4 ms·

Author makes a good point reminding us that free software does not automatically mean secure. But it's worth pointing out that at least with free software, we

Author makes a good point reminding us that free software does not automatically mean secure. But it's worth pointing out that at least with free software, we are able to assess just how (in)secure an application is. So we can find out which applications to use or avoid if we are interested in security. The same cannot be said for proprietary applications.

catnaroek 11y ago
> we are able to assess just how (in)secure an application is Realistically, most people aren't going to do this. A more pragmatic solution is to use a minimal system, where for every task, you always use the smallest application that will perform it in an adequate manner. With proprietary software, you seldom get the ability to set up such a minimal system. In particular, this means that I will never use a desktop environment, because there is no task for which a desktop environment is the smallest, simplest possible solution.
- noir_lord 11y ago
  Depends how you define minimal, functionality or code size and do we count libraries since once you pull in GTK, Qt or something on the JVM you are depending on millions of lines of code anyway.
  - catnaroek 11y ago
    All else being equal or irrelevant, I prefer the application with the fewest and smallest dependencies, as well as the least amount of features I won't use. For example, the only thing I want in a music player is that it plays music. I don't need to connect to online services to synchronize my playlists, discover new artists, or whatever else “music players” do these days. Thus my preference for moc instead of, say, Amarok.
chei0aiV 11y ago
Source code unavailability does not seem to stop security researchers from finding security issues in proprietary software. The advantage of free software here is of course that more people can read source code than can do security analysis of compiled software.

catnaroek 11y ago

> we are able to assess just how (in)secure an application is Realistically, most people aren't going to do this. A more pragmatic solution is to use a minimal system, where for every task, you always use the smallest application that will perform it in an adequate manner. With proprietary software, you seldom get the ability to set up such a minimal system. In particular, this means that I will never use a desktop environment, because there is no task for which a desktop environment is the smallest, simplest possible solution.

noir_lord 11y ago
Depends how you define minimal, functionality or code size and do we count libraries since once you pull in GTK, Qt or something on the JVM you are depending on millions of lines of code anyway.
- catnaroek 11y ago
  All else being equal or irrelevant, I prefer the application with the fewest and smallest dependencies, as well as the least amount of features I won't use. For example, the only thing I want in a music player is that it plays music. I don't need to connect to online services to synchronize my playlists, discover new artists, or whatever else “music players” do these days. Thus my preference for moc instead of, say, Amarok.

chei0aiV 11y ago

Source code unavailability does not seem to stop security researchers from finding security issues in proprietary software. The advantage of free software here is of course that more people can read source code than can do security analysis of compiled software.