4 ms·
> What happens when Matter gets acquired That's a major point that's addressed in the blog post, did you read it?
by defen 3y ago
> What happens when Matter gets acquired
That's a major point that's addressed in the blog post, did you read it?
- abound 3y agoNot sure about GP, but I did read the post. If they get acquired, I don't see anything stopping the acquirer from pushing an update that decrypts stuff and sends the plaintext to the servers.
- ndr 3y agoThis. And how likely is it that if their users value their app's data then there's an acquirer willing to wipe out all the users' data from the phones before they take over?
- filleduchaos 3y agoI'm rather baffled at this level of nitpicking. Yes, if the software was being written by completely different people with completely different goals they might then start to acquire user data but what does that have to do with the point (that data this team and this management don't have cannot be leaked)?
- stvltvs 3y agoI don't track management changes for the apps I use because who has the time? How can we protect ourselves against a malicious company changing their tech behind the scenes?
- abound 3y agoMy personal solution is just to self-host anything important or sensitive (password manager, file storage, photo storage, etc). Audit the code as desired, pin to specific versions, run on a private network.
- travisjungroth 3y agoBecause their current solution doesn’t meet their own stated goals. > even if we are competent enough to prevent a leak from ever happening, and even if our users trust us to do what we say, we must be resilient to being strong-armed by a future controlling power (e.g. if someone we don't trust buys us) They could be strong armed into collecting data and then handing it over.
- photonthug 3y agoIs there any kind of legal promise that could be made and not rescinded by the board, not swept away by mergers and acquisitions? I assume not but that’s almost what is needed here more than a software architecture fix which, no matter how well designed, is only as stable as the whims of internal stakeholders.
- filleduchaos 3y agoLegal promises don't enforce themselves.
- travisjungroth 3y agoI think you could make the alerting louder. Hire an independent auditing firm and create some contract around what to do if they fail. A closed source client is fundamentally incompatible with the claims they want to make.
- filleduchaos 3y agoAnd you as a customer can simply stop using their services if you no longer trust their intentions and (and this is a very clear and straightforward point) the company and the new controlling power would have nothing on you. Because it did not exist in the first place. Why are so many of you so keen for them to be "wrong"? Like what even is the alternative approach here supposed to be? Don't build a product in the first place?
- lebean 3y agoNo you see, at any moment this company can get acquired and can start pushing malware as updates. It's quite an elementary mistake to not account for this possibility, and the author of this post should hang their head in shame for even pretending to have a solution. /s