4 ms·

Your argument about the closed source is weak. Messing around with Wireshark is probably quicker than reading thousands of locs. I understand the value of open

by pasta 10y ago

Your argument about the closed source is weak. Messing around with Wireshark is probably quicker than reading thousands of locs. I understand the value of open source. But I'm still not sure if it matters. A lot of people think that open source software does not track personal data. But how do they know? Have they read all the code? Do they even understand all code? It's much easier to run Wireshark to check what the program does. That's how the world found out about what Windows 10 is sending to MS. In the end it's about trust.

vanviegen 10y ago
I don't believe wireshark will tell you that much since everything is encrypted with forward secrecy nowadays. So the browser would need to be able to output negotiated keys for data tracking connections. That seems unlikely, especially if what's being tracked is a bit shady.
Sylos 10y ago
Open-source doesn't just mean that you can view the source code. It also means that anyone can take the source code, make changes to it and distribute their new version. This means that if an open-source project does nefarious things, there's a good chance that a fork will come along and that people will start using that fork instead. So, you yourself don't have to read every single line of code for it to be relatively certain that an open-source project does not do bad things. There are of course exceptions to this. For example there are a lot of things that a lot of people are not fond of with Chromium. There are forks which try to address this (for example [0]), but Google has so much development workforce behind Chromium that such a fork has a hard time keeping up with merging security patches and updates in general. But even in that case, open-source offers protection without you reading every line of code. Because there's people out there who earn their daily bread by uncovering these sort of things: Journalists. Due to the source code being available, they have definitive proof and can slap these kind of stories on the front page. I mean, heck, Heart Bleed came on national TV in my country. If that vulnerability had been in closed-source software, they could have only ever reported about rumors. [0]: https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium
JustSomeNobody 10y ago
I think the difference is that with open source there's a chance that one could find out about tracking, fix it, then continue to use the product. With a closed source solution, this is almost impossible.

by pasta 10y ago

vanviegen 10y ago

I don't believe wireshark will tell you that much since everything is encrypted with forward secrecy nowadays. So the browser would need to be able to output negotiated keys for data tracking connections. That seems unlikely, especially if what's being tracked is a bit shady.

Sylos 10y ago

Open-source doesn't just mean that you can view the source code. It also means that anyone can take the source code, make changes to it and distribute their new version. This means that if an open-source project does nefarious things, there's a good chance that a fork will come along and that people will start using that fork instead. So, you yourself don't have to read every single line of code for it to be relatively certain that an open-source project does not do bad things. There are of course exceptions to this. For example there are a lot of things that a lot of people are not fond of with Chromium. There are forks which try to address this (for example [0]), but Google has so much development workforce behind Chromium that such a fork has a hard time keeping up with merging security patches and updates in general. But even in that case, open-source offers protection without you reading every line of code. Because there's people out there who earn their daily bread by uncovering these sort of things: Journalists. Due to the source code being available, they have definitive proof and can slap these kind of stories on the front page. I mean, heck, Heart Bleed came on national TV in my country. If that vulnerability had been in closed-source software, they could have only ever reported about rumors. [0]: https://github.com/Eloston/ungoogled-chromium https://github.com/Eloston/ungoogled-chromium

JustSomeNobody 10y ago

I think the difference is that with open source there's a chance that one could find out about tracking, fix it, then continue to use the product. With a closed source solution, this is almost impossible.