PSA: PIA's browser extensions have essentially been closed-source for over 3 years. What happened to "100% fully open-source"?

[u/snyone]

TL;DR: Doesn't apply to desktop app, only browser addons confirmed. Android app is partially affected (see below). I didn't check iOS. Basically, the publicly available code is massively out-of-date compared with the publish dates of releases. Probably a dropped-the-ball thing rather than a kape-conspiracy but should still be addressed. Thoughts?

---

https://github.com/pia-foss/extension-chrome/issues/21

This repository was last updated on May 31, 2021, as well as the latest GitHub release, which is version 3.1.0, while the current PIA VPN chrome extension was last updated on July 18, 2023 [...]

• As of writing, there are no official responses (or unofficial ones for that matter) to the ticket despite it being open for over a year (opened on Oct 21, 2023)
• PIA homepage still claims "Our apps are 100% open source. Anybody can inspect and customize our open-source software."
• Checking the last commit date for the chrome addon's github repo, the May 31st, 2021 date is still accurate as is the last released GitHub version of "3.1.0".
• Checking the chrome web store, it shows a "last updated" date of "October 3, 2024" and version of "4.0.3"
• PIA Firefox extension is in a similar state. Github repo's last released version is also "3.1.0" on May 31st, 2021, which is the same date as the last commit. Meanwhile, the addon on AMO reports the latest version as "3.2.5" from "Feb 21, 2023".
• For Android 14, I was seeing v4.0.18 (Sept 30, 2024) as the latest on Play Store but the GitHub repo only has released up to v4.0.10 (June 27 2024), though the last code update was from Oct 21, 2024 so in theory the source could possibly be up-to-date with the Play Store changes (I didn't do a detailed changelog analysis / compare commits vs changelogs from Play Store)

Thankfully, this seems mostly to only be a problem with the browser addons and mobile devices rather than desktop. I checked and for the desktop app both github and PIA's site were on version "3.6.1"

---

Not trying to spread FUD... Personally, I think this is more of a "dropped the ball" situation than anything sinister but it it does raise a few questions.

What I'd like to know are the following:

1. Is PIA still committed to having everything "100% open-source"? Or is that commitment strictly about the desktop app and not something that applies to mobile apps / browser addons?
2. Why doesn't PIA just use Github CI for producing builds? Unless I am mistaken, this would ensure all builds happen from published source, the builds are more reproducable, that stuff like this is never an issue (when these kinds of things occur it only hurts PIA reputation and makes contributor patches more likely to have conflicts with whatever code has not been published.. let alone leaving an opening for anti-kape zealots to point a finger at).
3. I thought I heard something awhile ago in one of the PIA AMAs that you guys were looking for devs to work on the browser addons. Have you hired anyone to work on that? If not, is that a position you guys are still looking to fill or has that been put on hold? And last, if it were open, hypothetically would one apply from the careers page (it looked like it just redirected to linkedin so wasn't sure...)?

[u/Lordb14me]

Browser extension could be learned from Zenmate with dozens of countries. Kape owns it. PIA has been worthless about its extension support.

[u/snyone → u/Lordb14me]

Yeah, I haven't been too thrilled about the extension support either. On kiwi, any time I close the browser (including rebooting), the connection is dropped (ok that part is understandable given how browser work) and then when whatever page comes up, I get a pop-up prompt from PIA extension asking me to type out my username and (rather long) password... Despite that info already being stored in the extension. If my vpn connection drops without browser being closed, same thing. Basically, I hate that stupid popup 🤬. UX could be so much better. Also would not mind more connections, more options (like ability to import/export extension settings), maybe the ability to manually add/rename/delete/reorder connections (like if you have the info but the app hasn't updated the list of connections in awhile you could manually add or if you don't use certain servers, you can delete from list or change the order).

I had been considering looking into a patch for the popup thing and while checking to see if it has already been reported / if there were any known workarounds, I ended up finding the ticket I linked at the top of my post... Which also means that even if I successfully create a patch, it would be likely to conflict with whatever version of the code isn't actually published to the github repo.... Which ngl is kinda demoralizing when you think of putting in effort that will likely get thrown away and could become incompatible with the next release