5 ms·

I'm already not wanting to have personal conversations on teams. My tech savvy colleagues and the ones who can be convinced are on signal, where we talk about j

I'm already not wanting to have personal conversations on teams. My tech savvy colleagues and the ones who can be convinced are on signal, where we talk about job offers and relationships. A few others do Instagram, and get to see my art photography. And occasionally I'll bump into someone when we're both in the office and be able to say whatever not looked over by AI. There's a real chilling effect on getting to know people.

fartcannon 4y ago
Signal and WhatsApp aren't 100% trust worthy though. Why not pick something you can host yourself?
- andrewxdiamond 4y ago
  This is a pretty classic example of “what’s your threat model”. WhatsApp/Signal may not be perfectly private, but it’s plenty private enough to hide trivial things like job offers from your employer.
  - fartcannon 4y ago
    Yeah, this is kind of how we got to the point where Microsoft tattles on you to your employer. Small concessions.
- dijit 4y ago
  Right, I'm tired of this. E2EE doesn't mean anything if you have the same entity controlling the server as is controlling the endpoints. If you control both ends of an E2EE communication and they are closed then you gain nothing over normal TLS encryption, you still trust the authority. (Whatsapp is obviously closed and yes, signal can be considered effectively closed as their client is not reliably or reproducably built from public sources and has hidden their agendas before[0]; and even depends on binary blobs from Google..) I know your favourite closed/walled messenger platform is basically religion at this point: but for heavens sake; please understand that unless you're auditing your clients or you can run trustable third-party clients; then end-to-end doesn't mean anything at all. It's just marketing buzzwords. [0]: https://www.youtube.com/watch?v=tJoO2uWrX1M&t=880s https://www.youtube.com/watch?v=tJoO2uWrX1M&t=880s
  - usrn 4y ago
    And we have cross platform signal style E2EE now in the form of OMEMO for XMPP. It's just that no one wants to use it.
  - fartcannon 4y ago
    I don't really know who you're arguing against, because I'm with you on the points you address. Why I care that its open is so that when they eventually pull a Microsoft, or Facebook style anti-consumer move, we can fork off and continue on how we see fit. It's about control of our communication. Using signal is the same as using WhatsApp. Eventually Facebook will buy it.
    - dijit 4y ago
      I'm agreeing with you and I'm frustrated that you got downvoted.
      - fartcannon 4y ago
        Ah I see. Well thank you for your concern. I'm pretty used to it by now. :) Its weird how much people fight against their own interests though eh.
  - throwaway290 4y ago
    If you say something ML thinks is wrong in Teams, you can be fired (at will). If you say something to your colleague via Whatsapp, the only scenario it can be used against you is if you commit an actual crime with reasonable evidence, they subpoena the records, and FB will be willing to go on record to the entire world as lying about Whatsapp E2EE, all in the name of putting you behind bars. (Also, maybe we can imagine that products actually do what they do and it is not normal to fear lies and nefarious agenda behind every offering?)
    - dijit 4y ago
      there were two points made: 1) Signal and whatsapp are not 100% trustworthy Maybe the implication is that it will leak info to your employer, but I think this is more like a general statement; one that is likely an attempt to discuss why we still put our conversations into the hands of large companies with potentially unknown motives; and the questionable state of using "end-to-end" where one entity controls the network, access to the network and both ends of the exchange. 2) Why not use something you can host yourself to which a reasonable reply is: network effects; I already have signal/whatsapp/telegram and I do not worry about them sending information to my employer. Unless your employer is facebook, then I think that's a perfectly legitimate rebuttal, but one nobody is making. In fact, people would rather argue that signal/whatsapp is the best privacy platform in the universe due to e2ee!
- bufferoverflow 4y ago
  Signal is open source. What's not trust worthy exactly?
  - dijit 4y ago
    1) You need to audit that code, which.. everyone will have to do on both sides of the communication channel. 2) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > the Signal Android codebase includes some native shared libraries that we employ for voice calls (WebRTC, etc). At the time this native code was added, there was no Gradle NDK support yet, so the shared libraries aren’t compiled with the project build. A good answer in my opinion, but it does mean that what you install from the play store is not reproducible and thus can never really be confirmed to be the same as public sources. There are also binary blobs needed for interacting with Google Play. 3) Signal is openly hostile to third party client implementations: https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37 Meaning they have a near monopoly on all signal communications through their client.. and since it's not reproducible, I hope everyone is building from source.
