- cross-posted to:
- privacy@lemmy.ml
- cross-posted to:
- privacy@lemmy.ml
We as a community must stop recommending Signal. For far too long we have blindly followed this app without a second thought. It has created a cult of followers, when there are much better apps out there for us to use.
https://archive.is/Lhe24 archive for the essay
This essay was posted to r/Privacy and subsequently removed and censored for literally No Reason. This is honestly really scary: https://old.reddit.com/r/privacy/comments/wj5svi/signal_messenger_revealed_to_have_cia_ties_funded/ https://archive.ph/FZr1d
I am seriously hoping we can have a discussion about this on lemmy. @TheAnonymouseJoker , I know you from r/PrivateLife, and thought you’d be the one to go to about this. Thanks for being open in the past and not bowing to the inner circle of reddit cringelords.
I also am preparing an essay of my own about a complicit honeypot-ish web going on between Signal, Skiff, r/Privacy, r/PrivacyGuides, etc. They have a crazy little cabal that is very creepy. Any materials are welcome. Every time i turn over a stone i find two more. More to come.
There are legitimate reasons for not wanting to use Fdroid and their builds are apparently reproducible, not sure what you mean about not being fully FOSS either. https://signal.org/blog/reproducible-android/
The client app is FOSS other than the Google blob for notifications. The server SW is partly closed source because they say that is needed to prevent spammers.
Thank you, I appreciate the info.
Such as?
The security risk their signing process introduces. My guess would be Signal wants a 0% chance of a malicious client being distributed, hence why they only allow direct apk downloads (which self-updates, essentially making an F Droid build obsolete) and Google Play. I would also guess this is why Signal only packages a deb package (if anyone knows a better way to run Signal desktop on fedora [besides the flatpak] than my current solution of spinning up a Mint Virtual Machine [maybe distrobox?] please let me know!) and literally has no official support for rpm based distributions.
Some developers don’t like their key signing process.