5 ms·

> and shown to be secure/stable For various definitions of "secure/stable". For me, anything which Google can reach and amass information from, and thus NSA,

by antocv 10y ago

> and shown to be secure/stable For various definitions of "secure/stable". For me, anything which Google can reach and amass information from, and thus NSA, is not secure. Rust on Linux where I am playing with, is fine. And its not only the "conspiracy style" "why would Google put backdoors in its 'Play Services'", no its more like "oh Google receives and sends notifications for every Signal message sent and recieved, among other information, such as Device ID, phone number, android version" - in short who is using signal and when. Signal is amassing huge amounts of information for benefit of Google. Look at their github page, where they even say they want more to amass more data and to "annoy the hell out of users" to make them update - shove updates down their throat a la Microsoft style.

tptacek 10y ago
Again: criticism of Signal is in-bounds, but outright allegations that Signal is a shill for Google is not. Moxie is a member of the HN community, and you cannot make these kinds of allegations about him here in this fashion.
- antocv 10y ago
  You can not tell me what accusations to make, based on your seniority of having been here longer than me or for any other reason. Moxie is a member of HN and of Github, and I have read his posts and his discussions on github, his contempt for the common user is obvious and abundant. Signal is dependent on Google. That is a fact. It can be hard to swallow, but many people, just read the github issue page, consider that insecure. For many people security means not feeding their data into USAs corporations and intelligence services data centers. For many users, like me, if the choice is between USA and others, Id prefer in fact to feed my data to Russian or Chinese or Indian corporations and intelligence services. Then its not a matter of "oh my encryption is better", it doesnt make a difference, in that position, Telegram is for me a better choice even if its encryption is not as good - if it at least makes it more difficult for USA (but very easy for Russia) then its better than Signal. Both Signal and Telegram suck, to various degrees in different forms, but the choice is easy to stay away from Signal and similar Google-only "secure" apps.
  - tptacek 10y ago
    It's got nothing to do with seniority. https://hn.algolia.com/?query=author:dang%20accusations%20shillage&sort=byPopularity&prefix&page=0&dateRange=all&type=comment&storyText=false https://hn.algolia.com/?query=author:dang%20accusations%20sh...
  - nzp 10y ago
    How does it make more difficult for USA to get your data if encryption is not as good? This is pure nonsense, sorry. If you think the NSA is dependent on Google to suck up your data, oh boy... Sir, would you be interested in purchasing a fine bridge? I upvoted this comment of yours because it seemed kind of unfair to me for it to be downvoted, and I don't like people being told what they can or can't do, but the gist of what you're trying to argue is complete nonsense. GCM dependence is a complete non-issue in context, and to say that because Telegram doesn't have that dependency it is safer from US intelligence is so over the top ridiculous. Signal-the-app has it's problems, and a fair share of questionable decisions, but GCM and Play Store are not among those. That Moxie acts with contempt toward people on GitHub issues is true. It is also true that most of those people (in exchanges I have read) are complete ignorants who wouldn't know security if it hit them on the head, yet insist and yell with noble indignation that they're correct. The kind of people who were thought that more FOSS = more security is an axiom and go from there. Since he gets tons of that, I kinda understand why he might act like that. I understand, but do not condone, it's extremely off putting. In the end, one of Signal-the-app's biggest problems is that it's mostly criticized by unreasonable people.
    - antocv 10y ago
      Thank you. There is 3 issues which Im trying to clear up here. With GCM and Signal: 1, Google and in turn USA based data-centers receive events/more-data to analyze. That this data is not the encrypted message, not the decrypted message doesnt matter. This data can be analyzed and used effectively. Its not impossible to think of "push-message for android phone available at X time - which looking through our other database shows it has Signal but doesnt have WhatsApp, hm, our other databse shows that android device has Signal app usage of X%". Oh boy. 2. Google has root on your phone, so even if the transport security is very good, it doesnt matter as the phone is effectively owned by Google and thus messages/keys can be stolen at will. 3. The choice should be with the users and not Moxie. Moxie has shown contempt and disregard for users wishes, see quote "annoy the fucking hell out of our users".
newjersey 10y ago
> Look at their github page, where they even say they want more to amass more data and to "annoy the hell out of users" to make them update - shove updates down their throat a la Microsoft style. I imagine this is by design. What do I do if there is a vulnerability that a patch fixed but the person I'm taking to refuses to update? I am not saying I like the idea of bricking an app if there's no update for three months but if you agree that the fight is against dragnet not targeted surveillance then this is a reasonable compromise.
- antocv 10y ago
  Nope it isnt, its up to me as user to decide when to update, what Signal/other-app can do in such case is provide a simple in-app messaging system "Hey there was a vulernaribility, read more about it here in this message". Then user can decide. And not "hey user, take this update which contains backdoors since the main developers got gagged/blackmailed, trust us this time for real".
  - tptacek 10y ago
    Again, the idea that Signal's developers were "gagged" or "blackmailed" is a lie, and you should be embarrassed to repeat it.
    - gkejxncnd 10y ago
      Why is it necessarily a lie when there's a large amount of precedent saying that it's not? If it happened to Lavabit, why can't it happen to OWS? Your tone is completely inappropriate and I suspect that you have a stake in this game.
      - tptacek 10y ago
        https://hn.algolia.com/?query=author:dang%20accusations%20shillage&sort=byPopularity&prefix&page=0&dateRange=all&type=comment&storyText=false https://hn.algolia.com/?query=author:dang%20accusations%20sh...

