Ask HN: What would convince you that a closed source messaging app is secure?

3 pointsposted 12 hours ago
by Brandon-Coll

Item id: 49236019

6 Comments

Bender

12 hours ago

Nothing. I barely trust open source after it's been in use for decades, reviewed by a myriad of pen-testers and battle hardened in the most hostile regions of the internet. I don't trust anything on a cell phone at all. That's just my take. Others may be more trusting.

fsflover

11 hours ago

> I don't trust anything on a cell phone at all.

Would you trust a phone running GNU/Linux with no proprietary drivers?

Bender

11 hours ago

I would not. If the modem was ever open source hardware it would never be permitted to attach to the major networks. There's always a catch. There is just too much collusion between wireless carriers and governments, having built out one of the first GSM network in the US in the 90's. The capabilities were wild back then and I can only imagine all the undocumented capabilities now. I only learned about the capabilities having worked around a lot of drunk Swedish telco switch mainframe developers.

Having said that, I would love to have a truly open source phone that I could load any bog standard Linux distro and all the drivers have been reviewed by Linus without him ever once feeling the urge to lift the middle finger. I would only be using it for non sensitive voice and text.

fsflover

2 hours ago

> The capabilities were wild back then and I can only imagine all the undocumented capabilities now.

I hope this can be eventually reverse-engineered. Pinephone's modem has some progress.

My daily driver, Librem 5, is as close to such device as possible. It runs an FSF-endorsed OS and has hardware kill switches for wireless and mic/camera. Can't recommend it enough.

nacozarina

11 hours ago

Combo of reputation & provenance. Someone widely respected as a super-competent programmer and known to be somewhat of a self-directed loner. If Fabrice Bellard suddenly decided secure messaging was what he was committed to doing, I wouldn’t care if he did it closed-source.

user

12 hours ago

[deleted]