UPDATE just started a free account with infomaniak so far happy with infomaniak except the free email extensions like @ik.me @etik.com or @ikmail.com addresses whether will be accepted / recognized by institutions like banks etc

also found a community group at https://www.reddit.com/r/Infomaniak/ will search if any group here as well

just started an account with infomaniak so far happy with infomaniak except the free email extensions like @ik.me @etik.com or @ikmail.com addresses whether will be accepted / recognized by institutions like banks etc

also found a community group at https://www.reddit.com/r/Infomaniak/ will search if any group here as well

except that I cannot sync with thunderbird windows I think

I was considering that until I have read come user comment saying that user could not contact them at all when some mulfunction have you had a good experience as a paid user, please share your experience if you could,

I was considering infomaniak until I have read some comment , user cannot get a solution or a response because of some emergency situation Please share your experiences with infomaniak. No to linux since many apps I have depends on windows I am afraid

Tuta seems to be OK but thunderbird integration is not free if I am correct

I agree, they would be the last resort for me

Thanks for sharing the link! I wouldn’t have known about it otherwise.

I consider myself an open-source user, but I struggle to understand why I should trust these projects when I lack the technical knowledge to evaluate the underlying code, which is frequently updated. I am skeptical about the enthusiasm surrounding open-source software, especially since it is practically impossible for an independent auditor to verify every update.

This raises the question of why we should place our trust in these systems.

Then through intensive search and I have found similar doubts in many online communities including the one you have mentioned

I feel compelled to raise this issue, as it may help me—and others—better understand the rationale behind the blind trust placed in open-source software.

Additionally, I have noticed that open-source supporters often seem hesitant to address this dilemma. I wanted to bring this concern to the community here by sharing the opinions in other places and ask if I am the only one (or one of the very few) who harbors doubts.

This is why I believe it is a very important topic for me to share & interact with the members (who are more knowledgeable than I am) here which is my END GOAL for your specific question.

Meanwhile, I will continue using open-source applications as I seek out like-minded individuals who share my doubt and search for a further scrutiny .

Take Open Source with a Grain of Salt: The Real Trust Dilemma

In the age of open-source software, there is a growing assumption that transparency inherently guarantees security and integrity. The belief is that anyone can check the code, find vulnerabilities, and fix them, making open-source projects safer and more reliable than their closed-source counterparts. However, this belief is often oversimplified, and it’s crucial to take open-source with a grain of salt. Here’s why.

The Trust Dilemma: Can We Really Trust Open Source Code?

There’s a famous story from the world of open-source development that highlights the complexity of this issue. Linus Torvalds, the creator of Linux, was once allegedly asked by the CIA to insert a backdoor into the Linux kernel. His response? He supposedly said, “No can do, too many eyes on the code.” It seems like a reassuring statement, given the vast number of contributors to open-source projects, but it doesn’t fully account for the subtleties of how code can be manipulated.

Not long after Torvalds’ alleged interaction, a suspicious change was discovered in the Linux kernel—an “if” statement that wasn’t comparing values but instead making an assignment to user ID 0 (root). This change wasn’t a mistake; it was intentional, and yet it slipped through the cracks until it was discovered before going live. The question arises: who had the power to insert such a change into the code, bypassing standard review processes and security protocols? The answer remains elusive, and this event highlights a critical reality: even the open-source community isn’t immune to vulnerabilities, malicious actors, or hidden agendas.

Trusting the Maintainers

In the world of open-source, you ultimately have to trust the maintainers. While the system allows for community reviews, there’s no guarantee that every change is thoroughly vetted or that the maintainers themselves are vigilant and trustworthy. In fact, history has shown us that incidents like the XZ Utils supply-chain attack can go unnoticed for extended periods, even with a large user base. In the case of XZ, the malware was caught by accident, revealing a stark reality: while open-source software offers the potential for detection, it doesn’t guarantee comprehensive oversight.

It’s easy to forget that the very same trust issues apply to both open-source and closed-source software. Both models are prone to hidden vulnerabilities and backdoors, but in the case of open-source, there’s often an assumption that it’s inherently safer simply because it’s transparent. This assumption can lead users into a false sense of security, which can be just as dangerous as the opacity of closed-source systems.

The Challenge of Constant Auditing

Let’s be clear: open-source code isn’t guaranteed to be safe just because it’s open. Just as proprietary software can hide malicious code, so too can open-source. Consider how quickly vulnerabilities can slip through the cracks without active, ongoing auditing. When you’re dealing with software that’s updated frequently, like Signal or any other open-source project, it’s not enough to have a single audit—it needs to be audited constantly by developers with deep technical knowledge with every update

Here’s the catch: most users, particularly those lacking a deep understanding of coding, can’t assess the integrity of the software they’re using. Imagine someone without medical expertise trying to verify their doctor’s competence. It’s a similar situation in the tech world: unless you have the skills to inspect the code yourself, you’re relying on others to do so. In this case, the “others” are the project’s contributors, who might be few in number or lack the necessary resources for a comprehensive security audit.

Moreover, open-source projects don’t always have the manpower to conduct ongoing audits, and this becomes especially problematic with the shift toward software-as-a-service (SaaS). As more and more software shifts its critical functionality to the cloud, users lose direct control over the environment where the software runs. Even if the code is open-source, there’s no way to verify that the code running on the server matches the open code posted publicly.