    - bufferoverflow 4y ago
      1) Nonsense. If you don't trust other people's code, you're screwed. You put yourself into the position where you have to audit your OS code, your CPU code, code of every driver that runs in your system. None of which you did. 2) Isn't WebRTC open source too? 3) Their code, their decisions.
      - fartcannon 4y ago
        Their code, their decisions is why it's bad. If the decide to start tattling to Microsoft too, what are you going to do? If it's open, we can fork it and move on with your lives. Free and open gives you and me the power to control our own communication.
        bufferoverflow 4y ago
- totetsu 4y ago
  - I don't have enough disposable income and disposable time to self host and then keep up to date some flavour of messaging protocol server. - Everyone's understanding of this issue is different. It's hard enough to convince technical people to use matrix/element vs signal, vs what ever they already have installed. Non-Technical people will either just ignore you or trust you entirely, I'm not sure which is worse. - When something goes wrong I have to fix it myself. now I'm 24/7 on call. - Even If I have knowledge enough to run the infrastructure myself, to compile clients and servers myself, to register domains etc.. I cant understand the source code to identify every possible un-trust worthy thing. even if I could, system security is not just about the code.. what is a trusted architecture to run it on? It just isn't in any way, by any stretch of the imagination, feasible to self host any messaging service myself, that I want to use with the aim of talking to a wide range of people, from all parts of my life.. When I just want to chat with my work colleagues and arrange to go to drinks, or about their break up, or some other company or whatever..
dj_mc_merlin 4y ago
Why would anyone have personal conversations on a platform which is linked to your work?
- ajmurmann 4y ago
  Because you might be friendly with coworkers and not always switch platform as the topic transitions.
  - dj_mc_merlin 4y ago
    > not always switch platform as the topic transitions My point is, you totally should. I am friendly with my coworkers too, if I want to have a non "work-friendly" talk with them, we talk in the kitchen or at the pub. It baffles me that people would use a work provided form of communication and _not_ assume it's auditable in some way. edit: should clarify that my work is probably more calm than most and would probably not GAF about it regardless.. but it's just good opsec. Never write something down you wouldn't be comfortable having read out to you if it can be traced back to you.
    - ajmurmann 4y ago
      Your original question was about "personal conversations". I don't think all personal conversations fall into the category of things I wouldn't write down. If I remember that I need to ask my coworker about dietary restrictions for going out together on the weekend while we are talking about our db problems, I won't necessarily switch to Signal for that.
      - dj_mc_merlin 4y ago
        Then we misunderstood each other. In that case there is no need to change platforms at all -- no one is ever going to penalize you for talking about dietary restrictions or similar topics. If you want to talk about looking for jobs, how much you hate your wife, or what an asshole your boss is, that should obviously not be done in a way that it could ever be traced to you. Failing to do that makes the situation at least half your fault, what did you expect?
california2077 4y ago
Your employer is not obliged to maintain a communication system so that you "get to know people". If you consider how much these tools cost to maintain, it's completely understandable that companies want to have 100% content control.
tgv 4y ago
Is that a recent thing? Or only in the US? Age related? Size of the company? The level of personal communication I've witnessed over such tools is pretty superficial, casual. But perhaps that's just my age, location, or the fact that the last time I worked for a large company, Skype was still new.
DeathArrow 4y ago
> And occasionally I'll bump into someone when we're both in the office and be able to say whatever not looked over by AI. At my present workplace, we have cameras with microphones. They also have installed spyware on laptops and desktops, to be able to see the screens of employees. They also go through mails and have a list of all web traffic done by employees. Which is one of the reasons I've handed my resignation a few days ago.
- nine_k 4y ago
  In most places where I worked, I signed an explicit consent form stating that all company-provided means of communication are for work purposes only, and may be audited. I suppose it's required by law. So my rule of thumb for workplace is: expect no privacy. If you want to use work-provided email, slack, etc to discuss things which you'd be very uncomfortable discussing in your office in the open, especially in the presence of your bosses, don't. Find a different venue.

