Proton CEO Is In 'Full AI Psychosis' (404media.co) 130
According to 404 Media, Proton CEO Andy Yen is aggressively pushing AI adoption while fostering what workers describe as a culture of fear that discourages raising security concerns or challenging leadership. The investigation is based on interviews with eight current and one former Proton employees, as well as internal Slack chats, meeting recordings, and an AI manifesto written by the company's CTO. Longtime Slashdot reader devnulljapan summarizes the findings: Engineers at Proton, which makes the encrypted email service Proton Mail and a suite of privacy- and security-focused products, including an encrypted drive service, an authenticator app, and a password manager, are being pushed to "stop lovingly handcrafting all our code and use AI more." Workers describe an environment where employees have genuine concerns about security or being asked to develop security products with AI but feel unable to voice them, lest Yen berates them in front of everyone or threatens their employment at the company. "The CEO is in full AI psychosis and has been for a while now," one of the sources told 404 Media. Yen reportedly dismissed an employee's request for additional security testing before releasing new code, calling it "bullshit and loser thinking" and insisting that "only losers think like that." In a separate exchange over Proton's post-quantum encryption rollout, Yen criticized how the company communicated the feature's limitations and told employees that "perception is more important than truth, the truth doesn't matter if you don't win on perception."
"The train is coming, get onboard or get crushed. Don't be the professional fax machine operator in the internet age," Yen wrote to the security Slack channel. "I think by the end of this year most developers stop programming and start writing specs for tests that AI will code and run, to validate AI written code that humans will no longer be able to review. This will be the last year that we hire engineers, and starting next year we hire what we used to call product managers, to build things with AI."
"The train is coming, get onboard or get crushed. Don't be the professional fax machine operator in the internet age," Yen wrote to the security Slack channel. "I think by the end of this year most developers stop programming and start writing specs for tests that AI will code and run, to validate AI written code that humans will no longer be able to review. This will be the last year that we hire engineers, and starting next year we hire what we used to call product managers, to build things with AI."
Diagnosed with Moron (Score:5, Insightful)
Re:Diagnosed with Moron (Score:5, Insightful)
It feels unfair to those dealing with hallucinations and shit to call this psychosis.
The CEO of a company known far and wide for offering a rather single concept (an old product made secure), has responded to security requests by:
calling it "bullshit and loser thinking" and insisting that "only losers think like that."
Before we assume this label feels unfair, perhaps a certain CEO needs a full medical evaluation, because humans. To ensure there are in fact no actual mental concerns.
If you were a member of the Board, explain how you would label what happened to a CEO running a company founded on security. Because that's above and beyond "stupid" thinking. Bad enough that I envision a Tony Montana sized mound of blow on the CEOs desk if I heard him say that kind of delusional nonsense. The drug test, would only be step 1 here. If it's just sheer stupidity, then I've no idea why he still has a job.
Re: (Score:3)
then I've no idea why he still has a job.
It will almost certainly be because of inertia. Company boards see what works, they see something successful. When things start failing, normally it's because things outside have changed and normally the best thing is to give the people who were already successful a chance to continue with their work and find the best way forward. Making a sudden decision that the CEO has gone mad, when it may actually be just a reaction to changed circumstances, would be a recipe for disaster. That means company boards oft
Re: Diagnosed with Moron (Score:2)
If you were a member of the Board, explain how you would label what happened to a CEO running a company founded on security.
So how does this affect the bottom line, will we sell more services?
More like psychopathy (Score:5, Insightful)
Its a known fact that a far greater proportion of CEOs are on the socio/psychopathic spectrum than the general population. Seems to me like this guy is way along it.
Re: (Score:2)
Narcissists are never clever people, but they keep going for as long as they are enabled.
Re: (Score:2)
A good manager is someone who can understand the technical side of things and has a bit of project management experience to keep things running smoothly. Then toss in fun stuff such as treating people like human beings that have lives outside of work.
Re: Diagnosed with Moron (Score:2)
I really don't want to sound cynical, but I've been in industry for many years now and can only agree with you. I've always wondered if this was due to business schools, human nature, or western culture.
Just maybe there is a country where managers are competent at the things they manage.
