4 ms·

I'm glad you brought this up. I know people who benefit from secure software today (they actually exist) and they are all customers. I don't know many users who

I'm glad you brought this up. I know people who benefit from secure software today (they actually exist) and they are all customers. I don't know many users who can say the same. For example, I've heard rumours about a formally-verified and usable replacement for PGP. Great... until the conversation turns to price: PGP sucks! Would you pay $10 for something better? Heck no! PGP is free. I think of security in terms of interests. Your interests, the developers' interests, and whether they align. I'm convinced the only scenario where our interests as users align with those of the developers is if we pay them directly. Not with ads, not with donations, not through foundations.

Kliment 11y ago
Personally I would pay $10 (or $50) for something better. But for a communication tool, I would not want to force that payment on everyone I interact with, and I would most definitely not accept a closed source security tool at any price.
- nickpsecurity 11y ago
  What about a closed-source tool whose source and compiled binary had been vetted by mutually-distrusting, qualified parties who themselves used the tool? And provided the binaries and signatures to tools' customers? Because as I outline here... https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_... ...both proprietary and FOSS really come down to you taking other people's word that they reviewed it and they were qualified to do so. So, review and trust in the reviewer(s) are the truly important points. The many eyes argument hasn't held for security for over a decade while a number of closed-source systems survived rigorous evaluation due to good design. So, would you trusted a rigorously built and evaluated system with closed source if you trusted the reviewers and could verify you had same thing? And, if not, why do you trust/use OSS that's made by people with varying competence with no proof of qualified review?

Kliment 11y ago

Personally I would pay $10 (or $50) for something better. But for a communication tool, I would not want to force that payment on everyone I interact with, and I would most definitely not accept a closed source security tool at any price.

nickpsecurity 11y ago
What about a closed-source tool whose source and compiled binary had been vetted by mutually-distrusting, qualified parties who themselves used the tool? And provided the binaries and signatures to tools' customers? Because as I outline here... https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_... ...both proprietary and FOSS really come down to you taking other people's word that they reviewed it and they were qualified to do so. So, review and trust in the reviewer(s) are the truly important points. The many eyes argument hasn't held for security for over a decade while a number of closed-source systems survived rigorous evaluation due to good design. So, would you trusted a rigorously built and evaluated system with closed source if you trusted the reviewers and could verify you had same thing? And, if not, why do you trust/use OSS that's made by people with varying competence with no proof of qualified review?