[fellowmartian]

I think this is a false dichotomy. Open hardware with open source software would be more protected simply by being more stress tested and vetted by more people. If you need even more protection you can employ zero-knowledge proofs and other trustless technologies. I have long been dreaming about some kind of hardware/software co-op creating non-enshittifying versions of thermostats, electric kettles, EV chargers, solar inverters, etc, etc. Hackable for people who want it, simply non-rent-seeking for everyone else.

[johncolanduoni]

The issue here is rarely whether the security features themselves are circumventable. It’s that at some point this turns into trusting users not to give malware apps permissions (whether that’s a dialog, a system wide setting, adding a third-party app store, etc.). Almost no users can usefully evaluate whether a particular bit of digital trust is a good or bad idea, so people will constantly get scammed in practice. If you’re thinking about ZNP as a solution, you’re not trying to solve the actual security problems of normal users.

[beeflet]

I think normal users will figure it out if you give them a couple of generations

[positron26]

> more stress tested and vetted by more people

Grandma and grandpa aren't reading the source code and certainly not up at a professional level. This is one of the core misconceptions of the "free/libre" formulation of OSS.

[nik282000]

> Grandma and grandpa aren't reading the source code and certainly not up at a professional level.

This is one of the core misconceptions of the anti "free/libre" formulation of OSS. Most users don't need to read the entire Debian source to know that it is safe to use. You are free to look up who maintains any part of the project and look at the history of changes that have been made. A lot of projects have nice, easy to read notes along with the actual code.

If you are so paranoid that you can't even trust open release notes then why would you trust a closed project at all?

[positron26]

> A lot of projects have nice, easy to read notes along with the actual code

This alone doesn't improve the quality of the source.

> Paranoid

Nothing to do with it. Please be logical. Having millions of people who can't program trust maintainers doesn't make those maintainers do better work.

The whole idea of more eyeballs is an appeal to a vision of crowdsourcing that was a new idea in the early internet. What we found out is that complacency sets in, the notes eventually don't mean anything, and most source code is not read.

This vision of more programmers spending more time reading other people's programs is wholly born from within programmer communities, from programmers talking to other programmers, forgetting that the average user will never program and not because they lack access. It's a romanticized ideal that is only even a plausible idea in a room full of programmers.

Until you focus on how the non-programmer is going to meaningfully improve the review and production of the open technologies, you will never have a scalable or equitable solution.

[beeflet]

The non-programmer never going to meaningfully improve the review and production of the open technologies. The solution is to make a society where people are literate in the technology they rely on or suffer otherwise.

[positron26]

And the solution to cavities is to increase self-dentistry literacy? The solution to a bridge collapsing is to increase civil engineering literacy? The solution to a plane crash caused by a cracked turbine blade is to increase casual aerospace engineering literacy? How much of how many literacies will we be willing to acquire so as to balance the responsibility we ask of every other profession and even those who are low and unskilled?

This incredibly selfish point of view put forth by a particular sect of _OSS polls sufficiently well at the engineer's only meeting in Palo Alto and nowhere else.

When people were coming up with the idea of computer literacy being ubiquitous like math, they meant math like addition and subtraction. To make the kind of impact that "free/libre" advocates want the everyday Joe to be responsible for, Joes need to know the CS equivalents of perturbation theory and how to solve partial differential equations. It's not happening, but believing that it can happen allows those ostensibly in favor of it to keep acting like they have a plan, like they want a solution.

As long as the hardware hacker is stuck in the mindset of what 0.01% of users want to do with devices, while they may find sympathy from the 0.1% who are software engineers, many of whom gather on this site, this is not even blowing at the gauge from halfway across the room in terms of moving the needle. Either figure out what is important to the consumer and how it aligns with your interests or just go home.

[beeflet]

>And the solution to cavities is to increase self-dentistry literacy?

This is what is done, in practice. You teach people at a young age how to take care of their own teeth and gums. The majority of the problem is preventative, you don't outsource the management of your health to some monopoly. And it's not unimaginable that the average person would have the ability to fill a cavity or something. If anything, dentistry is less archaic than computer software, the reason it's a profession is a more a matter of skill.

>The solution to a bridge collapsing is to increase civil engineering literacy? The solution to a plane crash caused by a cracked turbine blade is to increase casual aerospace engineering literacy?

I think that the difference in this situation is that anyone can play a role auditing and changing computer software they use (and recognize malware vs well built open software), but not everyone gets to build the bridge that everyone uses.

You might say that a lot of the world's software right now exists in the form of services, and you would be right. The goal is to make a world in which people are less dependent on centralized services. I think that most programmers here get paid to think in terms of client-server architecture instead of directly create useful software which is harder to monetize.

>When people were coming up with the idea of computer literacy being ubiquitous like math, they meant math like addition and subtraction. To make the kind of impact that "free/libre" advocates want the everyday Joe to be responsible for, Joes need to know the CS equivalents of perturbation theory and how to solve partial differential equations.

Not really, I think most computer software is a lot simpler than that. And I also generally don't believe that complex topics are inaccessible to most people. If it's the kind of information you learn about in college, then you just have to read textbooks and digest the information. Thanks to the internet, information on most topics are pretty accessible. I don't think there is some sort of "IQ" cap on the vast majority of topics, and you can pretty much learn anything as long as you are reasonably intelligent and motivated.

I think you are stuck in this "consumer vs producer" mentality with regards to technology, where some part of the population is destined to be drooling serfs and we just have to design everything to accommodate them. I take the opposite stance, which is that people are generally capable of learning and adapting to a far wider range of challenging environments than exist in modern society, and that those who can't are a small minority that should be culled anyways.