Re: Diagnosed with Moron (Score:2)
So you don't need engineers. Do ya need customers? (Score:5, Insightful)
This is just so disappointing to hear, as someone who just moved his life onto Proton. I'm not leaving yet but I'll be watching closely and planning an exit strategy.
Re:So you don't need engineers. Do ya need custome (Score:5, Insightful)
I'm not leaving yet
The CEO literally just said thinking about security is "loser thinking" and that "perception is more important than truth" -- if it were my money and my stuff, I would've dropped all of their services like a hot potato.
Re:So you don't need engineers. Do ya need custome (Score:5, Insightful)
The CEO literally just said thinking about security is "loser thinking" and that "perception is more important than truth" -- if it were my money and my stuff, I would've dropped all of their services like a hot potato.
I think the real loser thinking is to make snap kneejerk decisions based on a report from a news site soundbite that lacks context. Maybe he actually has this view, maybe he had a one of psychotic episode, maybe a disgruntled employee took an out of context quote and made it newsworthy.
In any case deciding anything on 8 words which are not part of even a complete sentence is a true loser strategy. The OP is perfectly right. We should now be cautious and focus on understanding what is going on.
Re: (Score:2)
They *could* have read TFA....
Re: (Score:3, Informative)
The CEO literally just said thinking about security is "loser thinking" and that "perception is more important than truth" -- if it were my money and my stuff, I would've dropped all of their services like a hot potato.
Loser thinking is dropping everything at the drop of a hat based on nothing more than one article written by somebody nobody has heard of on a fringe website.
Re: (Score:2)
Loser thinking is dumping tech stocks because they said they might make a few million dollars less in the next 3 months than they anticipated despite them making money hand over fist.
Re: (Score:3)
"Hanover FIST!!!!"
Re: (Score:2)
I understood that reference. :)
Re: (Score:2)
Are there any good alternatives? Don't say self host, that's a lot of work and your emails will be blocked anyway.
Re: (Score:2)
It is possible to self-host and not be blocked. However, it is even more work than "a lot". I've been doing it since the 90's (get off my lawn).
Re: (Score:3)
Oh? To me it is in "less than 1h per month" territory (Postfix on Debian/Devuan, relaying to a local machine at home that also has a static IP). The only larger struggle (4-5h) I had was getting SPF going as the assholes at Google did deliver spam-bounces instead of SPF-errors.
What causes all that effort for you?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
As SPF provides no real security advantage (and DKIM, DMARC and ARC do not either), I only add something when needed to get email accepted on the other end. The only thing that actually provides security is PGP and that is not part of the mail transfer system.
If you cannot rely on PGP, yes, then you want them all. But do not expect them to do much.
Re: (Score:3)
I self-host and I do not have a problem with my emails get blocked. The only thing I had to do is add SPF because of Google and the incompetent assholes at Google made debugging that hard by delivering SPAM-bounces instead of SPF errors. So here is some additional hints: If you want to bypass the Google SPAM filter, take 2-3 random pages from Wikipedia and copy them into your email.
The thing you need to make sure is to get a VM in an IP block that gets mostly used commercially and is known to the RBL makers
Re: (Score:2)
Main alternative is Tuta [tuta.com]
Re: (Score:2)
Thanks. Based in Germany is good. It's a shame they only do a few services. Part of the problem is that to completely de-Google you need to replace things like Google Maps and Android as well. YouTube is another big one. Nothing else offers anything like as much for sharing video, and of course everyone you want to watch is on there and isn't going to switch to a PeerTube instance for the the 3 people who use it.
Re: (Score:3)
It's not a complete replacement, but I have been using FastMail for years and they do well by their customers.
Re: (Score:2)
Thanks, Fastmail looks decent. Non-US company as well.
Re: (Score:2)
Note that gmail apparently pushes mail from proton to the spam bin by default.
Re: So you don't need engineers. Do ya need custom (Score:2)
Re: (Score:2)
Yes. The CEO is a person with no insight into his business at all. Software gets attacked. Proton certainly does. Unless the attacker is highest tier, those attacks will become public and shape perception. One such hack may well enough to end his company permanently. Proton is not Microsoft that can screw up again and again and customers are still not leaving. Proton needs a secure product and they must not get hacked in any way that becomes known to the public. This "strategy" the story describes is a good
Re: (Score:3)
...someone who just moved his life onto Proton...
I was considering a Proton package myself last weekend, lucky that I like to procrastinate. Sorry for your potential loss.
