• 6 Posts
  • 132 Comments
Joined 3 years ago
cake
Cake day: December 20th, 2021

help-circle




  • drspod@lemmy.mltoLinux@lemmy.mlIn regard to Hyprland and Fascism
    link
    fedilink
    arrow-up
    57
    arrow-down
    7
    ·
    5 days ago

    I thought this was going to be a new article or news, but it’s from April 9, 2024.

    I think this situation has been picked over and rehashed now to the point where anyone who was going to change their behaviour will have already done so. If there is no update on the situation then all I see is you dragging up drama from a year ago.










  • You need to put yourself in the shoes of a non-technical person who doesn’t know how to evaluate the relative security of all the tools that are out there available to them. If you are posting your pre-alpha untested software with a title like “Anti-forensic and secure messenger” then there are many people who will read that and think that it’s on an equal footing as the other tools they have heard of. The vast majority of people are not software engineers, and even fewer are cryptographers.

    this project is still in heavy development so without it getting professional security audit i wouldn’t recommend using it for sensitive stuff.

    You’ve got to lead with this.


  • Well a professional security audit would be at the top of the requirements for an established product that has a userbase and some kind of funding, but as a solo developer the least you can do before releasing your software to the world is to have at least one other person who has some experience in security look it over - that’s what I was asking.

    If you can tell people that your software is secure and “anti-forensic” (!) then you must be pretty confident in your understanding of security systems to release that without even a single code review by a peer.



  • Sorry, I didn’t think this would need further elaboration as to why it is relevant to your initial question.

    Which (Lenovo) notebooks to buy

    Why would anyone trust this company to provide them with hardware that they will use for sensitive tasks that handle personal data?

    Just because you are reinstalling the OS does not mean that you can implicitly trust the hardware. There are many forms that a manufacturer backdoor can take, and WPBT has shown that Windows is not clean after a reinstall. Similarly, Linux is vulnerable to binary injection by the UEFI firmware.

    You don’t have to agree with my opinion, and I wouldn’t shame you for buying a Lenovo device, but you cannot dispute the relevance of my comment. I put it there for the benefit of people who don’t know about Lenovo’s prior scandals and who, like me, would take that as a signal to reject their products.