6 ms·

Why on earth do people trust a closed source messenger owned by Facebook, which backs up to Google? Signal and Matrix are open source and full-featured.

r00fus 5y ago
Most likely because their contacts don't want to switch. I've migrated extended family off WhatsApp to Signal but it was a nontrivial effort since their contacts don't want to use anything but WhatsApp.
- epolanski 5y ago
  Just imagine the world we live in, how numb average joe is. I said same things to most of my closer people and in the end they tell me “well they have all our data anyway”. And all they have to do is just download an application.
  - distrill 5y ago
    TBF that's not really all they have to do. They also have to use that new application, which means (further) diving their communications stream. And it means an additional onboarding step when they set up a new device. I understand these aren't huge obstacles, but I am generally reluctant to add additional communication channels for these reasons - they aren't trivialities to everyone.
  - stef25 5y ago
    Isn't it more like changing email? You'd keep checking your old one for quite a while.
    - wruza 5y ago
      Email is much easier because of forwarding (or polling, in case an old service doesn’t have forwarding). I’m changing my main email every ten years or so and have few degenerate addresses like apple or yandex accounts which are dead but still attached to few orgs. Messengers usually don’t have forwarding or a sensible polling interface. It would be nice to have all-in-one app even with limited functionality, since I’m mostly using text and images. Or use one of real full-featured messengers with gateways to others.
jensensbutton 5y ago
Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.
- thevardanian 5y ago
  You just need one. Vanishingly small or not.
  - charcircuit 5y ago
    One person can always make a mistake. Also every update can introduce security problems. It's not a one time thing.
- eitland 5y ago
  > Because the number of people who can actually validate the security of the open source options is vanishingly small The people who can judge if Facebook are to be trusted should be in the millions by now though...
- philliphaydon 5y ago
  I have no faith as I still get facebook adverts shortly after discussing things in whats app.
- jacquesm 5y ago
  > and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk. Actually, no that's not sufficient evidence. That's only sufficient evidence for those interactions between the auditors and whatsapp's servers, it doesn't say anything about your interaction with whatsapp's servers. And that's the heart of the problem: using code shipped to a browser for e2e encryption is a flawed model, it would be trivial to target you with a version that has broken e2e encryption but subtle enough that you would never notice.
  - jensensbutton 5y ago
grayhatter 5y ago
Signal doesn't get credit for being open source.
- AnonC 5y ago
  Are you saying it’s not getting enough credit or that it shouldn’t? The Signal code was closed source for longer than a year (from April 2020) when no commits were done in the public repo because <we don’t have any official statement>. Some months ago the public repo got a barrage of commits after that long gap. It wasn’t that the Signal platform and client had no updates during this time. There were many, but the code wasn’t released. Signal may be open source at times, but that alone is not a reliable factor for the platform/company to be considered as trustworthy.
  - jakecopp 5y ago
    https://digital-justice.com/articles/skip-signal.html https://digital-justice.com/articles/skip-signal.html Agreed - I've moved ~80 of my friends from Messenger to the free Matrix server, and I host my own server. It's a wonderful experience.
  - rOOb85 5y ago
    > The Signal code was closed source for longer than a year (from April 2020) This absolutely untrue. Signals source has NEVER been closed source. The Signal server source code(which isn't special and doesn't change that often) just had no public commits. The Signal client source code(what matters and makes Signal secure) was frequently updated. > Signal may be open source at times, Again, Signal has always been open source.
    - izacus 5y ago
      > The Signal server source code(which isn't special and doesn't change that often) just had no public commits. So it was opensource... you just couldn't see the source running on the servers? Yeah, makes sense. Right.
      - 5y ago
schainks 5y ago
I can think of one UN sanctioned country where whatsapp _works_, but signal is banned.
lmm 5y ago
> Why on earth do people trust a closed source messenger owned by Facebook, which backs up to Google? Those are some of the few companies that are large enough to oppose governments. > Signal and Matrix are open source The main advantage of which is to enable audits like this, which WhatsApp is doing. Of course you can't actually build WhatsApp from the audited source or pin it to the audited version... but you can't do that with Signal either. Not to mention that you're stuck with closed-source Google Play Services (or closed-source iOS) anyway.
- GekkePrutser 5y ago
  > Those are some of the few companies that are large enough to oppose government They're more likely to cooperate with governments because they have so much to lose. All the big guys are caving in to China for example because they don't want to lose that sweet 1+ billion consumer market. Yes even Google. Check maps.google.cn and see the border around the South China Sea. And also their interests are much more aligned with the governments, being entities similar in size and controlled by huge shareholder interest groups. Oh and finally most of them don't even pretend to oppose government interests. Even Apple. The best thing about Matrix is that both the software and the network is open and decentralised. This is why I prefer it over Signal (which even frowns on third party clients)
  - polyomino 5y ago
    Facebook is in china? News to me.
    - GekkePrutser 5y ago
      Facebook the service no. Facebook/Meta the company yes :)
beermonster 5y ago
I think Signal and Matrix are more trustworthy and auditable. However I also think more people are on WhatsApp than those two (and possibly more) combined and people want to just use it probably for that reason. I saw some of my contacts sign up to Signal firstly after the privacy fiasco then again in smaller quantity after the major outage. I deleted WhatsApp a while ago but I decided to re-install it again recently or basically risk losing contact with some old friends. In fairness I did try and convert people to Signal; I managed to convince a couple - so not all was lost.
- wruza 5y ago
  I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.
  - beermonster 5y ago
    I find this odd as how signal looks and works is one of the reasons I enjoy using it. Can you highlight your collective pet peeves ?
    - wruza 5y ago
      Sadly no, I should have written that down (a good habit I’ve only got later). But I have vague memories that some of the issues were very basic, like replying or images or chat handling, and that we mostly expressed the same concerns. It’s not unusable, but it just didn’t feel right as a whole. It should also be noted that we are not privacy-critical, just like these “numb people” I believe, who choose over little details rather than a big picture. Our background at the time was whatsapp, telegram and viber.
    - rand49an 5y ago
      Just anecdotally Signal seems to be far less reliable when delivering messages and I've had a few crashes with the Android app. Another very small thing, but it irks me slightly - the chat bubbles are rounded too much.

