Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 851901" data-attributes="member: 82776">I am ready with my study (webdesign - online marketing), but my final thesis was rejected because the company which offered me a workplace for my thesis, decided to use it commercially to fast breaking some rules related to thesis topics. The company compensated me by offering a part time job (part time because I need time to finish a new thesis). Because I had to pay school for a whole year, I bargained a deal that I could folllow another minor without needing to pass the exams <img class="smilie smilie--emoji" loading="lazy" alt="👍" title="Thumbs up&nbsp; &nbsp; :thumbsup:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f44d.png" data-shortname=":thumbsup:" />So I am doing a minor on security now. Last topic was how safe is open source software?The answer was a bit disappointing: Transparency is no guarantee for security. The Deepin Linux OS was mentioned as an example:1. An OS has just to many lines of code to be checked manually, reducing transparency to something meaningless in practice.&nbsp; Automated checks (like some play stores have), even miss &#039; active leaks&#039;&nbsp; while the code base of an extension or App is just a fraction of the code base of an entire Operating System plus Desktop environment2. The &#039; hole&#039;&nbsp; does not have to be an &#039; active leak&#039;&nbsp; like &#039; ET phone home&#039;&nbsp; type of backdoor, but could be a well crafted &#039;passive leak&#039;&nbsp; like a vulnerability, which could be used when needed. The vulnability reports are a living proof that this happens for software of which their developers don&#039;t want them to have any bugs at all.3 A vulnerability is easier to use in a predictable manner (which is the requirement for a vulnerability to be promoted to an exploit) when context information is available about the targets computer hard- en software. Deepin sends home telemetry data (the CNZZ analysis service) which is no worse or better than Google&#039;s telemetry data collection (like user agent and screen resolution).Conclusion:&nbsp; ..... all conditions are set to misuse Deepin and it is up to your trust in people in general on whether to use this splendid linux distro or not (It is developed by a Chinese company), but ..... the same applies to software of Google and Facebook, so what else is new?My teacher ended the this topic with a scene out of House of Cards in which Frank Underwood says &quot;Good things happen to good people&quot;. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /></blockquote>

[QUOTE="Lenny_Fox, post: 851901, member: 82776"] I am ready with my study (webdesign - online marketing), but my final thesis was rejected because the company which offered me a workplace for my thesis, decided to use it commercially to fast breaking some rules related to thesis topics. The company compensated me by offering a part time job (part time because I need time to finish a new thesis). Because I had to pay school for a whole year, I bargained a deal that I could folllow another minor without needing to pass the exams 👍 So I am doing a minor on security now. Last topic was how safe is open source software? The answer was a bit disappointing: Transparency is no guarantee for security. The Deepin Linux OS was mentioned as an example: 1. An OS has just to many lines of code to be checked manually, reducing transparency to something meaningless in practice. Automated checks (like some play stores have), even miss ' active leaks' while the code base of an extension or App is just a fraction of the code base of an entire Operating System plus Desktop environment 2. The ' hole' does not have to be an ' active leak' like ' ET phone home' type of backdoor, but could be a well crafted 'passive leak' like a vulnerability, which could be used when needed. The vulnability reports are a living proof that this happens for software of which their developers don't want them to have any bugs at all. 3 A vulnerability is easier to use in a predictable manner (which is the requirement for a vulnerability to be promoted to an exploit) when context information is available about the targets computer hard- en software. Deepin sends home telemetry data (the CNZZ analysis service) which is no worse or better than Google's telemetry data collection (like user agent and screen resolution). Conclusion: ..... all conditions are set to misuse Deepin and it is up to your trust in people in general on whether to use this splendid linux distro or not (It is developed by a Chinese company), but ..... the same applies to software of Google and Facebook, so what else is new? My teacher ended the this topic with a scene out of House of Cards in which Frank Underwood says "Good things happen to good people". :unsure: [/QUOTE]

Verification