3 ms·

Again, the server code is AGPLv3 so it would copyright infringement (of the contributors to the code) on the part of WhisperSystems if they were to patch the se

by cyphar 8y ago

Again, the server code is AGPLv3 so it would copyright infringement (of the contributors to the code) on the part of WhisperSystems if they were to patch the server code and not provide the sources to users. There isn't a technical way to stop this problem (federation wouldn't solve it either -- it would allow you to switch to a host that you trust more but that's a different problem), you just sort of have to trust that WhisperSystems isn't breaking the law. To reiterate -- I agree with you on the general point that federation and having a decentralised system is important for many reasons. But you're moving the goal-posts so that now, even if the server code is AGPLv3 (which requires giving source code access to network users) you still can't be sure that code is running in production, and thus it's still effectively proprietary. That's not a reasonable argument. As an aside, WhisperSystems has remote attestation of parts of the server code using Intel SGX, which means that it actually has some degree of verifiability[1]. [1]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/

lrvick 8y ago
These goal posts are related. Given the context of the five eyes backdoor discussions it is not unreasonable to expect that a government could pressure WhisperSystems to manipulate a client update or patch a server, GPL laws be damned. A single employee could also be bribed or blackmailed. Intel could also be compelled to falsely attest an SGX enclave. When it comes to protecting privacy against highly motivated and sophisticated adversaries then centralized trust is just not an option to be taken seriously. It creates a Lavabit sized target. A company that is as serious about privacy as their marketing indicates would, like TOR, encourage as many servers to run as possible to ensure there is no central pressure point to abuse. Cards on the table: I find Moxies insistence on a walled garden while using Open Source and Privacy to market it simply unethical. I do again appreciate the updates on the current status of their public source code though. I will strive for better accuracy in the future on this.

by cyphar 8y ago

lrvick 8y ago

These goal posts are related. Given the context of the five eyes backdoor discussions it is not unreasonable to expect that a government could pressure WhisperSystems to manipulate a client update or patch a server, GPL laws be damned. A single employee could also be bribed or blackmailed. Intel could also be compelled to falsely attest an SGX enclave. When it comes to protecting privacy against highly motivated and sophisticated adversaries then centralized trust is just not an option to be taken seriously. It creates a Lavabit sized target. A company that is as serious about privacy as their marketing indicates would, like TOR, encourage as many servers to run as possible to ensure there is no central pressure point to abuse. Cards on the table: I find Moxies insistence on a walled garden while using Open Source and Privacy to market it simply unethical. I do again appreciate the updates on the current status of their public source code though. I will strive for better accuracy in the future on this.