4 ms·

You may not realize it, but you have proven my point. At what point does this all become totally impractical? Should you also manufacture your own chips as wel

You may not realize it, but you have proven my point. At what point does this all become totally impractical? Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? At some point, you need to trust somebody in this chain of dependencies. People who are beating their drums about open source are in essence saying: trust no one. But in the real world, that is not realistic.

lmm 11y ago
> Should you also manufacture your own chips as well to make sure there are no backdoors at the hardware level? How about for people who have no time for any of this (99.99999999% of the world)? You should ensure that your supply deal allows you to audit the manufacturing, yes. Maybe you don't actually have the time or money to do so, but if they don't offer that capability that's a giant red flag. > At some point, you need to trust somebody in this chain of dependencies. You never trust any single party unconditionally. I mean sure, even if you get an audit done, your audit agency could be crooked - a sufficiently large conspiracy can defeat anything a single person can do by themselves. But you don't want to put yourself in the position where one rogue company - or even one rogue employee at that company - could entirely compromise your security. If that level of security is good enough, why even bother using encryption at all?