3 ms·

Except there is absolutely no reason to trust a corporation. Even the most trustworthy can be forced to betray that trust by the powers that be.

• sliverstorm 11y ago
  Why doesn't that apply to open source contributors? They can be bought or coerced too. If we are assuming some malevolent entity powerful enough to manipulate the world's largest companies like marionettes, I don't see why we think open source is safe.
  • caskance 11y ago
    Because if it's open source, I don't need to trust anyone. I'm totally going to review the source code and build the binaries myself. One day. After writing the next chapter of my book.
  • michaelmrose 11y ago
    Safer. Its a matter of degree.
  • Lawtonfogle 11y ago
    There is little assumption needed to know there is collusions between powerful corporations and government spy agencies. Open source isn't fully trustable either, especially by the vast majority of users who are unable to review the source. But it is better, and we should not let perfect be the enemy of better in this case.
  • nickpsecurity 11y ago
    Exactly. The code and executable might not match. As in obfuscated C, the code might be subtly designed to fail. Further, the code might work but be integrated with libraries or deployed on an OS that the enemy knows they can hit. The security case of a given piece of software always depends on the reviewers and knowing you're using what they reviewed. That this is usually lacking in vast majority of software is why we're seeing a ton of vulnerabilities in both commercial and FOSS software.