4 ms·
The issue is that even with open source software, "trust" enter into play when everyone cannot possibly inspect the source code at every update. So the publishe
by Santosh83 6y ago
The issue is that even with open source software, "trust" enter into play when everyone cannot possibly inspect the source code at every update. So the publisher of the software does need a certain amount of (subjective) "credibility", even though the source is available.
This can be mitigated by disabling auto-update functionality and insisting on reproducible builds.
- kreetx 6y agoI agree. Even if I theoretically could inspect the sources I never do, and pretty much solely rely on "if this had something malicious in it, somebody would have screamed about it already". edit: What I originally wondered was what was meant with the "RIP karma" comment by the parent?
- Fnoord 6y agoWhenever I brought it up in past, I got downvoted to oblivion. I find that peculiar. Although it is not OK to complain about moderation.
- uponcoffee 6y agoWhat's the issue though? Their bio seems fine, they're experienced//well known, the signal protocol is open-source with no issues thus far as I'm aware... I asked this the other day on a similar comment, and the best they could do is critique Moxie for having a savior complex
- Fnoord 6y agoThe issue depends on the software. In this case, the stakes are high, and the government already knows the developers name for sure, so I don't understand why they try to obfuscate their name given the importance of the application.