It was only a couple of decades ago that access to computers was limited to the elite few who understood computers, and society seemed to hum along fine back then.

With increasing automation and access to information, you would think that people would have more time and info to study and become knowledgeable on a wider range of topics. Instead, they are even busier working fake jobs and competing in zero-sum arenas. Instead of setting lower standards for competence in society, why not increase standards and elevate the agency of the common man?

[daurentius523]

> When people were coming up with the idea of computer literacy being ubiquitous

If you require everyone to have a computer/phone to live in society for example by digital ID - then is ubiquitous and you must regard it as such.

> This incredibly selfish point of view put forth by a particular sect of _OSS polls sufficiently well at the engineer's only meeting in Palo Alto and nowhere else.

No one forces you to change your OS. No one forces you to code. No one forces you to dissemble. No one forces you to compile. No one forces you to add or remove certification authority (change the trust).

We only want to force corporations and states to allow Us to do that to device we own.

You are already responsible on code - closed source also GIVES NO WARRANTY.

> sect

the 'sect' as you called it - envisioned world in which when you get device you have driver to it and code to it.

Should manufacturer decide that you will get no new updates - you COULD go to another company and buy updates from them - because you would have ownership of software.

Should your phone manufacturer decide that you will not get no new updates - you COULD go to another company and buy updates from them - because you would have ownership of software.

Should your washing machine manufacturer decide to s-you and force you to connect to cloud via their app - you COULD go to another company and buy software that doesn't force you to do that, and let them install it for you - because you would have ownership of software.

If you want to use smart home - you could without any manufacturer connectivity bs - because you would have ownership of software.

You could decide that you trust company A for OS updates - and if they deceive your trust, change it to B. because you would have ownership of software.

Yes you would need to pay for updates and software - unless software company did sign a real deal with you for your data.

I hate when people say that Free Software is communism - it is not, it is consumer capitalism in purest form.

The whole point wasn't you SHOULD do it yourself - but you CAN do it yourself. The problem - you need market before any company can enter it. No libre drivers, no libre firmware - no such company.

And before anyone asks - yes you could extend it to cars. You would need stricter CA check (here you can make a reasonable exception that self-signed should not work) on that type of device though, but no longer ONLY MANUFACTURER. Why would you pay another company to do software updates / change when you do buy a repair / parts from third party?

This was intent - not 'increase self-dentistry literacy' - the literacy part came from the users of Linux mostly - you should think about it as after-effect.

> The solution to a bridge collapsing is to increase civil engineering literacy?

If the bridge collapsed because you have no good engineers then yes.

> How much of how many literacies will we be willing to acquire so as to balance the responsibility we ask of every other profession and even those who are low and unskilled?

You are not making good engineers/politicians/doctors etc. if you take ones who want to get paid big money - you are making good ones if the people teach are interested in their work and are willing to get better in it.

To do that you must give them opportunity to grow.

You need casual->small->big->"anti-monopoly split" company path

if you remove casual you don't have a market, you have a graveyard of one.

[fellowmartian]

I’m not suggesting grandpa reads code, contributors do. We all know that most commercial code is much shittier than open source. Sure, commercial code usually covers more edge cases and has better UX, but is cobbled together from legacy and random product asks.

[positron26]

> contributors do

More users != more contributors. As software gets more popular, you begin getting 10, 100, 1000, 1,000,000 users for every contributor.

This doesn't just affect non-programmers. We can't even police NPM.

People want it to be true so that it will be a talking point, but it's not true, and we need to find new talking points that align with facts that are evident outside the echo chambers.

[dismalaf]

NPM is... special... It's up to platform owners to set standards and police. NPM's failures have nothing to do with open source as a whole.

[jen20]

> We all know that most commercial code is much shittier than open source

Citation needed. Seriously.

[rmunn]

I'm not the one who made that assertion, but... Windows Millenium Edition almost makes his case all by itself.

[jen20]

That makes the case that a _single_ piece of commercial code was shitty.

I could make the same argument about MongoDB of a decade ago implying that all open source is trash...

[rmunn]

Norton, McAfee, in fact most virus scanners.

Plenty of examples I've heard about but haven't actually used myself so I can't confidently assert the quality of the software. But Windows ME, Norton, and McAfee, I have personal experience with.

Oh, and also Windows Vista.

Plenty of badly-written open source software, too; won't argue against that. But one of the biggest reasons, for me at least, why I prefer to use open-source software rather than commercial if I have a choice is bug fixes. I've reported over a dozen bugs against open-source software I use over the years; most of them have been fixed (in a couple cases I was able to fix it myself). I've rarely even been able to report a bug against closed-source software, let alone get those bugs fixed. So even if if were true that commercial software as a whole has similar or better quality than open-source, my personal experience is the other way around: open-source quality gets better over time while the closed-source software that I have to use (lacking open-source alternatives) doesn't improve the same way.

[nik282000]

Windows ME, Windows Vista, Internet Explorer, Adobe PDF Reader, Siemens Step7, Norton, McAffe, the list goes on. If you look at it as a function of terribleness * users then corporate ware takes the cake. There are loads of terrible open projects but nobody uses them.

[ranger_danger]

> contributors do

I would argue most code of any license is not actually regularly audited if at all, and certainly nowhere near the levels people seem to think they are.

> We all know that most commercial code is much shittier than open source

citation needed

[p_ing]

> I would argue most code of any license is not actually regularly audited if at all, and certainly nowhere near the levels people seem to think they are.

Every device should run OpenBSD. And only the audited part.