No, that wasn’t my question. We were talking about this particular case. So pls answer my question: Why would you use the script instead of downloading the browser from torproject?
My point was that @NX-01’s claim that using the torbrowser-package is in any way less secure than downloading the Tor browser yourself (and using it on Arch) is simply wrong. It’s equally safe. There are no “two points” of failure.
I didn’t write “two points of failure”, I wrote " two possible points of failure". That’s a difference.
This is true about only 5% of the code in Vivaldi.
That is what they say about it.
But they might be big fat liers
Of the three layers, only the UI layer is closed-source. This means that roughly 92% of the browser’s code is open-source coming from Chromium, 3% is open-source coming from us and only 5% is our UI closed-source code.
Well, it’s enough that 0.01% of Vivaldi’s source code is closed, if it contains the spyware part.
There are no two possible points of failure. I’ve already explained why.
For the same reason I use the package manager to install software whenever I can. We have already concluded that there is no difference in security between downloading the Tor browser yourself and running it on an Arch Linux system, compared to installing the torbrowser-package from the repos. There is a pragmatic difference, the latter is more convenient, since it gives you all the benefits of package management you don’t get when you download software yourself.
We’ve been over that before and I have no plans of doing it again. We already agreed that they have the opportunity and the motive and that there is no way to hold them accountable for it.
Proprietary software is intrinsically untrustworthy. Proprietary browsers that make money, but are gratis for the end user are especially untrustworthy. Not being suspicious about it is downright foolish.
Yes, there is a possibility, however unlikely, that Vivaldi does not contain spyware. nobody is denying that. The fact is that there is no easy way to know, unfortunately, because the source is closed.
For this purpose, it does not matter whether 0.01% of it is closed or 100%, the spyware part can be really tiny. It’s actually much worse than that, since even if one line of code is proprietary, you cannot build it from source yourself, that means you rely on the binary provided by the authors, and you only have their word over how much of it is proprietary or not. So it could be millions of lines of proprietary code, no way to know.
I don’t really recall that there were any conclusive evidence presented that they are really spying on the users. Having motive and opportunity without unquestionable evidence would really not appeal to any judge in any courts where there are some decent justice system to declare somebody guilty.
Agreed.
But yes, let’s leave it at that. I remember that I almost killed myself in the name of science back then to gather evidence of the existence of an afterlife for a forum friend.
I don’t recall I ever said such conclusive evidence is needed in order to conclude that it is unwise to use Vivaldi. I mean, if you are comfortable having blind trust in a complete stranger who has a motive and an opportunity to screw you over, and can get away with it… well sure, it’s not my place to tell you whom to trust. My argument was merely that such trust is foolish and careless. And I remember you agreed with that general assessment.
Not really! I want to set the records straight. Vivaldi contains 5% closed source code. We have no way way of knowing what those 5% code does. According to them it is part of the UI.
They have opportunity to include spying stuff in there if their motive to make money is by spying on their users. Frankly, I am not familiar with their business model to know how they make their money. But I could understand your concern that it is better to be safe than sorry.
My own personal use of Vivaldi is minimal. Mostly for acquainting myself with what features they offer
etc. I don’t do anything personal with it to compromise my privacy or security.
OK Kresimir, we have different opinions, nothing wrong with that. Maybe you are just much better with reading code than I am and you can immediately and with confidence tell if those issues are relevant or not. I can’t do that. I just see red flags here.