Re: (Score:2)
Re: So you don't need engineers. Do ya need custom (Score:2)
Re:So you don't need engineers. Do ya need custome (Score:4, Interesting)
If AI could actually code... (Score:5, Insightful)
Re: (Score:2)
AI can produce slop and slop works for simple things. The problem with secure coding is that many properties cannot actually be tested and LLMs are blind to many security problems, hence LLM review does not cut it. So unless you do baby-steps and review everything very carefully (which may well cost more than not using AI), AI code does not qualify as secure code. This guy is driving Proton towards a public and probably company-ending disaster.
Re: (Score:2)
Proton has IMAP support, but it costs extra.
Re: (Score:2)
Re: (Score:3)
The absence of a linux client is exactly what the CEO is complaining about. The lazy ass luddite programmers at proton are causing the company to fail.
In the password manager space, 1Password is eating their lunch with AI integrations that protonpass can only dream about.
Honestly at this point if AI spits out a Proton Drive linux client in the next couple of months it kind of proves the CEO's point given that his programming team still haven't done over 2 years later despite several unofficial clients using rsync being released.
Re:If AI could actually code... (Score:5, Insightful)
Honestly at this point if AI spits out a Proton Drive linux client in the next couple of months it kind of proves the CEO's point
Only if it doesn't get brutally exploited in the next couple of months after that.
Re: (Score:2)
Exactly - it's the kind of app where the difficultly is all in the details and security, not in getting a prototype up and running.
No doubt a non-developer "product manager" can vibe code a prototype - I don't doubt that. I highly doubt that a non-developer will be able to guide AI to developing something secure and bug free,
Re: (Score:2)
Re: If AI could actually code... (Score:2)
Re: (Score:2)
Post the source code and ask for community feedback.
Re: (Score:2)
Hopefully this translates into liability (Score:3)
For willful negligence.
Re: (Score:2)
Much probably a huge multimillionaire bonus paycheck when he leave the company behind in ashes.
That is what has been happening the most.
Great Quote (Score:2)
I wonder what Reality thinks about that; we should go ask it.
Re: Great Quote (Score:2)
What, it's true. People really don't judge a product by how many things don't go wrong. It's like how the drummer in a band gets overlooked until he misses a beat. You might actually have nothing that can go wrong, but it doesn't matter if people don't believe it. You need both but perception is right out front like it or not. I'm not suggesting go lead with a perception gap, just that managing it is different from you know, the reality. Knowing it's out front, you have to address it.
Releasing a steady stre
Troubling News about proton (Score:3)
Re: (Score:3)
It’s important to note that Proton Email is only secure if all parties on a thread use it and nobody forwards secure messages to addresses at other providers and their operating system and applications haven’t been compromised and...
For the specific case of getting loc
Re:Troubling News about proton (Score:5, Informative)
I also saw reports that Proton has divulged some private information to at least one government entity.
Please go read about the facts of that. All they handed over was the recovery email address. And they didn't just hand it over on demand, it was complying with a court order and after their own lawyers had made sure that what they had requested was legal under Swiss law. It is the same as every company operating anywhere in the world is legally required to do. Every company has to comply with a legal court order issued against them in the country they're operating and those courts only issue those orders if the alleged offence committed is illegal in that court's country. And as Proton cannot see files, email contents, or any other personal information related to users' accounts, that information cannot be shared with authorities on request. Literally the only thing Proton can see is a recovery email address.
Truth is more important than perception (Score:5, Interesting)
Perception without truth is just a magic show. You can make money with that, but it's not the business Proton is in. The guy doesn't understand his own product.
This will be the last year that we hire engineers
I'd be surprised if he could afford any next year.
If he is right about AI then Proton is in trouble (Score:4, Insightful)
Re: (Score:2)
Proton isn't about making an email client. The benefits of that service were in how that service operates.
Re: (Score:2)
"stop lovingly handcrafting all our code" (Score:2)
Re:"stop lovingly handcrafting all our code" (Score:4, Insightful)
Do you write security critical code that is under constant attack by competent attackers? If so, I would recommend an urgent career change. Because no, even Opus cannot write reliably secure code unless very carefully prompted and reviewed.
