The Signal Server repository hasn’t been updated since April 2020. There are a bunch of links about this here but I found this thread the most interesting.

To me, this is unforgivable behaviour. Signal always positioned themselves as “open source”, and the Server itself is under the best license for server software (AGPLv3 – which raises questions about the legality of this situation).

Signal’s whole approach to open source has constantly been underwhelming to say the least. Their budget-Apple attitude (secrecy, i.e. “we can never engage the community directly”, “we will never merge/accept PRs”, etc) has lead to its logical conclusion here, I guess. I have been somewhat of a “Signal apologist” thus far (I almost always defend them & I think a lot of criticism they get it very unfair) but yeah I’m over Signal now.

    • Dessalines
      23•3 years ago

      Same, /r/privacy and /r/privacytoolsio are so completely watered down that I’ve even seen a lot of pro-microsoft / vscode apologia there. The red flags with signal have been there for years, but they choose to ignore it.

      • @Cysioland@lemmygrad.ml
        10•3 years ago

        I feel like lots of “privacy-oriented” mainstream tech discourse is a psyop designed to direct people to honeypots or even just inferior solutions.

          • @federico3@lemmy.ml
            4•3 years ago

            Never underestimate how many people are paid to influence product reviews, social media, message boards and so on.

        • Dessalines
          6•3 years ago

          Pro US all the way down. It’s why all the reddit “privacy” subs praise microsoft, apple, signal, etc.

          • Ravn
            4•3 years ago

            Off-topic, but the US-centrism is what put me off reddit entirely. I just can’t go there anymore because it makes me immediately feel like a foreigner in another country. I sometimes wish there was an internet-wide filter for anything US.

      • @someone@lemmy.ml
        -1•3 years ago

        They ignore Mozilla’s nonsense too. All though I don’t remember seeing any pro-Microsoft apologia on r/privacytoolsio, any time someone suggested a Microsoft product as an alternative it was shot down saying Microsoft isn’t any better.

    • poVoq
      16•3 years ago

      We had huge discussions about it here on lemmy.ml a few weeks back. In the end I think the main problem with Signal is that (while surely better than WhatsApp) it does not fundamentally change anything about the dependency on a walled garden with servers and developers based in the US. No amount of Signal apologizing can change that, and we should really strive for something better than such a gradual improvement at best.

        • @southerntofu@lemmy.ml
          1•3 years ago

          Do you know of a good lightweight client that works well with tor? I’d like to be able to use matrix but Element is just super heavy (and works really bad over tor because of latency).

        • @je_vv@lemmy.ml
          4•3 years ago

          I had high hopes on Tox, but now a days I no longer do. Its security status hadn’t change for a while: https://github.com/TokTok/c-toxcore See there:

          This is an experimental cryptographic network library. It has not been formally audited by an independent third party that specializes in cryptography or cryptanalysis. Use this library at your own risk.

          The underlying crypto library NaCl provides reliable encryption, but the security model has not yet been fully specified. See issue 210 for a discussion on developing a threat model. See other issues for known weaknesses (e.g. issue 426 describes what can happen if your secret key is stolen)

          And the 2 issues highlighted there are scary:

          https://github.com/TokTok/c-toxcore/issues/210

          https://github.com/TokTok/c-toxcore/issues/426

          To me experimental, as highlighted in the github repo, is not enough, as mentioned in the 2nd issue.

          I really had high hopes on Tox, given its peer-to-peer distributed nature (much better to me than just decentralized by self hosting or so) but I don’t see it improving unfortunately…

          Briar is similar, but a 3rd party is just adding support for desktops, and as well as Tox, and I’d guess as any peer-to-peer distributed messaging mechanism, it’s really battery hungry, and phones don’t survive even half a day with them active. I don’t like Briar’s reliance on Tor btw: https://briarproject.org/how-it-works

          And on such peer-to-peer distributed systems, it seems really hard to get multi-devices support or syncing. But I’d guess there’s no other choice for some people other than Briar. I’m still looking for a distributed peer-to-peer messenger, not consuming the whole battery at least in a day, and that somehow, through mechanisms like the one keybase uses, allow some sync between devices… But the most important thing of course is battery life… Hopefully supporting as well voice/video calls, and some other common stuff to avoid needing other meesengers to support them…

            • @je_vv@lemmy.ml
              1•3 years ago

              qTox is just a desktop client. The Tox protocol implemented by c-toxcore is the one with security issues. BTW, part of the issue is precisely that the Tox protocol is not an e2ee one, and in one of the issues referred the axolotl protocol is shown as an example… So, no matter the client, the Tox protocol is lagging behind in terms of security.

          • @someone@lemmy.ml
            -2•3 years ago

            Oh, I hope it improves. Personally I want my IM client to send and receive e2ee text. Rest should be handled by other programs.

        • @federico3@lemmy.ml
          1•3 years ago

          Tox has a terrible security track record. At the same time, developers are still making wild claims that Tox can protect your from nation-state sponsored attacks:

          Whether it’s corporations or governments, digital surveillance today is widespread. Tox is easy-to-use software that connects you with friends and family without anyone else listening in.

          This is not a code problem.