5 ms·

This is tantamount to saying we should only trust open source software. If that’s your point, then you lost me. If not, then it’s obvious that some companies ar

This is tantamount to saying we should only trust open source software. If that’s your point, then you lost me. If not, then it’s obvious that some companies are more trustworthy than others. (P.S. the many active exploits found in core low level open source software after months or years because despite the source being open almost no one audits it because they’re cheap and/or assume someone else is doing it)

thomastjeffery 3y ago
Well why in the world would I trust iMessage and distrust Beeper Mini?
- willseth 3y ago
  Are you seriously asking why someone would trust Apple over a small generally unknown Android-only app company?
  - CivBase 3y ago
    I don't actually think it's that unreasonable. Apple has broken people's trust many times and come out just fine in the end because they are a huge company with many products participating in many markets. A small company like Beeper is dependent on a small user base and a significant breach of trust could easily spell the end for them. That said, I don't personally trust either of them. When it comes to matters of security, I prefer open protocols which can be proven to be secure over pinky swears from companies.
    - dwaite 3y ago
      Trust is generally something you build and lose, rather than something you are given by default. That reputation can be a massive asset or liability. The level of trust I currently give in Beeper is that identity verification happened such that someone could potentially be prosecuted for abuses after-the-fact. They have not built up a reputation, and in the face of potential scams or privacy abuses their reputation may not be as valuable as the user information they can gain access to. Small incidents can cause significant reputation harm to Apple, and those equate to billions of dollars lost in corporate value. Even the recent notification monitoring announcement harms their reputation, where the government itself mandated non-transparency. (For this reason, I somewhat expect they are trying to design an oblivious notification system, where role separation prevents a single intermediary from knowing both where a notification is from and where it is going to.)
      - thomastjeffery 3y ago
        Apple has done plenty to lose my trust, and very little to build it. But that's not really the subject at hand, though I do see where word choice is misleading here. You just brought up a better word: "liability". I'll go one step further: "attack surface". When it comes to security in software, we don't need to work with many unknowns. The unknowns we do work with are the attack surface. By presenting a greater domain of unknown behavior, closed source software effectively presents me (the user) a larger attack surface. Sure, I could trust that the extra attack surface is actually covered; but I can't know. With open source, I don't have to trust, because I can know instead. If I am to choose between open and closed source software, then I am choosing between knowledge and trust. That is a completely different position than choosing between closed and closed: trust vs. trust. So long as any securely-designed open-source messaging app exists, iMessage is at a disadvantage in end-user security. Even if Apple can know for certain that iMessage's attack surface is not larger than an open-source alternative, we the users can't. Closed source software will always present a higher demand for trust.

thomastjeffery 3y ago

Well why in the world would I trust iMessage and distrust Beeper Mini?

willseth 3y ago
Are you seriously asking why someone would trust Apple over a small generally unknown Android-only app company?
- CivBase 3y ago
  I don't actually think it's that unreasonable. Apple has broken people's trust many times and come out just fine in the end because they are a huge company with many products participating in many markets. A small company like Beeper is dependent on a small user base and a significant breach of trust could easily spell the end for them. That said, I don't personally trust either of them. When it comes to matters of security, I prefer open protocols which can be proven to be secure over pinky swears from companies.
  - dwaite 3y ago
    Trust is generally something you build and lose, rather than something you are given by default. That reputation can be a massive asset or liability. The level of trust I currently give in Beeper is that identity verification happened such that someone could potentially be prosecuted for abuses after-the-fact. They have not built up a reputation, and in the face of potential scams or privacy abuses their reputation may not be as valuable as the user information they can gain access to. Small incidents can cause significant reputation harm to Apple, and those equate to billions of dollars lost in corporate value. Even the recent notification monitoring announcement harms their reputation, where the government itself mandated non-transparency. (For this reason, I somewhat expect they are trying to design an oblivious notification system, where role separation prevents a single intermediary from knowing both where a notification is from and where it is going to.)
    - thomastjeffery 3y ago
      Apple has done plenty to lose my trust, and very little to build it. But that's not really the subject at hand, though I do see where word choice is misleading here. You just brought up a better word: "liability". I'll go one step further: "attack surface". When it comes to security in software, we don't need to work with many unknowns. The unknowns we do work with are the attack surface. By presenting a greater domain of unknown behavior, closed source software effectively presents me (the user) a larger attack surface. Sure, I could trust that the extra attack surface is actually covered; but I can't know. With open source, I don't have to trust, because I can know instead. If I am to choose between open and closed source software, then I am choosing between knowledge and trust. That is a completely different position than choosing between closed and closed: trust vs. trust. So long as any securely-designed open-source messaging app exists, iMessage is at a disadvantage in end-user security. Even if Apple can know for certain that iMessage's attack surface is not larger than an open-source alternative, we the users can't. Closed source software will always present a higher demand for trust.