by antocv 10y ago

tptacek 10y ago

Again: criticism of Signal is in-bounds, but outright allegations that Signal is a shill for Google is not. Moxie is a member of the HN community, and you cannot make these kinds of allegations about him here in this fashion.

antocv 10y ago
You can not tell me what accusations to make, based on your seniority of having been here longer than me or for any other reason. Moxie is a member of HN and of Github, and I have read his posts and his discussions on github, his contempt for the common user is obvious and abundant. Signal is dependent on Google. That is a fact. It can be hard to swallow, but many people, just read the github issue page, consider that insecure. For many people security means not feeding their data into USAs corporations and intelligence services data centers. For many users, like me, if the choice is between USA and others, Id prefer in fact to feed my data to Russian or Chinese or Indian corporations and intelligence services. Then its not a matter of "oh my encryption is better", it doesnt make a difference, in that position, Telegram is for me a better choice even if its encryption is not as good - if it at least makes it more difficult for USA (but very easy for Russia) then its better than Signal. Both Signal and Telegram suck, to various degrees in different forms, but the choice is easy to stay away from Signal and similar Google-only "secure" apps.
- tptacek 10y ago
  It's got nothing to do with seniority. https://hn.algolia.com/?query=author:dang%20accusations%20shillage&sort=byPopularity&prefix&page=0&dateRange=all&type=comment&storyText=false https://hn.algolia.com/?query=author:dang%20accusations%20sh...
- nzp 10y ago
  How does it make more difficult for USA to get your data if encryption is not as good? This is pure nonsense, sorry. If you think the NSA is dependent on Google to suck up your data, oh boy... Sir, would you be interested in purchasing a fine bridge? I upvoted this comment of yours because it seemed kind of unfair to me for it to be downvoted, and I don't like people being told what they can or can't do, but the gist of what you're trying to argue is complete nonsense. GCM dependence is a complete non-issue in context, and to say that because Telegram doesn't have that dependency it is safer from US intelligence is so over the top ridiculous. Signal-the-app has it's problems, and a fair share of questionable decisions, but GCM and Play Store are not among those. That Moxie acts with contempt toward people on GitHub issues is true. It is also true that most of those people (in exchanges I have read) are complete ignorants who wouldn't know security if it hit them on the head, yet insist and yell with noble indignation that they're correct. The kind of people who were thought that more FOSS = more security is an axiom and go from there. Since he gets tons of that, I kinda understand why he might act like that. I understand, but do not condone, it's extremely off putting. In the end, one of Signal-the-app's biggest problems is that it's mostly criticized by unreasonable people.
  - antocv 10y ago
    Thank you. There is 3 issues which Im trying to clear up here. With GCM and Signal: 1, Google and in turn USA based data-centers receive events/more-data to analyze. That this data is not the encrypted message, not the decrypted message doesnt matter. This data can be analyzed and used effectively. Its not impossible to think of "push-message for android phone available at X time - which looking through our other database shows it has Signal but doesnt have WhatsApp, hm, our other databse shows that android device has Signal app usage of X%". Oh boy. 2. Google has root on your phone, so even if the transport security is very good, it doesnt matter as the phone is effectively owned by Google and thus messages/keys can be stolen at will. 3. The choice should be with the users and not Moxie. Moxie has shown contempt and disregard for users wishes, see quote "annoy the fucking hell out of our users".

newjersey 10y ago

> Look at their github page, where they even say they want more to amass more data and to "annoy the hell out of users" to make them update - shove updates down their throat a la Microsoft style. I imagine this is by design. What do I do if there is a vulnerability that a patch fixed but the person I'm taking to refuses to update? I am not saying I like the idea of bricking an app if there's no update for three months but if you agree that the fight is against dragnet not targeted surveillance then this is a reasonable compromise.

antocv 10y ago
Nope it isnt, its up to me as user to decide when to update, what Signal/other-app can do in such case is provide a simple in-app messaging system "Hey there was a vulernaribility, read more about it here in this message". Then user can decide. And not "hey user, take this update which contains backdoors since the main developers got gagged/blackmailed, trust us this time for real".
- tptacek 10y ago
  Again, the idea that Signal's developers were "gagged" or "blackmailed" is a lie, and you should be embarrassed to repeat it.
  - gkejxncnd 10y ago
    Why is it necessarily a lie when there's a large amount of precedent saying that it's not? If it happened to Lavabit, why can't it happen to OWS? Your tone is completely inappropriate and I suspect that you have a stake in this game.
    - tptacek 10y ago
      https://hn.algolia.com/?query=author:dang%20accusations%20shillage&sort=byPopularity&prefix&page=0&dateRange=all&type=comment&storyText=false https://hn.algolia.com/?query=author:dang%20accusations%20sh...