5 ms·

With their proprietary client it does not matter how secure is a protocol. There's always a risk of bad update or total compromise. And of course ads need to be

by zx8080 3y ago

With their proprietary client it does not matter how secure is a protocol. There's always a risk of bad update or total compromise. And of course ads need to be targeted.

aembleton 3y ago
Same with WhatsApp and signal
- I_am_tiberius 3y ago
  I thought Signal is open source?
  - nicce 3y ago
    Also their builds are fully reproducible on Android.
    - zaik 3y ago
      Is there a guide how one can check that the PlayStore version matches the source code?
      - nicce 3y ago
        Here is one: https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod...
  - dontlaugh 3y ago
    US spooks can get Apple or Google to deliver altered apps to targets, if nothing else.
    - viktorcode 3y ago
      Source?
      - cies 3y ago
        AppStore and PlayStore are not open source, so you trust the distribution mechanism, is what I think parent wanted to say.
        I_am_tiberius 3y ago
        But you don't need to install them via their store. Also, you can always check the hash code of the binary.
        cies 3y ago
        I'm not sure about that. But true, in that case only the fact that's not open source is still in the way of me giving it my "baseline safe" approval. :)
  - MikusR 3y ago
    It's "source available". They make changes to their server code, run those modified servers for a year or so and then release a source.
    - contravariant 3y ago
      The server code isn't relevant in this case, you want the client code to be secure.
- ssss11 3y ago
  Well signal isn’t taking personal data or targeting people with ads, so no. Signal afaik cant access your data and it’s open source so assume has been proven.
  - hu3 3y ago
    Last I checked, Signal requires and uses your phone number.
    - ssss11 3y ago
      Actually I think you’re right - there is one data point. Pretty impressive
ssss11 3y ago
That’s it right - they get the goodwill of “we value privacy, look we gave you e2ee” and yet they still get to use your data and serve you targeted ads. Creeps.
cies 3y ago
Exactly. E2EE is just "transit encryption" when clients are not open source/ audited/ trusted. And FB cannot be trusted (I'm not going to list instances by which they gained my distrust here). Encrypting metadata is also really hard. See the Matrix (and XMPP) community for detailed discussions on why that is. I use and advise others to use E2EE encrypting tools, all are open source, audited and popular. Fake sense of safety is worse than understood unsafety.
linuxandrew 3y ago
Exactly. The protest against Reddit's ban on third party clients needs to be more widespread. We want FOSS clients for all IM, discussion and social media platforms.

by zx8080 3y ago

With their proprietary client it does not matter how secure is a protocol. There's always a risk of bad update or total compromise. And of course ads need to be targeted.

aembleton 3y ago

Same with WhatsApp and signal

I_am_tiberius 3y ago
I thought Signal is open source?
- nicce 3y ago
  Also their builds are fully reproducible on Android.
  - zaik 3y ago
    Is there a guide how one can check that the PlayStore version matches the source code?
    - nicce 3y ago
      Here is one: https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod...
- dontlaugh 3y ago
  US spooks can get Apple or Google to deliver altered apps to targets, if nothing else.
  - viktorcode 3y ago
    Source?
    - cies 3y ago
      AppStore and PlayStore are not open source, so you trust the distribution mechanism, is what I think parent wanted to say.
      - I_am_tiberius 3y ago
        But you don't need to install them via their store. Also, you can always check the hash code of the binary.
        cies 3y ago
        I'm not sure about that. But true, in that case only the fact that's not open source is still in the way of me giving it my "baseline safe" approval. :)
- MikusR 3y ago
  It's "source available". They make changes to their server code, run those modified servers for a year or so and then release a source.
  - contravariant 3y ago
    The server code isn't relevant in this case, you want the client code to be secure.
ssss11 3y ago
Well signal isn’t taking personal data or targeting people with ads, so no. Signal afaik cant access your data and it’s open source so assume has been proven.
- hu3 3y ago
  Last I checked, Signal requires and uses your phone number.
  - ssss11 3y ago
    Actually I think you’re right - there is one data point. Pretty impressive

ssss11 3y ago

That’s it right - they get the goodwill of “we value privacy, look we gave you e2ee” and yet they still get to use your data and serve you targeted ads. Creeps.

cies 3y ago

Exactly. E2EE is just "transit encryption" when clients are not open source/ audited/ trusted. And FB cannot be trusted (I'm not going to list instances by which they gained my distrust here). Encrypting metadata is also really hard. See the Matrix (and XMPP) community for detailed discussions on why that is. I use and advise others to use E2EE encrypting tools, all are open source, audited and popular. Fake sense of safety is worse than understood unsafety.

linuxandrew 3y ago

Exactly. The protest against Reddit's ban on third party clients needs to be more widespread. We want FOSS clients for all IM, discussion and social media platforms.