[Andy shoots at his foot]
“Ouch! Oh no, what did I do?! Must fix this.”
[Shoots at his other foot]

Absolutely. It’s typical of CEOs not to have any competence in what they manage… This is really over-incompetent though.

Interestingly, some critical (but still civil) replies to that post got deleted, as discussed by some users here. That post is just a PR move by the CEO.

This reply (ADHenchD) was very to the point:

Appreciate you putting your name to this, but I’ve read the 404 article in full and most of this rebuts things it didn’t actually say.

Also, toxic, abusive leadership is what I expected working hospitality at 18, when I didn’t know any better than to put up with it. Seeing it at a company built on trust and privacy, and then blaming the leaker(s) for it, is quite a take.

Now on to the points…

Perception vs truth: 404 never claimed this was about code security. It gave the PQC/Tuta context, the same context you’ve posted. Your screenshot confirms the quote word for word, and it also confirms the part people actually object to: the CEO telling an employee to go on Reddit with their personal account to “set the record straight”. Whether Proton did PQC better than Tuta is beside the point. Telling staff to post undisclosed from personal accounts is astroturfing, and that’s what worries people about a company whose whole pitch is trust.

Pentesting: Nobody serious claimed Andy banned pentesting. The report says he called a request for a few days of testing before release “bullshit and loser thinking”. The “baseline” line you say was omitted makes the same point: testing is fine as long as it doesn’t slow anything down. Your own summary (“what he didn’t agree to was it slowing down the pipeline”) is basically 404’s story. Also, in your screenshot that line sits under the “use AI more” message, so it’s not obvious it refers to security testing at all. And another engineer in that same thread said security was low priority at the moment, which you don’t mention.

git-ai: Overall fair that some viral posts overstated this, they often can with a situation like this…but 404 itself said it tracks how much AI code the company generates, not individuals. But a “non-goal” in a design doc is a clear intention, not a technical limit. And the same week, Andy told staff leadership already knew “more or less who is behind” ahead of the re-interviews. Also, re interviews? Come on man. That’s some dystopian “double think” Orwell shit. We both know this.

Hiring: 404 printed the full quote, including the “what we used to call product managers” bit. The part that bothers me more is the same message predicting AI-written code that “humans will no longer be able to review”.

Proton’s own spokesperson didn’t dispute any of the reporting, and Andy has since cancelled the re-interviews and admitted a communication failure. That’s hard to square with “intentionally taken out of context”.

I’m sure plenty of people there care about the mission. But that’s a leadership problem, not a leaker problem. Don’t blame someone for showing the truth man. This just comes across as the techbro version of blaming wikileaks for the uncovering all the dodgy stuff the US government was doing behind the scenes, rather than realising the government maybe shouldn’t be doing those dodgy things.

Perhaps an extreme example but we are all passionate about proton, recommended proton and spend our time and money on Proton. We all want it to do well, which is why many people are voting with their wallets and being vocal about rather troubling things which have come to light.

Indeed. Quoting from the chats: “so go on there with your personal account and coment [sic] to set the record straight”.

I find it strange that this particular engineer has suddenly been given permission to share the chats. Seems planned damage control to me.

Too late. Some things remain bad even when you add context to them.

Port forwarding seems difficult to find.

Check out hide.me, compared here, and others compared at https://techlore.tech/vpn.

I’m looking as well.