Comment by saagarjha | Hacker News Reader

Comment by saagarjha | Hacker News Reader

A somewhat tangential point: I think Signal's overall response was quite poor and somewhat concerning. Putting aside the usual discussion (Cellebrite sketch, Signal secure), I think the fact that this got published is evidence that Signal does not have very good self-control; or, possibly even worse, that Moxie does not have good self-control and Signal can't stop him from making snap decisions. Doing this kind of stunt is cool when you're a sole hacker working on your own, but when you run a company that makes software for many millions of people you cannot be this cavalier. There should be someone at Signal whose job is to moderate these kinds of responses, and obviously they either do not exist or are not able to do their job, and that is deeply problematic for the company. The blog post showed that Moxie (dragging along Signal) will go scorched earth against anyone who slights him–I mean, really, does a lazy PR blog post from Cellebrite really deserve this kind of response? They're living "rent free" in your head, dude.

(And, just to be fully clear, my support for Cellebrite/law enforcement in this situation is approximately zero. I just think that Signal could spend their time in better ways than going full nuclear against anyone who pisses the CEO off, which is what happened here.)

It is incredibly disingenuous to frame this as a personal "slight". This is a real security threat to the users of Signal, not some vendetta. Celebrite sells their tech to oppressive regimes and they use this against their opponents, who likely use Signal to communicate.

Cellebrite has been operating with their present capabilities for several years. I can see few reasons why Signal would choose to publish a blog post such as this now, if not for the fact that a couple months ago Cellebrite write a blog post that specifically mentioned their ability to extract data from Signal (which, to be clear, was not a specific vulnerability in Signal). This prompted a very pointed response from Signal, which you can read here: https://signal.org/blog/cellebrite-and-clickbait/. The timing makes it pretty obvious that Signal/Moxie took this personally (to say nothing of the general atmosphere when that blog post was written) and then took a few months acquiring a UFED and exploiting it, the results of which we're seeing now.

It's not a vendetta. This blogpost has had cellbrite deploy a more secure update to their software. Law enforcement agencies will be more secure, plus they will probably refrain from hacking signal which is a net positive for it's users. Publishing that blog post is a sound business decision

> There should be someone at Signal whose job is to moderate these kinds of responses

The article proposes the correct solution to this.

> Signal doesn’t have their own in-house General Counsel. At this point, with many millions of users around the globe depending upon them for their privacy, security, and even physical safety, they really should.

Even if the founder was then most composed person in the world that never made snap decisions, Signal is doing something a lot of people don't like. Those people have a lot of legal power and Signal needs to understand the playing field.

> ... Moxie ... will go full scorched earth against anyone who slights him ...

And by "anyone" we mean a billion dollar transnational corporation dedicated to putting his users at risk.

Actually, no! I would be a bit more lenient if this appeared to the case, although the response is still not great. As I mentioned in a comment further down the in the thread, it seems like the trigger for this was not Cellebrite doing its thing against Signal users (which is nothing new) but rather Cellebrite writing a blog post where they claimed that they could target Signal users (which Signal took to mean a claim that Cellebrite had broken their encryption): https://news.ycombinator.com/item?id=27172104

Actually, yes! I didn't mean to participate in an academic seminar on Jungian psycho-analysis. Let's make do with what we know for a fact.

If signal weren't centralized it would just be a server admin/client author you'd be worried about but now if he does something really stupid you'll have to rebuild your social graph somewhere else.

This is why I absolutely refuse to sign up for any more whatsapp/signal style apps.

> but when you run a company that makes software for many millions of people you cannot be this cavalier.

Why? Signal is a nonprofit, has no investors to provide returns unto, has no subscribers or paying customers. Why can't they take a moral stance in the market? Who is it hurting?

I felt their post was entirely fair/fine. It's not like they've shareholders or revenue to worry about. They're free to do what they want. Even the client and server are free software, if Signal itself imploded tomorrow someone else could release a new fork with a different API URL configured and stand up a server somewhere.

Reply on news.ycombinator.com