131–140 of 159 posts
Earlier quoted context omitted.
I think that’s true of all software, people are fallible open source or not. I’d love to see average time to discovery and reporting in closed versus open source though. I’ve always heard it’s better in open source, which intuitively makes sense, and by the nature of closed source I think gathering the data will be challenging but valuable to see a tight comparison.
Lots of people have attempted this sort of analysis. You can find attempts at this in ICSE of FSE or whatever. But frankly there is no way to make effective science out of this. All of the data are always messy and make huge compromises to get anything even close to resembling an apples-to-apples comparison. I don't believe that anybody who claims it is meaningfully better in open source has any actual data really ba…
(In fact, this impossibility is a big part of why I'm so bullish on redbean - being really small means really fast and really really secure. It is a joy to deal with so few moving parts in a server!)
Earlier quoted context omitted.
I noticed the same thing with Cisco vulns a while back. How many times do you hard code credentials before it becomes an intentional backdoor rather than negligence?
If you keep finding bedbugs in your house it doesn’t mean someone is intentionally putting them there. It just means that it’s really hard to get rid of all of them and more pop up naturally.
What is the worst case scenario here? Will the adversary be able to break out of the sandbox? i.e. will the adversary be able to access non WhatsApp data?
Earlier quoted context omitted.
Even the App Store version of Signal is allegedly not the same as what's in the open source project. So unless you compile and install the applications yourself, there's no way of knowing anything.
That is why we must support initiatives like f-droid. They put a special focus on reproducibility.
What is the worst case scenario here? Will the adversary be able to break out of the sandbox? i.e. will the adversary be able to access non WhatsApp data?
Give photo access to WhatsApp? Better hope there's not a dick pic in there or you end up like Bezos.
Off topic: Why does WhatsApp don't give the option to block all calls and texts by default? That way, I can only talk with folks I want. The signal app has that option. Random businesses can send you texts to promote their shity services (typically, your number is grabbed from data brokers or leaks). Of course, you can block and report such spam, but there is no DnD option right now. Alt url as nvd is under load: Cri…
I am one of these "WhatsApp spammers" (well, I don't consider myself a spammer but you might!). We sell financial services in a developing country. We're not a mobile app—we're just a mobile-first website (a common gripe on HN is 'there's too many apps, just make a website'. Well, we're one of them). We need to be able to get in touch with our customers for transactional purposes (changes to their account, delivery n…
The native app, no question. Why would I want to make a facebook account just to get notifications from a third party (you)?
Earlier quoted context omitted.
When most code is Objective-C it hardly matters anyway.
Plenty of mobile code, especially at large companies like this, rely on a ton of C code. It makes it easier to support features on both Android and iOS. I’m sure there are more benefits I’m not aware of.
Earlier quoted context omitted.
«The Russian government hates him too.» Telegram is one of few popular messengers that are NOT blocked/prohibited in Russia. So government and Durov have some agreement.
Russia’s main security agency, the FSB (a successor to the KGB) has branded Telegram the messenger of choice for “international terrorist organizations in Russia.” The government’s first attempts to ban it, a year ago, resulted in entire sections of the web, online stores, services—even the Kremlin museum’s ticket sales—being inadvertently blocked. But the messaging app has adopted a clever system of changing IP addr…
Earlier quoted context omitted.
I'm pretty sure they're talking about things like PAC, which are are definitely available to apps (and I think even required?).
Not for third party apps, the ABI is not stable yet.