3 ms·

Source code availability isn’t really a solution to the trust problem. Sure, it allows for an audit, but the practical truth is that few people are qualified to

Source code availability isn’t really a solution to the trust problem. Sure, it allows for an audit, but the practical truth is that few people are qualified to perform those audits and few of them have a sufficient incentive to spend their time doing so. So you still just invest trust in the maintainer or — if you’re lucky — the third party auditing firm who was paid to review the code. That you can review the code doesn’t mean that anyone does so. At least not in an exhaustive and relevant way. Closed source or open, the problem is made even worse now that we live in a Package Manager culture where even the simplest applications adopt dozens of dependencies. I’m not saying that you should trust Facebook and their closed source applications, just that you’re not really all that safer trusting anyone else just because their source code is available.

spsful 7y ago
I'm not sure I'd surmise the dependency of users to be an entire culture in and of itself. Plus, I feel like this splits hairs; going down the rabbit hole of "well who is checking the open source code" and "well who is checking the person checking the open source code" leads to endless complexity, especially when the move in question is more symbolic than substantive. If WhatsApp did not use e2e encryption by default (and they didn't), then there was possibility of governments reading the communications anyway. Does this new announcement really lessen the security and privacy of the users? To me, it sounds like they are making the policy clearer to the public, since US / UK governments have not explicitly made press releases telling citizens which of their communications will be monitored. While I am very much a proponent to end-to-end encryption for ALL communications, I think this move isn't going to sacrifice privacy that users previously had.
- oarsinsync 7y ago
  > If WhatsApp did not use e2e encryption by default (and they didn't) Correct use of past tense. In the present, e2e encryption is by default. > Does this new announcement really lessen the security and privacy of the users? Yes it does, since e2e encryption is enabled by default now. Best I can tell, there’s no way to disable it either.

spsful 7y ago

I'm not sure I'd surmise the dependency of users to be an entire culture in and of itself. Plus, I feel like this splits hairs; going down the rabbit hole of "well who is checking the open source code" and "well who is checking the person checking the open source code" leads to endless complexity, especially when the move in question is more symbolic than substantive. If WhatsApp did not use e2e encryption by default (and they didn't), then there was possibility of governments reading the communications anyway. Does this new announcement really lessen the security and privacy of the users? To me, it sounds like they are making the policy clearer to the public, since US / UK governments have not explicitly made press releases telling citizens which of their communications will be monitored. While I am very much a proponent to end-to-end encryption for ALL communications, I think this move isn't going to sacrifice privacy that users previously had.

oarsinsync 7y ago
> If WhatsApp did not use e2e encryption by default (and they didn't) Correct use of past tense. In the present, e2e encryption is by default. > Does this new announcement really lessen the security and privacy of the users? Yes it does, since e2e encryption is enabled by default now. Best I can tell, there’s no way to disable it either.