There is for now. Microsoft is working on closing the various loopholes.

I think a substantial part of the problem is the employee turnover rates in the industry. It seems to be just accepted that everyone is going to jump to another company every couple years (usually due to companies not giving adequate raises). This leads to a situation where, consciously or subconsciously, noone really gives a shit about the product. Everyone does their job (and only their job, not a hint of anything extra), but they’re not going to take on major long term projects, because they’re already one foot out the door, looking for the next job. Shitty middle management of course drastically exacerbates the issue.

I think that’s why there’s a lot of open source software that’s better than the corporate stuff. Half the time it’s just one person working on it, but they actually give a shit.

Like other people have said, it’s going to depend on what you want to do with the NAS. If it’s going to be a pure NAS (ie network storage only), then using onboard will be fine. If you plan on doing other things (home assistant, media server, etc), I recommend going the virtual machine + HBA route.

What I’m saying is one step more cynical that that. I’m saying is that you can’t fully trust anyone with your privacy. The best you can do is try to determine who will treat you best based on the motivation involved. VPNs take resources to operate. In our current society that means money, but even in the absence of money, there’s labour, hardware, and electricity costs that go into making it work. Expecting someone to just eat that cost in perpetuity is unreasonable. If the cost is being covered by the users, there is much less incentive for the operator to do anything shady with the data they have access to.

Don’t be bringing your politics into this. Communist, socialist, anarchist, etc, entities are all capable of running a honeypot VPN service. Even if the motive isn’t directly monetization, the user is still the product.

Also, even in the FOSS world, you have to be wary of services with ongoing costs (thinking of things that have a server side component, not software that you can run purely locally) that are offered for free.

Remember kids, if the service is free, you are the product.

I used a hodge-podge of chinesium parts and leftover drives to create a DAS system that hooks up to an HBA via DAC. I’m actually kinda surprised how stable it’s all been.