lastweakness

In general, I agree with you. I would very much prefer if they did more open sourcing too. Just want to address some additional stuff.

especially if it’s a scripted client, since it would deliver code uncompiled.

Unfortunately, this isn’t really true anymore because of the necessity of minification. It introduces obscurity but is necessary for performance. But yes, the rest is correct, which is why I specified “web clients”. You can verify the native clients, which is why native clients are so important imo. The concern of a hacked server serving a keylogging web client is unfortunately very real. Kind of makes it impossible to fully trust any SaaS at all.

if you trust audits for logging practices presumably you can trust them for checking that the code base is the same

The thing is, they already do public third party audits already. You can view their audit reports on their site. This is unlike companies like Google and Microsoft who conduct audits and keep the reports private. If you end up having to trust third party audits anyway, it doesn’t help their model of trust since they do already do that in a transparent manner.

But yeah… stuff like the monopoly is kind of intentional. The exports are a mitigation, a huge one at that. Proton Mail exports are supported by services like FastMail, Proton Pass exports are supported by Bitwarden, etc. But in the end, the best case scenario would be some level of open sourcing. It’s just that this “monopoly” is by design. For better or for worse, the fact that there is only one Proton is also good for Proton’s model of trust tbh since the user doesn’t have to wonder if the “instance” they’re using is a good one for example. The fediverse model will not work for something that is so heavily based on trust. Proton wants to appeal to the general user, more than us folks… for better or for worse…

I hope they succeed too. I don’t trust many companies. Proton has been one of the exceptions and I hope it stays that way…

would be good, actually.

Good for us. Bad for business. I explained this in another comment too but Proton’s idea of “open source” is simply to build trust in the security and privacy offered by the service. At least, as much as you can trust any SaaS.

but then why not share the server side code?

And to answer this… Well, business and practicality… One more than the other ofc unfortunately… Why would they take on the additional burden of making it self-hostable, make the backend fully open source, etc just to make competition for themselves? And that maintenance burden is huge btw, especially when the backend was probably never intended for self-hosting in the first place.

If Proton, as a company or foundation, didn’t keep making the right decisions in terms of privacy and security, we might have had a reason to doubt their backend. But so far, there’s been nothing. And steps like turning to a foundation-based model just inspires more trust. By using client-side encryption, even within the browser, they’re trying to eliminate the need for trusting the closed source backend. Open sourcing the backend wouldn’t improve trust in the service itself anyway since you can’t verify that the code running in the backend is the same as the open sourced code. If you’re concerned about data, they also offer exports in open formats for every service they offer.

Why wouldn’t you trust them just because their backend is closed source? Ideologically, yeah I’d like them to open source absolutely everything. But as a service, whose income source is exclusively the service itself, how can it make sense for them to open source the backend when it cannot tangibly benefit their model of trust?

My other comment regarding proton and trust: https://lemmy.world/comment/11003650

They’re not actually good points at all… Proton’s open sourcing of the clients is for the purpose of trust in terms of security and privacy. The backend doesn’t matter because the point is that the data is encrypted before it ever gets to the backend. The goal with Proton’s open sourcing is not the ability to make it self-hostable. Sure, a lot of concerns are valid, but this isn’t like Microsoft or Google. Nearly all of Proton is verifiably and provably secure. Well, at least as long as you trust the web clients being served are the ones whose code is publicly available. But again… You can’t verify that with any SaaS. Such a risk is even present with self-hosting tbh. But that’s another discussion.

Nearly all of Proton’s stuff uses publicly verifiable client side encryption, so idk what all this is about

Why would Microsoft care?

… Okay?

CPU usage is famously terrible with Electron, which i also pointed out in the comment you’re replying to. But yes, having multiple chromium instances running for each “app” is terrible

Yes, it really is that bad. 350 MBs of RAM for something that could otherwise have taken less than 100? That isn’t bad to you? And also, it’s not just RAM. It’s every resource, including CPU, which is especially bad with Electron.

I don’t really mind Electron myself because I have enough resources. But pretending the lack of optimization isn’t a real problem is just not right.

They didn’t just quadruple. They’re orders of magnitude higher these days. So content is a real thing.

But that’s not what’s actually being discussed here, memory usage these days is much more of a problem caused by bad practices rather than just content.

So we’re just going to ignore stuff like Electron, unoptimized assets, etc… Basically every other known problem… Yeah let’s just ignore all that

The people you described aren’t the ones being harassed

I think it’s very hypocritical of you to assume that and then call me out for assuming something similar. And then you call this harassment? I made an assumption based on an assumption you felt free to make. But when I make a similar assumption, that’s harassment?

If you are so confident in vegans harrassing almost-vegans who try to live without animal products, please name a single instance.

I’ve personally experienced it, both in real life and on social platforms, including lemmy. I just make it a point to try and avoid interactions like that these days. I don’t go into vegan communities despite being really enthusiastic about stuff like meat substitutes because around 50% of my interactions have been terrible. And 50% is a terrible number btw. The false equivalences, the assumptions and other issues even in this post’s comments section is kind of alarming. But yeah… Play a victim if that’s what suits you i guess.

I like the concept of veganism, but your community isn’t the best to outsiders. One day that too will change hopefully.

Removed by mod

What vegan is out there calling non-vegans rapists?

I’ve been told that before. Not being vegan implies you support terrible breeding practices which makes you a rapist… apparently… Which is especially dumb considering nobody likes the terrible breeding practices to begin with

Sounds delicious

Use it but don’t rely on it. Celeste uses rclone. The rclone support was temporarily disabled from Proton’s end a while back and also, the rclone backend still has a bunch of bugs and the developer seems to have gone missing

I guarantee you, he would still have dropped it at least once in two decades of use.

Facetiming is pretty commonly used i think

But I’ve tried both Mint and Ubuntu and the software updater constantly runs into issues very quickly after install.

I have a Blue-Build based custom distro (not many customisations tbh), that I’m planning to ship for my sister as well as me. So far, updates have been painless because it’s just one base image overwriting the other. I have a feeling that that’s where Linux distros in general is headed. I can imagine Bazzite being just right for you if you’re into gaming.

Pebble is still going pretty well though, so I don’t know if that’s a good comparison

Source: extremely common knowledge and the stranglehold that Google has on webdev