4 ms·

Sadly, the LAST thing I ever wanted the signal foundation to do. And this adds to the PIN & cloud "features", insistence of a phone number, refusal to work with

Sadly, the LAST thing I ever wanted the signal foundation to do. And this adds to the PIN & cloud "features", insistence of a phone number, refusal to work with 3rd-party apps... I'd rather them have done _nothing_ at all. Oh well.. further proof you really need federation.

pixiemaster 5y ago
> Oh well.. further proof you really need federation. more like: open protocols for certain interactions, irrespective of the app that implements it.
- gen220 5y ago
  Open protocols is the way. Then if a client starts acting sketchy or bloaty, you can ditch it for a better one. Plus, an open protocol changes the risk calculus for the group that manages the client implementation, in a way that would prevent situations like this one. However, open protocols beget federation, so I don't think you're at odds with the above poster. Email, DNS, etc are all open protocols with federation built-in, but we trade away some centralization of servers (GMail, Cloudflare, etc) in exchange for nice things (DoS protection, spam filtering, etc). In the worst case, where a server starts acting scammy (like embedding ads in your email) or tries to diverge from the protocol, you can always go back to hosting it yourself, or paying a small and trusted shop to host it for you. In the arena where Signal is competing, Matrix [1] is probably our best bet. (Assuming irc is too barebones for your needs, in 2021). It has also supported end-to-end encryption for some time now [2]. [1]: https://matrix.org/docs/spec/ https://matrix.org/docs/spec/ [2]: https://matrix.org/faq/#which-matrix-clients-support-e2e https://matrix.org/faq/#which-matrix-clients-support-e2e
toomuchtodo 5y ago
No, you do not need federation. You need an organization and leadership in it that is focused on their mission. For example, Let's Encrypt reliably, like clockwork, distributes certificates and maintains related PKI infrastructure. That is what Signal was supposed to be (at least, my interpretation based on their PR) with regards to secure messaging, and they have utterly failed to maintain the focus you'd expect of a non profit with their mission. If I want payments (unregulated payments at that), I would use and donate to a payment app, not a messaging app. But heh, report it to regulators and let them be the bullwhip to Signal and their poor choices if they ignore the community (who are their stakeholders as a non profit entity). Of all the ways to kill your project, this doesn't seem like the "hill to die on." Don't drag secure messaging into your fight against nation state currency regulations, and have some common sense about compartmentalizing around regulatory risk.
- FlyingSnake 5y ago
  > You need an organization and leadership in it that is focused on their mission. This is exactly what Signal had, until the leadership changed their focus onto more lucrative prizes.
  - bombcar 5y ago
    Which is why you need to see "where's the money coming from" because a non-profit that can't survive will go looking for it. Let's Encrypt is small enough that it can entirely exist under the donations of some of the large internet companies - Signal doesn't have that and so the temptation to look for money will be there.
    - FlyingSnake 5y ago
      > "where's the money coming from" I'm not sure if I understood it correctly, but isn't a major selling point of cryptocurrencies is the anonymity/untraceability?
      - luckylion 5y ago
        I believe that comment meant the money to fund the development of Signal.
      - bombcar 5y ago
        No, I'm talking about the company/organization itself. A non-profit like Signal can be all high and mighty and principled as long as the bills are being paid (by whom?) but once that dries up (or never materializes) the temptation to monetize by doing things that go against the original mission becomes greater. Let's Encrypt doesn't have a reason to try to blockchain their certs because their bills are being paid. Signal clearly wants more money (they openly state that the coin will pay $1m/yr to Signal).
    - jeltz 5y ago
      As far as I know Signal has no issues with funds. I feel this is more about Moxie and potentially other employees who want to make money for themselves, not for the foundation.
mayneack 5y ago
> And this adds to the PIN & cloud "features", insistence of a phone number the PIN & cloud features are explicitly designed to facilitate breaking the phone number requirement.
- freeone3000 5y ago
  You don't really need either. Tying the keys to the device was sufficient.

pixiemaster 5y ago

> Oh well.. further proof you really need federation. more like: open protocols for certain interactions, irrespective of the app that implements it.

gen220 5y ago
Open protocols is the way. Then if a client starts acting sketchy or bloaty, you can ditch it for a better one. Plus, an open protocol changes the risk calculus for the group that manages the client implementation, in a way that would prevent situations like this one. However, open protocols beget federation, so I don't think you're at odds with the above poster. Email, DNS, etc are all open protocols with federation built-in, but we trade away some centralization of servers (GMail, Cloudflare, etc) in exchange for nice things (DoS protection, spam filtering, etc). In the worst case, where a server starts acting scammy (like embedding ads in your email) or tries to diverge from the protocol, you can always go back to hosting it yourself, or paying a small and trusted shop to host it for you. In the arena where Signal is competing, Matrix [1] is probably our best bet. (Assuming irc is too barebones for your needs, in 2021). It has also supported end-to-end encryption for some time now [2]. [1]: https://matrix.org/docs/spec/ https://matrix.org/docs/spec/ [2]: https://matrix.org/faq/#which-matrix-clients-support-e2e https://matrix.org/faq/#which-matrix-clients-support-e2e

toomuchtodo 5y ago

No, you do not need federation. You need an organization and leadership in it that is focused on their mission. For example, Let's Encrypt reliably, like clockwork, distributes certificates and maintains related PKI infrastructure. That is what Signal was supposed to be (at least, my interpretation based on their PR) with regards to secure messaging, and they have utterly failed to maintain the focus you'd expect of a non profit with their mission. If I want payments (unregulated payments at that), I would use and donate to a payment app, not a messaging app. But heh, report it to regulators and let them be the bullwhip to Signal and their poor choices if they ignore the community (who are their stakeholders as a non profit entity). Of all the ways to kill your project, this doesn't seem like the "hill to die on." Don't drag secure messaging into your fight against nation state currency regulations, and have some common sense about compartmentalizing around regulatory risk.

FlyingSnake 5y ago
> You need an organization and leadership in it that is focused on their mission. This is exactly what Signal had, until the leadership changed their focus onto more lucrative prizes.
- bombcar 5y ago
  Which is why you need to see "where's the money coming from" because a non-profit that can't survive will go looking for it. Let's Encrypt is small enough that it can entirely exist under the donations of some of the large internet companies - Signal doesn't have that and so the temptation to look for money will be there.
  - FlyingSnake 5y ago
    > "where's the money coming from" I'm not sure if I understood it correctly, but isn't a major selling point of cryptocurrencies is the anonymity/untraceability?
    - luckylion 5y ago
      I believe that comment meant the money to fund the development of Signal.
    - bombcar 5y ago
      No, I'm talking about the company/organization itself. A non-profit like Signal can be all high and mighty and principled as long as the bills are being paid (by whom?) but once that dries up (or never materializes) the temptation to monetize by doing things that go against the original mission becomes greater. Let's Encrypt doesn't have a reason to try to blockchain their certs because their bills are being paid. Signal clearly wants more money (they openly state that the coin will pay $1m/yr to Signal).
  - jeltz 5y ago
    As far as I know Signal has no issues with funds. I feel this is more about Moxie and potentially other employees who want to make money for themselves, not for the foundation.

mayneack 5y ago

> And this adds to the PIN & cloud "features", insistence of a phone number the PIN & cloud features are explicitly designed to facilitate breaking the phone number requirement.

freeone3000 5y ago
You don't really need either. Tying the keys to the device was sufficient.