undefined | Better HN

0 pointshackideiomat2y ago0 comments

I guess, if the crypto is real, the only things feds could do is tell tuta to load different JS for certain IPs. Which would not be easy to verify as anyone but a targeted person.

The point here is, if they have nothing to hide, they can easily open source. If they already have a weird system to serve some people insecure code, they have to extract that from their code base, maintain 2 versions and make sure both sides are up to date at all times. So not going open source is easier if you wanna be malicious. Not a huge task for feds tbh, but still.

Also, there's still benefits for my privacy and security as in I'm sure some people would find vulns in the code and report them.

0 comments

3 comments · 1 top-level

amanzi2y ago· 2 in thread

But my point is that even if they did open-source their backend code, and even if it was 100% secure and showed that full end-to-end encryption was implemented, you still wouldn't know for sure that this was the code they were running in production. They might have a modified code base running in production and you would be none the wiser.

hnarn2y ago

You’re straw-manning. Nobody said that open sourcing the server component would increase trust in the SaaS service. The whole point of open sourcing a server side component is so that you can self-host, so you don’t have to trust the provider.

Also, regardless of whether someone is actually interested in self-hosting or not, one can still call Tuta disingenuous for repeatedly marketing themselves as “open source” when they are clearly not.

amanzi2y ago

If it's just self-hosting that you're after, then yes - open-sourcing the server-side components would definitely help. Regarding their marketing as "open source" - I haven't seen their marketing claims, so I'll take your word for it, and in that case I agree with you - it's a disingenuous claim.

But my comments were mostly around your original post, where you said you were sceptical of their trustworthiness because they hadn't open-sourced the server-side components. This implied that you would trust them (and I assumed the SaaS service) more if they did this. I was just expanding on a theme that you mentioned: "unless they willingly serve binaries that are not actually built from that code...", and I was just highlighting the fact we would never know if this was happening. So if you're sceptical without them open-sourcing, you should remain sceptical even if they did open source the backend.

1 more reply

j / k navigate · click thread line to collapse