4mo ago

Under Meredith Whittaker, Signal Is Out to Prove Surveillance Capitalism Wrong

www.wired.com Under Meredith Whittaker, Signal Is Out to Prove Surveillance Capitalism Wrong

On its 10th anniversary, Signal’s president wants to remind you that the world’s most secure communications platform is a nonprofit. It’s free. It doesn’t track you or serve you ads. It pays its engineers very well. And it’s a go-to app for hundreds of millions of people.

Privacy @lemmy.ml

Signal Is More Than Encrypted Messaging. Under Meredith Whittaker, It’s Out to Prove Surveillance Capitalism Wrong

www.wired.com /story/meredith-whittaker-signal/

537 271

You're viewing a single thread.

169 comments

What is signal anyway? I've never paid attention to phone apps much. Why isn't it on F-droid if it's FOSS? Is it like irc but with encryption? I guess I should look into it.
- Why isn't it on F-droid if it's FOSS?
  That got me interested and apparently, they fear forks running out of date.
  Concerning F-Droid, we already providing an auto-updating APK directly from our site, and we really don't want forked versions of the app maintained by other parties connecting to our servers. Not only could the users using the forked version have a subpar experience, but the people they're talking to (using official clients) could also have a subpar experience (for example, an official client could try to send a new kind of message that the fork, having fallen out of date, doesn't support). I know you say you'd advocate for a build expiry, but you know how things go. Of course you have our full support if you'd like to fork Signal, name it something else, and use your own servers.
  While that statement got plenty of thumbs down, I hate to admit that F-Droid is indeed out of date quite often. I currently can't find a source for this but I once read this has something to do with their signing process.
  
  Yes, they manually sign every package.
  But they could easily have their own F-Droid repository, I have repositories for FUTO apps like Grayjay and their keyboard, Bitwarden, and Newpipe, among others. Those are run by the projects themselves, so they're in charge of how often they update it, as well as how they sign it. So if they have issues with the "official" F-Droid repositories, they can always host their own. I honestly prefer projects that host their own repos precisely because they should, in theory, update faster.
  That said, a self-updating APK is good enough for me. However, I didn't see an install option easily listed on their website and had to search for "signal android apk" to find the page. It should be listed on the regular install page on their website, next to the link to Google Play. I found three separate pages for getting it for Android, and all three had a link to Google Play and only one had the APK.
  
  Hmm, ok, thanks. But I'm kind of tired of version churn: who needs to keep changing a chat program? IRC has been around since the 1980s or so and still works fine.
  
  who needs to keep changing a chat program? IRC has been around since the 1980s or so and still works fine.
  some people like texting their family who doesn't use IRC, and they'd rather not send messages in plain text for one reason or another.
  
  I get that IRC is old school and encryption is important. My question is why the program has to keep changing. If the task is simple enough, there shouldn't be incompatible changes required if there are new versions at all.
  
  With new possibilities due to new tech user demands rise, too. People asked for features like group or video chats or coupled devices (not trivial with E2EE) and since good companies listen, they developed those and still do.
  Also, I don't think there's a single IRC client still in use that hasn't been updated since the 80s. I wouldn't be surprised if your favorite client got an update in the last couple of months - and that despite it being a trivial protocol.
  
  https://media.ccc.de/v/3e0a51f5-f60a-4a90-a78a-3a311c6ffe41 here the author explains why and it all sounds like a bucket of bullshit
  
  Thanks, I might try to watch some of that.
- It's more like WhatsApp or messenger (pick your poison on which one I am referring). Fairly lightweight. No useless features. And I think there's an F-Droid version, running as Molly.
  
  Interesting, it looks like molly.im has its own f-droid repo, but there is nothing about Molly in the regular f-droid repo. Thanks though. I guess I should look into this a bit more. I'm way out of date with phone stuff.
  
  Molly allows you to use alternative push servers (instead of Google's), amongst other things.
  
  Oh interesting, yeah I saw some reference to Signal relying on some kind of Google service. I figure I would want to self-host anything I was serious about. It also looks like these things do video chat, so they're much more elaborate (perhaps unnecessarily) than IRC, which is text-only. I've never used Whatsapp and am not even sure what it is, except that for a while I confused it with Instagram.
  I've installed GNU Jami and that seems like enough for video chat? I just haven't had occasion to actually use it. I'm not a video guy and frankly am usually happy with email. PGP from the 1980s still works fine, if anyone cares.
  
  The aim of Signal Foundation is to displace the likes of WhatsApp and Messenger thus it has to support all modern and expected features.
  Interestingly enough WhatsApp uses Signal's protocol for encryption, it's part of the planned messaging interop forced on Meta by EU.
  
  Thanks that is interesting. I wonder if newer versions will use MLS.
  
  And (what is important to me now) allows using any Socks proxy instead of only Signal's own censorship-bypassing solutions. This is a weird decision on Signal's part, because in places like this, you might need to switch between various protocols when the old ones stop working. And for Signal, developing censorship evasion is not the primary task so naturally they would not be as advanced and quickly-evolving as the communities dedicated to it.

169 comments