You Will (Not) Escape ☸️ on Nostr: I'm very skeptical of your framing on some of this. I'm pretty sure their funding is ...
I'm very skeptical of your framing on some of this. I'm pretty sure their funding is common knowledge, and even if they don't publicly reference all of their funding, that's not abnormal really. The CIA has good reasons to promote genuinely secure encryption, China and Russia hack our shit constantly, and better to have it hidden from everyone then let out enemies posses it.
Signal is tied to a phone number and everything about the UX practicallly screams "this is not meant to be a desktop app." I feel the worst you could say is that they should be more clear that data sent to your computer from your phone isn't private, but at the end of the day, encryption is only as the device you're using anyway. It doesn't change that much.
The server source code isn't super important for something like Signal as long as you can confirm the clients are doing what they're supposed to. Ik FOSS nerds want to have it as a standard but the reality of the situation is, it's a completely arbitrary place to draw the line. For all you know, the SimpleX servers are also running modified server software that stores everything and collects your keys every time they rotate, etc. You can't tell unless you personally inspect their instance.
You can host your own, but then no one will use it, so you might as well use pen and paper.
You don't really want an encrypted messenger to federate because each chat is only as secure as the dumbest end user, so you want to key management to be as automated and retard friendly as possible. Your only good options are a centralized service or a block chain, and so far the blockchains seem to slow.
This is a much fuzzier issue than FOSS purists are typically willing to consider before you even touch security arguments.
Signal is tied to a phone number and everything about the UX practicallly screams "this is not meant to be a desktop app." I feel the worst you could say is that they should be more clear that data sent to your computer from your phone isn't private, but at the end of the day, encryption is only as the device you're using anyway. It doesn't change that much.
The server source code isn't super important for something like Signal as long as you can confirm the clients are doing what they're supposed to. Ik FOSS nerds want to have it as a standard but the reality of the situation is, it's a completely arbitrary place to draw the line. For all you know, the SimpleX servers are also running modified server software that stores everything and collects your keys every time they rotate, etc. You can't tell unless you personally inspect their instance.
You can host your own, but then no one will use it, so you might as well use pen and paper.
You don't really want an encrypted messenger to federate because each chat is only as secure as the dumbest end user, so you want to key management to be as automated and retard friendly as possible. Your only good options are a centralized service or a block chain, and so far the blockchains seem to slow.
This is a much fuzzier issue than FOSS purists are typically willing to consider before you even touch security arguments.