r00fus 5y ago

Most likely because their contacts don't want to switch. I've migrated extended family off WhatsApp to Signal but it was a nontrivial effort since their contacts don't want to use anything but WhatsApp.

epolanski 5y ago
Just imagine the world we live in, how numb average joe is. I said same things to most of my closer people and in the end they tell me “well they have all our data anyway”. And all they have to do is just download an application.
- distrill 5y ago
  TBF that's not really all they have to do. They also have to use that new application, which means (further) diving their communications stream. And it means an additional onboarding step when they set up a new device. I understand these aren't huge obstacles, but I am generally reluctant to add additional communication channels for these reasons - they aren't trivialities to everyone.
- stef25 5y ago
  Isn't it more like changing email? You'd keep checking your old one for quite a while.
  - wruza 5y ago
    Email is much easier because of forwarding (or polling, in case an old service doesn’t have forwarding). I’m changing my main email every ten years or so and have few degenerate addresses like apple or yandex accounts which are dead but still attached to few orgs. Messengers usually don’t have forwarding or a sensible polling interface. It would be nice to have all-in-one app even with limited functionality, since I’m mostly using text and images. Or use one of real full-featured messengers with gateways to others.

jensensbutton 5y ago

Because the number of people who can actually validate the security of the open source options is vanishingly small and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk.

thevardanian 5y ago
You just need one. Vanishingly small or not.
- charcircuit 5y ago
  One person can always make a mistake. Also every update can introduce security problems. It's not a one time thing.
eitland 5y ago
> Because the number of people who can actually validate the security of the open source options is vanishingly small The people who can judge if Facebook are to be trusted should be in the millions by now though...
philliphaydon 5y ago
I have no faith as I still get facebook adverts shortly after discussing things in whats app.
jacquesm 5y ago
> and assessments like this provide sufficient evidence that WhatsApp's claims are not bunk. Actually, no that's not sufficient evidence. That's only sufficient evidence for those interactions between the auditors and whatsapp's servers, it doesn't say anything about your interaction with whatsapp's servers. And that's the heart of the problem: using code shipped to a browser for e2e encryption is a flawed model, it would be trivial to target you with a version that has broken e2e encryption but subtle enough that you would never notice.
- jensensbutton 5y ago

grayhatter 5y ago

Signal doesn't get credit for being open source.

