• 8 Posts
  • 158 Comments
Joined 2 years ago
cake
Cake day: July 9th, 2023

help-circle










  • Hi, what about gnu linux xz utils backoor scenario?

    This was caught by the community thanks to it being FOSS, and it was somewhat distinct from the scenario we’re talking about here, since the repository was wholly taken over by a bad actor who tricked the original (burnt out) maintainer to hand over the repo.

    Could a bad actor get their claws in and take over the repo? Possibly, but given the fact that it’s maintained by a foundation with lots of devs and not just one thankless hobbyist, that likelihood is probably small.

    Also is there any regular auditing of signal by third party auditing company?

    Regular? I don’t know. They have been audited, iirc, and they have received numerous legal requests to turn over data to courts, to which they’ve been able to reply “what data?” Bear in mind that they would almost certainly not do this if it meant jeopardizing their entire business. No business is going to go to jail for us, after all.

    You do what you feel is appropriate for your threat model, but as far as general threats to privacy or Signal’s existence go, I’m not currently concerned about their future.


  • Signal Foundation is a nonprofit in California, and they are the ones that operate the relays and maintain the FOSS app. Since they’re a regular 501©3 and not a religious org, you can look into how their money is spent (to see if it’s going to any suspicious recipients) and whether they’re getting suspiciously large sums of money.

    On top of that, they don’t have access to the communication data itself. It’s all E2EE, and the app being FOSS means you can inspect how that data is encrypted and sent (and even build your own from source, if you’re paranoid). Even if they’re unknowingly hiring covert bad actors, it’s unlikely their activities would stay hidden for long.

    So while it’s certainly a concern that it’s still centralized messaging, it’s probably one of the best options due to the easy access for most people. Other than a billionaire buyout or government laws that force backdoors into encryption, the only real existential threat they currently face is operation costs. They were fortunate to have wealthy philanthropists in the beginning, but if they have an explosion in users (unlikely), it might bring the organization to its knees.

    I don’t find your particular scenario to be worrisome. And if it turns out that it’s compromised in the future, there’s other good apps out there, like SimpleX.









  • You need to cite specific people, because right now, your post reads like the screed from an Alex Jones’s rant. Vaguely gesturing towards some shadow organization isn’t useful information, and it can lead to being manipulated by people who know how to weaponize that vaguery. You can’t act against the unknown.

    There’s certainly bad actors at work, but they operate out in the open. Everybody who hovers in Trump’s orbit, everybody who worked on P2025, the Heritage Foundation, the Federalist Society, fundigelical churches, every billionaire…

    If they currently have money or power (often both), they’re almost definitely part of the current problem.