openlyoperated.org

[benfitita 35]

I’m wondering what do you folks think about https://openlyoperated.org/? Is it something that could introduce more confidence and trust in today’s internet? Is it viable for businesses to use?

Sample audits: https://openlyoperated.org/reports

[OpenSourcerer 1359]

6 hours ago, benfitita said:

Is it viable for businesses to use?

Taking that website's sentence "businesses operate on incentives", the core problem is not solved. If there was no incentive for companies to respect users' privacy and confidentiality before, there will be an equally big incentive to get something of their own making audited. I don't see Apple, Facebook, Google submit their apps to it - they're big enough to employ their own hackers.

There's also that picture of a modified "app wants to access this" prompt on iOS which they define as a "long-term goal". It's interesting for a veeeery tiny subset of users, the rest usually goes "meh they all have our data, anyway, what's the point". Ergo, it won't find its way to any store or OS.

We don't pay for this, apparently, so I bet they will make the companies "pay a fair amount". This decreases that same incentive to go through the process even more.
Last but not least, it seems to be quite a new project, unknown to the majority of users. To trust their reports, one needs to trust the auditor first.

[nexsteppe 23]

8 hours ago, giganerd said:

We don't pay for this, apparently, so I bet they will make the companies "pay a fair amount". This decreases that same incentive to go through the process even more.
Last but not least, it seems to be quite a new project, unknown to the majority of users. To trust their reports, one needs to trust the auditor first. 

OO smells of a thinly masqueraded attempt to make a business of Certification.  While probably well-intentioned, it's hard to see how this gets around the plethora of problems we see in privately owned certifying bodies for other industries.  In any case, so long as they've no leverage over those they "audit" their word as guarantor has little meaning.

They're apparently also in the VPN business (see: Confirmed VPN).

[benfitita 35]

That’s what I was wondering as well: is that certified VPN affiliated with OO. Still they claim to have a read only AWS account for server inspection. I wonder if you can actually SSH there to see actual configuration files.