5 ms·

I did not read GP as saying it was a binary choice, but rather a prerequisite. That is to say, without transparency, there can be no trust, but you can also ha

I did not read GP as saying it was a binary choice, but rather a prerequisite. That is to say, without transparency, there can be no trust, but you can also have no trust with transparency. For someone like me, who is somewhat technically competent, but not a security expert, openness means that names and figures I do trust have the chance to examine whatever I intend to use and comment on it, observe it, and make assessments, including shaming poor implementations claiming traits they have no right to. Turns out there are plenty of people more competent than me that can catch these things. Transparency also allows less hiding of incompetency in otherwise commercial and/or proprietary designs.

xoa 8y ago
>I did not read GP as saying it was a binary choice, but rather a prerequisite. That is a binary statement though, saying it's a prereq is saying without it trust is 0. >That is to say, without transparency, there can be no trust, but you can also have no trust with transparency. That would clearly be incorrect though. Transparency is not needed to probe a system, it is mostly helpful in changing the incentive structure for development in the first place (helping avoid laziness mostly), making the system more likely to be casually looked at, and fixing it if the original party is slow about it or absent. There can absolutely be trust without transparency however when other factors are strong enough, it's just that transparency lowers the strength needed and in turn helps in cases where it's not there. >For someone like me, who is somewhat technically competent, but not a security expert, openness means that names and figures I do trust have the chance to examine whatever I intend to use and comment on it, observe it, and make assessments, including shaming poor implementations claiming traits they have no right to. Turns out there are plenty of people more competent than me that can catch these things. >Transparency also allows less hiding of incompetency in otherwise commercial and/or proprietary designs. That's what I said though? But are you arguing in turn that the typical iPhone is a lot easier to break into and less trustworthy then the typical Android or PC? It's the least transparent after all. And what about for the majority of the population who lack even the technical meta-knowledge we have let alone anything more? They still have to exercise trust, so how do you think that works from their perspective?
- yellowapple 8y ago
  "Transparency is not needed to probe a system" Maybe not strictly, but without transparency that probing becomes more difficult. It also suggests that there's something worth hiding, which is all the more reason to not trust it.
PeterisP 8y ago
"names and figures I do trust have the chance to examine whatever I intend to use and comment on it, observe it, and make assessments, including shaming poor implementations claiming traits they have no right to" does not necessarily require openness - third party audits, if done by people who you do trust, can do the same thing for closed systems, for example as described in the tptacek's comment https://news.ycombinator.com/item?id=18385507 https://news.ycombinator.com/item?id=18385507 above.
- nly 8y ago
  Audits done by a select few who were given privileged access by definition are not open or transparent. You don't just want conclusions to be published, you want the methodology and source material to be too so the findings are reproducible.

xoa 8y ago

>I did not read GP as saying it was a binary choice, but rather a prerequisite. That is a binary statement though, saying it's a prereq is saying without it trust is 0. >That is to say, without transparency, there can be no trust, but you can also have no trust with transparency. That would clearly be incorrect though. Transparency is not needed to probe a system, it is mostly helpful in changing the incentive structure for development in the first place (helping avoid laziness mostly), making the system more likely to be casually looked at, and fixing it if the original party is slow about it or absent. There can absolutely be trust without transparency however when other factors are strong enough, it's just that transparency lowers the strength needed and in turn helps in cases where it's not there. >For someone like me, who is somewhat technically competent, but not a security expert, openness means that names and figures I do trust have the chance to examine whatever I intend to use and comment on it, observe it, and make assessments, including shaming poor implementations claiming traits they have no right to. Turns out there are plenty of people more competent than me that can catch these things. >Transparency also allows less hiding of incompetency in otherwise commercial and/or proprietary designs. That's what I said though? But are you arguing in turn that the typical iPhone is a lot easier to break into and less trustworthy then the typical Android or PC? It's the least transparent after all. And what about for the majority of the population who lack even the technical meta-knowledge we have let alone anything more? They still have to exercise trust, so how do you think that works from their perspective?

yellowapple 8y ago
"Transparency is not needed to probe a system" Maybe not strictly, but without transparency that probing becomes more difficult. It also suggests that there's something worth hiding, which is all the more reason to not trust it.

PeterisP 8y ago

"names and figures I do trust have the chance to examine whatever I intend to use and comment on it, observe it, and make assessments, including shaming poor implementations claiming traits they have no right to" does not necessarily require openness - third party audits, if done by people who you do trust, can do the same thing for closed systems, for example as described in the tptacek's comment https://news.ycombinator.com/item?id=18385507 https://news.ycombinator.com/item?id=18385507 above.

nly 8y ago
Audits done by a select few who were given privileged access by definition are not open or transparent. You don't just want conclusions to be published, you want the methodology and source material to be too so the findings are reproducible.