| > This is a lose-lose scenario. If you don't trust a closed operating system in the first place I don't trust open systems either. I don't have the time to audit them. If I did, I wouldn't trust myself to catch everything. I don't trust "enough eyes make all bugs shallow" either. Case in point: Canonical written "features" in Ubuntu, and OpenSSL bugs in general. > why would you then, after performing these steps, trust the system that it really does what it says it does. Don't trust: verify with wireshark? Alternatively, trust the people who wrote this to have run wireshark. Alternatively, "Trust but verify." I generally trust Microsoft and FOSS to not be actively malicious on their own behalf. I trust neither Microsoft nor FOSS to do their privacy due diligence, write perfect software, to be free of capitalistic or engineering pressure to add privacy harming features, nor to be free from subversion by state actors (NSA etc.) What's your superior counter-proposal, under these conditions? > The point is that you don't know, and you can never be sure. Fundamental truth of computing, not "windows 10". I can't even trust the code I write myself to be free of security or privacy issues due to my own mistakes or lack of consideration. > The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust. I reject the thesis that trust is binary. Were I to accept it, I trust nobody - everyone is vulnerable to being subverted by blackmail, intimidation, making mistakes, etc. Trust of system is also not the only factor influencing my use of a system. I trust a deeply buried cement brick more than any computer, but I can't use the web with it. I have very different trust needs for my bank servers, my workstation, my catstation, and my gaming console. |