ta2223332221

Joined 7 years ago

Karma

Submissions

Member since

Mar 14

Recent submissions

Sometimes I wonder if the motivation is to allow petty fraud as an outlet for crime, to keep the people who commit it from doing other less desirable things. Like a stealth welfare.

Comment · 7 years ago

If you want security and privacy to become mainstream, simply make it a boring, invisible implementation detail of your messenging platform which is superior in convenience

I believe that is precisely Signal's philosophy. Which is why for example it uses/requires a phone number instead of a username - which then people also complain about on HN and elsewhere. That it's less convenient than other messengers (which I don't dispute) is not for the lack of trying.

So I suspect the answer is the loudest users/commenters will "never" learn this.

Comment · 7 years ago

but how do you know if it really is the source code of Signal?

That's a valid question which used to bug me about open source projects. But apparently they finally figured out that the output of the source needs to be deterministic and match the binaries they ship. This property is called "reproducible builds". Signal claims to have them (modulo some third party libraries), though I haven't personally verified it: https://signal.org/blog/reproducible-android/

Honestly though, trust boils down to trusting people. I trust Signal because I trust Moxie, and I trust Moxie because of his reputation among the prominent security experts publicly active on the internet, at least the ones that I find convincing. As a security layman, that's the best I can do.

Comment · 7 years ago

"Open source" means the SOURCE CODE is OPEN. Which it is.

The internet is full of half-baked "secure" and "private" chat clients and servers. Security is hard to get right. I'm guessing they don't want the reputation of Signal muddled up with some other random client. IIUC anyone can run their own network, and make it as open as they like, using their code, they just can't call it Signal. Much like how Firefox and RedHat use their trademarks.