this post was submitted on 27 Jan 2026
1243 points (99.7% liked)
Technology
79473 readers
6893 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Okay Old Fashioned, but doesn't open source encryption audited by a third party solve this problem? Signal protocol for example? Also proton, I'm guessing, but I'm too lazy to check
Unfortunately even the best intentioned and best audited project can be compromised. So that is not a guarantee (sure, much better than closed source but that is a given)
You may be forced by a rubber hose attack (or legal one) to insert vulnerabilities in your code… and you have the traffic… a single point to attack… signal/proton/etc
Is it possible with two different vendors? Sure it is but it is way more complicated
That's a really good point. All we'd need is for signal devs to be compromised in some way and the next update ends security for signal.
Cynical me would say they don't have to use the code they put up on GitHub in production.
By this logic, can we trust any open source software, even if they claim to use some third party encryption? They could say they're using a super secure encryption, even show it implemented in their open source code base, then just put the other, secret evil backdoor code base in production? Is there a way for any open source project to prove that the code in their open source repo is the code in production?
If you can self host it, yes. Like matrix
But only if you self-host right? Otherwise who ever hosts the matrix instance can tinker with it.
Correct.
In the end i have to choose between some shady company or some guy with a homelab. I guess I'll choose the one who isn't financially incentivized to screw me over.
Yep