why do people hate on signal?
- They claim full open source but for several years they did not release the server.
- They claim federation is impossible… yet matrix has it.
- They claim openness but are actively hostile to linux distributions and f-droid.
- Related, getting signal from an app store is no more secure than getting any random proprietary app.
- There's a lot of allegations that they don't need VCs because they have backing from the USA army.
> Signal facing collapse after CIA cuts funding
> https://english.almayadeen.net/articles/analysis/signal-faci...
However, widely disseminating an app that supports secure e2e messaging can serve a positive purpose for the CIA in running its agents.
Association with the CIA or In-Q-Tel is not necessarily a bad thing. They have unique requirements for operational security like many other Signal users?
The CIA has access to zero-days. They will just use those for targeted attacks and are generally not in the business of mass surveillance? Whereas the FBI and NSA sorta are to achieve their respective mandates
The State department has since walked back its love for international freedom of speech with the populist movement in Brazil. They’re active in suppressing speech there, just like they were in promoting it in the Middle East.
> funding for Tor came from the Navy
Similarly, CIA/Navy/whatever doesn't want their tools to have zero-days. You might think "zero-days for me, but not for thee" but come on... we all know that doesn't work. If there's an exploit, the exploit works for anyone. You may have an edge in knowing where to look, but you're not going to maintain that edge for long. Worse, good luck finding out if someone else finds out. How do you prevent adversaries from exploiting your tools? Doesn't take a genius to figure that out...
I really hate these conspiracies. Like come on. Yeah, we should be highly critical of US spy agencies and apply a lot of scrutiny. But not everything they touch results in a landmine. They aren't all powerful gods. And they're up against some serious adversaries like China, Russia, and yes, Israel, and the most important one of them all... themselves! Spooks are spooks. They don't trust their neighbors, they don't trust themselves.
And if they were omniscient, surely they'd know the very first rule of security: if there's a backdoor, somebody will find it at the least conveniently possible time.
The Washington Post:
In a statement, WikiLeaks indicated that the initial stockpile it put online was part of a broader collection of nearly 9,000 files that would be posted over time describing code developed in secret by the CIA to steal data from a range of targets. WikiLeaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States.
and:
The experience of O.S.B. engineers bore some resemblance to the Apple TV+ drama “Severance,”
I mean the critiques are mostly valid but wanted to point out they're mostly technical.
I really wish the server was fully open. I feel like that could actually create a mixed federated ecosystem. At worst be optional, right? I can get where he's coming from (and now Meredith), but I think there's a lot of value in it and they've solved hard problems before. Even just the ideas of mesh nets in local areas could be a real win for privacy and security.
Being a Linux user and signal user for quite some time I'm confused at that critique. What's hostile? That it's electron? I mean that does suck but I've used various open source desktop versions and some TUIs. No real issues so far. What am I missing?
Generally the talk I hear about government money is implications of back doors. Just seems like they are more interested in getting encrypted communications into other people in other countries hands. At least that's my understanding of the mission of the organization that's funding them. They'd want that as secure as possible. Government isn't a single entity. If the complaint is morally taking money from the government, yeah it was a weird move. Kinda seems out of character. But not too crazy. Personally I'm okay if they aren't building weapons and there's no strings attached. My understanding is it's not enough money to justify that.
Like selling you no chemical fertilisers vegetables and then using them anyway.
It's hostile because they want you to use their binary build… which you don't know if it corresponds to the source they have online. And can't verify due to the binary blob.
edit: you trust the USA army to not ask any control in exchange for that money? Remember there's no reproducible builds really, and that installing via app store which is linked to an account is very easy to send vulnerable versions to journalists or whistleblowers.
Look, I'm mostly with you. My point is that the issues we argue over are only things us nerds care about. Not the average person.
> you trust the USA army to not ask any control in exchange for that money?
From what I know, the money was not through the military. It was through Radio Free Asia, an organization suspected to have ties to the CIA. Notably, the CIA is concerned with foreign targets, not at home. So like I argued, it is entirely reasonable for "the government" to want perfectly encrypted communication systems in the hands of people they want overthrowing a current regime while also not wanting that service to be used at home.
The government isn't a single super intelligent entity working together. It is a fucking shit show of organizations (and sub-organizations) with entirely opposing goals.
They're a non-profit... their books are open. If you are really concerned, switch to Molly. Or idk, use iMessage, WhatsApp, or Telegram. Because those have far less suspicion, right? Sure, you could use Matrix, but I can't get my grandma to use Matrix, but I can Signal. I'll take what I can get.
> but I can't get my grandma to use Matrix, but I can Signal
Why not? On the phone they look just like any other messaging app.
I don't know how you can cherry pick the technical detail and and ignore what that means without making me suspect you're being dishonest.
Just in case you are honest. It means that you cannot verify the application, so it's no more secure than any proprietary application.
And signal is marketing themselves as MOST SECURE THING EVER!!!!! People should be aware that their main marketing point is false.
Yet take zero action against TeleMessage.
Citation needed. Strange allegations (and from whom?) when the pentagon itself has discouraged using Signal in an official capacity...[0]
[0]https://abcnews.go.com/Business/what-is-signal-messaging-enc...:
> The Pentagon's internal watchdog criticized a former official's use of the Signal app in 2021, calling it a breach of the department's "records retention policies" and an unauthorized means of communicating sensitive information.
> "Signal is not approved by the DoD as an authorized electronic messaging and voice-calling application," the report asserted, adding that "the use of Signal to discuss official DoD information does not comply with Freedom of Information Act requirements and DoD's records retention policies."
I believe the claim was that it's hard to adapt to changing markets and be federated [1]. Comparing Signal's market share to Matrix's is obviously not a direct cause-and-effect, but Matrix hasn't yet proven that you can get mass adoption that way.
> - They claim openness but are actively hostile to linux distributions and f-droid.
I'm too lazy to find the specific GitHub comment, but IIRC there was a specific list of features they'd need to actively support F-Droid. It is now available in the Guardian Project's F-Droid repository though [2].
[1] https://signal.org/blog/the-ecosystem-is-moving/
[2] https://guardianproject.info/apps/org.thoughtcrime.securesms...
Neither has signal. I can contact more people with GPG than with signal.
At the same time, it has reached far more regular users than Matrix has. I believe market penetration is at about 15% here in the Netherlands, which is a ways off from WhatsApp, but a pipe dream for Matrix.
Specifically, they didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 [0] while they secretly added a cryptocurrency payment system to which Moxie was a paid technical advisor [1], which Moxie denied they were doing in January 2021 [2].
0: https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article)
1: https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin)
2: https://www.theverge.com/22249391/signal-app-abuse-messaging...
They absolutely do NOT claim that, at least from a technical point of view:
https://signal.org/blog/the-ecosystem-is-moving/
> Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.
Related issues:
https://github.com/signalapp/Signal-Android/issues/13704 https://github.com/signalapp/Signal-Android/issues/12341 https://github.com/signalapp/Signal-Android/issues/10336 https://github.com/signalapp/Signal-Android/issues/9729
For example: Signal doesn't need a cryptocurrency implementation. Signal does need a commercial product offering so they're not just donation funded (there's several obvious, useful applications here - they're doing none of them).