Hacker News Reader

First it's all open source so even without knowing that my paid service uses the same open source libraries, you can verify yourself that nothing leaves the client unencrypted.

Of course we will also do public audit(s) with security companies to make sure our cryptographic protocols are sound and implemented correctly.

View on HN

Thanks for the info. Of course, "its all open source" is a fair answer, but its also a dangerous one, since it shifts culpability for verification to anyone who has the time/resources to audit the open source components that you're using.

But, it also has to be stated, there is no guarantee that you're using only the open source components you've declared, which is why an impartial audit by a third party would be necessary before this project can be used to build products in some industries.

Anyway, I see that you have other concerns, so no worries and thanks for the honest answer.

Just making sure that you saw the point where we will do an impartial third party audit!

I did, and I hope you will promote that fact a bit more overtly, because its kind of important for some .. especially in Europe ..

Reply on news.ycombinator.com