What open source actually buys you in a notes app.

Every notes app now says it can't read your writing. Open source is the difference between believing that and being able to go and check, and it's worth knowing exactly how far the checking goes.

"Open source" turns up on privacy pages next to "encrypted" and "secure", and it's doing a completely different job from either of them.

It doesn't mean free. Plenty of open source software is paid, this one included. It doesn't mean audited, which is a separate and much more expensive thing. It certainly doesn't mean safe, you can publish bad code as readily as good code and people do, daily.

What it means is narrow and, I think, more useful than any of that. It means the claim is checkable.

The claim is the problem

Every notes app says some version of the same sentence now. Your notes are private. We can't read them. Encrypted end to end.

I've written before about who holds the key and how the recovery flow gives the answer away, and that test still works, it takes 2 minutes and you don't need to know any cryptography. But it's an inference. You're watching the outside of the machine and reasoning about the inside, and it's reliable right up until an app does something you didn't think to test for.

The code is the inside of the machine. When it's public, the sentence on the marketing page stops being a promise and becomes a thing with an answer.

The kitchen with a window in it

There's a restaurant near where I live with a serving hatch cut through to the kitchen, and you can stand there and watch your food being made.

I have never once watched. Not properly, not for more than the few seconds it takes to see somebody move a pan. And it doesn't matter in the slightest, because the window isn't really there for me. It's there because a kitchen that anyone might look into at any moment is run differently from one behind a closed door. Nobody has to actually look. The possibility does the work.

That's most of what open source buys a notes app. Not you, personally, reading 40,000 lines of Swift on a Sunday. The knowledge that somebody could, and that the developer wrote every line expecting it.

What you can actually check, if you want to

The useful thing is that you don't need to read all of it, you need to read the part where the claim lives.

For a notes app claiming it can't read your writing, that's a small and specific set of questions. Where is the key made, on the phone or on a server. Does anything that could rebuild the key ever get sent anywhere. What exactly goes into the encrypted item and what's left in the clear beside it. Is there a second key, for support, for recovery, for the developer's convenience on a bad day.

Those live in a handful of files. Someone who knows the language can answer all 4 in an afternoon, and once one person has answered them in public, the rest of us get the answer for the cost of reading a forum post.

Where the window stops

Now the part the marketing pages skip, and I'd rather say it than have you find out later.

The code you can read is not provably the app you installed. What arrives on your phone from the App Store is a compiled binary, and unless a project has gone to the considerable trouble of reproducible builds, nobody can demonstrate that this binary came from that source. It almost certainly did. Almost is doing real work in that sentence.

Published code is also not reviewed code. A repository nobody has ever opened offers the same guarantee as a closed one, which is none, and there's a long tail of open projects carrying quiet bugs for years precisely because everyone assumed somebody else was looking.

And a licence is not a promise about the future. Code published today can stop being published tomorrow, and the version you can read is only the version you can read.

So the window doesn't prove the kitchen is clean. It makes a dirty kitchen a much harder thing to run for very long.

Why Catchlight is open

Catchlight's iOS code is public under Apache 2.0, and the reason is not principle, or not only principle.

It's that I'm asking you to believe something quite large. I'm telling you there's no account, that 12 words generated on your phone derive the key, that nothing capable of rebuilding that key ever reaches me, and that if you lose those words your writing is gone because I have no way to recover it. That's a strong set of claims from one person you've never met, and "trust me" is not an answer I'd accept from somebody else's app either.

So the encryption code is there to be read. The privacy phrase handling is there to be read. If I'd built a quiet way to recover your notes, it would be in there, and somebody would find it.

The app itself is coming soon, on iPhone, and the waitlist gets 30 days free rather than 14 when it lands. The code is public now, which is the right way round, because a claim you can only check after you've paid isn't much of a claim.

Have a look through the hatch if you like. Mostly, just pick apps that left one.