fartcannon 4y ago

Signal and WhatsApp aren't 100% trust worthy though. Why not pick something you can host yourself?

andrewxdiamond 4y ago
This is a pretty classic example of “what’s your threat model”. WhatsApp/Signal may not be perfectly private, but it’s plenty private enough to hide trivial things like job offers from your employer.
- fartcannon 4y ago
  Yeah, this is kind of how we got to the point where Microsoft tattles on you to your employer. Small concessions.
dijit 4y ago
Right, I'm tired of this. E2EE doesn't mean anything if you have the same entity controlling the server as is controlling the endpoints. If you control both ends of an E2EE communication and they are closed then you gain nothing over normal TLS encryption, you still trust the authority. (Whatsapp is obviously closed and yes, signal can be considered effectively closed as their client is not reliably or reproducably built from public sources and has hidden their agendas before[0]; and even depends on binary blobs from Google..) I know your favourite closed/walled messenger platform is basically religion at this point: but for heavens sake; please understand that unless you're auditing your clients or you can run trustable third-party clients; then end-to-end doesn't mean anything at all. It's just marketing buzzwords. [0]: https://www.youtube.com/watch?v=tJoO2uWrX1M&t=880s https://www.youtube.com/watch?v=tJoO2uWrX1M&t=880s
- usrn 4y ago
  And we have cross platform signal style E2EE now in the form of OMEMO for XMPP. It's just that no one wants to use it.
- fartcannon 4y ago
  I don't really know who you're arguing against, because I'm with you on the points you address. Why I care that its open is so that when they eventually pull a Microsoft, or Facebook style anti-consumer move, we can fork off and continue on how we see fit. It's about control of our communication. Using signal is the same as using WhatsApp. Eventually Facebook will buy it.
  - dijit 4y ago
    I'm agreeing with you and I'm frustrated that you got downvoted.
    - fartcannon 4y ago
      Ah I see. Well thank you for your concern. I'm pretty used to it by now. :) Its weird how much people fight against their own interests though eh.
- throwaway290 4y ago
  If you say something ML thinks is wrong in Teams, you can be fired (at will). If you say something to your colleague via Whatsapp, the only scenario it can be used against you is if you commit an actual crime with reasonable evidence, they subpoena the records, and FB will be willing to go on record to the entire world as lying about Whatsapp E2EE, all in the name of putting you behind bars. (Also, maybe we can imagine that products actually do what they do and it is not normal to fear lies and nefarious agenda behind every offering?)
  - dijit 4y ago
    there were two points made: 1) Signal and whatsapp are not 100% trustworthy Maybe the implication is that it will leak info to your employer, but I think this is more like a general statement; one that is likely an attempt to discuss why we still put our conversations into the hands of large companies with potentially unknown motives; and the questionable state of using "end-to-end" where one entity controls the network, access to the network and both ends of the exchange. 2) Why not use something you can host yourself to which a reasonable reply is: network effects; I already have signal/whatsapp/telegram and I do not worry about them sending information to my employer. Unless your employer is facebook, then I think that's a perfectly legitimate rebuttal, but one nobody is making. In fact, people would rather argue that signal/whatsapp is the best privacy platform in the universe due to e2ee!
bufferoverflow 4y ago
Signal is open source. What's not trust worthy exactly?
- dijit 4y ago
  1) You need to audit that code, which.. everyone will have to do on both sides of the communication channel. 2) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > the Signal Android codebase includes some native shared libraries that we employ for voice calls (WebRTC, etc). At the time this native code was added, there was no Gradle NDK support yet, so the shared libraries aren’t compiled with the project build. A good answer in my opinion, but it does mean that what you install from the play store is not reproducible and thus can never really be confirmed to be the same as public sources. There are also binary blobs needed for interacting with Google Play. 3) Signal is openly hostile to third party client implementations: https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37 Meaning they have a near monopoly on all signal communications through their client.. and since it's not reproducible, I hope everyone is building from source.
  - bufferoverflow 4y ago
    1) Nonsense. If you don't trust other people's code, you're screwed. You put yourself into the position where you have to audit your OS code, your CPU code, code of every driver that runs in your system. None of which you did. 2) Isn't WebRTC open source too? 3) Their code, their decisions.
    - fartcannon 4y ago
      Their code, their decisions is why it's bad. If the decide to start tattling to Microsoft too, what are you going to do? If it's open, we can fork it and move on with your lives. Free and open gives you and me the power to control our own communication.
      - bufferoverflow 4y ago
totetsu 4y ago
- I don't have enough disposable income and disposable time to self host and then keep up to date some flavour of messaging protocol server. - Everyone's understanding of this issue is different. It's hard enough to convince technical people to use matrix/element vs signal, vs what ever they already have installed. Non-Technical people will either just ignore you or trust you entirely, I'm not sure which is worse. - When something goes wrong I have to fix it myself. now I'm 24/7 on call. - Even If I have knowledge enough to run the infrastructure myself, to compile clients and servers myself, to register domains etc.. I cant understand the source code to identify every possible un-trust worthy thing. even if I could, system security is not just about the code.. what is a trusted architecture to run it on? It just isn't in any way, by any stretch of the imagination, feasible to self host any messaging service myself, that I want to use with the aim of talking to a wide range of people, from all parts of my life.. When I just want to chat with my work colleagues and arrange to go to drinks, or about their break up, or some other company or whatever..

