Hacker News Reader

> Therefore, no need to trust anybody, as long as the software is open-source.

Demonstrably untrue. You must trust that the contributors are trustworthy, they have implemented a strong security posture for their project, and that the code is reviewed by people who are trustworthy. Many open-source projects have been, and continue to be, compromised on a regular basis.

View on HN

> You must trust that the contributors are trustworthy

In theory, that's only the case if you are unable to review the code yourself.

In practice, it's like saying that TLS encryption is pointless, because one needs to trust every single person who implements it.

We're sure you review all the code you run.

That's only the case if I am unable to review the code myself, before any update, I fully understand the code, and I am smart enough that the contributors are unable to pull a fast one on me.

Given that I'm not a cryptography expert, I have a limited number of hours in the day, and open-source supply chain attacks are typically obfuscated, I don't consider that to be a trivial statement.

Reply on news.ycombinator.com