Michael Fisher on Nostr: Opt-in isn’t enough. If the feature is in fact in a disabled-by-default state, and ...

Opt-in isn’t enough. If the feature is in fact in a disabled-by-default state, and can be left that way without destroying OS or application functionality, and in fact doesn’t capture *anything* when disabled, there’s one more question: If it can be enabled or disabled in software, then a malicious actor may be able to write their own malware or use existing/updated C&C botnets to flip the feature on without the user’s knowledge. (1/2)