3 ms·
I don’t have ultimate trust in any software or hardware, but I get to “good enough” by deciding which providers I trust: * Software: Canonical, Google, Microso
by jl6 4y ago
I don’t have ultimate trust in any software or hardware, but I get to “good enough” by deciding which providers I trust:
* Software: Canonical, Google, Microsoft, Valve, Oracle, Dropbox. I install software from their official repos and keep it up to date. Anything 3rd-party/unofficial/experimental/GitHub goes in a VM.
* Hardware: I built my main PC from mainstream commodity components. I have no way of knowing if there are secret backdoors but I consider it unlikely.
I use a password manager, I enable 2FA, I turn off things I don't use, and generally have a low-risk hygienic approach to computing.
I’m also privileged enough to not be a “person of interest” so don’t feel the need to take any extraordinary precautions.
Yes, I’m aware of VM escapes. Yes, I’ve read Reflections on Trusting Trust. I choose to trust regardless because life’s too short for paranoia. As Frank Drebin said:
“You take a chance getting up in the morning, crossing the street, or sticking your face in a fan.”
- rhn_mk1 4y agoWhat about publicly known backdoors in your hardware? https://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/ https://www.techrepublic.com/article/is-the-intel-management... There is hardware that doesn't contain those at least, but it doesn't break power records.
- jl6 4y agoI don't consider it practical to take any countermeasures to the possibility of this threat. I think there's a ~10% chance it's a backdoor, and if it is, there's a 98% chance it would be at the behest of a branch of the US government, and I'm not currently an adversary of theirs. (This is not an argument for mass surveillance, it's just a practical assessment of the risk).
- rhn_mk1 4y agoJust to be clear, the question of whether it's a backdoor or not doesn't matter for whether bad actors use it. The capabilities are rather well known. Its vulnerabilities aren't, but vulnrabilities do not a backdoor make.
- hutzlibu 4y ago"which providers I trust: * Software: Google, Microsoft" I trust that Google and Microsoft won't hack into my bank account and steal money, even though they could, but otherwise I assume they collect anything they want and can.
- jl6 4y agoI assume they profile me, but I don't assume they steal my files.
- hutzlibu 4y agoThey (hopefully) won't steal your ip or personal pictures, but there is so much telemetry and other phoning home going on, and without transparency or the option to really turn it off.
- ghostpepper 4y agoSecurity and privacy are two separate things and not always aligned.
- alyandon 4y agoI caught Windows Defender "automatic sample submission" silently uploading places.sqlite out of my Firefox directory despite the assurance in the control panel that "We'll prompt you if the file we need is likely to contain personal information". So now I disable automatic sample submission via group policy but Microsoft definitely can and will access files that they really have no business accessing.
- rejectfinite 4y agoYes, but the topic is security, not privacy.