4 ms·

From the article: > Protecting myself from bad actors is not my job. It is the government’s job. Following recent events, the EFF, and the dealings of 3-lette

by cies 6y ago

From the article: > Protecting myself from bad actors is not my job. It is the government’s job. Following recent events, the EFF, and the dealings of 3-letter agencies in the US, it seems the bad actor we all want to pretect ourselves from is the government. Stallman is right, and was right so many times. Also, FLOSS is so ubiquitous that you dont even know yr using it. The internet runs on it. Android OS and Apple's OSes all use a lot of it. MS is even caving in. FLOSS won.

mrkeen 6y ago
As a developer, I agree with the sentiment that FLOSS won. As a consumer, I think the situation is in some ways worse than ever. Consumer software used to be distributed to the end-users' PCs. You could store your data on your PC, and inspect the source code to make sure that nothing nefarious was going on. Now the code stays with the companies (so you can't modify it or learn from it), and you send your data to them via the browser.
- b1daly 6y ago
  This argument about code inspection does not make sense to me. The number of people who are going to even have the ability to inspect the code of the applications they use is infitesimal and of that small number the people who have time and inclination to do so is microscopic. Given that applications are complex, written by groups of programmers over extended time what is the chance of meaningful code review by an individual? It could take years for a single application. I don’t know if Free software makes software less secure but I don’t see how it makes it more secure? Especially given that security might not be a high priority for the authors. I’m not a programmer so it’s hard for me to understand the arguments, but from what I gather is that any popular software could be a vector for threats and that users themselves remain the biggest vector. The author suggests greater use of code signing could help. It also seems to me that progress towards computer security needs to be the province of large, well resourced organizations. Our own (US) government seems to not be prioritizing this correctly, preferring to maintain their own exploits at the cost of defense. This is a political problem. It is of a piece with the historical arrogance of the US security-military apparatus that is being badly outplayed, mistaking pure military superiority as the most important type of security.
  - mrkeen 6y ago
    > This argument about code inspection does not make sense to me. It's about doing things in public. Not many people fit in a public courthouse, but court reporters can write down what happened and broadcast it to the public. Compare that to the FISA court. > I don’t know if Free software makes software less secure but I don’t see how it makes it more secure Without the source code, one can't even have an opinion on whether it's secure or not. I simply have to take the vendor's word for it. > The author suggests greater use of code signing could help. This is probably part of the solution. But who is signing what, and why? If Microsoft gives me a signed binary, all that tells me is that Microsoft vouches for their own binary.
    - denton-scratch 6y ago
      It also means that if I modify it, it's no longer signed. And if the system is configured so that only binaries signed by Microosoft (or by a signer that Microsoft trusts) can run, then the modified software won't run. Code signing is A Good Thing, in principle. But it's easily hijacked by bad actors to further monopolistic goals.
      - thereddaikon 6y ago
        It also gives a false sense of security. There have been supply chain attacks in the past that succeeded because the attackers got their hands on a cert and signed malicious code.
  - eythian 6y ago
    Personally, I see the arguments about software security to be a bit distracting. In my experience, users of free/open source software don't generally inspect the code (there are definitely exceptions of course.) What it can provide is things like the ability to customise, to avoid vendor lock-in, and things like that. Most users aren't developers, but those that aren't can still get benefits from those who are. For example, if I provide software X to someone, and they use me for support (set up, config, development, whatever), they can choose to move to someone else to provide their support if they want. If I start charging too much, or provide bad service, or just want to get out of the industry and go into woodworking, I as a developer am replaceable. If I don't want to do something, they can get someone else to do it. I used to work on a free software project where this was a big draw for the users. They usually didn't have their own expertise to do the support, but there was a big pool of people and companies they could choose from to take over. And, some did have someone internal to do it, which meant they could change things to suit their own needs as they saw fit. We occasionally got patches and QA reviews from our customers, through the public bugtracker for the project. It does get more complicated with SaaS stuff, but that is solvable also (for example, requiring that data and code is provided.) This is of course only one aspect, and is a bit more commercially oriented (because that's a lot of my experience), but I just think that the security aspects, while valid, often distract from some of the core reasons behind the free and open source models.
b1daly 6y ago
We need protection from which government? All of them? I think that is probably impossible.
- dmantis 6y ago
  It's not binary. For example, passive snooping and data collection aggregation (like Snowden's NSA revelations) is much worse than the direct attack possibility with humans involved. E.g. it's much less likely to be targeted by NSA employees without too loud crimes than been analyzed and targeted after some automatic scanning and anomalies findings. And the article as well as comments assumes that the whole world lives in US! It would be nice to be protected from US and China espionage workers for other ~200 countries citizens and their govs. Moreover, that's strictly necessary to develop those countries and grow healthy competition. And free software is much easier to review and modify to security and military services of other countries.
- sokoloff 6y ago
  We all need protection from all governments that would grow more powerful and influential at any positive rate (even 1% annually) forever. The seat of power must remain with the people, not corporations and not governments for people to have meaningful freedom.

