4 ms·
> If I don't know what it's doing, how can I trust it? It's not enough to examine software: if you don't trust the company, then anything they say or promise i
by irq-1 11y ago
> If I don't know what it's doing, how can I trust it?
It's not enough to examine software: if you don't trust the company, then anything they say or promise is worthless. Automatic updates can change anything, including the TOS! This is the same company that sells a 1984-Telescreen (XBox) with an always-on camera and microphone. _NSA shouldn't be forgotten.
Oracle likes to tout Java as GPL, but what does that matter when we know the company can't be trusted? Who controls a software project is the key, not the licenses or corporate promises. There's no point in trusting iOS because we've examined it, we also have to trust Apple.
- sliverstorm 11y agoOr as I like to put it, at the end of the day you have to trust someone, somewhere in the chain. In the case of software vendors, you have to trust the vendor. You cannot independently verify everything. You do not have the expertise nor the bandwidth. Edit: and if you have the software audited, are you not then trusting the auditor?
- bad_user 11y agoI don't like this argument. It's not necessarily you who has to audit your software. You can pay other people to do it. Big companies can pay for it. Your government's institutions can pay for it. If on the other hand the software is closed-source, then that's not an option. And especially for governments and for big companies Windows is a security liability.
- TheOtherHobbes 11y agoTrue, but there's no logical fallacy in writing off companies and products if they're consistently untrustworthy.
- deleted 11y ago[deleted]
- bad_user 11y agoThe source-code in OpenJDK can be inspected and OpenJDK itself can be forked if Oracle's stewardship goes awry, which is the whole freaking point of open-source, so I don't see how that can compare with Windows or iOS.
- irq-1 11y ago> OpenJDK itself can be forked Tell that to Google.
- satai 11y agoAndroid wasn't fork of OpenJDK
- anonbanker 11y agobut Dalvik was.
- tedunangst 11y agoWhat shouldn't we forget about _NSA?
- blackbeard 11y agoYes we should forget it. They worked out it's easier to get at our data out and on home territory (cloud, telemetry) than actually have to break into your kit.
- anonbanker 11y agoI think he meant _NSAKEY [0]. 0. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY