4 ms·

if you deploy an os from a company, consider your box belongs to them.

by x5n1 11y ago

themartorana 11y ago
Let's be honest - if you don't vet every single line of code in your OS and software toolset, you run the risk of exposing yourself. There are levels of trust to be sure, but there is always trust.
- x5n1 11y ago
  Honest is that if all the source code that is compiled is available as open source and a binary with the same signature can be built using that code then the chances that the code acts against your interests is much less than binary blob that you can not vet... etc.
  - Lennie 11y ago
    I'm a Debian user: https://reproducible.debian.net/reproducible.html https://reproducible.debian.net/reproducible.html Partly because they do care about these things and they are sending patches upstream as well so as many as possible applications in Debian can eventually be build reproducible. I hadn't seen it before, but even better they added this piece of text on that page: "we care about free software in general, so if you are an upstream developer or working on another distribution, we'd love to hear from you! Just now we've started to programatically test coreboot and OpenWrt - and there are plans to test Fedora, FreeBSD and NetBSD too."
- jsjohnst 11y ago
  Let's be honest - if you don't vet every single trace and circuit in your hardware, you run the risk of exposing yourself. Just trying to further emphasize your point, not be obnoxious. The truth is, there's almost no possible way to not expose yourself. Anything made by humans can be abused by other humans for personal gain.
paulkon 11y ago
If only NCC/OCAP would audit Windows.
- schoen 11y ago
  Parts of NCC have audited parts of Windows. They just weren't allowed to publish the results. This has definitely significantly improved the security of Windows, though not given users any kind of protection against malfeasance by Microsoft (including in the sense of giving people malware or simply less-secure new versions of stuff through Windows Update).
Lennie 11y ago
Let's be very clear: if you still think you are 'buying' software from a company like Microsoft you are just fooling yourself. You are paying for a license to use the software. That company still owns the software.

if you deploy an os from a company, consider your box belongs to them.

by x5n1 11y ago

if you deploy an os from a company, consider your box belongs to them.

Let's be honest - if you don't vet every single line of code in your OS and software toolset, you run the risk of exposing yourself. There are levels of trust to be sure, but there is always trust.

x5n1 11y ago
Honest is that if all the source code that is compiled is available as open source and a binary with the same signature can be built using that code then the chances that the code acts against your interests is much less than binary blob that you can not vet... etc.
- Lennie 11y ago
  I'm a Debian user: https://reproducible.debian.net/reproducible.html https://reproducible.debian.net/reproducible.html Partly because they do care about these things and they are sending patches upstream as well so as many as possible applications in Debian can eventually be build reproducible. I hadn't seen it before, but even better they added this piece of text on that page: "we care about free software in general, so if you are an upstream developer or working on another distribution, we'd love to hear from you! Just now we've started to programatically test coreboot and OpenWrt - and there are plans to test Fedora, FreeBSD and NetBSD too."
jsjohnst 11y ago
Let's be honest - if you don't vet every single trace and circuit in your hardware, you run the risk of exposing yourself. Just trying to further emphasize your point, not be obnoxious. The truth is, there's almost no possible way to not expose yourself. Anything made by humans can be abused by other humans for personal gain.

paulkon 11y ago

If only NCC/OCAP would audit Windows.

schoen 11y ago
Parts of NCC have audited parts of Windows. They just weren't allowed to publish the results. This has definitely significantly improved the security of Windows, though not given users any kind of protection against malfeasance by Microsoft (including in the sense of giving people malware or simply less-secure new versions of stuff through Windows Update).

Lennie 11y ago

Let's be very clear: if you still think you are 'buying' software from a company like Microsoft you are just fooling yourself. You are paying for a license to use the software. That company still owns the software.