by cies 6y ago

mrkeen 6y ago

As a developer, I agree with the sentiment that FLOSS won. As a consumer, I think the situation is in some ways worse than ever. Consumer software used to be distributed to the end-users' PCs. You could store your data on your PC, and inspect the source code to make sure that nothing nefarious was going on. Now the code stays with the companies (so you can't modify it or learn from it), and you send your data to them via the browser.

b1daly 6y ago
This argument about code inspection does not make sense to me. The number of people who are going to even have the ability to inspect the code of the applications they use is infitesimal and of that small number the people who have time and inclination to do so is microscopic. Given that applications are complex, written by groups of programmers over extended time what is the chance of meaningful code review by an individual? It could take years for a single application. I don’t know if Free software makes software less secure but I don’t see how it makes it more secure? Especially given that security might not be a high priority for the authors. I’m not a programmer so it’s hard for me to understand the arguments, but from what I gather is that any popular software could be a vector for threats and that users themselves remain the biggest vector. The author suggests greater use of code signing could help. It also seems to me that progress towards computer security needs to be the province of large, well resourced organizations. Our own (US) government seems to not be prioritizing this correctly, preferring to maintain their own exploits at the cost of defense. This is a political problem. It is of a piece with the historical arrogance of the US security-military apparatus that is being badly outplayed, mistaking pure military superiority as the most important type of security.
- mrkeen 6y ago
  > This argument about code inspection does not make sense to me. It's about doing things in public. Not many people fit in a public courthouse, but court reporters can write down what happened and broadcast it to the public. Compare that to the FISA court. > I don’t know if Free software makes software less secure but I don’t see how it makes it more secure Without the source code, one can't even have an opinion on whether it's secure or not. I simply have to take the vendor's word for it. > The author suggests greater use of code signing could help. This is probably part of the solution. But who is signing what, and why? If Microsoft gives me a signed binary, all that tells me is that Microsoft vouches for their own binary.
  - denton-scratch 6y ago
    It also means that if I modify it, it's no longer signed. And if the system is configured so that only binaries signed by Microosoft (or by a signer that Microsoft trusts) can run, then the modified software won't run. Code signing is A Good Thing, in principle. But it's easily hijacked by bad actors to further monopolistic goals.
    - thereddaikon 6y ago
      It also gives a false sense of security. There have been supply chain attacks in the past that succeeded because the attackers got their hands on a cert and signed malicious code.
- eythian 6y ago
  Personally, I see the arguments about software security to be a bit distracting. In my experience, users of free/open source software don't generally inspect the code (there are definitely exceptions of course.) What it can provide is things like the ability to customise, to avoid vendor lock-in, and things like that. Most users aren't developers, but those that aren't can still get benefits from those who are. For example, if I provide software X to someone, and they use me for support (set up, config, development, whatever), they can choose to move to someone else to provide their support if they want. If I start charging too much, or provide bad service, or just want to get out of the industry and go into woodworking, I as a developer am replaceable. If I don't want to do something, they can get someone else to do it. I used to work on a free software project where this was a big draw for the users. They usually didn't have their own expertise to do the support, but there was a big pool of people and companies they could choose from to take over. And, some did have someone internal to do it, which meant they could change things to suit their own needs as they saw fit. We occasionally got patches and QA reviews from our customers, through the public bugtracker for the project. It does get more complicated with SaaS stuff, but that is solvable also (for example, requiring that data and code is provided.) This is of course only one aspect, and is a bit more commercially oriented (because that's a lot of my experience), but I just think that the security aspects, while valid, often distract from some of the core reasons behind the free and open source models.

b1daly 6y ago

We need protection from which government? All of them? I think that is probably impossible.

dmantis 6y ago
It's not binary. For example, passive snooping and data collection aggregation (like Snowden's NSA revelations) is much worse than the direct attack possibility with humans involved. E.g. it's much less likely to be targeted by NSA employees without too loud crimes than been analyzed and targeted after some automatic scanning and anomalies findings. And the article as well as comments assumes that the whole world lives in US! It would be nice to be protected from US and China espionage workers for other ~200 countries citizens and their govs. Moreover, that's strictly necessary to develop those countries and grow healthy competition. And free software is much easier to review and modify to security and military services of other countries.
sokoloff 6y ago
We all need protection from all governments that would grow more powerful and influential at any positive rate (even 1% annually) forever. The seat of power must remain with the people, not corporations and not governments for people to have meaningful freedom.