• 8 Posts
  • 711 Comments
Joined 1 year ago
cake
Cake day: June 15th, 2023

help-circle









  • So, I just looked it up and apparently their official stance is that auditing is questionably effective and thus unnecessary:

    Our software is free and open source, while we repute at the moment [it’s] not acceptable to provide external companies with root access to our servers to perform audits which can not anyway guarantee future avoidance of traffic logging or transmission to third parties. On the contrary, we deem very useful anything related to penetration tests. Such tests are frequently performed by independent researchers and bounty hunters and we also have a bounty program.

    In other words, their reasoning seems to be:

    1. Their software is free and open source, so if it does logs anything, the community would find out, so in this sense the community is the independent auditors;
    2. There’s no stopping an audited party from ceasing to log right before the audit and start up again after the audit ends, so an audit is kind of toothless anyway;
    3. Regarding penetration tests, they already have independent testing done as well as a bounty program.

    Personally, I don’t agree with points #2 and #3, but point #1 is fair I suppose. In my opinion, it should not be up to the users to hold the company accountable; and there is a difference between penetration tests and log auditing, as the former I believe are merely to check the resilience against outside hacking.

    My end impression is that judging from their other documentation and forum posts, the fact that their software is fully open-source, and their past behavior in accordance with their stated values, I think I’m inclined to believe them. However, it is somewhat worrying nevertheless that there isn’t log auditing involved regardless of their actions.











  • Honestly, I had a bunch of little confusions. I thought the input() function was only a string until the user typed in a value when prompted, and then it became either an integer value or a floating-point value depending on what you typed in.

    Thanks to Labna@lemmy.world and your other response, I understand that it is always a string regardless until you convert it after the fact.

    Also, I meant to type an asterisk instead of a plus sign when typing over my code snippet into my post. Fixed now.

    Also, to answer your last question, if I do h+r or h*r, I get “5010” for the former (which makes sense) and the standard “can’t multiply sequence by non-int of type ‘str’”, which also makes sense to me now that I understand the above point.