this post was submitted on 22 Apr 2024
468 points (97.4% liked)

Open Source

31713 readers
422 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 59 points 8 months ago (2 children)

The backend is proprietary. Avoid.

[–] [email protected] 9 points 8 months ago (3 children)
[–] [email protected] 6 points 8 months ago

I use their mail system, and it's pretty good ngl

[–] [email protected] 4 points 8 months ago (1 children)
[–] [email protected] 7 points 8 months ago

E2E Encrypted FOSS smoke signals that are only visible on a Time-Based One-Time wavelength of light are the only way.

[–] [email protected] 1 points 8 months ago (1 children)
[–] [email protected] 2 points 8 months ago

Except anything Valve, which is awesome.

[–] [email protected] 1 points 8 months ago (1 children)
[–] [email protected] 1 points 8 months ago (2 children)

Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage.

[–] [email protected] 1 points 8 months ago (1 children)
[–] [email protected] 1 points 8 months ago

Something like Vaultwarden if you care about cloud sync, or KeePassXC if that's not on your priority list.

[–] [email protected] 1 points 7 months ago (1 children)

if the client is e2ee and you can control that, then why is the server relevant?

[–] [email protected] 1 points 7 months ago* (last edited 7 months ago) (1 children)

Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code.

Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you're paranoid.

[–] [email protected] 1 points 7 months ago (1 children)

and you can control that

Sorry, I meant "assuming one has complete control over the client source" where the remote cannot just change it on you.

[–] [email protected] 2 points 7 months ago* (last edited 7 months ago) (1 children)

I mean they can make a sneaky update to the client that introduces such changes.

Sure, if you won't update your client, this won't affect you, but would potentially open you up to other security vulnerabilities.

[–] [email protected] 2 points 7 months ago* (last edited 7 months ago)

This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of.