523
Google Messages just flicked the switch on end-to-end encryption for all RCS and group chats
(chromeunboxed.com)
this post was submitted on 10 Aug 2023
523 points (98.0% liked)
Technology
60082 readers
4864 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No of course not. I'm sorry if I'm expressing this badly, my point was merely that open source tends to add a false sense of security for people. The relevant ability to verify is factually never used, and experts that review the code might as well have had access to it without it being open sources (see Whatsapp's audit a while back).
That is not to say that Open Source is not a good thing, don't get me wrong. But I feel we tend to massively overstate what it adds for us personally. We put too much value on that side of it, as if it automatically means every user has personally verified everything.
That's a fair statement to say open source on it's own doesn't add any security. I will say that any developer who's intentionally adding vulnerabilities to their code is less likely to publish the source, simply because someone COULD see it. With the number of automated vulnerability scanners on Github, it would require a lot of extra work to go undetected, when simply going closed source is an option. Once again, the more open the better, since there's fewer places to hide things.
It doesn't add a false sense of security at all. It forces the devs to put their name on the line with every pull request. They are publicly accountable for any and all code that is added to the product, in an open and transparent repository. If they try any shenanigans, and if anyone catches them, the developer, the project, and the community will all suffer.
It also gives the community a chance to fork the code and remove the problem. You can carefully rebuild with a new dev or new team.
Using open source software is a real sense of security, because it was built for you, not for money.