[deleted]
Wire – Modern Communications Network
351–360 of 411 posts
Re: Wire – Modern Communications Network
#352Personally I'll wait for Hemlis (http://heml.is) to be released (even if it doesn't do everything Wire does).
Re: Wire – Modern Communications Network
#353Earlier quoted context omitted.
I often wonder about price when I see great domain names like this. Sometimes they seem to boost the product and many times it doesn't matter. I saw a post on reddit about examine.com. I think the guy said he paid like 40k for the domain and he believes it was a big part of why they were growing. He basically said that he had money from previous business selling and he figured even if the site didn't work out the dom…
That's me!
oh hai. So was what I said correct? When I had money I used to scarf up domain names for any idea I had. Some of them were decent but I don't think I've ever sold a single one. Eventually just let them all expire after holding them for like 6 years.
Re: Wire – Modern Communications Network
#354Earlier quoted context omitted.
There are already FOSS replacements for Skype, such as Tox. The fact is that if every line of code can't be inspected then the software can't be considered secure, and we're forced to put blind faith in a faceless corporation, which is understandably not acceptable for many people. I don't really care if you think this is "practical" or not. That's simply the reality of the situation. Proprietary == insecure. If a co…
I would argue that, theoretically, proprietary can be secure. A code base can be made secure by highly experienced engineers who are paid to make the code secure. You might never be able to see the code, but it could still be secure. The problem is that you can never actual verify how secure the proprietary solution is. So whether or not it is secure, you don't trust it. (there are even some interesting arguments to…
While you can argue that some piece of open source software can be more insecure than a proprietary alternative, auditing a piece of software requires access to the source code and that is mandatory. And with open source everybody can audit with no restrictions. Yes, OpenSSH is a piece of shit, but how do you think it was discovered, from 2 independent parties no less.
Then there's another effect that I like - after the initial patch was released, the story went public, we got notified immediately, then we could discuss about what caused it and see the actual commits and who did it. Such a catastrophe can sink a company, therefore you never see such post mortems for proprietary stuff. And yes, even I as a developer cannot audit software for security, but the point is that I could hire somebody else to do that for me, like the Finnish company that discovered Heartbleed.
So yeah, there is no concrete proof that proprietary stuff is less or more secure than open source, but the point is that we'll never know, because nobody can know how secure something is without looking at the source code.
Re: Wire – Modern Communications Network
#355Earlier quoted context omitted.
You're making the baseless (and some might say naive) assumption that it is secure to the best of their knowledge. If they really wanted to build trust then they would prove it and leave no doubt in people's minds.
"Dear citizen, you're asking us to make the baseless assumption that you're innocent until proven guilty, if you really want to build trust you'll let us monitor you 24/7 and leave no doubt in our mind." You're making an assumption of guilt. The fact that something isn't open source doesn't inherently make it insecure.
It doesn't make it trustworthy either. When speaking of encryption algorithms, not publishing a new algorithm for peer reviewing is unthinkable. This is also not about judgment - I do consider people to be innocent until proven guilty, but do you trust people you don't know with issues that could harm you? Besides companies are not people, we are taking about a commercial entity here that wants to sell something. And people get to vote with their wallet and opinions, depending on their needs and I see nothing wrong with that.
Re: Wire – Modern Communications Network
#356Earlier quoted context omitted.
"Dear citizen, you're asking us to make the baseless assumption that you're innocent until proven guilty, if you really want to build trust you'll let us monitor you 24/7 and leave no doubt in our mind." You're making an assumption of guilt. The fact that something isn't open source doesn't inherently make it insecure.
It doesn't make it trustworthy either. When speaking of encryption algorithms, not publishing a new algorithm for peer reviewing is unthinkable. This is also not about judgment - I do consider people to be innocent until proven guilty, but do you trust people you don't know with issues that could harm you? Besides companies are not people, we are taking about a commercial entity here that wants to sell something. And…
"And people get to vote with their wallet and opinions, depending on their needs and I see nothing wrong with that."
I was thinking the same thing! But you seem to be assuming guilt and I am not. Honestly, I can see it both ways. It just seemed spurious to me to state that if we don't know it's good, it must be bad.
Re: Wire – Modern Communications Network
#357seems buggy to me when you can't even register to the platform :(
Re: Wire – Modern Communications Network
#358Earlier quoted context omitted.
I would argue that, theoretically, proprietary can be secure. A code base can be made secure by highly experienced engineers who are paid to make the code secure. You might never be able to see the code, but it could still be secure. The problem is that you can never actual verify how secure the proprietary solution is. So whether or not it is secure, you don't trust it. (there are even some interesting arguments to…
I don't even have to argue to make this point, I merely have to point out Heartbleed or Shellshock. The reason both were found and had the absurd propaganda campaigns behind them as they did that are the only reason you can even name them to begin with, is precisely because the underlying software was free. On the other hand, let's name drop another vulnerability and its exploit: SMBRelay. Took 7 years after it was m…
So what it boils down to, is that both open source and closed source software can have bugs lingering in them for years that go unnoticed and/or unfixed.
Re: Wire – Modern Communications Network
#359Strange decision to solely target Android 4.4 and above, that means it's only compatible with about 34% of Android devices.
I wonder which feature that they need that is only present in 4.4+
Re: Wire – Modern Communications Network
#360Earlier quoted context omitted.
Unfortunately, even if they DID specifically list out all the security measures that they used, someone would still complain because it isn't completely open source. The previous company I worked for not only had legitimate encryption for anything private we received from the user (e.g.: email passwords) so that nobody at the company could ever read them, but also had some (if I remember correctly) good documentation…
No, much larger than the issue of open-source is that we already have dozens of major communication protocols that are not based on open standards or that do federation (one implies the another). XMPP does OTR for example. And you know, the cool thing about an open standard is that it can have many clients. Throw federation in the mix and then many people will actually find it desirable. Otherwise it's just a matter…
XMPP and OTR are not workable for mobile devices. The protocol structure assumes a consistent background connection that doesn't get killed, something that is relatively cheap to do on the laptops and desktops it was designed for, but is expensive battery wise for mobile devices.
Go download an OTR client for iOS, like cryptocat and notice how it pings you after 10 minutes that you have to re-open the app to keep on receiving messages! It's because iOS does not allow you to keep an app running in the background indefinately for battery reasons. This is required for the XMPP / OTR model to work.
You need a protocol of some sort that would work properly with mobile, and I think textsecure is it.