[CiPHPerCoder]

> it's still desirable for such critical security components to be free, or at least "open source".

Why the scare quotes?

What about software's source code being available makes it more desirable for your non-technical users who will never modify their software?

[seba_dos1]

Even though I'm not a "non-technical" user, I don't review crypto of my XMPP client. And that's fine, I know a few people that did and I trust them enough. This way I don't have to trust an entity that may benefit from being able to access my messages.

Also, this is a fallacy. Just because "typical user" won't care or won't be able to do something doesn't mean we shouldn't strive to build and popularize platforms that do right things. Of course it also has to be good at what users actually do care for to have any chance of taking off, but that's not the point.

[CiPHPerCoder]

> Also, this is a fallacy.

What is a fallacy? I asked a question.

Non-technical users will never modify their software. The act of doing so would recategorize them as "technical". I don't see any fallacy here?

The most likely interpretation of your comment is, you're assuming an argument that I am not making.

> Just because "typical user" won't care or won't be able to do something doesn't mean we shouldn't strive to build and popularize platforms that do right things.

That's a disagreement with an argument I did not make.

> Of course it also has to be good at what users actually do care for to have any chance of taking off, but that's not the point.

What is the point, even?

I just asked how something being "open source" (to borrow the scare quotes) is more desirable to users who do not read/write software code? What is their incentive supposed to be to prioritize open source over proprietary software?

That's not an argument. It's certainly not a fallacious one.

> Even though I'm not a "non-technical" user, I don't review crypto of my XMPP client.

Little bit of background: I'm the sort of person who would review the crypto of an XMPP client.

> And that's fine, I know a few people that did and I trust them enough. This way I don't have to trust an entity that may benefit from being able to access my messages.

Cool, let's ask an trustworthy expert then. I can think of no finer expert to chime in on this discussion than JP Aumasson, one of the co-authors of SipHash and BLAKE2, who wrote the book Serious Cryptography and conducted many cryptography audits in his career.

https://research.kudelskisecurity.com/2018/10/02/open-source...

Oh.