AnonC 5y ago
Are you saying it’s not getting enough credit or that it shouldn’t? The Signal code was closed source for longer than a year (from April 2020) when no commits were done in the public repo because <we don’t have any official statement>. Some months ago the public repo got a barrage of commits after that long gap. It wasn’t that the Signal platform and client had no updates during this time. There were many, but the code wasn’t released. Signal may be open source at times, but that alone is not a reliable factor for the platform/company to be considered as trustworthy.
- jakecopp 5y ago
  https://digital-justice.com/articles/skip-signal.html https://digital-justice.com/articles/skip-signal.html Agreed - I've moved ~80 of my friends from Messenger to the free Matrix server, and I host my own server. It's a wonderful experience.
- rOOb85 5y ago
  > The Signal code was closed source for longer than a year (from April 2020) This absolutely untrue. Signals source has NEVER been closed source. The Signal server source code(which isn't special and doesn't change that often) just had no public commits. The Signal client source code(what matters and makes Signal secure) was frequently updated. > Signal may be open source at times, Again, Signal has always been open source.
  - izacus 5y ago
    > The Signal server source code(which isn't special and doesn't change that often) just had no public commits. So it was opensource... you just couldn't see the source running on the servers? Yeah, makes sense. Right.
    - 5y ago

schainks 5y ago

I can think of one UN sanctioned country where whatsapp _works_, but signal is banned.

lmm 5y ago

> Why on earth do people trust a closed source messenger owned by Facebook, which backs up to Google? Those are some of the few companies that are large enough to oppose governments. > Signal and Matrix are open source The main advantage of which is to enable audits like this, which WhatsApp is doing. Of course you can't actually build WhatsApp from the audited source or pin it to the audited version... but you can't do that with Signal either. Not to mention that you're stuck with closed-source Google Play Services (or closed-source iOS) anyway.

GekkePrutser 5y ago
> Those are some of the few companies that are large enough to oppose government They're more likely to cooperate with governments because they have so much to lose. All the big guys are caving in to China for example because they don't want to lose that sweet 1+ billion consumer market. Yes even Google. Check maps.google.cn and see the border around the South China Sea. And also their interests are much more aligned with the governments, being entities similar in size and controlled by huge shareholder interest groups. Oh and finally most of them don't even pretend to oppose government interests. Even Apple. The best thing about Matrix is that both the software and the network is open and decentralised. This is why I prefer it over Signal (which even frowns on third party clients)
- polyomino 5y ago
  Facebook is in china? News to me.
  - GekkePrutser 5y ago
    Facebook the service no. Facebook/Meta the company yes :)

beermonster 5y ago

I think Signal and Matrix are more trustworthy and auditable. However I also think more people are on WhatsApp than those two (and possibly more) combined and people want to just use it probably for that reason. I saw some of my contacts sign up to Signal firstly after the privacy fiasco then again in smaller quantity after the major outage. I deleted WhatsApp a while ago but I decided to re-install it again recently or basically risk losing contact with some old friends. In fairness I did try and convert people to Signal; I managed to convince a couple - so not all was lost.

wruza 5y ago
I tried signal among my close-y circle and we had no issue with nobody else there. But it didn’t stick because of how it looks and works. When I read reports like yours it feels like you don’t use all of the features, but what repelled us was not that inertia thing.
- beermonster 5y ago
  I find this odd as how signal looks and works is one of the reasons I enjoy using it. Can you highlight your collective pet peeves ?
  - wruza 5y ago
    Sadly no, I should have written that down (a good habit I’ve only got later). But I have vague memories that some of the issues were very basic, like replying or images or chat handling, and that we mostly expressed the same concerns. It’s not unusable, but it just didn’t feel right as a whole. It should also be noted that we are not privacy-critical, just like these “numb people” I believe, who choose over little details rather than a big picture. Our background at the time was whatsapp, telegram and viber.
  - rand49an 5y ago
    Just anecdotally Signal seems to be far less reliable when delivering messages and I've had a few crashes with the Android app. Another very small thing, but it irks me slightly - the chat bubbles are rounded too much.