this post was submitted on 19 Feb 2024
1 points (66.7% liked)
Privacy
31915 readers
586 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I am not understanding something then.
The basics in this case are a legally binding document saying they don't do x and y. Them doing x or y means that they would be doing something illegal, and they are being intentionally deceptive (because they say they don't do it).
So, the way I see it, the risk you are trying to mitigate it is a company which actively tries to deceive you. I completely agree that this can happen, but I think this is quite rare and unfortunately a problem with everything, that does not have a solution generally (or to be more specific, that what you consider basics - open source code and an audit - do not mitigate).
Other than that, I consider a legally binding privacy policy a much stronger "basic" compared to open source code which is much harder to review and to keep track of changes.
Again, I get your point and whatever your threshold of trust is, that's up to you, but I disagree with the weight of what you consider "the basics" when it comes to privacy guarantees to build trust. And I believe that in your risk mapping your mitigations do not match properly with the threat actors.
That's absolutely your call mate. I'm not here to tell you you're wrong. I just know what it is that I personally consider to be active steps towards establishing trust and that I base my opinion on them. If yours and mine don't align, so be it - to each their own.
Sure, but if you are considering a malicious party in the kagi case, your steps don't help. What you propose can totally work if you are considering good faith parties.
In other words: assume you use searXNG. If you now want to consider a malicious party running an instance, what guarantees do you have? The source code is useless, as the instance owner could have modified it. I don't see a privacy policy for example on https://searxng.site/searxng/ and I don't see any infrastructure audit that confirms they are running an unmodified version of the code, which - let's assume - has been verified to respect your privacy.
How do you trust them?
I am curious, what do you use as your search engine?
I self host just about every service I can, including search.
You're asking for a guarantee, which I've repeatedly admitted I can't offer because absolutely no one can provide that. No provider, no service, no software. All we can do is decide what we each consider to be actions/behaviours indicative of trust and use their offering in a way that maximises privacy for us as individuals. I put more trust in software/services that has code that anyone can read, that has been independently audited, that is trusted by the community and possibly tested in a legal environment. You might put more trust in things like privacy policies and other legally binding documents. Neither of us can guarantee anything however. I've lost count of the number of companies who've violated privacy laws and users only find out years or even decades after the fact.
But I'll say it again - whats right for me might not be right for you and that's fine.
OK guarantee was too strong of a word, I meant more like "assurance" or "elements to believe".
Either way, my point stand: you did not audit the code you are running, even if open source (let's be honest). I am a selfhoster myself and I don't do either.
You are simply trusting the software author and contributors not to screw you up, and in general, you are right. And that's because people are assholes for a gain, usually, and because there is a chance that someone else might found out the bad code in the project (far from a guarantee). That's why I quoted both the policy and the business model for kagi not to screw me over. Not only it would be illegal, but would also be completely devastating for their business if they were to be caught.
But yeah, generally hosting yourself, looking at the code, building controls around the code (like namespaces, network policies, DNS filtering) is a stronger guarantee that no funny business is going on compared to a legal compliance and I agree. That said, despite being a selfhoster myself, I do have a problem with the open source ecosystem and the inherent dependency on free labour, so I understand the idea of proprietary code. Ultimately this is what allowed kagi to build features that make kagi much more powerful than searXNG for example.