4 ms·

I'm overall intrigued by SimpleX and I'd be excited to see it undergo a proper audit. Even if the "no IDs" thing is more of a gimmick than a useful feature, a c

I'm overall intrigued by SimpleX and I'd be excited to see it undergo a proper audit. Even if the "no IDs" thing is more of a gimmick than a useful feature, a competitor to Signal would be great given the direction it appears to be heading. I'm a little put off by parts of their advertising though. Their homepage states Signal can be MITMed given the "operator's servers are compromised", which I don't doubt is true to the extent of the actor stealing, maybe, phone numbers and metadata? But my understanding of Signal's protocol is that a compromised server couldn't intercept _messages_, which is what I feel they're implying. According to GitHub, their (mono?)repo[1] is split 33% between Haskell, Kotlin, and Swift, which is nice. [0] https://simplex.chat/docs/protocol/simplex-chat.html https://simplex.chat/docs/protocol/simplex-chat.html [1] https://github.com/simplex-chat/simplex-chat/ https://github.com/simplex-chat/simplex-chat/

hsjqllzlfkf 3y ago
> a competitor to Signal would be great given the direction it appears to be heading. What direction does it appear to be heading?
- Caligatio 3y ago
  The direction people refer to is the company making a few decisions that deviate from being 100% idealistic. Forget the fact that the client is open source, the parent company being a non-profit, and the app being ad-free. Instead, focus on delayed server source code releases, a weird US crypto currency thing, and the company not supporting private/standalone Signal networks. Oh, also, super concentrate on the client using phone numbers as if it's a fatal flaw rather than a design choice. Instead, keep using WhatsApp or Telegram which have way more problems (like being owned by Meta or having completely closed source server code). Companies generally trying to do the right thing (e.g. Signal and Mozilla) are held to impossible standards. They are by no means perfect but they're leagues better than the alternatives.
  - veave 3y ago
    They are held to the standards they set to themselves. You can't brag about your open source server code and then stop updating it for a year. You can't spend all day on twitter writing bullshit to attract a certain political demographic and then add a crypto wallet to a chat client. etc etc
    - Caligatio 3y ago
      I really, really don't understand the obsession with the server source code. The client verifiably performs E2E encryption so who cares what the server does. Moreover, there is basically no way for external parties to verify what code is running on the servers. In the era of practically every free service selling out their users to the lowest bidder, it literally blows my mind the amount of hate Signal gets because of an old complaint about their server source (repo looks quite lively now). The tech community is seriously guilty of letting perfect be the enemy of good. For the record, I'm not a huge fan of the crypto wallet thing at all but I just don't use it.
      - veave 3y ago
        >I really, really don't understand the obsession with the server source code. You just used "closed server source code" as an argument against telegram? I also agree that it doesn't matter at all. But then why trashtalk telegram?
        nani8ot 3y ago
        Telegram does not have solid E2E enabled by default, so it's more important what the server does.
      - ignoramous 3y ago
        > For the record, I'm not a huge fan of the crypto wallet thing at all but I just don't use it. Why not, if it solves payments between Signal users (believe the Signal-MobileCoin integration, disregarding Moxie's involvement in both for a second, is a direct response to the now-defunct Libra/Deim)? Personally, I see MobileCoin / wallets as a genuine path to monetization for the Signal Foundation. Though, it remains to be seen if it is any successful.
epoberezkin 3y ago
There was an audit of critical parts in November 22: https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html https://simplex.chat/blog/20221108-simplex-chat-v4.2-securit...

hsjqllzlfkf 3y ago

> a competitor to Signal would be great given the direction it appears to be heading. What direction does it appear to be heading?

Caligatio 3y ago
The direction people refer to is the company making a few decisions that deviate from being 100% idealistic. Forget the fact that the client is open source, the parent company being a non-profit, and the app being ad-free. Instead, focus on delayed server source code releases, a weird US crypto currency thing, and the company not supporting private/standalone Signal networks. Oh, also, super concentrate on the client using phone numbers as if it's a fatal flaw rather than a design choice. Instead, keep using WhatsApp or Telegram which have way more problems (like being owned by Meta or having completely closed source server code). Companies generally trying to do the right thing (e.g. Signal and Mozilla) are held to impossible standards. They are by no means perfect but they're leagues better than the alternatives.
- veave 3y ago
  They are held to the standards they set to themselves. You can't brag about your open source server code and then stop updating it for a year. You can't spend all day on twitter writing bullshit to attract a certain political demographic and then add a crypto wallet to a chat client. etc etc
  - Caligatio 3y ago
    I really, really don't understand the obsession with the server source code. The client verifiably performs E2E encryption so who cares what the server does. Moreover, there is basically no way for external parties to verify what code is running on the servers. In the era of practically every free service selling out their users to the lowest bidder, it literally blows my mind the amount of hate Signal gets because of an old complaint about their server source (repo looks quite lively now). The tech community is seriously guilty of letting perfect be the enemy of good. For the record, I'm not a huge fan of the crypto wallet thing at all but I just don't use it.
    - veave 3y ago
      >I really, really don't understand the obsession with the server source code. You just used "closed server source code" as an argument against telegram? I also agree that it doesn't matter at all. But then why trashtalk telegram?
      - nani8ot 3y ago
        Telegram does not have solid E2E enabled by default, so it's more important what the server does.
    - ignoramous 3y ago
      > For the record, I'm not a huge fan of the crypto wallet thing at all but I just don't use it. Why not, if it solves payments between Signal users (believe the Signal-MobileCoin integration, disregarding Moxie's involvement in both for a second, is a direct response to the now-defunct Libra/Deim)? Personally, I see MobileCoin / wallets as a genuine path to monetization for the Signal Foundation. Though, it remains to be seen if it is any successful.

epoberezkin 3y ago

There was an audit of critical parts in November 22: https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html https://simplex.chat/blog/20221108-simplex-chat-v4.2-securit...