2,002 karma · joined January 24, 2014
Specifically, they didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 [0] while they secretly added a cryptocurrency payment system to which Moxie was a paid technical advisor [1], which Moxie denied they were doing in January 2021 [2].
0: https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article)
1: https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin)
2: https://www.theverge.com/22249391/signal-app-abuse-messaging...
> Lest anyone doubt that Twitter was idiotic enough to release code that would cause a race condition and result in its own users executing a DDOS attack on it, here's the network console readout from Firefox showing all the network requests blasting away.
0: https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article)
1: https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin)
2: https://www.theverge.com/22249391/signal-app-abuse-messaging...
The specific threat being protected against (leaving aside the increased safety of iPhone users by making the stolen parts market untenable) is your phone, that you recognize and use as your phone and which contains your confidential material and credentials, having internal components swapped out while unattended.
Is remaining in a role in which it's not possible to be effective negligent?
> [Mudge and Sethi] deprioritized Twitter's kernel & OS upgrade and encryption at rest initiatives.
(from Ian Brown, who deserves his good reputation as much as anyone I've met)