Re: (Score:3)
Re: (Score:2)
That is a great quote! Well, for those that understand it, that is ;-)
Do you have a reference to the talk where that statement and the examples were in?
Re: (Score:3)
Re: (Score:2)
Excellent. Thank you!
Oh that proron (Score:2)
What changed (Score:2)
I wonder what changed in this guy Andy Yen. When he did his TED Talk he seemed fine and reasonable, and now I keep hearing stories like this about them. Was he always like that or did he suffer from the Tech Bro curse?
Re: (Score:2)
Looks like some kind of fanaticism or quasi-religious effect. Kills all rationality.
It's more than just AI pyschosis (Score:5, Insightful)
The only good news here is that once again, excellent journalism by 404 Media has made us aware of a situation that we really need to know about. My response to reading this just now has been to break one of my own rules (no meetings on Fridays) because we're already using a number of Proton services and were planning to expand our usage. However, it would obviously be well beyond merely irresponsible to do so when there's a madman running the company. I intend to demand his immediate termination for cause, and if that demand isn't met, then we'll reverse course (which will be annoying and expensive) and end our business relationship with Proton. We cannot, in good conscience, even think of relying on a company whose CEO thinks security is unimportant.
If Proton has a board of directors, they need to be in emergency session right now.
Re: (Score:2)
Indeed. That is the kind of person that brought us numerous disasters and that is completely unsuitable to manage any kind of engineering.
Re: (Score:2)
Which is exactly why he was promoted to CEO - Peter Principle. He is so much incompetent that he can rise pretty much forever. Maybe next year he'll become Switzerland's President, for what we know... and maybe in 2 years, president of the USA, and then the world!!!!!1one
security is "loser thinking" (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: security is "loser thinking" (Score:2)
It's typical of maggots to refer to respected independent media the way you did, because you're all actually Nazis underneath.
Best stay away from Proton then (Score:2)
Because one thing LLMs can absolutely not do is secure coding. Even if the prompt engineers eventually learn the difficult skill of usually coaxing secure code from an LLM, hallucinations and other effects make a careful code review absolutely needed. If the current CEO does not like that then he is either an idiot or intent on destroying Proton.
I use and pay for Proton (Score:2)
I prefer, with my money, more loser thinking if it means security testing. I am not after features or capability, otherwise I would be using Google, I am after security and privacy., This requires a lot of loser testing.
Sincerely,
Your Customer.
Re: (Score:2)
Re: (Score:2)
This CEO (Score:2)
Knows nothing about coding or reviewing code. AI output needs to be checked.
Re: (Score:2)
bbl, "Ow! My Balls!" is on the TV.
That's not AI Psychosis (Score:4, Insightful)
AI psychosis is where you talk to an AI about your weird beliefs, and it reinforces them generating paranoid delusions.
This is just him being more bullish on AI than his employees. Frankly, his employees need to figure their shit out, because their concern about security is bullshit. We can't have "AI is able to detect incredibly obscure security vulnerabilities and exploit them as zero days", and "AI is incapable of producing secure code" at the same time. All you need to do is make sure you actually prompt it to find the vulnerabilities and fix them (and actually review the code, which, contrary to most people's weird beliefs, is perfectly readable in general).
Re: (Score:2)
He's opposed to human engineers reviewing AI-generated code. He seems to believe, truly believe, it suffices for engineers to prompt the AI to review and fix the code itself. And then for the AI itself to evaluate the fixes made and simply report to the engineers whether the fixes it made to the problems it detected were successful. And so on, and so forth.
Re: (Score:2)
Actually those two stances are NOT incompatible. I'm not sure they're both true, but they might well be.
Finding a code exploit is a task with an easily validated result. That's where AI is best.
Writing code that doesn't have exploits doesn't have a easy check. So AI is not as good there.
You could use a harness to check for exploits after you wrote the code, but that increases both time and cost, and isn't guaranteed to find all the exploits. (People and AIs think differently, and don't recognize all the
Re: (Score:2)
We can't have "AI is able to detect incredibly obscure security vulnerabilities and exploit them as zero days", and "AI is incapable of producing secure code" at the same time.
Can you explain to me why not? I do not produce code for living, so maybe I am missing something. Being able to check for flaws in code, which is pattern recognition, is not the same task as being able to create flawless code, which is creative process bound by functionality.
