4 ms·

> it is still largely unsafe It's not unsafe, you just don't know if it's safe or not. That doesn't make it unsafe. Even if the code were open source and ther

> it is still largely unsafe It's not unsafe, you just don't know if it's safe or not. That doesn't make it unsafe. Even if the code were open source and there were some guarantee that WhatsApp was using that exact code during compilation, you still would not know if it's safe. Just like most other people, you are relying on people experienced with such things to confirm that they are doing things in a "safe" way. Thus for all practical matters, it really doesn't matter if it's open source or not. There is always going to be an unknown here, and open source does not reduce that much risk. In fact, it's probably better to look at how WhatsApp, the software, behaves (i.e. what it does on the wire) rather than the code. Sure there could be backdoors, but that is the risk you take when you use any pre-compiled software -- open source doesn't change that. All we are really left with then is trust.

pookeh 11y ago
And if you don't trust FB then it is ... unsafe :)
- danielrhodes 11y ago
  Well if your point is that safe or unsafe are always subjective conclusions, then of course I agree with you. If the safe/unsafe determination is being declared as an objective conclusion, then I don't.
lmm 11y ago
> Even if the code were open source and there were some guarantee that WhatsApp was using that exact code during compilation, you still would not know if it's safe. Speak for yourself > Just like most other people, you are relying on people experienced with such things to confirm that they are doing things in a "safe" way. Thus for all practical matters, it really doesn't matter if it's open source or not. If you rely on the experts then it still matters to you whether being open-source means more or better experts. > In fact, it's probably better to look at how WhatsApp, the software, behaves (i.e. what it does on the wire) rather than the code. It is provably impossible to tell whether the RNG has been backdoored that way. > Sure there could be backdoors, but that is the risk you take when you use any pre-compiled software -- open source doesn't change that. Huh? So you require reproducible builds and/or build from source yourself. You absolutely don't trust that some random binary is what it claims to be.
- danielrhodes 11y ago
  You may not realize it, but you have proven my point. At what point does this all become totally impractical? Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? At some point, you need to trust somebody in this chain of dependencies. People who are beating their drums about open source are in essence saying: trust no one. But in the real world, that is not realistic.
  - lmm 11y ago
    > Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? You should ensure that your supply deal allows you to audit the manufacturing, yes. Maybe you don't actually have the time or money to do so, but if they don't offer that capability that's a giant red flag. > At some point, you need to trust somebody in this chain of dependencies. You never trust any single party unconditionally. I mean sure, even if you get an audit done, your audit agency could be crooked - a sufficiently large conspiracy can defeat anything a single person can do by themselves. But you don't want to put yourself in the position where one rogue company - or even one rogue employee at that company - could entirely compromise your security. If that level of security is good enough, why even bother using encryption at all?

pookeh 11y ago

And if you don't trust FB then it is ... unsafe :)

danielrhodes 11y ago
Well if your point is that safe or unsafe are always subjective conclusions, then of course I agree with you. If the safe/unsafe determination is being declared as an objective conclusion, then I don't.

lmm 11y ago

> Even if the code were open source and there were some guarantee that WhatsApp was using that exact code during compilation, you still would not know if it's safe. Speak for yourself > Just like most other people, you are relying on people experienced with such things to confirm that they are doing things in a "safe" way. Thus for all practical matters, it really doesn't matter if it's open source or not. If you rely on the experts then it still matters to you whether being open-source means more or better experts. > In fact, it's probably better to look at how WhatsApp, the software, behaves (i.e. what it does on the wire) rather than the code. It is provably impossible to tell whether the RNG has been backdoored that way. > Sure there could be backdoors, but that is the risk you take when you use any pre-compiled software -- open source doesn't change that. Huh? So you require reproducible builds and/or build from source yourself. You absolutely don't trust that some random binary is what it claims to be.

danielrhodes 11y ago
You may not realize it, but you have proven my point. At what point does this all become totally impractical? Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? At some point, you need to trust somebody in this chain of dependencies. People who are beating their drums about open source are in essence saying: trust no one. But in the real world, that is not realistic.
- lmm 11y ago
  > Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? You should ensure that your supply deal allows you to audit the manufacturing, yes. Maybe you don't actually have the time or money to do so, but if they don't offer that capability that's a giant red flag. > At some point, you need to trust somebody in this chain of dependencies. You never trust any single party unconditionally. I mean sure, even if you get an audit done, your audit agency could be crooked - a sufficiently large conspiracy can defeat anything a single person can do by themselves. But you don't want to put yourself in the position where one rogue company - or even one rogue employee at that company - could entirely compromise your security. If that level of security is good enough, why even bother using encryption at all?