The Reproducibility Issue

One of the most critical issues with open-source software lies in ensuring that the code you see matches the code you run. While reproducible builds are a step in the right direction, they only help ensure that the built binaries match the source code. But that doesn’t guarantee the source code itself hasn’t been altered. In fact, one of the lessons from the XZ Utils supply-chain attack is that the attack wasn’t in the code itself but in the build process. The attacker inserted a change into a build script, which was then used to generate the malicious binaries, all without altering the actual source code.

This highlights a crucial issue: even with open-source software, the integrity of the built artifacts—what you actually run on your machine—can’t always be guaranteed, and without constant scrutiny, this risk remains. It’s easy to assume that open-source software is free from these risks, but unless you’re carefully monitoring every update, you might be opening the door to hidden vulnerabilities.

A False Sense of Security

The allure of open-source software lies in its transparency, but transparency alone doesn’t ensure security. Much like closed-source software, open-source software can be compromised by malicious contributors, dependencies, or flaws that aren’t immediately visible. As the XZ incident demonstrated, even well-established open-source projects can be vulnerable if they lack active, engaged contributors who are constantly checking the code. Just because something is open-source doesn’t make it inherently secure.

Moreover, relying solely on the open-source nature of a project without understanding its review and maintenance processes is a risky approach. While many open-source projects have a strong track record of security, others are more vulnerable due to lack of scrutiny, poor contributor vetting, or simply not enough people actively reviewing the code. Trusting open-source code, therefore, requires more than just faith in its transparency—it demands a keen awareness of the process, contributors, and the ongoing review that goes into each update.

Conclusion: Take Open Source with a Grain of Salt

At the end of the day, the key takeaway is that just because software is open-source doesn’t mean it’s inherently safe. Whether it’s the potential for hidden backdoors, the inability to constantly audit every update, or the complexities of ensuring code integrity in production environments, there are many factors that can undermine the security of open-source projects. The fact is, no system—open or closed—is perfect, and both models come with their own set of risks.

So, take open source with a grain of salt. Recognize its potential, but don’t assume it’s free from flaws or vulnerabilities. Trusting open-source software requires a level of vigilance, scrutiny, and often, deep technical expertise. If you lack the resources or knowledge to properly vet code, it’s crucial to rely on established, well-maintained projects with a strong community of contributors. But remember, no matter how transparent the code may seem, the responsibility for verification often rests on individual users—and that’s a responsibility that’s not always feasible to bear.

In the world of software, the real question is not whether the code is open, but whether it’s actively maintained, thoroughly audited, and transparently reviewed

AFTER

EVERY

SINGLE

UPDATE.

Until we can guarantee that, open-source software should be used with caution, not blind trust.

Thank you, I have just tried that. Fluent Reader doesn’t cache

so far the only one which has been suggested is Chaski is the one I like ,

but you need to be online to retrieve the full articles one by one first, then it lets you read the full article offline

Nothing like a podcast player which always downloads the full article, to be read offline

Thank you , so far the only one which has been suggested is Chaski is the one I like ,

but you need to be online to retrieve the full articles one by one first, then it lets you read the full article offline

Nothing like a podcast player which always downloads the full article, to be read offline

I agree, so far the only one which has been suggested is Chaski is the one I like , but you need to be online to retrieve the full articles one by one first, then it let you read the full article offline Nothing like a podcast player which always downloads the full article, to be read offline

tried all those already, none seems to be working for the portable Have you actually set up the portable librewolf yourself as a default browser?

Recent News: If VPNs are targeted, cloud accounts could be compromised too Massive brute force attack uses 2.8 million IPs to target VPN devices https://www.bleepingcomputer.com/news/security/massive-brute-force-attack-uses-28-million-ips-to-target-vpn-devices/

Recent News: If VPNs are targeted, cloud accounts could be compromised too Massive brute force attack uses 2.8 million IPs to target VPN devices https://www.bleepingcomputer.com/news/security/massive-brute-force-attack-uses-28-million-ips-to-target-vpn-devices/

Thank you for the link, do you think I ask the same question there as well or just read the posts there to gain more knowledge on the risks please

Thank you for that, I’m afraid I have mentioned the “encrypted” word in my post :

(ie. if I choose to store them online/cloud encrypted, I face significant privacy concerns. While they might be secure now, there’s always the potential for a very near future breaches or compromises, especially with the evolving risks associated with AI training and data misuse),

but haven’t detailed/highlighted/clear enough

Yes “encrypt them first then upload them” is the situation I meant

p.s edited the post now

I have tried to post my thank you message but “hanging” after clicking the reply button has continued for 3 days or so.

I sincerely thank you for your incredibly thoughtful and detailed response. Not only did you take the time to explain everything so clearly, but the way you included your personal experience really made a difference.

It’s rare to come across someone who is willing to share such in-depth insight, and I truly appreciate how much effort you put into helping me understand things from a practical standpoint. Your advice has been extremely helpful,

Thank you again for being so generous with your time and knowledge!

I agree that I have to to rely on the encryption for what I have for the films online/cloud, and that seems acceptable.

However, when it comes to personal family photos and videos, I’m facing a dilemma.

• If they’re stored online, they’re vulnerable to potential compromises (PRIVACY CONCERN) -maybe not now, but in the future, especially with the risks posed by AI training.

• On the other hand, if they’re kept offline, I’m still at risk of losing them due to physical factors, especially since I live in an earthquake-prone area

I appreciate your suggestion very much. I wonder what the difference between gocryptfs and others like Trucrypt would be.
Need to search and compare the pros and cons of both, the advantages and disadvantages of each, particularly in terms of security, ease of use, and performance