Hacker News Reader

Comment by irq-1 | Hacker News Reader

> If I don't know what it's doing, how can I trust it?

It's not enough to examine software: if you don't trust the company, then anything they say or promise is worthless. Automatic updates can change anything, including the TOS! This is the same company that sells a 1984-Telescreen (XBox) with an always-on camera and microphone. _NSA shouldn't be forgotten.

Oracle likes to tout Java as GPL, but what does that matter when we know the company can't be trusted? Who controls a software project is the key, not the licenses or corporate promises. There's no point in trusting iOS because we've examined it, we also have to trust Apple.

View on HN

The source-code in OpenJDK can be inspected and OpenJDK itself can be forked if Oracle's stewardship goes awry, which is the whole freaking point of open-source, so I don't see how that can compare with Windows or iOS.

> OpenJDK itself can be forked

Tell that to Google.

Android wasn't fork of OpenJDK

but Dalvik was.

No, Dalvik is not a fork of OpenJDK, but a clean room implementation. If it would have been a fork, then Google would be protected by the GPL license.

No. Dalvik was a new implementation and for the android standard library was used a fork of Harmony.

What shouldn't we forget about _NSA?

Yes we should forget it.

They worked out it's easier to get at our data out and on home territory (cloud, telemetry) than actually have to break into your kit.

I think he meant _NSAKEY [0].

0. https://en.wikipedia.org/wiki/NSAKEY

Or as I like to put it, at the end of the day you have to trust someone, somewhere in the chain.

In the case of software vendors, you have to trust the vendor.

You cannot independently verify everything. You do not have the expertise nor the bandwidth.

Edit: and if you have the software audited, are you not then trusting the auditor?

I don't like this argument. It's not necessarily you who has to audit your software. You can pay other people to do it. Big companies can pay for it. Your government's institutions can pay for it. If on the other hand the software is closed-source, then that's not an option. And especially for governments and for big companies Windows is a security liability.

True, but there's no logical fallacy in writing off companies and products if they're consistently untrustworthy.

Reply on news.ycombinator.com