Comment by badsectoracula | Hacker News Reader

Comment by badsectoracula | Hacker News Reader

> I take occupational offense to misuse of the term private because we’ve spent the last half decade building Standard Notes to be private without any ambiguity to what that term means.

> [..]

> Using the word “private” as “anything that isn’t on a cloud” is misleading, in my opinion. We know this is not the definition of private we want.

I don't know, for me that is a very acceptable definition since anything on the cloud is not private. If anything...

> When we think private, and when software products typically use the word private, they mean it to say privacy is a primary focus of the application, as enacted and permeated through mission, culture, code and operation.

...that definition could be applied to stuff on the cloud too since a cloud app can claim to care about privacy being "its primary focus" and its "culture, code and operation".

Of course something being local doesn't mean that it is 100% watertight proven that it is private, but the default state of a computer (at least as far as regular PCs go) is that and it is only after your actions as a user that state can be compromised.

As such the advice "don't download stuff that run `rm -f` on your hard drive" is a perfectly valid advice.

TBH this looks like some product's blog claiming why another competing product is inferior and theirs is better.

Hmm, I wonder if swapping "private" for "secure" would change the framing. Would an application touting "secure" in their tagline, but offering an insecure plugin architecture, be disjointed? I ask because the interchangeability of "private" and "secure" has always been a fascinating dilemma to me. Their definitions are precisely what I try to poke into in this post.

I don't know that the layperson sees them as interchangeable. Private, to me, merely says that the goal is for this to be for my eyes only. Secure tells me that they've gone to extra steps to ensure that that privacy is upheld.

It's like if someone has a private office versus a secure office. One is a room with a door on it, the other is a room with a security guard.

Privacy and security seem orthogonal to me.

Privacy is only one thing of many that could be assured via security. Imagine an office with glass walls, very little sound insulation, and a security guard at the door. The security guard and walls prevent physical attacks on the office occupant, thus ensuring their physical security, but it'd be difficult to say that office is private.

Is iPhone private? Apple says it is. Yet Apple also has the keys to user iCloud data. I agree that with proper metaphor the distinction becomes very clear, but in the open I’m not so sure if this distinction is well-defined, well-used, or well-understood.

I do not see much difference between 'application' and 'plugin'. Both are just some code one installs one on one's computer that somehow work together. There is risk that plugin does 'rm -rf ~/', but the same risk is for the application, both are mitigated through distribution infrastructure. So i do not see why application should have any kind of responsibility for plugins.

"Secure" is a much better word to discuss, because it's obviously a relative term that only has meaning against a threat model. So, yes, if the author kept using "secure" on his article, we would see a much better conversation, about how he is changing the goalposts instead of simply arguing that the goal is on a place where the posts are not.

I think you are responding to the author actually. But I agree, I think the author is mixing up privacy and security here.

Reply on news.ycombinator.com