Re: (Score:2)
AI psychosis is where you talk to an AI about your weird beliefs, and it reinforces them generating paranoid delusions.
This CEO probably got his weird belief in "no more engineering required" reinforced by "talking to AI", so he got paranoid about every other company betting on AI eating his lunch.
This is just him being more bullish on AI than his employees. Frankly, his employees need to figure their shit out, because their concern about security is bullshit. We can't have "AI is able to detect incredibly obscure security vulnerabilities and exploit them as zero days", and "AI is incapable of producing secure code" at the same time.
Oh yes, we have exactly that at the same time: LLMs generate code doing (mostly) what you ask the code to do. If what you ask for is missing security relevant aspects, you will get very insecure code in return. At the same time, the same LLM could very well point out to a different user who is asking to identify security issues in
Perception (Score:2)
Proton used to let you buy an account with Bitcoin. Then they started requiring a credit card number or an outside email/phone.
It was clear to me that the perception of security replaced privacy.
I'm not sure what I need Proton for that needs my banking information tied to it.
The article is actually reassuring that I didn't misperceive what was going on.
How long before they fail or do a U-turn ? (Score:2)
It seems that the entire purpose of Proton is as a security and privacy conscious alternative to Google, and as soon as they abandon those core tenets they've got nothing ...
Perception over security ? Sounds like the CEO thinks his customers are idiots.
Well, it is a well known axiom... (Score:2)
It's well known that in the realm of human exploitation that perception of truth trumps truth.
If you're still running Windows, would think that would be well understood?
I've already seen this movie (Score:2)
Re: (Score:2)
This is the same level of hubris and bravado that the creator of Luna had, just before everything collapsed. When you stop being cautious and ignore the warnings from your experts, it is just a matter of time.
I disagree. CEOs have always ignored the fact experts that didn’t agree with them. Typically by saying “do it anyway or you’re fired!” Or making a lower level executive or manager say it for them. I mean just look at musk for a prime example, there is a zero percent chance both spaceX and Tesla are full of no nothing idiots amounting to hundreds of positions or more compared to the chance there is one idiot at the top. Your main issue was failing to not apply logic, company succe
AI FOMO (Score:2)
The CEO sees other tech companies getting giant boosts and is pissed that isn't him. Line going up for other companies more than his.
When in doubt, blind alignment to the hype of the day should, potentially get there. No room for nuance or actual vision to what would capture the indicated missing value, AI should just provide it... somehow.
Do you know what you do? (Score:2)
Dude, you aren't some kind of randroid superman hero of industry. You run a kind of boring utility company. Which is fine; civilization runs on boring utilities quietly handled by competent people. Problem is that you don't seem to be fine with it.
Re: (Score:2)
Confusing (Score:2)
Just canceled (Score:2)
Reason: Other, description: I do not trust the CEO's decision to put my safety and security fully in the hands of AI.
I had been a subscriber for years now. But this makes no sense given that the entire purpose of their product is Safety and Security, and I genuinely do not trust AI to consistently get that right.
unit of money (Score:2)
Great Test Of Proton Email Service (Score:2)
This report will trigger a fantastic test of the Proton encrypted email service. This CEO will no doubt demand they find the leakers cited in the article. No doubt there will be searches of the encrypted mailboxes, if it's remotely possible.
Re: (Score:3)
Well, not necessarily. There's a difference between a CEO vibe coding and a developer vibe coding. Anyone can write shitty code, AI included. It takes a dev to properly keep the AI in check.
Re: (Score:2)
Agreed. If you don't know what you're doing it's hard to even ask for the right thing or know what's possible. For example: I'm currently developing a system that uses a local AI to help debug internal issues. The initial incarnations of it were very slow to start up each command; clearly, it wasn't doing proper KV caching and was having to prefill every turn; it required patches on the llama.cpp fork and our API wrapper, and also adjusting the system prompt to keep variable content at the end. But if yo
Re: (Score:3)
Absolutely - and if they really do stop hiring "engineers" and start hiring "product managers" to do the software creation and maintenance, then they're going to be in a world of trouble in fairly short order - even if they do write decent specs.
If they're still around in a years time, just as soon as there's a change of CEO, there'll be plenty of work at Proton cleaning up the mess they've made of it. You might still not be hand-writing much code, and instead be fiddling with specs - but you'll get to actu