7 ms·

> this still doesn't solve the problem of whether Apple themselves are abusing your privacy Eventually you have to trust someone. This added transparency from

> this still doesn't solve the problem of whether Apple themselves are abusing your privacy Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Some people are successful while open sourcing everything, and that is commendable too.

lwhi 6y ago
Why do you have to eventually trust someone?
- kingnight 6y ago
  Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.
  - the_gipsy 6y ago
    not a single person, but the sum of all people looking at the different parts. that's how open source works.
    - dkonofalski 6y ago
      Sure, but then you're putting your trust in those people. The point was that an individual can't possibly have the time or resources to do it themselves and so, at some point, they have to put their trust in someone else.
    - baddox 6y ago
      And thus you would need to trust those people.
      - gggmaster 6y ago
        Better than trusting a black box from a single business.
      - andrepd 6y ago
        It's better to trust several people, with competing interests, that one single entity. This is like, democracy 101, come on.
    - whynotminot 6y ago
      I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.
      - gggmaster 6y ago
        But for a closed source one there’s definitely no way to audit the source code.
        fiddlerwoaroof 6y ago
        Sure there is: tools like strace, dtrace and eBPF let you “peak under the hood” of nearly any application, not to mention disassemblers like IDA Pro and Ghidra. I have debugged all sorts of issues with closed source applications using these tools.
      - Seirdy 6y ago
        Being able to inspect the code is a necessary but insufficient measure for being secure. If you cannot inspect the source code, you are not fully aware of how the program works. Tools like strace can help you analyze a program's behavior from the outside, but you get limited insight into its internals (e.g., what algorithms is it using?). Being open source does not automatically make software more secure. A successful compilation doesn't automatically make your code bug-free. Yet both are necessary to achieve the desired goal: security and correctness, respectively.
        whynotminot 6y ago
        How often do you inspect the code of the open source programs you use every day? How about when updates come out? Do you check again? Or, do you trust that someone has looked at it? How much faith do you have in someone out there in the community? My point isn't that open source isn't a good thing--my point is that it's not the silver bullet a lot of people blindly assume it to be. Hence the second line of my post: > In theory it means something could maybe be safer, but it far from guarantees it.
    - dogecoinbase 6y ago
      The (ongoing) saga of libssh alone should be enough convincing that many eyes do nothing as regards shallowness.
      - rimjongun 6y ago
        I read in a news paper that one time this search party completely missed a young girl they were looking for. Your logic would dictate that search parties are a waste of time. Is open source a panacea? No, clearly, as you stated. Are more eyes, even untrained ones, better than no eyes? Ask all the people saved by search party volunteers every year.
    - TheDong 6y ago
      I mean, I've known a few developers that worked at apple. I trust them every bit as much as the average developer who reads open source code. They vouched that the code they worked with at apple was attempting to be secure and wasn't trying to steal user's data. If I'm not going to read the source code myself either way, why should I trust that random open source code-reader X who says "yup, didn't see any malicious code" vs a developer friend who works for apple and says "yup, no malicious code"? Honestly, more often than not there's a lot of overlap between those people... And I'd bet that there's a ton of eyes I'd trust on iOS's source code given how many devs apple pays to work on it, while I think there's far fewer on most non-corporate open source projects.
      - lwhi 6y ago
        I don't think the issue we should worry about will always just be one bad actor in an organisation. A corporation like Apple (or TikTok) will sometimes decide to implement features that are antithetical to its users best interests, because there's a commercial imperative to do so. If the code is closed-source, it's more difficult to assess whether this is the case.
  - andrepd 6y ago
    Wait a minute. So it's better to have government finances be closed to the public, right? Because after all, you would need to audit 100,000s of pages of documents to understand what's going on -- which isn't feasible for anyone.
andrepd 6y ago
>Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Funny how you change your argument mid-paragraph. "It's okay! You have to trust somebody. Or maybe you don't. But anyway, it's a private company, so just don't buy it!" Well the latter is not what GP was arguing in this thread is it? -.-
- unityByFreedom 6y ago
  You have a choice about where you place your trust. You seem to want me to say "buy it" or "don't buy it" and I'm saying it's up to you.
dheera 6y ago
> Eventually you have to trust someone. Perhaps, but Apple is the last company I would trust. They work in a culture of secrecy and engineer for obscurity rather than transparency, and that does not make them trustable at all. > Private companies are not under any moral obligation to open source their code But I will give far more trust to those who do so, or at least the privacy-critical parts. With Android I need to trust no-one; I can modify things on the OS level that do not necessarily execute apps in the way those apps expect to be executed, and that is the ultimate privacy guarantee. I own the hardware, so how my hardware runs software should be my choice; the entire set of instructions and APIs for creating phone apps is merely a suggestion for how the OS should execute apps, and how a stock OS executes apps, but does not necessarily reflect how I choose to have my hardware execute them.

