No surprise that security updates are the center of this conversation. Software patching is a source of vulnerabilities turned off (exploitation from fixed bugs) and turned on (update provider can be malicious).<p>When heartbleed broke that was evidence that the 'many eyes' theory of secure open source software hadn't worked. Alternatively, the bug was found because big corporations with security budgets were getting serious about holes, so maybe 'many eyes' is starting to be true. Certainly apple's 'goto fail' and RSA's key strength bribery are examples of 'not enough eyes' for closed software.
"I didn't use Microsoft machines when I was in my operational phase, because I couldn't trust them" ... I'm not really sure that open source should get a free pass in terms of trust - it's not possible for you as an individual to single handedly verify that the open source software is trustable either; you need to assume that the group maintaining it has your best interests at heart.
Snowden generally seems not to open his mouth unless he has something worthwhile to say, so I imagine he might have addressed this in the actual talk of which this article is such a brief summary, but: what choice do we have? No, it's not great, but we typically use government power to check corporations, so I don't see anything inherently wrong with using corporations to check an unaccountable, runaway government.
I was thinking about encryption the other day. It struck me that whenever the topic came on HN we tended to see encryption as 100% or nothing.<p>I however think we should instead focus on creating good enough encrypted communication for email, chat... for two reasons.<p>1. It'll make things a little bit more expensive for the "watchers."<p>2. It will create noise. I.e. right now, if one person is using encrypted communication, he automatically becomes a target. With everyone using some level of encryption...<p>3. It'll serve as an intro to security. The same app that provides base level encryption can give TIPS on how to become even more secure. Think Windows "Tip of the day."<p>There's no perfect security. An insecure world-wide, easy-to-setup encrypted communication is better than nothing. Because, it'll at least make people more security/privacy conscious.