With companies, there's an incentive structure that usually makes it pretty obvious whether they have an interest to do really shady stuff on your PC. For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust. That's just good management. Of course, management often screws this up and then we get (justifiably) outraged HN posts.

For pirated software the incentive structures are also clear, and usually point towards "yeah if given the chance they'll take everything from my HDD and make a run for it."

I'm all for FOSS everything, but running a company-distributed binaries is very different from pirated ones, and I agree with GP that it baffles me someone would do the latter.

>For "proper" companies that have established customer bases and a legit revenue model, they have an incentive to not screw everyone over and lose their trust.

It also depends on what company means by "not screw everyone over" Right now many companies consider practices as 'OK' while I am coming from the times when most of those modern activities considered to be virus or malware. So for me it doesn't really matter whether you have malware installed by a virus or it's hidden deeply in EULA which you can't reject partially anyway.

Oh I'm not trying to defend these practices in the least. But at least there is some mechanism (public outrage) there to make them think about it. That these mechanisms seem to fail and we need proper regulation is a different matter. Also in a lot of cases it's not really clear which tangible monetary benefit companies get from spying on their customers. Many cases seem to be managerial paranoia (Just in case the customers pirate!) or "because we can."

Pirating and re-packaging software for torrent is also a non-negligible amount of work, and with no revenue stream besides bundling the apps with malware. So it's quite a different incentive structure still.

> But do you understand people who dare to run executables from 'proper-company' site? It's closed source, you have no idea what you are running, isn't it? As long as it's not free software in terms of FSF there is not guarantee what so ever that it's not harmful or even worse intentionally harmful.

You'll have to trust somebody at some point.

Do you trust the company who designed your Ethernet chip? Do you trust the person who wrote the firmware for it? If not, go and design your own network chip. Otherwise, there's no guarantee it won't spy on you.

You'll also want to write your own compiler that you'll then use to build the operating system you intend to run. You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website.

>You'll have to trust somebody at some point.

No, I do not have to. I can choose to, but I don't have to! That is the core of the issue.If I 'have to' then I don't. I prefer checking and facts, not delusions.

>Do you trust the company who designed your Ethernet chip?

No, I don't and we shouldn't. I evaluate chances and we should track network activity with diff. hardware on diff. chipsets from diff. manufacturers.

>Do you trust the person who wrote the firmware for it?

No, I don't and we shouldn't as it's insane to do so.

>If not, go and design your own network chip.

There are other means to overcome this: encryption. But yes, you right, we should make open source network chip. Agree. I certainly plan to design it.

>Otherwise, there's no guarantee it won't spy on you. That is correct, I agree with you.

>You'll also want to write your own compiler.

Yes, that is correct. I want and I am writing it right now. There is also an option of GNU c/c++ compiler available (GCC) https://gcc.gnu.org

>that you'll then use to build the operating system you intend to run.

This is how you build a proper GNU/Linux system worth some degree of your trust.

>You won't just go download some Linux .iso to install, would you? After all, there's no guarantee it's not been manipulated by those who offer it on their website.

Exactly. Or it can be modified on the way, while you download it. For the later you can check hash sums published by a site who respects user freedom and cares about own reputation.

>You'll have to trust somebody at some point.

Again I do not have to, but I can choose to trust with some degree to Richard Stallman and people sharing his views. https://www.youtube.com/watch?v=n9YDz-Iwgyw

I have some trouble trusting FSF since he was removed from the position due to false accusations for saying (!) just saying things, which he actually didn't say if you read carefully. Speak about respect of freedom of speech.

https://www.youtube.com/watch?v=7UbQ1kc1vQU

To trust the system we should have trust worthy components with open sourced designs starting from CPU and every chip installed and ending with each software running. That is the only way!

There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :)

The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small.

> There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :)

Obligatory reference to Reflections on trusting trust [1]

[1] https://dl.acm.org/doi/10.1145/358198.358210

>The set of computer users who a) have the knowledge to do security code review and b) have the time to review the programs they run is, I would expect, fairly small.

Even a small number of those who understands can make a huge noise, because if comment is well grounded, it spreads exponentially by people who do not need to understand all the details.

And frankly how much those who understand you really need for each project? The thing is, if you are worried you can always look, which is not the case if you have nowhere to look.

Also expert is not always required just to see there is no brutal obvious harm intent, which covers a lot of cases

There are a number of cases, even with just bugs, which won't be deliberately hidden (unlike malicious software) where critical security issues have gone unnoticed in major open source software packages for year (e.g. shellshock).

Then you have the fact that if it's deliberately malicious things can be hidden such that even experienced code reviewers (who are not plentiful) could be fooled. A good example of this is the underhanded C contest http://www.underhanded-c.org/_page_id_2.html .

Sure an open source user may catch malicious behaviour, but then security researchers find malicious behaviour in closed source software pretty regularly via reverse engineering or binary analysis.

This isn't an anti-open source thing, it's a reflection that open source often isn't much of a signal of safety, unless further work has been done and continues to be done on a regular basis.

Still a reputation to lose, generally speaking.

I have also never seen anybody who made this argument verify their free software by looking at sources before compiling.

Exactly. Even if I would use only 100% FOSS software, I would not have the time to read all the source code of the whole stack, from the device drivers to the kernel and up to the source code of the web browser, etc etc.

and neither of those are ransomware. do you understand the difference?

>do you understand the difference?

Let's take a File System for a second as example. If you wrote your personal data on some disk drive and then to read this drive you need let's say Mac/Win because it's a closed format. And Mac/Win cost money. How it differs from ransomware then? Sure you have more time to decide, usually more than 3 days and it costs a bit less, but is it much of a difference there? Probaly a choice to start using it, but is it really a choice? In many cases it's not really. So back to your point, I understand it, but do you?