4 ms·

- They claim reproducible builds, but use a binary blob… which invalidates the whole concept. - They claim full open source but for several years they did not

by guappa 1y ago

- They claim reproducible builds, but use a binary blob… which invalidates the whole concept. - They claim full open source but for several years they did not release the server. - They claim federation is impossible… yet matrix has it. - They claim openness but are actively hostile to linux distributions and f-droid. - Related, getting signal from an app store is no more secure than getting any random proprietary app. - There's a lot of allegations that they don't need VCs because they have backing from the USA army.

conradev 1y ago
Brian Acton put $100m into Signal and I thought that was the reason that they don’t need funding
- aleph_minus_one 1y ago
  I rather think the money for Signal comes (or originally came) from the CIA. Evidence: > Signal facing collapse after CIA cuts funding > https://english.almayadeen.net/articles/analysis/signal-facing-collapse-after-cia-cuts-funding https://english.almayadeen.net/articles/analysis/signal-faci...
  - jajko 1y ago
    If they had good access, why cut the funding? To subvert the security product where they actually have backdoor?
    - guappa 1y ago
      [flagged]
      - immibis 1y ago
        It makes sense when viewed through the lens that he's a foreign agent.
        immibis 1y ago
        Funny how a comment can go from +5 to -4 once the American time zone gets online.
      - ForHackernews 1y ago
        (if only HN had eye-roll reacts) Radio Free Europe was/is not a propaganda outlet any more than the BBC is a propaganda outlet (in fact, this is why Trump hates it). To an authoritarian, free press looks like propaganda. Showcasing what makes your society great is propaganda only inasmuch as it casts the failures of other models into sharper relief. Liberal democracy is not a propaganda trick, it's just better.
        guappa 1y ago
        Have you ever listened to it? I have.
        itishappy 1y ago
        Do you see many stories critical of US foreign policy?
        amendegree 1y ago
        I mean… yes the BBC is very much a propaganda outlet as is every single modern media organization. People who claim their media isn’t propaganda have already been brainwashed.
        guappa 1y ago
        BBC right before the brexit vote was like: "now we listen to this well spoken university professor tell us why brexit will fix all our problems", and then, to offer balanced views: "we will listen to this random person who likes europe and we picked from a street 3 minutes ago so they don't have a nice coherent speech and will sound like they're stupid"
        ForHackernews 1y ago
        I'm sorry but this is such a midwit take. Your uber-skepticism of "every single modern media organization" does not make you a savvy free-thinker, it just makes you more likely to fall down some gibbering conspiratorial rabbit hole on youtube or tiktok. Yes, media entities have biases and viewpoints; no, that doesn't make them propaganda organs.
      - bojan 1y ago
        Radio Free Europe was for 10 years almost the only way to know what's really going on in my country. I'm forever grateful to them and it horrifies me that their mission ultimately has failed.
        pphysch 1y ago
        "Russia Today was for 10 years almost the only way to know what's really going on in my country". I'm only being half-sarcastic. RT will cover factual issues about Western countries that the state-endorsed media won't. But they're still disinformation outlets that should be consumed with a massive grain of salt, just like RFE and RFA.
        bojan 1y ago
        That's a ridiculous take. Yes, Russian propaganda works best when they are based on a grain of truth, and it often is. However, it is just that - a propaganda machine serving a dictator.
        LtWorf 1y ago
        That's what Radio Free Europe is… serving foreign interests.
        pphysch 1y ago
        "Our noble warriors, their savage terrorists. Our objective media, their insidious propaganda." Blah blah.
  - jonstewart 1y ago
    This is a pretty conspiratorial article… However, widely disseminating an app that supports secure e2e messaging can serve a positive purpose for the CIA in running its agents.
  - conradev 1y ago
    The initial funding for Tor came from the Navy (where it was created) and the State Department (where it was helpful for Arab spring) Association with the CIA or In-Q-Tel is not necessarily a bad thing. They have unique requirements for operational security like many other Signal users? The CIA has access to zero-days. They will just use those for targeted attacks and are generally not in the business of mass surveillance? Whereas the FBI and NSA sorta are to achieve their respective mandates The State department has since walked back its love for international freedom of speech with the populist movement in Brazil. They’re active in suppressing speech there, just like they were in promoting it in the Middle East.
