Re:The second crypto war and the future of the Internet
by gknoy on Thursday January 22, 2015 @02:17PM
(#8931090)
Open source still has its security benefits. When an exploit is publicized, the "fix" for it can be highly scrutinized, and people can comment meaningfully on whether it actually fixes it, and can contribute their own. I remember looking at diffs and the accompanying analysis when heartbleed was out, and it was informative and reassuring.
When an exploit in closed source software is publicized, we have to take their word for it that it gets fixed.
But it's also quite hard to tell if an open source application is secure. Do you have time to audit thousands of lines of impenetrable C/C++/Java/Go/etc. code? The rash of OpenSSL bugs we've had recently shows that "Linus's law" really doesn't work -- the fact that the code can be audited openly doesn't mean anyone is going to spend the time to actually do it. People are busy.
It comes down to the question of "how paranoid are you?"
If I were highly paranoid I'd take a defense in depth strategy -- layer multiple cryptosystems, possibly on multiple OSes/platforms, etc. But that level of paranoia comes at a price of course, both in setup time and overhead.
iMessage is pretty good for every day use. PGP is probably better since you have greater transparency, but is less convenient. SSH and SSL are also pretty good for every day use. But I would trust none of those things to protect me from the NSA or a very well funded criminal adversary.