Hacker News Reader

Comment by nemothekid | Hacker News Reader

>And you and I don't have access to the source code, so we have no idea what's going on on their servers

Consider this: for 90% of the population, that is also true of any FOSS solution. I'm tired of the "you don't have access to the source code" argument. I don't inspect the microcode that runs on my CPU - why should I trust Intel and not Apple? And for a greater portion of the population, that source code may as well be mud.

This article is about alternatives to Google on the basis of privacy. Isn't a company that doesn't base its core business model on mining your data an improvement for a vast majority of users?

View on HN

> I don't inspect the microcode that runs on my CPU - why should I trust Intel and not Apple?

You shouldn't trust Intel either (see ME and all of the other negative-ring stuff that runs on their CPUs). But at the moment there isn't a strong alternative. AMD is somewhat better but still has similar issues. ARM is a mixed bag. RISC-V might save us but still isn't at the tape-out stage. OpenPOWER is possibly the only really usable option but software support is awful (if you've never had to deal with ppc64le bugs, you're lucky).

At least you have a reasonable alternative to Apple.

Even if you don't inspect it personally, there's a greater community of people who don't get their paycheck from Apple who may be looking at the code.

Regarding the Intel comparison, you have no choice but to trust them, but by using Apple products, you are trusting Intel and Apple, which is worse than just trusting Intel.

> who may be looking

may be

This is called faith

I agree, though I prefer the word trust; I think in the end most security arguments basically move trust around between entities, so I would either trust the open-source community or Apple.

In this case I decided trust the open-source community more than Apple, since the incentives of people inspecting open-source code probably align better with my own interests than the incentives of Apple.

> the incentives of people inspecting open-source code probably align better with my own interests than the incentives of Apple.

The incentives of any people are: earn enough money for a peaceful existence.

When Heartbleed happened, it turned out that only a handful of people in the entire world have the expertise to do a full audit of the OpenSSL code. And their work is ridiculously expensive. And the audit didn't happen until someone paid for it [1] (I'm not entirely sure it ever completed [2]).

People may actually have less incentives to inspect open-source code because there's always the question of life, money, time, work-life balance etc. etc.

[1] https://www.zdnet.com/article/ncc-group-to-audit-openssl-for...

[2] http://isopensslauditedyet.com

having the source code be open doesn't necessarily make it trustable, but it definitely has an added benefit. like op says, proprietary code is untrustable by design.

there is also the fact that I cannot take the code and compile it myself, proprietary solutions like the nvidia linux driver for example have given me headaches so many times, it would be nice if there was some form of entry to the code to at least get a vague idea of what the code is supposed to be doing. I basically have to pray for software to do what I want, when it doesn't the whole solution due to it's closedness/unadaptivity becomes useless to me.

> doesn't...mining your data

This is my point. You simply don't know that. You have no idea what's happening on their servers. It's all proprietary. You have absolutely no evidence to claim that.

Reply on news.ycombinator.com