3 ms·

I guess, if the crypto is real, the only things feds could do is tell tuta to load different JS for certain IPs. Which would not be easy to verify as anyone but

I guess, if the crypto is real, the only things feds could do is tell tuta to load different JS for certain IPs. Which would not be easy to verify as anyone but a targeted person. The point here is, if they have nothing to hide, they can easily open source. If they already have a weird system to serve some people insecure code, they have to extract that from their code base, maintain 2 versions and make sure both sides are up to date at all times. So not going open source is easier if you wanna be malicious. Not a huge task for feds tbh, but still. Also, there's still benefits for my privacy and security as in I'm sure some people would find vulns in the code and report them.

amanzi 3y ago
But my point is that even if they did open-source their backend code, and even if it was 100% secure and showed that full end-to-end encryption was implemented, you still wouldn't know for sure that this was the code they were running in production. They might have a modified code base running in production and you would be none the wiser.
- hnarn 3y ago
  You’re straw-manning. Nobody said that open sourcing the server component would increase trust in the SaaS service. The whole point of open sourcing a server side component is so that you can self-host, so you don’t have to trust the provider. Also, regardless of whether someone is actually interested in self-hosting or not, one can still call Tuta disingenuous for repeatedly marketing themselves as “open source” when they are clearly not.
  - amanzi 3y ago
    If it's just self-hosting that you're after, then yes - open-sourcing the server-side components would definitely help. Regarding their marketing as "open source" - I haven't seen their marketing claims, so I'll take your word for it, and in that case I agree with you - it's a disingenuous claim. But my comments were mostly around your original post, where you said you were sceptical of their trustworthiness because they hadn't open-sourced the server-side components. This implied that you would trust them (and I assumed the SaaS service) more if they did this. I was just expanding on a theme that you mentioned: "unless they willingly serve binaries that are not actually built from that code...", and I was just highlighting the fact we would never know if this was happening. So if you're sceptical without them open-sourcing, you should remain sceptical even if they did open source the backend.
    - hnarn 3y ago
      > you said you were sceptical of their trustworthiness because they hadn't open-sourced the server-side components I never said that. I said that: - Their marketing is disingenuous because they call themselves "open source",[1] when their server side component is in fact not open source. - I was "skeptical" regarding one very specific thing: > if their clients are indeed open source (...), and all encryption happens client-side before being sent to the server (...), how would it even be possible for this [tutanota being compromised] to be true? [1]: You can confirm this by searching for `site:https://mastodon.social/@Tutanota https://mastodon.social/@Tutanota open source`

amanzi 3y ago

But my point is that even if they did open-source their backend code, and even if it was 100% secure and showed that full end-to-end encryption was implemented, you still wouldn't know for sure that this was the code they were running in production. They might have a modified code base running in production and you would be none the wiser.

hnarn 3y ago
You’re straw-manning. Nobody said that open sourcing the server component would increase trust in the SaaS service. The whole point of open sourcing a server side component is so that you can self-host, so you don’t have to trust the provider. Also, regardless of whether someone is actually interested in self-hosting or not, one can still call Tuta disingenuous for repeatedly marketing themselves as “open source” when they are clearly not.
- amanzi 3y ago
  If it's just self-hosting that you're after, then yes - open-sourcing the server-side components would definitely help. Regarding their marketing as "open source" - I haven't seen their marketing claims, so I'll take your word for it, and in that case I agree with you - it's a disingenuous claim. But my comments were mostly around your original post, where you said you were sceptical of their trustworthiness because they hadn't open-sourced the server-side components. This implied that you would trust them (and I assumed the SaaS service) more if they did this. I was just expanding on a theme that you mentioned: "unless they willingly serve binaries that are not actually built from that code...", and I was just highlighting the fact we would never know if this was happening. So if you're sceptical without them open-sourcing, you should remain sceptical even if they did open source the backend.
  - hnarn 3y ago
    > you said you were sceptical of their trustworthiness because they hadn't open-sourced the server-side components I never said that. I said that: - Their marketing is disingenuous because they call themselves "open source",[1] when their server side component is in fact not open source. - I was "skeptical" regarding one very specific thing: > if their clients are indeed open source (...), and all encryption happens client-side before being sent to the server (...), how would it even be possible for this [tutanota being compromised] to be true? [1]: You can confirm this by searching for `site:https://mastodon.social/@Tutanota https://mastodon.social/@Tutanota open source`