3 ms·
Since you aren’t installing something that can be checked against an audited open source build, you always have to TRUST the publisher of the software. You jus
by EGreg 4y ago
Since you aren’t installing something that can be checked against an audited open source build, you always have to TRUST the publisher of the software.
You just take their word for it. They could always phone home any kind of data using steganography!
I replied to Moxie’s opposition to decentralized open source software, with arguments like this.
- jrm4 4y agoI'm 100% in agreement that we should see the source, but it seems to me there could be a "black boxy" way to check for this? As in set up e.g. an emulator and sniff all traffic in and out?
- palata 4y agoThere is always trust involved. The question is: what's your threat model? You can compile Signal yourself, but maybe you don't trust your OS, or your hardware, or your cleaning lady, or your wife. Signal cannot do anything if your phone got compromised by Pegasus, but they never claimed they could. That's exactly equivalent with decentralised software.