Yes I’ve been to Ohio. It’s as terrible as people say.
However the correct analogy is this:
“I distrust alliant credit union, but I trust a random internet stranger that in theory is doing their work in public”. That’s the right number of employees and the right scale.
Your analogy is basically accepting my point. In this case, I’m trusting a random internet stranger not to lie to me, and you’ve very clearly illustrated why that doesn’t work. Believing Ohio isn’t real would require a large conspiracy. Ublock introducing something naughty would require one man. I trust that one man, but there’s no reason to. If you think that’s absurd do some research about recent software package changes that introduced backdoors.
I trust a random internet stranger that in theory is doing their work in public
There’s no ‘in theory’ about it.
I’ve actually had an extension I was using be revealed as spyware (it was hoverzoom, I immediately switched to an alternative afterward).
I don’t read every line of every piece of software I use because that would be impossible, but I do actually look at some of it and modify it to suit my needs. It was because there are many thousands of people like me that do this that the problem in hoverzoom was caught. It’s been ten years, so I don’t have the best memory of the event, but I think it only took a few days to catch it as well, despite the fact that the offending code was left out of the GitHub repo and was only in the compiled extension.
The state of open source isn’t perfect (not everything has reproducible builds yet) but in general I ‘trust’ that every other programmer in existence isn’t in on a conspiracy to screw me over specifically.
Why would any of this be about you personally? I honestly can’t take you seriously when this is your view of security, and it’s made worse when you extend that to “we caught em once so the system works”.
Yes I’ve been to Ohio. It’s as terrible as people say.
However the correct analogy is this: “I distrust alliant credit union, but I trust a random internet stranger that in theory is doing their work in public”. That’s the right number of employees and the right scale.
Your analogy is basically accepting my point. In this case, I’m trusting a random internet stranger not to lie to me, and you’ve very clearly illustrated why that doesn’t work. Believing Ohio isn’t real would require a large conspiracy. Ublock introducing something naughty would require one man. I trust that one man, but there’s no reason to. If you think that’s absurd do some research about recent software package changes that introduced backdoors.
There’s no ‘in theory’ about it.
I’ve actually had an extension I was using be revealed as spyware (it was hoverzoom, I immediately switched to an alternative afterward).
I don’t read every line of every piece of software I use because that would be impossible, but I do actually look at some of it and modify it to suit my needs. It was because there are many thousands of people like me that do this that the problem in hoverzoom was caught. It’s been ten years, so I don’t have the best memory of the event, but I think it only took a few days to catch it as well, despite the fact that the offending code was left out of the GitHub repo and was only in the compiled extension.
The state of open source isn’t perfect (not everything has reproducible builds yet) but in general I ‘trust’ that every other programmer in existence isn’t in on a conspiracy to screw me over specifically.
Why would any of this be about you personally? I honestly can’t take you seriously when this is your view of security, and it’s made worse when you extend that to “we caught em once so the system works”.