My stance on Proton is my stance on GrapheneOS: just because the creator is bad doesn’t mean the software is bad. As long as the software is better compared to the alternatives then I seen no reason to stop using it.
I think the major difference is that for a software package or operating system like GrapheneOS, theoretically people can audit the code and verify that it is secure (of course in practice this is not something that 99% of people will ever do). So to some extent, you technically don’t have to put a ton of trust into the GrapheneOS devs, especially with features like reproducible builds allowing you to verify that the software you’re running is the same software as the repository.
For something like Proton where you’re using a service someone else is running, you sort of have to trust the provider by default. You can’t guarantee that they’re not leaking information about you, since there’s no way for you to tell what their servers are doing with your data. Accordingly, to some extent, if you don’t trust the team behind the service, it isn’t unreasonable to start doubting the service.
I think the major difference is that for a software package or operating system like GrapheneOS, theoretically people can audit the code and verify that it is secure (of course in practice this is not something that 99% of people will ever do). So to some extent, you technically don’t have to put a ton of trust into the GrapheneOS devs, especially with features like reproducible builds allowing you to verify that the software you’re running is the same software as the repository.
For something like Proton where you’re using a service someone else is running, you sort of have to trust the provider by default. You can’t guarantee that they’re not leaking information about you, since there’s no way for you to tell what their servers are doing with your data. Accordingly, to some extent, if you don’t trust the team behind the service, it isn’t unreasonable to start doubting the service.