Because their current solution doesn’t meet their own stated goals.

> even if we are competent enough to prevent a leak from ever happening, and even if our users trust us to do what we say, we must be resilient to being strong-armed by a future controlling power (e.g. if someone we don't trust buys us)

They could be strong armed into collecting data and then handing it over.

Is there any kind of legal promise that could be made and not rescinded by the board, not swept away by mergers and acquisitions? I assume not but that’s almost what is needed here more than a software architecture fix which, no matter how well designed, is only as stable as the whims of internal stakeholders.

Legal promises don't enforce themselves.

I think you could make the alerting louder. Hire an independent auditing firm and create some contract around what to do if they fail.

A closed source client is fundamentally incompatible with the claims they want to make.

And you as a customer can simply stop using their services if you no longer trust their intentions and (and this is a very clear and straightforward point) the company and the new controlling power would have nothing on you. Because it did not exist in the first place.

Why are so many of you so keen for them to be "wrong"? Like what even is the alternative approach here supposed to be? Don't build a product in the first place?

No you see, at any moment this company can get acquired and can start pushing malware as updates. It's quite an elementary mistake to not account for this possibility, and the author of this post should hang their head in shame for even pretending to have a solution. /s

> And you as a customer can simply stop using their services if you no longer trust their intentions

The original premise of the article is we don’t have to be concerned with their intentions. This is false.

> Why are so many of you so keen for them to be "wrong"?

I’d rather they were right. But they are wrong.

> Like what even is the alternative approach here supposed to be? Don't build a product in the first place?

Don’t say you can do things you can’t.

I don’t have to offer a solution to point out they’re not offering one either.

I don't track management changes for the apps I use because who has the time? How can we protect ourselves against a malicious company changing their tech behind the scenes?

My personal solution is just to self-host anything important or sensitive (password manager, file storage, photo storage, etc).

Audit the code as desired, pin to specific versions, run on a private network.