Notices by Dmytri (dk@tldr.nettime.org)

@cherti @clayton the signal project proved it's toxicity in the early days with the f-droid fight.and many times since. Nobody is persecuting them for "doing things different" but for real bad choices and bad responses when called on them. But for the last time, it's not federated, I can't run my own server in any practical sense, so it doesn't belong on the OP list. End of story.

@cherti @clayton if Signal does eliminate the phone number issue that will change things somewhat, tho after all these years, I'm not holding my breath. Also, can I use Signal Desktop with my phone off yet? Or must I be physically trackable to send messages still?

@cherti @clayton

A volunteer and donation based business model can be ok, however it's certaily not ok when it ties you to a central server and demands you disclose private information.

This makes your platform vulnerable to what I've called "the pennybags attack" operating costs rising along with user growth leading to trading user data for money, or simply being coerced to give up the data for business continuity.

Even federated models are not immune to this, and I would prefer something properly end to end with no servers.

So while Matrix is an imperfect alternative, Signal is literally WhatsApp with a smaller, and thus more conspicuous, userbase.

@cherti @clayton the single worst case scenario data leakage is phone number disclosure in any vulnerable situation. Signal fails before you share your first message, There is nothing more to discuss.

@cherti @clayton

"Hello, welcome to our dissident activist group ... please give me your phone number"

Nice try CIA

@cherti @clayton dude, you're 'splaining now. Chosing the right messenger will certainly not clear away all risks. Choosing the wrong one, namely Signal, will create new risks. Now please don't tag me on anymore Signal related messages, this is more time than I have discussing a dodgy project that will never be something "everybody uses" and is not intended to be such by it's intelligence affiliated funders. Tell someone else. I'm happy to use it, like other IMs when needed, I do not recommend it, ever, and it does not belong on the OP list, which features *federated* projects.

@cherti @clayton it's been discussed many times, and I'm familiar with the Signal apologia. Yes, there is no perfect tool, yes no tool is a guarantee of safety, none of this changes the fact that Signal should not be recommended for the reasons already stated. Sorry for the impatience, nothing personal, just tired of talking about this project which has always been toxic imo.

@cherti @clayton this is from *2016* and most of the criticism was already old and well known then. It's almost 2023.

https://it-kollektiv.com/wrong-signal-das-falsche-signal-engl/

The original notorious f-droid and libresignal github threads have long been deleted iirc, but I remember them well, same with the Axolotl/Proteus, iOS wars, etc.

And we all probably know where OTF money comes from, and can see that Signal has no real business model, yet insists on being the only organization that can run servers,

If that's "tinfoil" then bake me a potato.

@cherti @clayton OTF, not Signal, is Radio Free Asia 2.0. It literally is.

It's good to hear it's possible to use desktop without your phone on, and I'm sorry if I misunderstood before. My impression was at one point the only way to use Signal on your laptop was if your phone is connected. My mistake.

Your comment is dishonest tho, since it's clear, even to you i'm sure, that you are using a fallacy, being wrong about one thing in no way indicates error about another. I'll take it as a joke due to the smiley, but it does make you seem a bit desperate to defend Signal.

If they remove the requirement to disclose a phone number then that would be an improvement, at least for the people already using Signal due to it being widely promoted as a secure tool for activists and dissidents, many of whom may not know better or have a choice.

Tho as you correctly point out, it would still be problematic because of the fact that they are funded by the regime change industrial complex, have no business model, and refuse to federate with any other servers. So thanks for pointing that out again. Something that didn't tie to you to an intelligence-affiliated centralized server operator would indeed be better. You are right!

@cherti @clayton the signal team has been ignoring criticism for many many years, I don't see them as being credible on privacy at all. Cryptography, sure, took them years to work without google play services, fraught with f-droid, still require phone numbers, etc, etc, etc. Not a good actor in the community, never have been.

@cherti @clayton just memory of the various issues and shenanigans around signal over the years, things Moxi has said, etc. It's always been a sus project. The phone number disclosure and lack of federation is enough to make it not belong on that list tho, so believe what you want about the rest. Matrix does not require phone number disclosure and has federation.

@clayton Signal is not free software (only the client is) and requires phone number disclosure to use. It should never be recommended as an alternative to anything. Matrix/Element makes more sense in that list.

@cherti @clayton my understanding is that it is not compete, that the software running on the backend of Signal itself is not the same. In anycase, it does not federate and requires phone number disclosure. Not a project that should be supported. Again, Matrix/Element is more appropriate for this list.