything wrong with Proton and its customer base despite so many obvious flaws to how Proton behaves, how their customers talk, justifications for how their anti spam measures undermine all of their privacy and records claims, and now the CEO dismissing engineers security concerns

I'm a paying proton customer, I migrated last year from the horror that is Office365 (or Copilot 365 or whatever they call it now) and before that I migrated from Google Workspace. In direct comparisson, proton is the best product for me - and that does not include privacy or security things, just stuff like generall UX and featureset. Yes, they have some annoying bugs, but so did the others.

I think the AI backlash against Proton so far is unwarranted. It is purely speculative and based on make-belief. I am a dev myself, I use AI more and more, and I have no more long-term experience than the next dev. But so far the claim that using AI in your corp and workflow will result in buggier, shitty code is not true on a broad scale. It is certainly not true for proton, at least I don't see service quality detiorating for my service. I think it is a tool, and what you get out of using it still depends on the skill of the craftsman.

As a customer, I do demand stable service and the promised saftey and security. But I also demand low prices and a product that can compete with the market. Now, the market is Google and Microsoft - two companies we don't even need to question if they lay off people due to AI usage. Proton is kind of under pressure to compete on a product level in a pretty much david-against-goliath situation. We see AI-assisted exploits such as the Linux use-after-free from Anthropic and can't blame Proton for restructuring their dev process to incorporate AI to find exactly these kind of security issues. I wouldn't even feel comfortable as a client if proton whipped on a "human code only" label on their services.

As a proton customer myself, I've changed email providers before, and it isn't easy.

When I recommend for someone to try proton, I recommend they do so with a custom domain for their email address.

That way, if something goes awry at proton, they can set up service elsewhere while keeping their same email address.

This a thousand times. Having your own domain makes all kinds of migrations easier. My blog had 3 providers, my emails have 2. It still works without a hiccup.

If something happens? I'm ready to pack bags and migrate again.

I only considered Proton for security/privacy.

Their lots of half-baked products added since already reminded me of the Mozilla slide to irrelevance.

This seals the deal. I am OK if they use AI to enhace their productivity. I do care if they want to use AI to "move fast and break things" not giving a damn for stability and careful testing, think craftmanship and careful development is for losers, or speak to their employees like that.

This CEO reminds me of Martin Shkreli. He should be laid off. Do they have a board that cares? An ideal company for services like Proton's shouldn't be for profit to begin with.

I believe the harm is irrevocably done now. In the middle of cybersecurity frenzy hearing about that verifications, making sure something is done properly at a security focus organisation has lower priority than speed, that left a mark in a very sensitive spot. Central one. I pay more than I use because of getting comfy after a capabilities exploration, and some idealistic reasons too, despite a few UX matters I found clumsy (this word from the article resonates with my feelings) and I never got to fully like the way they present the service. But this is now beyond ideals and comfort. I lost trust with their attitude shining through and their clumsy way in general. I should first switch to a base subscription, loosing one or maybe two aspects I use from a higher tier. It did not come at a fortunate time when I lack any spare time and energy for this, figuring out how much I will miss exactly, but I will have to do it. Figuring out what happens exactly on degrading my subscription. Some guide about 'what happens if' would be very handy now.
> Yen was fine with pentesting, as long as it didn’t slow down the pipeline.

Wash me but don’t get me wet.

That's why you don't have to share with the head honchos what you are doing in your time. They don't know the domain, so if they act like that, you don't share with them the details. It took this much time. At the end of the day he can brag about AI blabla and the engineers will sleep well. End of story.
Proton mail already starts to become confusing. So much clutter and useless dialogs. The latest is that when you try to login out it asks something about potential identifiers and if you are curious you have to read a wall of blabla text. Complete nonsense.

Engineers are already way much faster with the help of AI... so the CEO might have had a tad bit too much cocaina this time.

Put the CEO in a cage, and no food for 3 days :D.