I believe you missed the point, I am not in defense of Security through obscurity (https://en.wikipedia.org/wiki/Security_through_obscurity), quiet the opposite.
The point: "[...] risk for the service owner as it gives an easily parsable way for an attacker to check [...]" is well known and not the discussion here. You can choose close source for 'security' this is opensource community so I am wondering about such a tool.
There's no "open source" centralized website. You can't know what the server is effectively running unless you have access to it. To me this makes no sense.
And C++, just checked the wiki and the 2 example of openssh's heartbleed and sudo, both in C. Not C++. As expected.
I'm not sure why people keep pushing that myth on C++. It's been a decade we have smart pointers. There's no memory management to be done ever.
Using the old 'new' is like typing 'unsafe' in rust. Even arrays/vectors have safe accessor.
Am I missing something?
Are we codeberg yet?
They won't go to jail, period. No company owners never go to jail, kinda ever. This phrase is out of proportion. At worse they would have a fine.
Also still in the blog everything is words and very opaque like " We do this not only through technology and advocacy (Proton has contributed over $500,000 toward defending these values around the world)" : like where, what, when?
"There was no legal possibility to resist or fight this particular request." : I doubt very much unless Switzerland is a dictatorship in disguise.
"Switzerland generally will not assist prosecutions from countries without fair justice systems." : clearly not.
You can search it online : I don't know any good media so here's the first result on DuckDuckGo https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-court-order-french-climate-activist-arrest-identification
It is a nice PR but for me I am not impressed. Rolex is also a non profit organization in Switzerland and and mostly help hiding there finance.
Correct me if I am wrong but all I see is words and promises. I would trust them if they release the yearly finance transparently.
For now the only act I can judge them on is their collaboration with police to give ecologist activists IP.
Justin Pot is no expert but expert on writing.
Thanks for your answer.
First I don't even grasp what a "service owner" is.
Second, for JS front-end openness there are already a bunch of app (web, android) that are open-source and secured. Everything has dependencies nowadays, this doesn't prevent good security. Think all the python app and their dependencies, rust, android... even c\c++ packages are built with dependencies and security updates are necessary (bash had security issues).
I think with JS scripts it's actually even easier to have good security because the app is ran in our web browser so the only possible attacker is the website we are visiting itself. If they are malicious then the close-sourced JS script is even worse. Unless you count 3rd party scripts embedded that bad dev uses in their website without even thinking about trusting them. That is also awful in both open or close source environment.
So even having imperfect security (which happens regardless to openness), who is the attacker here? I would rather run js script on my end if the code can be checked.