3 ms·
How can you personally verify that any 3rd party service is doing what it claims? Unless you're a security expert with plenty of time to comb through someone e
by xapata 10y ago
How can you personally verify that any 3rd party service is doing what it claims?
Unless you're a security expert with plenty of time to comb through someone else's code, you're still relying on others to be truthful and competent. Even then you're relying on layers upon layers of software and hardware. Far too much for an individual to verify.
- holri 10y agoYou rely on a net of diverse independent reviewers instead of a single entity with a particular interest. A peer reviewed distributed trust net is much more trustworthy.
- homakov 10y agoThere's no such net, nobody is signing the binaries.
- xapata 10y agoThat single entity consists of many diverse individuals with differing ethics. As much as the law might try to pretend, companies are not people. Uh, except in the sense that they are compromised of people. So, they literally are people, people combined with capital.
- holri 10y agoPeople in a single entity are by definition not independent.
- xapata 10y agoIn that sense, no one is independent. We've all got friends and family, or at least people we know. By definition, if you've heard of someone else's software, that person had a social network by which they distributed the software to you.
- holri 10y agoSocial dependency is not binary. Developers in a company a much more dependent from each other and the boss, than reviewers of free software.
- xapata 10y agoVery true. Maybe I misread your previous comment as being more binary than you intended. Keep in mind that reviewers of free software are also often employees and may have some agenda beyond pure altruism, even if the software isn't copyright of the employer. Open source is big business these days.
- holri 10y agoMaybe Open Source is big business, but not free software.
- xapata 10y agoIt all is. The person contributing to gcc needs to make money somehow. Well, at least it could be considered tainted by self-interest if you're paranoid. My point was that commercial interest does not prevent quality/security.