    - godelski 1y ago
      > funding for Tor came from the Navy Notably they want it more widely used because it's really not useful if the only people that connect to Tor are spies. Makes finding spies super easy ("X connected to Tor. Okay, let's go arrest X"). How do you prevent that? Doesn't take a genius to figure that out... Similarly, CIA/Navy/whatever doesn't want their tools to have zero-days. You might think "zero-days for me, but not for thee" but come on... we all know that doesn't work. If there's an exploit, the exploit works for anyone. You may have an edge in knowing where to look, but you're not going to maintain that edge for long. Worse, good luck finding out if someone else finds out. How do you prevent adversaries from exploiting your tools? Doesn't take a genius to figure that out... I really hate these conspiracies. Like come on. Yeah, we should be highly critical of US spy agencies and apply a lot of scrutiny. But not everything they touch results in a landmine. They aren't all powerful gods. And they're up against some serious adversaries like China, Russia, and yes, Israel, and the most important one of them all... themselves! Spooks are spooks. They don't trust their neighbors, they don't trust themselves. And if they were omniscient, surely they'd know the very first rule of security: if there's a backdoor, somebody will find it at the least conveniently possible time.
      - conradev 1y ago
        > I really hate these conspiracies. Like come on. The Washington Post: In a statement, WikiLeaks indicated that the initial stockpile it put online was part of a broader collection of nearly 9,000 files that would be posted over time describing code developed in secret by the CIA to steal data from a range of targets. WikiLeaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States. https://archive.ph/QgK0a#:~:text=In%20a%20statement,the%20United%20States. https://archive.ph/QgK0a#:~:text=In%20a%20statement,the%20Un... and: The experience of O.S.B. engineers bore some resemblance to the Apple TV+ drama “Severance,” https://archive.ph/K59TS#:~:text=The%20experience%20of%20O.S.B.%20engineers%20bore%20some%20resemblance%20to%20the%20Apple%20TV+%20drama%20“Severance%2C” https://archive.ph/K59TS#:~:text=The%20experience%20of%20O.S...
godelski 1y ago
See? Mostly nerdy stuff. Like these complaints are weird to put side by side with how we'd critique all the big companies. Its not that we shouldn't critique them (we should) it is that it's weird when we are discussing big tech and act like companies like Signal, Mozilla, ffmpeg, or whatever aren't good models to look up to because they aren't perfect. Because right now the alternative is the status quo. I mean the critiques are mostly valid but wanted to point out they're mostly technical. I really wish the server was fully open. I feel like that could actually create a mixed federated ecosystem. At worst be optional, right? I can get where he's coming from (and now Meredith), but I think there's a lot of value in it and they've solved hard problems before. Even just the ideas of mesh nets in local areas could be a real win for privacy and security. Being a Linux user and signal user for quite some time I'm confused at that critique. What's hostile? That it's electron? I mean that does suck but I've used various open source desktop versions and some TUIs. No real issues so far. What am I missing? Generally the talk I hear about government money is implications of back doors. Just seems like they are more interested in getting encrypted communications into other people in other countries hands. At least that's my understanding of the mission of the organization that's funding them. They'd want that as secure as possible. Government isn't a single entity. If the complaint is morally taking money from the government, yeah it was a weird move. Kinda seems out of character. But not too crazy. Personally I'm okay if they aren't building weapons and there's no strings attached. My understanding is it's not enough money to justify that.
- guappa 1y ago
  They're not really technical. If you say you do reproducible builds and you don't it's just… dishonesty? Like selling you no chemical fertilisers vegetables and then using them anyway. It's hostile because they want you to use their binary build… which you don't know if it corresponds to the source they have online. And can't verify due to the binary blob. edit: you trust the USA army to not ask any control in exchange for that money? Remember there's no reproducible builds really, and that installing via app store which is linked to an account is very easy to send vulnerable versions to journalists or whistleblowers.
