4 ms·

Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. Reject all platforms that are not fully open, and reject all

by titzer 3y ago

Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware. Reading some damn "location privacy policy" is not going to cut it. Such policies are written by lawyers who lie by omission all the time. E.g. as soon as location data is "anonymized" the policy no longer applies. Which is of course a steaming lie. Location information cannot be effectively anonymized without basically nullifying its utility. Guess where that car parks? In one of two general locations for > 18 hours a day, usually. Gee, I wonder who that is. Even with 100m of noise, it's uniquely identifying of you. Don't even think about mobile phones that are accurate to the meter, tricked out with WiFi, accelerometers, and barometers. They are wireframe god mode tracking devices given the accuracy of sensors these days. What a nightmare to have these in everyone's hands and run by big tech.

kwhitefoot 3y ago
> reject all devices that come with any amount of closed software or firmware. Implementing that policy would mean not owning a mobile phone, a car, a television, microwave, or washing machine, etc.
- TaylorAlexander 3y ago
  I would love to see a world where all of those things use open source software and hardware. It would take a long time to make it a reality, but I see a path to that where more people are out there today making successful open source hardware systems and learning the parameters of how to fund them and financially maintain development.
  - HKH2 3y ago
    I would too. Some of us have trouble trying to justify buying a System76 laptop etc; the anti-abuse options are usually more expensive. (Edit: PinePhones are cheaper than I thought.)
    - Syonyk 3y ago
      > ...the anti-abuse options are usually more expensive. So you can read into that, "This is how profitable it is to abuse your users." Smart TV companies make more money selling behavioral data now than they do selling TVs. Streaming stick companies are the same. Roku basically gives hardware away at cost in exchange for the juicy data streams coming off it (their "how we sell your data" "privacy" policy is a hysterical read, they grant themselves permission to scan your network and report other devices on it should they care to).
- angry_moose 3y ago
  Yeah, unfortunately that ship has sailed. The more practical advice at the moment seems to be "don't buy anything with an internet connection if you aren't 100% OK with it tracking your every movement". Seems like that's only going to last another year or two with 5G and shit like Amazon Sidewalk making every single device internet connected.
- gerbilly 3y ago
  Now you're onto something! And thankfully, you can still find washing machines and microwaves which don't spy on you. Keep your old stuff people cos, soon I'm sure _everything_ will spy on you and track you!
  - kwhitefoot 3y ago
    The controllers will still be closed source even if they aren't spying.
- fsflover 3y ago
  Librem 5 smartphone runs an FSF-endorsed OS (PureOS).
HeckFeck 3y ago
> Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware. I wish we could, but they truly have us by the balls. It is nigh impossible to participate in society without using proprietary software.
- asdff 3y ago
  There are plenty of times however where you can choose between open and closed source, and in those cases its best to chose open and support that sort of development.
- gerdesj 3y ago
  It's worth a try though to push back. We are not talking holding off a bunch of murderous Russian troops. It's not a good look trying to recall " ... and they came for me" either. Just push back. Here's an example: Reolink are a Chinese company, what makes cameras - nothing intrinsically wrong with that but you should expect them to be be required to comply with any requirements the CCP might ... require. Reolink are also quite a savvy bunch and have gradually ensured that their products don't actually require an internet connection, at all. They do offer an app and the requirements of using the app are that the cams need to see the interwebs and be gatewayed by systems that are eventually subject to the CCP. Now this isn't quite yet perfect. Rio cams have offered ONVIF for at least five years, so Zoneminder, Frigate and all the rest can be your NVR. The camera's VLAN can be firewalled off from the internet. Mine is called THINGS and it is net door to SEWER for stuff I really worry about! Their doorbell offering is pretty decent but two way comms needs some handling. At the moment their app is the best bet for functionality but there are signs that Home Assistant with webrtc - https://github.com/AlexxIT/WebRTC https://github.com/AlexxIT/WebRTC should be OK. It is not impossible to live without prop software. At least care and try.
colechristensen 3y ago
>Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. People are fully accepting of data gathering when it's out in the open. Trust doesn't have anything to do with it, people are consenting to this kind of thing openly, and when something does come out they do not care.
- yazzku 3y ago
  People are not generally consenting when given the option. See what happened to FB stock when they were forced to show the pop-up.
isykt 3y ago
Why should I trust open source hardware / firmware / software?
- robflynn 3y ago
  You shouldn't just automatically trust it, but it allows you to examine what its doing and make your own informed decision about whether or not you can trust it. If you discover your data is being collected in an open source project you can, at the least, make an informed decision and give consent to it. And while everyone won't be able to understand what they're looking at, the community as a whole would benefit from people looking at it an announcing/discussing problematic things they see in the code base. If an open source project is syphoning data, someone's going to see it and talk about it. If a closed project is doing it, it's harder / more complicated for that act to be discovered.
  - fragmede 3y ago
    and on Github too, or some other public build mechanism. The thing of it is, is that if it's open source, but the binaries are built privately, there's no guarantee that the binary actually came from the source that's been presented.
  - isykt 3y ago
    But how can I trust “the community”? I don’t know them. I don’t know their capabilities, nor do I have any say in what they check: whether it’s complete, or accurate; whether the software has been compromised since the last time the community checked; or whether they did the checking they said at all.
- jacquesm 3y ago
  Because you can inspect the code and rebuild it to generate the same binaries.
  - fragmede 3y ago
    "same". I haven't been following progress with reproducible builds, it that actually possible today?
ascar 3y ago
> Location information cannot be effectively anonymized without basically nullifying its utility. I was under the impression that properly anonymizing location data includes aggregating a sufficient amount of individuals and the radius of this aggregation of course changes based on the population density in a given area. In with anonymized location data we can only draw conclusions on a populace and not an individual, which is still very useful. Of course, I generally agree with you. In most cases it won't be done properly and just replacing PI with the same "anonymous" id on a set of location data points of an individual achieves next to nothing.

by titzer 3y ago

kwhitefoot 3y ago

> reject all devices that come with any amount of closed software or firmware. Implementing that policy would mean not owning a mobile phone, a car, a television, microwave, or washing machine, etc.

