pull down to refresh

103 sats \ 4 replies \ @optimism 26 Jul \ parent \ on: Praxeology of Privacy Book Club - Part VI BooksAndArticles
It may be scary to trust your secrets to anonymous developers behind Graphene

You can review Graphene (the non secure version) so with some skills, a good eye, great analytic capacity and a superb system to track your patches in trust is diminished.

What you cannot review is pixel firmware and the embargoed security patches. You can try to reverse engineer that. Depending on how skilled you and your bots are, you may be able to get a good guess.

But you'll still have to trust Google. Much more than Graphene.

write
compose
1 sat \ 3 replies \ @dc3c6b893e 26 Jul

I was mostly addressing arguments similar to "what is preventing Graphene devs from backdooring it?"

reply
124 sats \ 2 replies \ @optimism 26 Jul

I addressed EXACTLY that argument. Read again.

reply
126 sats \ 1 reply \ @dc3c6b893e 26 Jul

What I'm trying to say is that most people won't do that, so instead they rely on accountability. E.g., you don't need to review Apple's code (some of it is open source), because you can always sue them (in theory) because they are a legit company.

I feel like to many Graphene is a toy project, but it is now backed by a foundation and has a reputation, so the argument is moot, and there's no need to be worried about who is responsible.

reply
103 sats \ 0 replies \ @optimism 26 Jul
most people won't do that

Of course not. In fact, I doubt that there are any stackers here besides their employees and yours truly that ever even looked at the repo further than seeing the manifest and realizing that there is a shitton of stuff you need to look at in order to really know. I had to design a system just for my notes back when I did it all manually. To not miss anything.

sue

You cannot sue Apple when you're dead. You cannot sue Graphene when you're dead. And guess what, you can not sue Google when you're dead either. Posthumous security is interesting by the time we can upload our consciousness to a substrate, Iain Banks style. Until then, prevention takes precedence.

Here is the test to see if you actually need security: how many people could you comfortably share your location with the past month without lying to them? If the answer is greater than 1, you're probably not in great need of elevated security measures. After all, do you trust your mom to not tell your adversary where you are at with the wrong side of a barrel pointed at them?

However, situations change. If you feel you may ever be in that situation in the future, take it from someone that didn't prepare: its better to build your security now, before you're under attack.

reply