  - godelski 1y ago
maeil 1y ago
> - They claim openness but are actively hostile to linux distributions and f-droid. Yet take zero action against TeleMessage.
Ragnarork 1y ago
> - There's a lot of allegations that they don't need VCs because they have backing from the USA army. Citation needed. Strange allegations (and from whom?) when the pentagon itself has discouraged using Signal in an official capacity...[0] [0]https://abcnews.go.com/Business/what-is-signal-messaging-encryption/story?id=120129513 https://abcnews.go.com/Business/what-is-signal-messaging-enc...: > The Pentagon's internal watchdog criticized a former official's use of the Signal app in 2021, calling it a breach of the department's "records retention policies" and an unauthorized means of communicating sensitive information. > "Signal is not approved by the DoD as an authorized electronic messaging and voice-calling application," the report asserted, adding that "the use of Signal to discuss official DoD information does not comply with Freedom of Information Act requirements and DoD's records retention policies."
- pphysch 1y ago
  The highest military council in the country uses Signal to communicate. I think violating FOIA is probably part of the appeal. Or they use that modified Israeli client that stores messages to address those concerns.
  - godelski 1y ago
    They don't use Signal. They use an app that wraps around Signal. There is in fact a difference. Specifically because the purpose of that app is to do exactly what you're accusing Signal of doing. If Signal already did this... why would they pay for the other app?
    - pphysch 1y ago
      What am I "accusing Signal of doing"?
pona-a 1y ago
There also was this one controversy they had with F-Droid. To be on F-Droid, you have to let them build the binaries, because otherwise they'd be shipping untrusted blobs. They demanded an exemption and got promptly denied, so there's that. Their official client also uses Google's push notification services, breaking on deGoogled ROMs. And to top that off, their Git is updated in giant commits like "Released verison X", which makes independent code review challenging. And they require a phone number, which goes against some people's threat model.
Vinnl 1y ago
> - They claim federation is impossible… yet matrix has it. I believe the claim was that it's hard to adapt to changing markets and be federated [1]. Comparing Signal's market share to Matrix's is obviously not a direct cause-and-effect, but Matrix hasn't yet proven that you can get mass adoption that way. > - They claim openness but are actively hostile to linux distributions and f-droid. I'm too lazy to find the specific GitHub comment, but IIRC there was a specific list of features they'd need to actively support F-Droid. It is now available in the Guardian Project's F-Droid repository though [2]. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ [2] https://guardianproject.info/apps/org.thoughtcrime.securesms/ https://guardianproject.info/apps/org.thoughtcrime.securesms...
- LtWorf 1y ago
  > but Matrix hasn't yet proven that you can get mass adoption that way. Neither has signal. I can contact more people with GPG than with signal.
  - Vinnl 1y ago
    No, but Signal doesn't have to prove that centralised services can be successful: other services have already done that for them. At the same time, it has reached far more regular users than Matrix has. I believe market penetration is at about 15% here in the Netherlands, which is a ways off from WhatsApp, but a pipe dream for Matrix.
dogecoinbase 1y ago
> They claim full open source but for several years they did not release the server. Specifically, they didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 [0] while they secretly added a cryptocurrency payment system to which Moxie was a paid technical advisor [1], which Moxie denied they were doing in January 2021 [2]. 0: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/ https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article) 1: https://news.ycombinator.com/item?id=26715013 https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin) 2: https://www.theverge.com/22249391/signal-app-abuse-messaging-employees-violence-misinformation https://www.theverge.com/22249391/signal-app-abuse-messaging...
rkangel 1y ago
> - They claim federation is impossible… yet matrix has it. They absolutely do NOT claim that, at least from a technical point of view: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ > Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.

