I gave my two boomer/maybe X-er coworkers (in well compensated IT roles) shit about it recently after one of them made us all sit through youtube ads to show us a goddamn Archer clip on a screen-share. I said "at this point browsing without an ad-blocker should be considered a security risk" and neither of them had any concept of why I thought that or that there was anything sucky about sitting through ads. It took a lot of restraint to not get angry or further mock them
good to know! as a discord/slack alternative that feature seems sorta important though
if all the people chirping about how matrix is shit/compromised and I need to RETVRN to XMPP are right I'm gonna be so annoyed. I'm slowly starting to feel like they might be
yeah I'm glad it exists, people are a bit too eager to shit on things sometimes. Plus the context is kinda "should we recommend this project now" not "is this any good"
I'm perfectly happy with firefox though, never tried any of these alternative/productivity browsers
Self-destructing messages can prevent this, and hostility towards 3rd party apps help in that case since you can be more certain that nobody is using some shoddy implementation that ignores self-destruction or improperly deletes things.
Helps you with local cops for sure. But disappearing messages are also just a false sense of security IMO, there's nothing technically stopping someone from using a modified client like that, in fact some do exist and generally work despite the hostility, and so do screenshots...
If you're somewhere in between like a cartel or terrorist organization, please stay off any app I use to send memes to friends.
I mean yeah, but I don't think this is realistic. If you offer people bulletproof un-censor-able security they're going to take you up on it, even if you don't like them. But signal isn't that
Signal like every mainstream service has some amount of control and uses it to crack down on things like spam. They likely will use that control to censor other things too in the long term. To me that's a bad thing. If it were federated, that power and responsibility would be with the instance/homeserver, not with one centralized organization.
The beauty of E2EE is that you don't need to trust the servers at all, once you verify that you're actually connected to the person you intend to be.
This ties back to my point about metadata. There are plenty of reasons to want to trust the server, and with signal, you can't.
I do agree though, feds doing targeted surveillance have easier ways. The issue is more one of bulk collection, and principle.
And frankly the whole argument about open source safety goes out the window when the source and distribution is centralized, development is done behind closed doors (not sure to what extent this is true of signal clients but it was true of the server), and updates are automatically pushed out.
There are big advantages to the linux-distro-with-maintainers model in that regard, as those are well-versed people who track development and act as a filter between users and a malicious update.
yeah idk what to think. Tor too, its genuinely quite good as far as I can tell, but the background is a bit sus.
Oh gross lol. I kinda assume there's a human in the loop somewhere but who knows
Yeah hotels use either little weight switches or simple beam-break sensors afaik. And they leave them out on the counter usually, so the drinks aren't even cold I last saw one in a holiday inn express iirc, but you can find videos on youtube of how they work.
The stars hypothesis is interesting but I think it was genuinely caused by that youtuber recommending it. The reason it started 2 days before the video's release is because he gives early video access to his patrons, if I had to guess. And that's the only genuinely sus thing about it.
It is worth waiting for some commit history and consistency to be shown before recommending it on the privacyguides site though
if I had to actually work in it every day? nah
but in general yeah. Its kind of a liminal space thing
Yeah, warrant canaries are kind of a joke. They only work if people actually check them and you think the feds are too stupid to notice (or you think the courts actually care about precedent around not compelling actions but they obviously don't). Or I guess if the creator gets merc'ed or arrested but servers aren't seized, but that's not really what they're supposed to be for.
not to be an ultra-anonymous hardened messaging platform to avoid state-level targeted attacks.
But this is basically how it's presented to people in a lot of online spaces when the topic comes up, including here. As the gold standard, best you can get, currently unbreakable.
It's a design decision, not a security flaw.
it's kinda both. Not a flaw per-se, but that design decision precludes any verification that the code they are running is what they publish, and at that point what's the point of open source? Being actively hostile to any 3rd party apps, servers, etc. is pretty suspect. In open source security transparency is paramount, IMO.
I'm glad they finally added usernames and stuff but I don't think we should necessarily trust it either. I use it for day to day chatting. it's at least not getting read by advertisers which is a feature on its own. I would not use it for serious organizing
edit: one final thing
And, since Signal is E2EE, they don't have any useful data to share when they receive a warrant anyway.
Metadata is absolutely useful info, and while signal does protect metadata more than the average bear, I don't think I'd confidently claim they have nothing to hand over if the NSA comes knocking.
I haven't used that feature but a bunch of non-element clients seem to support that according to this: https://matrix.org/ecosystem/clients/ (filter by feature)
Of them, I would say Hydrogen web, and FluffyChat, are the most serious based on features supported and what I've heard about them. I haven't used fractal since before it supported e2ee though
uhhhh
I dunno I only really use it for a once-a-week call and there's a new issue with the web UI in firefox approximately every other call. And that's now that they even support firefox (I think). Before I had to User-Agent spoof to use it. Plus outlook calendar now tries to attach a teams call to every new meeting you create so my coworkers are constantly sending out invites with teams calls that they didn't mean to create.
I mean sure, better than 5-10 years ago, but compared to other existing solutions now it's nothing special IMO