4 ms·

This is true iff you look through the code yourself, or are willing to trust that others have done so in as thorough a manner as your use case (attack vectors)

This is true iff you look through the code yourself, or are willing to trust that others have done so in as thorough a manner as your use case (attack vectors) necessitate. Apple isn't worth consideration if you are willing to put in the effort, or delegate trust, to other systems. If you'd prefer to delegate trust to them, how is that effectively different that FOSS that you haven't examined?

extralego 8y ago
Incentive. When devs announce how their software handles privacy concerns, they have an incentive to be honest because all it takes is one discovery of conflicting code and their trust is lost. But if the code is closed source, that incentive for honesty is removed. Of course the media can still seek circumstantial evidence and make accusations, but that’s a far cry from version control. Separately, closed source code invites new incentives to disrespect user privacy for profit. So, there are these two major categories involved, both of which are mitigated by opening the source code. Apple remains liable for both of them. All that Apple has is an observation that they sell hardware too. I guess we are just assuming they already make enough money from advertising as it is and don’t really want more. I think there is a significant difference.
- millstone 8y ago
  Companies get hit with multi-million dollar fines for violating their privacy policies. So there's your incentive. I just don't see open source as better protecting privacy. See for example the telemetry in .NET Core or VS Code [1]. Users discover this stuff by watching network traffic, not through code audits. 1: https://github.com/Microsoft/vscode/issues/16131 https://github.com/Microsoft/vscode/issues/16131
  - extralego 8y ago
    Fines are accounted as overhead. Watching network traffic is limited to circumstantial evidence, and not even that without a circumstantially isolated environment. Those are a couple of scenarios where these accusations can be made.
  - bronco21016 8y ago
    Is a multi-million dollar fine enough to matter? Let’s assume Apple violated their privacy policy and was fined $999 million, the highest “multi-million dollar” fine they could be assessed. That’s just barely more than 1% of their market cap. Fines are definitely incentive to do right but the fine must be felt. I’m not aware of any cases where the tech giants have been levied a fine that really hits them hard.
    - Godel_unicode 8y ago
      The fine you're proposing would cause a much larger hit to market cap than you're suggesting. Consider, Apple made ~20 billion in profit last quarter, your hypothetical fine would be a precipitous hit to profit margin which, when reported on the quarterly earnings call, would cause an abrupt downturn in share price. Consider the 13% hair cut earlier this year when the market thought Apple was going to miss. Then there's the existential panic of "does this mean Apple is in for more such fines?".
      - extralego 8y ago
        I guess jail time will have to do.
cosmojg 8y ago
Let's consider the incentives in each case and how they enable you to distribute your trust. Apple is a for-profit, publicly traded corporation. Their purpose is to make money, and they will likely do whatever they can to achieve that. More importantly, only they can see their code, not you and not other users. All you can possibly have is their word, and they will say whatever it takes to sell you their product. If they lie or exaggerate, there's no way you or anyone else could know. On the other hand, open source projects come in all shapes and sizes. Generally, they have a strong community of both developers and users around them. If you don't feel like looking at the code, you don't even have to trust the project itself. You can look to the community and its abundance of users, at least a few of which have audited the code and share your use case. And these users aren't just neutral third parties. Nay, they're better than that. They, too, value their own privacy, and are therefore motivated to protect it.
- millstone 8y ago
  This is silly. Apple publishes their privacy policy. If they were found to be violating it, they would lose business and be liable for expensive lawsuits. And security researchers are extremely good at finding these things. So yes, Apple has a very powerful incentive to tell the truth. As for the theory of "open source community," see the MyBTGWallet scam. This open source project, recommended by the Bitcoin Gold team, stole $5 million via a single line of code. Being open source isn't much protection really.
  - gear54rus 8y ago
    He's telling you about the fact that there's conflict of interest between you and crapple and you tell him an anecdote where some scum of this earth stole money and open source software was involved. Does this really sound like a compelling argument?
    - deleted 8y ago
      [deleted]
    - mattkevan 8y ago

extralego 8y ago

Incentive. When devs announce how their software handles privacy concerns, they have an incentive to be honest because all it takes is one discovery of conflicting code and their trust is lost. But if the code is closed source, that incentive for honesty is removed. Of course the media can still seek circumstantial evidence and make accusations, but that’s a far cry from version control. Separately, closed source code invites new incentives to disrespect user privacy for profit. So, there are these two major categories involved, both of which are mitigated by opening the source code. Apple remains liable for both of them. All that Apple has is an observation that they sell hardware too. I guess we are just assuming they already make enough money from advertising as it is and don’t really want more. I think there is a significant difference.

millstone 8y ago
Companies get hit with multi-million dollar fines for violating their privacy policies. So there's your incentive. I just don't see open source as better protecting privacy. See for example the telemetry in .NET Core or VS Code [1]. Users discover this stuff by watching network traffic, not through code audits. 1: https://github.com/Microsoft/vscode/issues/16131 https://github.com/Microsoft/vscode/issues/16131
- extralego 8y ago
  Fines are accounted as overhead. Watching network traffic is limited to circumstantial evidence, and not even that without a circumstantially isolated environment. Those are a couple of scenarios where these accusations can be made.
- bronco21016 8y ago
  Is a multi-million dollar fine enough to matter? Let’s assume Apple violated their privacy policy and was fined $999 million, the highest “multi-million dollar” fine they could be assessed. That’s just barely more than 1% of their market cap. Fines are definitely incentive to do right but the fine must be felt. I’m not aware of any cases where the tech giants have been levied a fine that really hits them hard.
  - Godel_unicode 8y ago
    The fine you're proposing would cause a much larger hit to market cap than you're suggesting. Consider, Apple made ~20 billion in profit last quarter, your hypothetical fine would be a precipitous hit to profit margin which, when reported on the quarterly earnings call, would cause an abrupt downturn in share price. Consider the 13% hair cut earlier this year when the market thought Apple was going to miss. Then there's the existential panic of "does this mean Apple is in for more such fines?".
    - extralego 8y ago
      I guess jail time will have to do.

cosmojg 8y ago

Let's consider the incentives in each case and how they enable you to distribute your trust. Apple is a for-profit, publicly traded corporation. Their purpose is to make money, and they will likely do whatever they can to achieve that. More importantly, only they can see their code, not you and not other users. All you can possibly have is their word, and they will say whatever it takes to sell you their product. If they lie or exaggerate, there's no way you or anyone else could know. On the other hand, open source projects come in all shapes and sizes. Generally, they have a strong community of both developers and users around them. If you don't feel like looking at the code, you don't even have to trust the project itself. You can look to the community and its abundance of users, at least a few of which have audited the code and share your use case. And these users aren't just neutral third parties. Nay, they're better than that. They, too, value their own privacy, and are therefore motivated to protect it.

millstone 8y ago
This is silly. Apple publishes their privacy policy. If they were found to be violating it, they would lose business and be liable for expensive lawsuits. And security researchers are extremely good at finding these things. So yes, Apple has a very powerful incentive to tell the truth. As for the theory of "open source community," see the MyBTGWallet scam. This open source project, recommended by the Bitcoin Gold team, stole $5 million via a single line of code. Being open source isn't much protection really.
- gear54rus 8y ago
  He's telling you about the fact that there's conflict of interest between you and crapple and you tell him an anecdote where some scum of this earth stole money and open source software was involved. Does this really sound like a compelling argument?
  - deleted 8y ago
    [deleted]
  - mattkevan 8y ago