by guappa 1y ago

conradev 1y ago

Brian Acton put $100m into Signal and I thought that was the reason that they don’t need funding

aleph_minus_one 1y ago
I rather think the money for Signal comes (or originally came) from the CIA. Evidence: > Signal facing collapse after CIA cuts funding > https://english.almayadeen.net/articles/analysis/signal-facing-collapse-after-cia-cuts-funding https://english.almayadeen.net/articles/analysis/signal-faci...
- jajko 1y ago
  If they had good access, why cut the funding? To subvert the security product where they actually have backdoor?
  - guappa 1y ago
    [flagged]
    - immibis 1y ago
      It makes sense when viewed through the lens that he's a foreign agent.
      - immibis 1y ago
        Funny how a comment can go from +5 to -4 once the American time zone gets online.
    - ForHackernews 1y ago
      (if only HN had eye-roll reacts) Radio Free Europe was/is not a propaganda outlet any more than the BBC is a propaganda outlet (in fact, this is why Trump hates it). To an authoritarian, free press looks like propaganda. Showcasing what makes your society great is propaganda only inasmuch as it casts the failures of other models into sharper relief. Liberal democracy is not a propaganda trick, it's just better.
      - guappa 1y ago
        Have you ever listened to it? I have.
      - itishappy 1y ago
        Do you see many stories critical of US foreign policy?
      - amendegree 1y ago
        I mean… yes the BBC is very much a propaganda outlet as is every single modern media organization. People who claim their media isn’t propaganda have already been brainwashed.
        guappa 1y ago
        BBC right before the brexit vote was like: "now we listen to this well spoken university professor tell us why brexit will fix all our problems", and then, to offer balanced views: "we will listen to this random person who likes europe and we picked from a street 3 minutes ago so they don't have a nice coherent speech and will sound like they're stupid"
        ForHackernews 1y ago
        I'm sorry but this is such a midwit take. Your uber-skepticism of "every single modern media organization" does not make you a savvy free-thinker, it just makes you more likely to fall down some gibbering conspiratorial rabbit hole on youtube or tiktok. Yes, media entities have biases and viewpoints; no, that doesn't make them propaganda organs.
    - bojan 1y ago
      Radio Free Europe was for 10 years almost the only way to know what's really going on in my country. I'm forever grateful to them and it horrifies me that their mission ultimately has failed.
      - pphysch 1y ago
        "Russia Today was for 10 years almost the only way to know what's really going on in my country". I'm only being half-sarcastic. RT will cover factual issues about Western countries that the state-endorsed media won't. But they're still disinformation outlets that should be consumed with a massive grain of salt, just like RFE and RFA.
        bojan 1y ago
        That's a ridiculous take. Yes, Russian propaganda works best when they are based on a grain of truth, and it often is. However, it is just that - a propaganda machine serving a dictator.
        LtWorf 1y ago
        That's what Radio Free Europe is… serving foreign interests.
        pphysch 1y ago
        "Our noble warriors, their savage terrorists. Our objective media, their insidious propaganda." Blah blah.
- jonstewart 1y ago
  This is a pretty conspiratorial article… However, widely disseminating an app that supports secure e2e messaging can serve a positive purpose for the CIA in running its agents.
- conradev 1y ago
  The initial funding for Tor came from the Navy (where it was created) and the State Department (where it was helpful for Arab spring) Association with the CIA or In-Q-Tel is not necessarily a bad thing. They have unique requirements for operational security like many other Signal users? The CIA has access to zero-days. They will just use those for targeted attacks and are generally not in the business of mass surveillance? Whereas the FBI and NSA sorta are to achieve their respective mandates The State department has since walked back its love for international freedom of speech with the populist movement in Brazil. They’re active in suppressing speech there, just like they were in promoting it in the Middle East.
  - godelski 1y ago
    > funding for Tor came from the Navy Notably they want it more widely used because it's really not useful if the only people that connect to Tor are spies. Makes finding spies super easy ("X connected to Tor. Okay, let's go arrest X"). How do you prevent that? Doesn't take a genius to figure that out... Similarly, CIA/Navy/whatever doesn't want their tools to have zero-days. You might think "zero-days for me, but not for thee" but come on... we all know that doesn't work. If there's an exploit, the exploit works for anyone. You may have an edge in knowing where to look, but you're not going to maintain that edge for long. Worse, good luck finding out if someone else finds out. How do you prevent adversaries from exploiting your tools? Doesn't take a genius to figure that out... I really hate these conspiracies. Like come on. Yeah, we should be highly critical of US spy agencies and apply a lot of scrutiny. But not everything they touch results in a landmine. They aren't all powerful gods. And they're up against some serious adversaries like China, Russia, and yes, Israel, and the most important one of them all... themselves! Spooks are spooks. They don't trust their neighbors, they don't trust themselves. And if they were omniscient, surely they'd know the very first rule of security: if there's a backdoor, somebody will find it at the least conveniently possible time.
    - conradev 1y ago
      > I really hate these conspiracies. Like come on. The Washington Post: In a statement, WikiLeaks indicated that the initial stockpile it put online was part of a broader collection of nearly 9,000 files that would be posted over time describing code developed in secret by the CIA to steal data from a range of targets. WikiLeaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States. https://archive.ph/QgK0a#:~:text=In%20a%20statement,the%20United%20States. https://archive.ph/QgK0a#:~:text=In%20a%20statement,the%20Un... and: The experience of O.S.B. engineers bore some resemblance to the Apple TV+ drama “Severance,” https://archive.ph/K59TS#:~:text=The%20experience%20of%20O.S.B.%20engineers%20bore%20some%20resemblance%20to%20the%20Apple%20TV+%20drama%20“Severance%2C” https://archive.ph/K59TS#:~:text=The%20experience%20of%20O.S...

godelski 1y ago

See? Mostly nerdy stuff. Like these complaints are weird to put side by side with how we'd critique all the big companies. Its not that we shouldn't critique them (we should) it is that it's weird when we are discussing big tech and act like companies like Signal, Mozilla, ffmpeg, or whatever aren't good models to look up to because they aren't perfect. Because right now the alternative is the status quo. I mean the critiques are mostly valid but wanted to point out they're mostly technical. I really wish the server was fully open. I feel like that could actually create a mixed federated ecosystem. At worst be optional, right? I can get where he's coming from (and now Meredith), but I think there's a lot of value in it and they've solved hard problems before. Even just the ideas of mesh nets in local areas could be a real win for privacy and security. Being a Linux user and signal user for quite some time I'm confused at that critique. What's hostile? That it's electron? I mean that does suck but I've used various open source desktop versions and some TUIs. No real issues so far. What am I missing? Generally the talk I hear about government money is implications of back doors. Just seems like they are more interested in getting encrypted communications into other people in other countries hands. At least that's my understanding of the mission of the organization that's funding them. They'd want that as secure as possible. Government isn't a single entity. If the complaint is morally taking money from the government, yeah it was a weird move. Kinda seems out of character. But not too crazy. Personally I'm okay if they aren't building weapons and there's no strings attached. My understanding is it's not enough money to justify that.

