4 ms·

Open-source is orders of magnitude better, simply because you can compromise it only through systematic long-term efforts for introducing subtle flaws that are

Open-source is orders of magnitude better, simply because you can compromise it only through systematic long-term efforts for introducing subtle flaws that are hard to detect by regular code reviews, and you can count on such flaws only for limited periods of time, not to mention that architectural decisions can always happen without the NSA being able to prevent it. E.g. if your Linux distro is up to date, the older flaws are likely to be fixed already. On the other hand, NSA can simply demand the addition of a dumb IF just like you described in any proprietary software, and nobody will ever find out about it. If Windows XP contained backdoors in 2001, it may as well contain the same backdoors now. Just because you can't get a 100% guarantee of safety, that doesn't mean that open-source isn't much safer. And yeah, people exemplify with that embarrassing SSH flaw in Debian. Well, at least you found out about it, at least you know it was fixed.

Tyrannosaurs 13y ago
That would be the sort of systematic long-term efforts we know the NSA have been undertaking and almost certainly continue to take? Given that the assumption that most people would (reasonably) make is that OSS is more resistant to these things, if you're the NSA isn't that exactly what you'd target? And given that we know that they've undermined standards, compromised hardware and so on, wouldn't it be naive to think that they'd not made significant efforts to infiltrate and compromise OSS projects? I certainly agree safer, I'm just really not convinced that safer crosses the line to actually being safe.
- girvo 13y ago
  Frankly, against a State sponsored and run adversary like the NSA, with the clout of the US of A behind it... I personally don't think it's possible to cross the line is to safe. Frankly, with a lot of our hardware and software coming out of companies in the US, there are so god damn many avenues the NSA can take, I'm going to go fashion myself a tin foil hat at this point! FOSS gets us closer, but without FOSS hardware known (and can you ever know?) to be secure and free of influence... And I don't see the very act of creating that FOSS hardware to replace my devices as feasible at all. Sigh. This sucks. I knew it was bad, I use encryption, I share only what I want to share, etc. And none of it turns out to really matter. The NSA's actions have made me as a non-US citizen or resident so wary of anything coming out of that country now :( And with China having the same issues, the two big tech powerhouses... What's left? My own country (Australia) definitely would cooperate with these sorts of things too. We are effectively controlled by tech dictators at this point, and no way out in the near future. This sucks.

Tyrannosaurs 13y ago

That would be the sort of systematic long-term efforts we know the NSA have been undertaking and almost certainly continue to take? Given that the assumption that most people would (reasonably) make is that OSS is more resistant to these things, if you're the NSA isn't that exactly what you'd target? And given that we know that they've undermined standards, compromised hardware and so on, wouldn't it be naive to think that they'd not made significant efforts to infiltrate and compromise OSS projects? I certainly agree safer, I'm just really not convinced that safer crosses the line to actually being safe.

girvo 13y ago
Frankly, against a State sponsored and run adversary like the NSA, with the clout of the US of A behind it... I personally don't think it's possible to cross the line is to safe. Frankly, with a lot of our hardware and software coming out of companies in the US, there are so god damn many avenues the NSA can take, I'm going to go fashion myself a tin foil hat at this point! FOSS gets us closer, but without FOSS hardware known (and can you ever know?) to be secure and free of influence... And I don't see the very act of creating that FOSS hardware to replace my devices as feasible at all. Sigh. This sucks. I knew it was bad, I use encryption, I share only what I want to share, etc. And none of it turns out to really matter. The NSA's actions have made me as a non-US citizen or resident so wary of anything coming out of that country now :( And with China having the same issues, the two big tech powerhouses... What's left? My own country (Australia) definitely would cooperate with these sorts of things too. We are effectively controlled by tech dictators at this point, and no way out in the near future. This sucks.