121–130 of 159 posts
Earlier quoted context omitted.
If your concern is about deliberately inserted exploits by the WhatsApp developers, that's got virtually nothing to do with the topic at hand.
If this particular exploit had been deliberately inserted by WhatsApp developers, what would you expect to be different?
Earlier quoted context omitted.
The usual argument that safer languages are needless, because bugs happen anyway, yet Apple is going Swift, and adopting hardware mitigations to fix these kind of issues.
Hardware mitigations which you can’t use?
This publicly disclosed vuln brings a new perspective into the Bezos phone hacking incident: https://en.m.wikipedia.org/wiki/Jeff_Bezos_phone_hacking_inc...
Does this mean Jeff Bezos was doing WhatsApp video calls with https://en.wikipedia.org/wiki/Mohammed_bin_Salman ?
Both Apple and Google have tried to isolate media codecs more since, but apparently not enough.
Earlier quoted context omitted.
If you keep finding bedbugs in your house it doesn’t mean someone is intentionally putting them there. It just means that it’s really hard to get rid of all of them and more pop up naturally.
alternatively you just haven't found what keeps attracting these bed bugs, like easy prey.
Out-of-bounds indexing is always fun. I'm interested in programming languages with mostly-watertight spatial memory safety, which can prevent many exploits at a minimal ergonomic/flexibility cost, compared to temporal memory safety which requires a borrow checker and endless compiler complexity (plus I find it easier to statically verify you don't use-after-free in the limited code interacting with resource lifetimes…
Temporal safety does not require a borrow checker etc, you can use a GC and get it.
waiting for the time when i can only use my matrix/element and be able to talk to whatsapp or instagram or snapchat users without creating and maintaining accounts there.
It's going to take nothing short of massive legal action to get any sort of competitive compatibility like that. As much as I wish for that to happen my hopes aren't very high. So until then I'll keep chugging along on whatever open solutions I can, hoping that my small contribution to network effects will help steer things down the line.
On this subject, I like to quote Pavel Durov, the founder of Telegram: "Since the creation of WhatsApp, there's hardly been a moment in which it was secure: every few months researchers uncover a new security issue in the app. I wrote about this in detail 2 years ago (read here if you missed it). Nothing has changed since then. It would be hard to believe that the technical team of WhatsApp is so consistently incompe…
Earlier quoted context omitted.
You can compile your less trusted libraries to webassembly and then run them in a webview?
That sounds like a huge hit to energy use, if it is even feasible for something like implementing webrtc because of communication costs with the native process.
Earlier quoted context omitted.
Lots of people have attempted this sort of analysis. You can find attempts at this in ICSE of FSE or whatever. But frankly there is no way to make effective science out of this. All of the data are always messy and make huge compromises to get anything even close to resembling an apples-to-apples comparison. I don't believe that anybody who claims it is meaningfully better in open source has any actual data really ba…
Good insight about the long tail of open source projects that don't have the same level of activity or interest from the developer community. I hadn't considered how sharply that drop off is, even for some what still widely used projects simply because the amount of people with the know how, and interest, to look for vulnerabilities is a lot smaller than the available project surface area.
I don't think "long tail" is a good way to put it. Both OpenSSL and Log4j had millions of deployments and had pretty major bugs. I'd argue it's Linux then everything else.
Earlier quoted context omitted.
if you can't trust Meta, why could you trust apple?
Apple has been building their brand on privacy and trust for at least a couple of years now. Can you be sure they're not sending everything to the NSA? Of course not. But they also make their money by directly charging users for services unlike the ad-based companies. There have also been many attempts by various governments to publicly force Apple to insert backdoors or prevent them from fixing security vulnerabilit…