Unpopular opinion: open-source isn't the privacy proof people think it is; network behavior is.
Genuine question for this crowd, because I keep going back and forth on it.
Everyone treats "open source" as the privacy gold standard. But almost nobody actually
reads the source, they trust that someone could. Meanwhile a closed tool that provably
makes zero network calls is, in practice, leaking nothing. So which actually protects you:
source you can theoretically audit, or behavior you can verify right now with Wireshark?
I ask because I build a fully offline AI (local Qwen models, no cloud round-trip, works in
airplane mode) and it's closed-source (which this sub would normally reject on reflex.) But
you can point a firewall at it and watch it make no outbound calls to do its job. So I
genuinely don't know if "but it's closed" is the dealbreaker people say it is, or a proxy
for "I can't verify it"; which is solvable a different way.
Disclosure: yeah, I sell these (solo dev). But I'd actually rather argue the principle. Tell
me where I'm wrong.