The ball is on Signal's control, but they are clearly not caring to improve further, just stagnate so long as they have got control of it
In the unlikely event that a set of vulnerabilities as devastating as those from the Nebuchadnezzar paper were found in Signal, Signal controls the whole platform end-to-end, and can simply publish software updates to fix them. Matrix has to do a coordinated multivendor update of their entire protocol.
- If you use our client you can use our servers - If you don't use our client, you can't use our servers, but you can use any other server
It's like, technically it's sometimes[1] OSS, but they don't care about actually being FOSS in practice. If I can't fork the software, add or remove a feature and keep using the software's other features, it hasn't hit the bare minimum to be called FOSS, IMO.
1 - Most old versions of Signal are OSS, but frequently updates are only shared after a long delay - in some cases over a year out of date, if my memory serves me.
(I like Matrix and will always sound like I'm dunking on them because of the implications of Nebuchadnezzar, and, before that, of opt-in E2EE; they're doing mostly the best they can with a tough hand to play.)
xx Messenger doesn't require user's phone number (it's optional, if the user wants to make it easier to be found by phone number).
Messaging clients on some other networks also don't require phone numbers, but that makes it harder to find people. xx Messenger allows the creation and use of network nicknames that can be ported to other apps.
Source code:
https://github.com/xxfoundation/elixxir-xx-Messenger-Android
https://github.com/xxfoundation/elixxir-xx-messenger-iOS
(Mobile app hasn't been updated for a while; the reason is development of a unified Web-based desktop and mobile client is going on here - https://github.com/xxfoundation/elixxir-speakeasy-web/tree/d... - and it may eventually replace xx Messenger).
xx Network allows 3rd party clients. There's an SDK - https://xx.network/developers-mixnet/ - to make that easier.
Disclosure: I own xx coins.
or xxx Porn Rating?
Also, it wasn't mentioned in the articles, but another issue solved by us and many of these other messengers is use of a private keyboard instead of the vendor/isp ones that can spy on users.
Unfortunately, I learned the hard way that better privacy and security will not beat convenience and network effects when you are competing with "free", so we are changing our approach.
Regardless that particular point stands even if he's not the messiah anymore, that he was heralded as a saint who bestowed on humanity the right to privacy, and that we should trust in him.
From what I can find about the entity that funded Signal from the government it seems to be a lot to do with the CIA and anti-censorship products designed to disrupt other countries... Which, actually fits with the narrative of censorship resistant messaging, at least -- so no reason to think that it betrays the stated mission of Signal
The foundation that funded them used to be called: Radio Free Asia (which on inspection seems to be considered propaganda, though seems to market itself as free media), now called OTF, if you see the list of other software they sponsor it's very much in the same category: https://en.wikipedia.org/wiki/Open_Technology_Fund
So, I recant those statements about NSA, I only know that a number of people in NSA are not using Signal, and I had heard about NSA funding from somewhere, which obviously is not true.
The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).
I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions.
I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues.
> The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).
I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.
What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.
Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven;
I would correct the article even if it completely invalidated my point.
I would correct the article if you hadn't been emotional too.
It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread.
I think (I hope) you agree with that.
Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact).
The reason you can't understand what I'm arguing about is because I'm... not arguing.
To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.
You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.
Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine
Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration.
Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect.
IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect.
I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.
I don't think you're doing this person any favors by keeping this debate alive.
So I think it’s at least a mild mischaracterisation that they funded everything.
in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0]
“How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was.
No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either.
[0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...
It's fine not to be super well informed about this stuff. Why would you be? Most subjects that come up on HN, I'm very poorly informed about, too. But it's not fine to be so noisily poorly informed that you spread misinformation, which is literally what you've done here. I've done that, too! But I believe I apologized when that happened, rather than doubling down. I hope I did! Dealing with this thread has made me super self conscious about that, which is I guess a good thing. Your blog post was so bad I experienced personal growth.
You could have asked people before you posted this story; you could have done any kind of research at all, and improved it. But you didn't: instead, you ran a piece that claimed the NSA funded Signal, and that Signal relies on server security, and that advocates of Signal are part of disingenuous conspiracy.
(You and I are the ~only people reading this flagged, buried thread now, so we can leave it here if you like).
I mentioned a few times that it doesn't materially matter: i could completely remove the entire point about any external funding and let the point stand on: US foundation, authoritative control & aggressive promotion.
I’ll say it clearly again; all these things are small, all can be argued or diminished, people primarily diminish the points by leaning the idea of trust or they take a point of bad optics in isolation, but when they are all together an untrustworthy picture is visible. So “trust” is not enough to lean on.
To answer the point you just made though: I did google search the other things that they funded, and this is what came up and it comes from the time frame you claim they invested everything.
I might sound defensive, but thats because I am in a position of defending the optics, nothing in this entire thread has given a convincing response over why Signal is over-promoted and authoritarian- just a lot of very angry people attempting to argue semantics.
This article says it's not rehashing DeVault's arguments, and it isn't; it's making an even dumber set of arguments.