Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

> Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions.

I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues.

> The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.

You ran an article titled "I don't trust Signal" with a subhed that read "Signal took NSA money". That was false, as you acknowledged. You can correct it properly or not. People can draw conclusions from your actions either way.

Sorry, where are you getting the idea that I wouldn't correct the article?

What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.

I don't pretend to understand what you're arguing about right now. Personally, I think you should correct the article, but you could opt not to. It's your call either way.

OK, let me be as clear as I can be because I thought I stated this: I will, always, absolutely correct the article, and I will keep my original statements as strike-throughs.

Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven;

I would correct the article even if it completely invalidated my point.

I would correct the article if you hadn't been emotional too.

It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread.

I think (I hope) you agree with that.

Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact).

The reason you can't understand what I'm arguing about is because I'm... not arguing.

Sounds like there's not much more to talk about!

The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.

> so I am dumb

To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.

To be fair, had anyone other than tptacek used that tone on today's HN they'd be downvoted as intolerably rude.

I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.

> The NSA thing is the only thing I didn't check out

You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.

>a number of people in NSA are not using signal

Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine

I think you are being too deferential here.

Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration.

Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect.

IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect.

I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.

That's not what they said. They didn't write "Signal, like every other privacy app at the time, took US-backed Broadcast Board of Governors money". They wrote "Signal took NSA money", which is inflammatory and, of course, obviously false. You can't rescue that claim with jazz hands.

I don't think you're doing this person any favors by keeping this debate alive.

I cant see any evidence that Broadcast Board of Governers has funded anything like: Telegram, Briar, any of the third party clients for XMPP or IRC or any of the major privacy mail services like tutanota.

So I think it’s at least a mild mischaracterisation that they funded everything.

in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0]

“How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was.

No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either.

[0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...

You are very poorly informed. You were a Google search away from a sprawling list of projects OTF funds, but instead found a 2017 PDF of "current projects" that listed a tiny percentage of them, and concluded you'd found dispositive evidence for your argument.

It's fine not to be super well informed about this stuff. Why would you be? Most subjects that come up on HN, I'm very poorly informed about, too. But it's not fine to be so noisily poorly informed that you spread misinformation, which is literally what you've done here. I've done that, too! But I believe I apologized when that happened, rather than doubling down. I hope I did! Dealing with this thread has made me super self conscious about that, which is I guess a good thing. Your blog post was so bad I experienced personal growth.

You could have asked people before you posted this story; you could have done any kind of research at all, and improved it. But you didn't: instead, you ran a piece that claimed the NSA funded Signal, and that Signal relies on server security, and that advocates of Signal are part of disingenuous conspiracy.

(You and I are the ~only people reading this flagged, buried thread now, so we can leave it here if you like).

I think you’re reading much more into that single specific comment; though I am happy to be informed I don't seem yo be getting a lot in the way of information only indications that I am uninformed or stupid or that I don’t understand; all fine comments but I need citations because obviously I am incapable of finding them.

I mentioned a few times that it doesn't materially matter: i could completely remove the entire point about any external funding and let the point stand on: US foundation, authoritative control & aggressive promotion.

I’ll say it clearly again; all these things are small, all can be argued or diminished, people primarily diminish the points by leaning the idea of trust or they take a point of bad optics in isolation, but when they are all together an untrustworthy picture is visible. So “trust” is not enough to lean on.

To answer the point you just made though: I did google search the other things that they funded, and this is what came up and it comes from the time frame you claim they invested everything.

I might sound defensive, but thats because I am in a position of defending the optics, nothing in this entire thread has given a convincing response over why Signal is over-promoted and authoritarian- just a lot of very angry people attempting to argue semantics.

I don't think casting aspersions on people and calling their reputations into question is a small thing at all. The argument on this thread isn't about semantics: it's about demonstrably false inflammatory things you said in your post.