dj_mc_merlin 4y ago

Why would anyone have personal conversations on a platform which is linked to your work?

ajmurmann 4y ago
Because you might be friendly with coworkers and not always switch platform as the topic transitions.
- dj_mc_merlin 4y ago
  > not always switch platform as the topic transitions My point is, you totally should. I am friendly with my coworkers too, if I want to have a non "work-friendly" talk with them, we talk in the kitchen or at the pub. It baffles me that people would use a work provided form of communication and _not_ assume it's auditable in some way. edit: should clarify that my work is probably more calm than most and would probably not GAF about it regardless.. but it's just good opsec. Never write something down you wouldn't be comfortable having read out to you if it can be traced back to you.
  - ajmurmann 4y ago
    Your original question was about "personal conversations". I don't think all personal conversations fall into the category of things I wouldn't write down. If I remember that I need to ask my coworker about dietary restrictions for going out together on the weekend while we are talking about our db problems, I won't necessarily switch to Signal for that.
    - dj_mc_merlin 4y ago
      Then we misunderstood each other. In that case there is no need to change platforms at all -- no one is ever going to penalize you for talking about dietary restrictions or similar topics. If you want to talk about looking for jobs, how much you hate your wife, or what an asshole your boss is, that should obviously not be done in a way that it could ever be traced to you. Failing to do that makes the situation at least half your fault, what did you expect?

california2077 4y ago

Your employer is not obliged to maintain a communication system so that you "get to know people". If you consider how much these tools cost to maintain, it's completely understandable that companies want to have 100% content control.

tgv 4y ago

Is that a recent thing? Or only in the US? Age related? Size of the company? The level of personal communication I've witnessed over such tools is pretty superficial, casual. But perhaps that's just my age, location, or the fact that the last time I worked for a large company, Skype was still new.

DeathArrow 4y ago

> And occasionally I'll bump into someone when we're both in the office and be able to say whatever not looked over by AI. At my present workplace, we have cameras with microphones. They also have installed spyware on laptops and desktops, to be able to see the screens of employees. They also go through mails and have a list of all web traffic done by employees. Which is one of the reasons I've handed my resignation a few days ago.

nine_k 4y ago
In most places where I worked, I signed an explicit consent form stating that all company-provided means of communication are for work purposes only, and may be audited. I suppose it's required by law. So my rule of thumb for workplace is: expect no privacy. If you want to use work-provided email, slack, etc to discuss things which you'd be very uncomfortable discussing in your office in the open, especially in the presence of your bosses, don't. Find a different venue.