TaylorAlexander 3y ago
I would love to see a world where all of those things use open source software and hardware. It would take a long time to make it a reality, but I see a path to that where more people are out there today making successful open source hardware systems and learning the parameters of how to fund them and financially maintain development.
- HKH2 3y ago
  I would too. Some of us have trouble trying to justify buying a System76 laptop etc; the anti-abuse options are usually more expensive. (Edit: PinePhones are cheaper than I thought.)
  - Syonyk 3y ago
    > ...the anti-abuse options are usually more expensive. So you can read into that, "This is how profitable it is to abuse your users." Smart TV companies make more money selling behavioral data now than they do selling TVs. Streaming stick companies are the same. Roku basically gives hardware away at cost in exchange for the juicy data streams coming off it (their "how we sell your data" "privacy" policy is a hysterical read, they grant themselves permission to scan your network and report other devices on it should they care to).
angry_moose 3y ago
Yeah, unfortunately that ship has sailed. The more practical advice at the moment seems to be "don't buy anything with an internet connection if you aren't 100% OK with it tracking your every movement". Seems like that's only going to last another year or two with 5G and shit like Amazon Sidewalk making every single device internet connected.
gerbilly 3y ago
Now you're onto something! And thankfully, you can still find washing machines and microwaves which don't spy on you. Keep your old stuff people cos, soon I'm sure _everything_ will spy on you and track you!
- kwhitefoot 3y ago
  The controllers will still be closed source even if they aren't spying.
fsflover 3y ago
Librem 5 smartphone runs an FSF-endorsed OS (PureOS).

HeckFeck 3y ago

> Reject all platforms that are not fully open, and reject all devices that come with any amount of closed software or firmware. I wish we could, but they truly have us by the balls. It is nigh impossible to participate in society without using proprietary software.

asdff 3y ago
There are plenty of times however where you can choose between open and closed source, and in those cases its best to chose open and support that sort of development.
gerdesj 3y ago
It's worth a try though to push back. We are not talking holding off a bunch of murderous Russian troops. It's not a good look trying to recall " ... and they came for me" either. Just push back. Here's an example: Reolink are a Chinese company, what makes cameras - nothing intrinsically wrong with that but you should expect them to be be required to comply with any requirements the CCP might ... require. Reolink are also quite a savvy bunch and have gradually ensured that their products don't actually require an internet connection, at all. They do offer an app and the requirements of using the app are that the cams need to see the interwebs and be gatewayed by systems that are eventually subject to the CCP. Now this isn't quite yet perfect. Rio cams have offered ONVIF for at least five years, so Zoneminder, Frigate and all the rest can be your NVR. The camera's VLAN can be firewalled off from the internet. Mine is called THINGS and it is net door to SEWER for stuff I really worry about! Their doorbell offering is pretty decent but two way comms needs some handling. At the moment their app is the best bet for functionality but there are signs that Home Assistant with webrtc - https://github.com/AlexxIT/WebRTC https://github.com/AlexxIT/WebRTC should be OK. It is not impossible to live without prop software. At least care and try.

colechristensen 3y ago

>Stallman was right. You absolutely cannot trust closed source to protect the privacy of your data. People are fully accepting of data gathering when it's out in the open. Trust doesn't have anything to do with it, people are consenting to this kind of thing openly, and when something does come out they do not care.

yazzku 3y ago
People are not generally consenting when given the option. See what happened to FB stock when they were forced to show the pop-up.

isykt 3y ago

Why should I trust open source hardware / firmware / software?

robflynn 3y ago
You shouldn't just automatically trust it, but it allows you to examine what its doing and make your own informed decision about whether or not you can trust it. If you discover your data is being collected in an open source project you can, at the least, make an informed decision and give consent to it. And while everyone won't be able to understand what they're looking at, the community as a whole would benefit from people looking at it an announcing/discussing problematic things they see in the code base. If an open source project is syphoning data, someone's going to see it and talk about it. If a closed project is doing it, it's harder / more complicated for that act to be discovered.
- fragmede 3y ago
  and on Github too, or some other public build mechanism. The thing of it is, is that if it's open source, but the binaries are built privately, there's no guarantee that the binary actually came from the source that's been presented.
- isykt 3y ago
  But how can I trust “the community”? I don’t know them. I don’t know their capabilities, nor do I have any say in what they check: whether it’s complete, or accurate; whether the software has been compromised since the last time the community checked; or whether they did the checking they said at all.
jacquesm 3y ago
Because you can inspect the code and rebuild it to generate the same binaries.
- fragmede 3y ago
  "same". I haven't been following progress with reproducible builds, it that actually possible today?

ascar 3y ago

> Location information cannot be effectively anonymized without basically nullifying its utility. I was under the impression that properly anonymizing location data includes aggregating a sufficient amount of individuals and the radius of this aggregation of course changes based on the population density in a given area. In with anonymized location data we can only draw conclusions on a populace and not an individual, which is still very useful. Of course, I generally agree with you. In most cases it won't be done properly and just replacing PI with the same "anonymous" id on a set of location data points of an individual achieves next to nothing.