Hacker News Reader

Comment by justThis1Post | Hacker News Reader

Couldn't agree more. These days we have to protect ourselves more from our own software than from viruses. Assume any software is a trojan horse, even the OS.

View on HN

Or you could use free software.

How, pray tell, does free change the problem except in fantasies? There is plenty of "free" software that contains the same problem.

At least, with those, you can audit the code and have someone fix it. No such luck with proprietary software.

Free as in freedom, not beer. You can look at the code of the free software, therefore tell if it's phoning home or not. More importantly, changing it.

How many people have the time or inclination to validate everything that way?

Not many, but the effort is parallelizable. If you find a security problem and report it in public, others can verify it, and still others can benefit from the fix even if they never would have bothered to look for themselves.

It doesn't take many. The problem is making sure that someone is doing it (cf., OpenSSL).

Exactly. This is how the Google Chromium always-on voice recognition payload was discovered, for example. We may never have known about it if it wasn't an open source project, or at least we wouldn't have heard about it until long after it shipped.

Not a guarantee of privacy or anonymity. See: SourceForge. Generally a step in the right direction though.

Many software projects I use are hosted on SourceForge. While SF has been using some nasty techniques with binary installers, the source code is, as far as I know, untouched.

And, as soon as it's touched, the project maintainers can shut down the SourceForge repos and move on to someplace else.

It's not a guarantee of security, privacy or anonymity, but open source is still your best chance to get any (or all) of the three.

Counterexample: Ubuntu sending local file system searches off to Amazon because apparently online shopping and file searching are things you want to do simultaneously.

Which is why being open source is not enough. It needs to be non-commercial.

Which you can fix by either using another distro/uninstalling it/disabling it/using another window manager.

The main difference between Ubuntu and Windows 10 is that Ubuntu will respect your decision to opt-out.

"Your information is ours unless you are aware of it and spend unreasonable amount of time searching for the information leaking settings and disabling them." Yaay

This is incorrect. Ubuntu told me in clear words that dash searches will be sent after installation when I used dash. That's how I came to know of it, and that's why I disabled it.

I didn't like the fact that that it is opt-out and not opt-in, but yeah, way way better than Windows 10 for now.

Also note that Canonical took steps to ensure amazon doesn't get to imprint your system by proxying the requests through their server.

Reply on news.ycombinator.com