[etiam]

I'm inclined to agree in that they can't really be trusted if they can't be thoroughly audited and all the lockdown is an obstruction to that.

On the other hand I think they could really be doing good things behind the veils, and that could benefit very large numbers of people who don't have the knowledge or inclination to defend their own communications, (and anyone who has the knowledge and inclination but also the misfortune of needing to communicate with those who don't).

I don't know anything about Jacobs beyond what we've just seen here, but I would guess someone who has worked on that level with Open Whisper Systems wouldn't be prone to accepting poor security design, nor to accepting unethical practices in handling user information. I'd be much happier with an open Apple Inc. too, but as long as it keeps standing for a closed and locked environment, Jacobs seems like just the kind of person I would want working there.

[stephenr]

I'm a big fan of using open source software to build a business on - particularly BSD/MIT/Apache (aka "permissive") licenses - but the idea that "Open Source === Audited" is laughable.

How many huge bugs have been discovered in very widely used open source libraries/applications and identified as having affected the software for many years?

Would you be satisfied if Apple provided the option for NDA-sealed access to the source, allowing people/researchers to view (but not redistribute) their stack?

Edit: fixed brain shart (extra word)

[threeseed]

Heartbleed is a classic example.

OpenSSL was vulnerable since end of 2011. Fixed mid 2014.

And it's one of the most popular and commonly used open source technologies.