lwhi 6y ago

Why do you have to eventually trust someone?

kingnight 6y ago
Because you would need to write and/or audit your entire technology toolchain — software, build tools, operating systems, hardware, etc — which isn't feasible for anyone.
- the_gipsy 6y ago
  not a single person, but the sum of all people looking at the different parts. that's how open source works.
  - dkonofalski 6y ago
    Sure, but then you're putting your trust in those people. The point was that an individual can't possibly have the time or resources to do it themselves and so, at some point, they have to put their trust in someone else.
  - baddox 6y ago
    And thus you would need to trust those people.
    - gggmaster 6y ago
      Better than trusting a black box from a single business.
    - andrepd 6y ago
      It's better to trust several people, with competing interests, that one single entity. This is like, democracy 101, come on.
  - whynotminot 6y ago
    I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.
    - gggmaster 6y ago
      But for a closed source one there’s definitely no way to audit the source code.
      - fiddlerwoaroof 6y ago
        Sure there is: tools like strace, dtrace and eBPF let you “peak under the hood” of nearly any application, not to mention disassemblers like IDA Pro and Ghidra. I have debugged all sorts of issues with closed source applications using these tools.
    - Seirdy 6y ago
      Being able to inspect the code is a necessary but insufficient measure for being secure. If you cannot inspect the source code, you are not fully aware of how the program works. Tools like strace can help you analyze a program's behavior from the outside, but you get limited insight into its internals (e.g., what algorithms is it using?). Being open source does not automatically make software more secure. A successful compilation doesn't automatically make your code bug-free. Yet both are necessary to achieve the desired goal: security and correctness, respectively.
      - whynotminot 6y ago
        How often do you inspect the code of the open source programs you use every day? How about when updates come out? Do you check again? Or, do you trust that someone has looked at it? How much faith do you have in someone out there in the community? My point isn't that open source isn't a good thing--my point is that it's not the silver bullet a lot of people blindly assume it to be. Hence the second line of my post: > In theory it means something could maybe be safer, but it far from guarantees it.
  - dogecoinbase 6y ago
    The (ongoing) saga of libssh alone should be enough convincing that many eyes do nothing as regards shallowness.
    - rimjongun 6y ago
      I read in a news paper that one time this search party completely missed a young girl they were looking for. Your logic would dictate that search parties are a waste of time. Is open source a panacea? No, clearly, as you stated. Are more eyes, even untrained ones, better than no eyes? Ask all the people saved by search party volunteers every year.
  - TheDong 6y ago
    I mean, I've known a few developers that worked at apple. I trust them every bit as much as the average developer who reads open source code. They vouched that the code they worked with at apple was attempting to be secure and wasn't trying to steal user's data. If I'm not going to read the source code myself either way, why should I trust that random open source code-reader X who says "yup, didn't see any malicious code" vs a developer friend who works for apple and says "yup, no malicious code"? Honestly, more often than not there's a lot of overlap between those people... And I'd bet that there's a ton of eyes I'd trust on iOS's source code given how many devs apple pays to work on it, while I think there's far fewer on most non-corporate open source projects.
    - lwhi 6y ago
      I don't think the issue we should worry about will always just be one bad actor in an organisation. A corporation like Apple (or TikTok) will sometimes decide to implement features that are antithetical to its users best interests, because there's a commercial imperative to do so. If the code is closed-source, it's more difficult to assess whether this is the case.
- andrepd 6y ago
  Wait a minute. So it's better to have government finances be closed to the public, right? Because after all, you would need to audit 100,000s of pages of documents to understand what's going on -- which isn't feasible for anyone.

andrepd 6y ago

>Eventually you have to trust someone. This added transparency from Apple is commendable. I support open source for publicly funded software, but if it's privately owned and funded, you can choose to buy and use it or not. Private companies are not under any moral obligation to open source their code or methods. Funny how you change your argument mid-paragraph. "It's okay! You have to trust somebody. Or maybe you don't. But anyway, it's a private company, so just don't buy it!" Well the latter is not what GP was arguing in this thread is it? -.-

unityByFreedom 6y ago
You have a choice about where you place your trust. You seem to want me to say "buy it" or "don't buy it" and I'm saying it's up to you.

dheera 6y ago

> Eventually you have to trust someone. Perhaps, but Apple is the last company I would trust. They work in a culture of secrecy and engineer for obscurity rather than transparency, and that does not make them trustable at all. > Private companies are not under any moral obligation to open source their code But I will give far more trust to those who do so, or at least the privacy-critical parts. With Android I need to trust no-one; I can modify things on the OS level that do not necessarily execute apps in the way those apps expect to be executed, and that is the ultimate privacy guarantee. I own the hardware, so how my hardware runs software should be my choice; the entire set of instructions and APIs for creating phone apps is merely a suggestion for how the OS should execute apps, and how a stock OS executes apps, but does not necessarily reflect how I choose to have my hardware execute them.