Google considers VPN leaks to be valid bugs but unfortunately doesn't consider them security bugs. Internal issues are created for any issue report considered valid. The external one is only used to communicate with people. If it was filed as a security bug, they'll close it if it isn't considered within the scope of the bounty program.
I am not sure why all your comments are flagged, but here is my response to your other comment:
> We plan to heavily overhaul the VPN implementation to make most forms of leaks nearly impossible rather than continuing to use the current system prone to it.
Thanks, great to hear. Given the slew of bugs you uncovered it seems the Android implementation has some rough edges. Would `pasta` be helpful to you? It allows you to unshare netns and then pass a user-space network adapter inside. https://passt.top/passt/about/ Podman leverages this one as well in more recent versions.
The past couple weeks of our replies were maliciously flagged. We've made a post about it on social media as we've had to do before when this happens. This happens very regularly to posts by GrapheneOS or posts which simply support GrapheneOS. There are a bunch of malicious accounts which show up to each thread about GrapheneOS to make personal attacks towards our team, baselessly claim it's a honey pot, promote non-hardened products reducing privacy/security compared to AOSP and to make a bunch of disingenuous attacks towards it. The attacks towards our team often involve fabricated stories about us and harassment content. There's an account active in many of these recent threads making disingenuous replies and spreading Kiwi Farms harassment content in their profile:
This comment specifically was also auto-collapsed for me, without being marked as flagged or dead.
It might help to ask moderation about this. Could be an artefact of brigarding or something similar.
I also wouldn't worry about individual accounts so much. Asking for others to be banned, linking mirrored profiles, etc. That is just not the stuff many users like to read on HN. I think your technical content is truly amazing on its own already.
The past several weeks of our replies were wrongly flagged. None of our posts were in any way inappropriate and it's entirely appropriate to ask for help getting it undone. On the other hand, you're repeatedly making personal attacks on our team, engaging in doxxing and spreading harassment content. You're directly pointing people to Kiwi Farms harassment content with blatant libel and doxxing. There have been years of this harassment on Hacker News without it being addressed by the moderators. We're not going to be tolerating it anymore. Hacker News actively engages in moderation and therefore has no excuse to be permitting this harassment and leaving up years of it across many threads.
We've previously emailed them with no result. This time around we got a reply about this specific account targeting us but it isn't resolved. We don't have much optimism about getting the many past threads with personal attacks based around fabricated stories and harassment content addressed without doing more than asking via email.
I worked at a startup that did this and it was... totally fine? Like, we hired a guy who knew how to set Kubernetes up, he spent like a week or two setting it up, and then it was totally solid and the development experience was great. I was building some of the core product-specific logic and it only made my life easier.
Which really just goes to show that the "legible" aspects matter far less than the illegible aspects. It's easy to say "hey, this startup is using boring technology and deploying a monolith, great!" or "Kubernetes and a bunch of services, over-complicated!". It's hard to say "hey, this startup's codebase is awful and it's an unforced error slowing them down" vs "hey, these guys are taking some shortcuts but it makes sense in context".
But a mess built on "boring", simple tech is going to derail you far more than a needlessly complex but well-executed setup.
I remember reading an article years ago about how a company was running rings around its competition because they were releasing features faster and more effectively, due to their choice to use Lisp as their language. Of course a competitor who tried to pivot to Lisp was unlikely to have the same results - the specific language choice was not nearly as important as the fact that the founders were already experts in Lisp.
The point being, Kubernetes is easily the right choice for a start-up if you have a Kubernetes expert on the team (and the rest of the team is willing to put the time in learning the system and not just cargo-culting around it)
