4 ms·

Open sourcing helps everybody. Power users make sure its save for them, if it is, it is save for 'normal' users as well. I don't need to read Signal code to ha

by nickik 9y ago

Open sourcing helps everybody. Power users make sure its save for them, if it is, it is save for 'normal' users as well. I don't need to read Signal code to have confidence in its working.

bilbo0s 9y ago
"...if it is, it is save for 'normal' users as well..." Not sure about that. I think even if a power user were to say "this is safe", you still have a boatload of integrity problems with the software. -How do we know the power users can be trusted? -Even if they can, what guarantee do we have that the service provider we use is using the same open source code that the power user validated? -Etc, etc, etc. Basically, a lot of trust issues. I agree with asadlionpk, open source can generally only be proven to help power users in a trustless environment. And where security is concerned, we cannot ascribe the "safe" attribute to any system where that safety cannot be proven.
FussyZeus 9y ago
OK so if your tech-inclined friend sets up a Signal server, for little to nothing in return, that's automatically more trustworthy than a multi-billion dollar corporation with an ingrained and (seemingly) solid attitude regarding NOT selling user's data? I roll an OwnCloud server for me and my family, and I know that I'm not invading their privacy, but I could very easily do so and not leave a trace of my having done it even that a pro user could find, let alone a layman. To say that Apple is less trustworthy than a given power user solely because they use closed source is ridiculous, there is zero correlation there.
Veratyr 9y ago
> Power users make sure its save for them, if it is, it is save for 'normal' users as well. Power users can make sure the code they're running is safe for them. There's no guarantee that Signal for example is running the same code they release to others.
- lorenzhs 9y ago
  Signal for Android has reproducible builds, so you can verify that the version on the Play Store matches the code you audited.
  - krallja 9y ago
    How does that help you verify what is running on the server?
    - nickpsecurity 9y ago
      They can use trusted computing or HSM tech for that. They have the money but probably won't spend it.
      - closeparen 9y ago
        But they don't, so why do they get points for having an open source server?
        nickpsecurity 9y ago
        For a full solution, it would be a start to what they needed. The main benefit of an open-source server is that people can audit it for vulnerabilities. As in, they get free to cheap labor to reduce their liabilities. People might also submit extensions they find useful. The usual benefits of FOSS for suppliers.
      - threeseed 9y ago
        None of that addresses the point. Without third party, independent verification of their servers and the code that is running open source provides limited (if any) improvements to privacy and security.
        nickpsecurity 9y ago
        That's part of the point rather than separate. A closed system without any way to prove it's running something often can't to get 3rd party verification or user trust that's consistently believable. An open-source, tamper-resistant system can. Quite a bit of difference. Once verifications come in, the effects of reputation then allow users with less technical knowledge to learn what's trustworthy or not.

by nickik 9y ago

Open sourcing helps everybody. Power users make sure its save for them, if it is, it is save for 'normal' users as well. I don't need to read Signal code to have confidence in its working.

bilbo0s 9y ago

"...if it is, it is save for 'normal' users as well..." Not sure about that. I think even if a power user were to say "this is safe", you still have a boatload of integrity problems with the software. -How do we know the power users can be trusted? -Even if they can, what guarantee do we have that the service provider we use is using the same open source code that the power user validated? -Etc, etc, etc. Basically, a lot of trust issues. I agree with asadlionpk, open source can generally only be proven to help power users in a trustless environment. And where security is concerned, we cannot ascribe the "safe" attribute to any system where that safety cannot be proven.

FussyZeus 9y ago

OK so if your tech-inclined friend sets up a Signal server, for little to nothing in return, that's automatically more trustworthy than a multi-billion dollar corporation with an ingrained and (seemingly) solid attitude regarding NOT selling user's data? I roll an OwnCloud server for me and my family, and I know that I'm not invading their privacy, but I could very easily do so and not leave a trace of my having done it even that a pro user could find, let alone a layman. To say that Apple is less trustworthy than a given power user solely because they use closed source is ridiculous, there is zero correlation there.

Veratyr 9y ago

> Power users make sure its save for them, if it is, it is save for 'normal' users as well. Power users can make sure the code they're running is safe for them. There's no guarantee that Signal for example is running the same code they release to others.

lorenzhs 9y ago
Signal for Android has reproducible builds, so you can verify that the version on the Play Store matches the code you audited.
- krallja 9y ago
  How does that help you verify what is running on the server?
  - nickpsecurity 9y ago
    They can use trusted computing or HSM tech for that. They have the money but probably won't spend it.
    - closeparen 9y ago
      But they don't, so why do they get points for having an open source server?
      - nickpsecurity 9y ago
        For a full solution, it would be a start to what they needed. The main benefit of an open-source server is that people can audit it for vulnerabilities. As in, they get free to cheap labor to reduce their liabilities. People might also submit extensions they find useful. The usual benefits of FOSS for suppliers.
    - threeseed 9y ago
      None of that addresses the point. Without third party, independent verification of their servers and the code that is running open source provides limited (if any) improvements to privacy and security.
      - nickpsecurity 9y ago
        That's part of the point rather than separate. A closed system without any way to prove it's running something often can't to get 3rd party verification or user trust that's consistently believable. An open-source, tamper-resistant system can. Quite a bit of difference. Once verifications come in, the effects of reputation then allow users with less technical knowledge to learn what's trustworthy or not.