20 ms·

Sure you should be suspicious. You should always be suspicious. Especially if it's free. And you can do something to calm your suspicions. Like checking out Sig

Sure you should be suspicious. You should always be suspicious. Especially if it's free. And you can do something to calm your suspicions. Like checking out Signlas Open Source code.

gruez 1y ago
>Like checking out Signlas Open Source code. What's preventing them from serving a backdoored version? xz was open source as well, that didn't stop the backdoor. There might be reproducible builds on android, but you can't even inspect the executable on iOS without jailbreaking.
- cherryteastain 1y ago
  You can instead install a FOSS fork of Signal like Molly [1] built by F-Droid directly from the source code [1] https://molly.im/ https://molly.im/
  - Tijdreiziger 1y ago
    Isn’t that against Signal’s terms of service? Won’t they ban you?
    - sneak 1y ago
      It is neither against the signal software’s license, nor it is against the signal service’s terms of service. This is a false meme spread because the Signal founder (who is no longer with the company) didn’t like people making forks without changing the API server URL and running their own servers. Open source software doesn’t work like that, however.
      - deleted 1y ago
        [deleted]
      - Tijdreiziger 1y ago
        Whether they’re open source doesn’t matter (for this question). They control (their instance of) the server. As you say, I do remember them issuing some threats about it, so it would be interesting to know if they’ve changed their stance on this. (Discord, as an example, has banned users for using alternative clients.)
        sneak 1y ago
        Alternative clients are banned in the Discord TOS. The Signal TOS is on their website and doesn’t prohibit any clients. Also, separately, the idea that you can only use a service with a certain client is dumb. Imagine if a website said you can only use a certain browser, or they ban you. It’s ridiculous.
  - deleted 1y ago
    [deleted]
- mos_6502 1y ago
  Signal designs their systems from the ground up to deliver verifiable trust mechanisms (via remote attestation) along with data minimization/zero-access encryption techniques. Here’s one such example, which is also an interesting technical deep dive: https://signal.org/blog/building-faster-oram/ https://signal.org/blog/building-faster-oram/
eviks 1y ago
How would that calm suspicion if you're not arr/ign-orant and understand that continuous security audit is practically impossible at an individual level?

Sure you should be suspicious. You should always be suspicious. Especially if it's free. And you can do something to calm your suspicions. Like checking out Signlas Open Source code.

gruez 1y ago

>Like checking out Signlas Open Source code. What's preventing them from serving a backdoored version? xz was open source as well, that didn't stop the backdoor. There might be reproducible builds on android, but you can't even inspect the executable on iOS without jailbreaking.

cherryteastain 1y ago
You can instead install a FOSS fork of Signal like Molly [1] built by F-Droid directly from the source code [1] https://molly.im/ https://molly.im/
- Tijdreiziger 1y ago
  Isn’t that against Signal’s terms of service? Won’t they ban you?
  - sneak 1y ago
    It is neither against the signal software’s license, nor it is against the signal service’s terms of service. This is a false meme spread because the Signal founder (who is no longer with the company) didn’t like people making forks without changing the API server URL and running their own servers. Open source software doesn’t work like that, however.
    - deleted 1y ago
      [deleted]
    - Tijdreiziger 1y ago
      Whether they’re open source doesn’t matter (for this question). They control (their instance of) the server. As you say, I do remember them issuing some threats about it, so it would be interesting to know if they’ve changed their stance on this. (Discord, as an example, has banned users for using alternative clients.)
      - sneak 1y ago
        Alternative clients are banned in the Discord TOS. The Signal TOS is on their website and doesn’t prohibit any clients. Also, separately, the idea that you can only use a service with a certain client is dumb. Imagine if a website said you can only use a certain browser, or they ban you. It’s ridiculous.
- deleted 1y ago
  [deleted]
mos_6502 1y ago
Signal designs their systems from the ground up to deliver verifiable trust mechanisms (via remote attestation) along with data minimization/zero-access encryption techniques. Here’s one such example, which is also an interesting technical deep dive: https://signal.org/blog/building-faster-oram/ https://signal.org/blog/building-faster-oram/

eviks 1y ago

How would that calm suspicion if you're not arr/ign-orant and understand that continuous security audit is practically impossible at an individual level?