I think it's completely unrelated to Signal, to be frank. > Naomi Wu has expressed recently that she feels totally ignored in this issue. Yeah; I'd ignore it

I think it's completely unrelated to Signal, to be frank. > Naomi Wu has expressed recently that she feels totally ignored in this issue. Yeah; I'd ignore it too if it was reported in a bug bounty programme. It'd obviously be out of scope. It reminds me of the "but users might be running malicious WebExtensions!" argument (one of many!) I keep seeing in the Signal community for not implementing a proper web client (along with "but the PKI might be compromised and the JavaScript might be backdoored!"). They might be running a compromised OS too! Hell, their phone might have an entire ARM-based listening device inside the case. Security is always relative, and if someone reading "Use Signal, it's secure" doesn't understand that then they have bigger problems.