3 ms·

I can't see a way to "trust nobody" beyond abstaining entirely from phones, computers, etc. Imagine a Free Software utopia with open hardware running an open s

I can't see a way to "trust nobody" beyond abstaining entirely from phones, computers, etc. Imagine a Free Software utopia with open hardware running an open source OSes and apps. Someone is writing that code. Someone is manufacturing that device. Someone is compiling and packaging that distribution for you. Someone is running the network. Having access to the (alleged) source code for everything, and being able to compile it all yourself, would surely be worth something. But it'd be way too much code for you to audit alone. So you're going to have to trust Someone (security researchers, open source contributors) to be doing this for you...

mwfunk 7y ago
For some people, I think it's actually exciting for them to think about how independent they are and how nobody can spy on them or trick them out of money because they consider themselves to be so worldly and knowledgeable about such things. And maybe they are compared to their families or the people they deal with during their day-to-day. I've known plenty of people (myself included at times) who get some of their feelings of self-worth from this sort of thing. But because it's more of a fun or emotional or ego-boosting thing than a rational thing, they'll often make big bold binary blanket statements about all the products they refuse to buy or web sites they refuse to go to or companies they refuse to patronize. And that's all great, actually, as long as it's rational and based on facts rather than some narrative in their head. We need more skeptical people, we always do. But it's not always rational, and sometimes it is more like they're LARPing through some exciting narrative about the world, and in that narrative they're the heroes who know stuff that the normies don't. They're more like survivalists living an adventure in their head than rational people making rational choices. And that's where people can also get into trouble, both for having a false sense of confidence about their ability to avoid risk, and for giving others bad advice based on excessive confidence or rose-colored glasses about the same things. I'm all for better security practices based on ever more openness, but I agree 100% with your example: people are kidding themselves if they think just because they run binaries built by other people from open source, it's almost as good as if they had personally inspected every line of code themselves. And when people are making those sorts of utopian statements, it's generally coming from the LARPing survivalist narrative part of the mind rather than the skeptical rational part of the mind and should be viewed with that much more skepticism. Not rejected, but just considered with an extra dollop of skepticism, because they hopefully at least mean well.
- mirimir 7y ago
  That's me, for sure. But here's the thing: It's always just a game. So sure, call it LARPing. However, consider that the US came out of LARPing.
mirimir 7y ago
Sure, you must always trust someone. However, you can distribute trust. With open-source software, you distribute trust across many developers, researchers and other users. It doesn't always work. But you're not stuck trusting just one entity. Another example is Tor. You can't trust any one relay operator. But Tor does onion routing through three relays (guard, middle and exit) and so it's the design that you're trusting. Basically, the difficulty is identifying what relays you're using, and getting data from them. Plus the fact that the routing changes frequently (10 minutes by default) so adversaries would need data from many relays. Even so, Tor's design can't resist traffic analysis by adversaries with access to global network data, and global attack networks. That was an explicit choice. Because resisting such adversaries would require stuff (random mixing and latency, padding to provide ~constant throughput, etc) that makes the network far less usable, and not scale well.

mwfunk 7y ago

For some people, I think it's actually exciting for them to think about how independent they are and how nobody can spy on them or trick them out of money because they consider themselves to be so worldly and knowledgeable about such things. And maybe they are compared to their families or the people they deal with during their day-to-day. I've known plenty of people (myself included at times) who get some of their feelings of self-worth from this sort of thing. But because it's more of a fun or emotional or ego-boosting thing than a rational thing, they'll often make big bold binary blanket statements about all the products they refuse to buy or web sites they refuse to go to or companies they refuse to patronize. And that's all great, actually, as long as it's rational and based on facts rather than some narrative in their head. We need more skeptical people, we always do. But it's not always rational, and sometimes it is more like they're LARPing through some exciting narrative about the world, and in that narrative they're the heroes who know stuff that the normies don't. They're more like survivalists living an adventure in their head than rational people making rational choices. And that's where people can also get into trouble, both for having a false sense of confidence about their ability to avoid risk, and for giving others bad advice based on excessive confidence or rose-colored glasses about the same things. I'm all for better security practices based on ever more openness, but I agree 100% with your example: people are kidding themselves if they think just because they run binaries built by other people from open source, it's almost as good as if they had personally inspected every line of code themselves. And when people are making those sorts of utopian statements, it's generally coming from the LARPing survivalist narrative part of the mind rather than the skeptical rational part of the mind and should be viewed with that much more skepticism. Not rejected, but just considered with an extra dollop of skepticism, because they hopefully at least mean well.

mirimir 7y ago
That's me, for sure. But here's the thing: It's always just a game. So sure, call it LARPing. However, consider that the US came out of LARPing.

mirimir 7y ago

Sure, you must always trust someone. However, you can distribute trust. With open-source software, you distribute trust across many developers, researchers and other users. It doesn't always work. But you're not stuck trusting just one entity. Another example is Tor. You can't trust any one relay operator. But Tor does onion routing through three relays (guard, middle and exit) and so it's the design that you're trusting. Basically, the difficulty is identifying what relays you're using, and getting data from them. Plus the fact that the routing changes frequently (10 minutes by default) so adversaries would need data from many relays. Even so, Tor's design can't resist traffic analysis by adversaries with access to global network data, and global attack networks. That was an explicit choice. Because resisting such adversaries would require stuff (random mixing and latency, padding to provide ~constant throughput, etc) that makes the network far less usable, and not scale well.