guappa 1y ago
They're not really technical. If you say you do reproducible builds and you don't it's just… dishonesty? Like selling you no chemical fertilisers vegetables and then using them anyway. It's hostile because they want you to use their binary build… which you don't know if it corresponds to the source they have online. And can't verify due to the binary blob. edit: you trust the USA army to not ask any control in exchange for that money? Remember there's no reproducible builds really, and that installing via app store which is linked to an account is very easy to send vulnerable versions to journalists or whistleblowers.
- godelski 1y ago

maeil 1y ago

> - They claim openness but are actively hostile to linux distributions and f-droid. Yet take zero action against TeleMessage.

Ragnarork 1y ago

> - There's a lot of allegations that they don't need VCs because they have backing from the USA army. Citation needed. Strange allegations (and from whom?) when the pentagon itself has discouraged using Signal in an official capacity...[0] [0]https://abcnews.go.com/Business/what-is-signal-messaging-encryption/story?id=120129513 https://abcnews.go.com/Business/what-is-signal-messaging-enc...: > The Pentagon's internal watchdog criticized a former official's use of the Signal app in 2021, calling it a breach of the department's "records retention policies" and an unauthorized means of communicating sensitive information. > "Signal is not approved by the DoD as an authorized electronic messaging and voice-calling application," the report asserted, adding that "the use of Signal to discuss official DoD information does not comply with Freedom of Information Act requirements and DoD's records retention policies."

pphysch 1y ago
The highest military council in the country uses Signal to communicate. I think violating FOIA is probably part of the appeal. Or they use that modified Israeli client that stores messages to address those concerns.
- godelski 1y ago
  They don't use Signal. They use an app that wraps around Signal. There is in fact a difference. Specifically because the purpose of that app is to do exactly what you're accusing Signal of doing. If Signal already did this... why would they pay for the other app?
  - pphysch 1y ago
    What am I "accusing Signal of doing"?

pona-a 1y ago

There also was this one controversy they had with F-Droid. To be on F-Droid, you have to let them build the binaries, because otherwise they'd be shipping untrusted blobs. They demanded an exemption and got promptly denied, so there's that. Their official client also uses Google's push notification services, breaking on deGoogled ROMs. And to top that off, their Git is updated in giant commits like "Released verison X", which makes independent code review challenging. And they require a phone number, which goes against some people's threat model.

Vinnl 1y ago

> - They claim federation is impossible… yet matrix has it. I believe the claim was that it's hard to adapt to changing markets and be federated [1]. Comparing Signal's market share to Matrix's is obviously not a direct cause-and-effect, but Matrix hasn't yet proven that you can get mass adoption that way. > - They claim openness but are actively hostile to linux distributions and f-droid. I'm too lazy to find the specific GitHub comment, but IIRC there was a specific list of features they'd need to actively support F-Droid. It is now available in the Guardian Project's F-Droid repository though [2]. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ [2] https://guardianproject.info/apps/org.thoughtcrime.securesms/ https://guardianproject.info/apps/org.thoughtcrime.securesms...

LtWorf 1y ago
> but Matrix hasn't yet proven that you can get mass adoption that way. Neither has signal. I can contact more people with GPG than with signal.
- Vinnl 1y ago
  No, but Signal doesn't have to prove that centralised services can be successful: other services have already done that for them. At the same time, it has reached far more regular users than Matrix has. I believe market penetration is at about 15% here in the Netherlands, which is a ways off from WhatsApp, but a pipe dream for Matrix.

dogecoinbase 1y ago

> They claim full open source but for several years they did not release the server. Specifically, they didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 [0] while they secretly added a cryptocurrency payment system to which Moxie was a paid technical advisor [1], which Moxie denied they were doing in January 2021 [2]. 0: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/ https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article) 1: https://news.ycombinator.com/item?id=26715013 https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin) 2: https://www.theverge.com/22249391/signal-app-abuse-messaging-employees-violence-misinformation https://www.theverge.com/22249391/signal-app-abuse-messaging...

rkangel 1y ago

> - They claim federation is impossible… yet matrix has it. They absolutely do NOT claim that, at least from a technical point of view: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ > Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.