[kfreds]

I'm not sure what you mean by "Oof". We don't have a dedicated security team because security and privacy are integral to all aspects of our service. It doesn't make sense to centralise it.

As for our support team they are responsive and experienced. Several of them have worked with us for many years and do offensive security research in their free time.

Unlike many organisations we don't see customer support as a cost center, just like we don't see security as a cost center. Our support team represent our customers, and as a consequence contribute a lot to how we prioritise our roadmap.

[traceroute66]

> I'm not sure what you mean by "Oof".

I second this.

Clearly the person who wrote "Oof" has never emailed Mullvad support.

Whenever I have emailed Mullvad support I have received a prompt reply from a human being who clearly actually cares about taking ownership of the question and seeing it through to resolution.

I have also witnessed first-hand the support person taking the question to an internal team member where it requires additional input. So there are clear paths for escalation if circumstances require it.

Finally the support mail allows for PGP encryption of communications too.

(I am not a Mullvad shill. Not a Mullvad employee. Just a satisfied customer)

[fragmede]

Human psychology is weird and some things are just cultural. If you have the ops team make the security@ email alias just forward to support, you could avoid having to go into all that.

"Just email support@" feels like you don't care. That you do, and that your support team is awesome, doesn't change the fact that there are other companies out there who's aren't. Security people are human with human egos, and they want to feel special, so giving them a special way to reach you, even if it's the same thing behind the scene, makes a world of difference.

[nananana9]

It still probably makes sense to alias it to [e-mail] for privacy/security concerns.

I'm not familiar with how you run your company -- without the context you gave most people would hesitate emailing support@ for security issues.

[Stefan-H]

"We don't have a dedicated security team because security and privacy are integral to all aspects of our service".

Do you have people whose role is explicitly security? Who are the security SMEs in your organization if not? I personally find the "Security is so important to us that we don't have a team dedicated to it" argument weak, and often results in misaligned incentives - if individuals have to alternate hats from "deliver results" to "properly vet security", the business push to deliver tends to win out. I'd be very curious to hear how you ensure your team doesn't fall into that trap.

[wren6991]

You're right, that was a knee-jerk reaction. Sorry, I take it back.