3 ms·

Which is exactly the issue? At any time the server can request a key reset and have messages resent. I don't see how it is at all irrelevant since it is exactly

Which is exactly the issue? At any time the server can request a key reset and have messages resent. I don't see how it is at all irrelevant since it is exactly what the cause is here.

CiPHPerCoder 10y ago
The issue is that the client software being open source (rather than closed source) would do nothing to change the risk profile, so it's not worth bringing up. If the client is open source: What the server is doing is irrelevant as long as the client is secure. If the client is closed source: What the server is doing is irrelevant as long as the client is secure. If the server can compromise the client, whether or not the client is open source does not matter. People who believe that open source is a prerequisite for security are disregarding the entire discipline of reverse engineering which is a large chunk of software security expertise.
- iwlbebnd 10y ago
  Interesting how the goal posts keep moving, meanwhile I get down votes and my comments are being removed. Look you're wrong, you're wrong for multiple reasons and this happens all the time, especially in politics, where the so called experts reject the common sense of hobbyists, amateurs, and mere working stiffs like me who is merely a lowly sys admin. Open source software allows anyone at anytime to conduct a security audit without advanced warning, open source allows you to access server and client side code equally, open source software doesn't require the additional work of de obsuficanting binaries, open source code can be forked and modified and tested easily, there are no additional barriers and anyone can pick it up and do it at any time, that makes open source software inheritly easier to test and verify. Also large open source projects are more difficult to inflitrate with a back door, all a closed source project needs to do is modify some server side behavior that no one gets to see. Most closed source software lives on closed servers. Sure closed source programs can be secure, can be trusted, and can be verified, but to pretend it isn't harder, sometimes impossible, and trivial to backdoor is to ignore history and common sense. You're wrong, it's okay to be wrong and if you need to take out your anger by flagging my remarks so they aren't seen then so be it.

Which is exactly the issue? At any time the server can request a key reset and have messages resent. I don't see how it is at all irrelevant since it is exactly what the cause is here.

CiPHPerCoder 10y ago

The issue is that the client software being open source (rather than closed source) would do nothing to change the risk profile, so it's not worth bringing up. If the client is open source: What the server is doing is irrelevant as long as the client is secure. If the client is closed source: What the server is doing is irrelevant as long as the client is secure. If the server can compromise the client, whether or not the client is open source does not matter. People who believe that open source is a prerequisite for security are disregarding the entire discipline of reverse engineering which is a large chunk of software security expertise.

iwlbebnd 10y ago
Interesting how the goal posts keep moving, meanwhile I get down votes and my comments are being removed. Look you're wrong, you're wrong for multiple reasons and this happens all the time, especially in politics, where the so called experts reject the common sense of hobbyists, amateurs, and mere working stiffs like me who is merely a lowly sys admin. Open source software allows anyone at anytime to conduct a security audit without advanced warning, open source allows you to access server and client side code equally, open source software doesn't require the additional work of de obsuficanting binaries, open source code can be forked and modified and tested easily, there are no additional barriers and anyone can pick it up and do it at any time, that makes open source software inheritly easier to test and verify. Also large open source projects are more difficult to inflitrate with a back door, all a closed source project needs to do is modify some server side behavior that no one gets to see. Most closed source software lives on closed servers. Sure closed source programs can be secure, can be trusted, and can be verified, but to pretend it isn't harder, sometimes impossible, and trivial to backdoor is to ignore history and common sense. You're wrong, it's okay to be wrong and if you need to take out your anger by flagging my remarks so they aren't seen then so be it.