Hacker News Reader

Comment by enriquto | Hacker News Reader

> So you don't eat at restaurants then?

Yes I do. I was talking about selling packaged food, but still, restaurants make a good example also. They will always tell you if one of their recipe contains a particular ingredient (of which you might be allergic), and whether there are vegan options. Many restaurants even write the complete list of ingredients on each item in the menu!

Even then, except for very complex sauces, it is quite easy to see all the ingredients once you have the dish in front of you. This is impossible with proprietary software. Just grepping at a binary, you won't get too far.

View on HN

That's not quite true. You can easily decompile any binary and glean all sorts of valuable information from it. On Windows you can find out which API calls it makes and can even use detours/trampolines to redirect such calls:

https://github.com/Microsoft/Detours/wiki/Using-Detours

At one point I wrote a little piece of software as a proof of concept that used detours to redirect any file I/O in IE that was deemed "unsafe" to a special in-memory file system.

The bottom line is that you don't need the source code in order tell if an application is "phoning home" or if it makes suspicious API calls. In fact, it is often easier to just simply monitor how the software interacts with the host system to determine if it is performing (possibly) malicious actions. IOW, if you're concerned about a certain piece of software, then auditing the source code isn't going to be as good of a solution as just sandboxing the application so that it's impossible for the application to do something bad.

> They will always tell you if one of their recipe contains a particular ingredient (of which you might be allergic), and whether there are vegan options.

I authored the article. People ask us about our software all the time. We answer their questions. We have a post on our views on privacy, how we collect and use data etc. We give people the option to opt-out of data collection. Our email list is strictly opt-in. It seems that you are fine trusting the people that provide your food, but not your software.

Reply on news.ycombinator.com