Comment by godelski | Hacker News Reader

Comment by godelski | Hacker News Reader

Parent Full thread

This is the Moxie that created Signal.[0]

I'm pointing this out because people are acting like he's a bit naive. But Moxie has built a very successful company, without the need for VCs, and the tech is used by many big tech companies. Several use the signal protocol. It's a successful nonprofit building open source software.

If your focus is to make large amounts of money, maybe his isn't the best advice. But if you're trying to make a high quality product, then I think it is good advice. It depends which you prioritize: profits or money. Obviously you can have both, but when push comes to shove, will you sacrifice the product for profits or will you sacrifice profits for the product?

Personally, I believe as engineers our focus should be on the product. The profits are the domain of the business people. The contention we have is good, it creates balance. If engineers overly dominate products roll out too slow and only appeal to other engineers. If business people overly dominate we sell broken garbage. Neither situation is great but which side of the spectrum would you like to be on?

[0] https://signal.org/

[note] sure I know it's popular to hate on Signal but let's be real, this is technical nerdy shit we're arguing over (see the too much engineering side). Not something that's actually broken

I don't believe that 'profit' are the domain of business people anymore than astronomy is about telescope.

You need business skills to run a non-profit as much as you need to run a "for-profit" business or any organization really. Your goal may not to be "to make a profit", but cost control is essential to any organization.

Really, it's a balance of priorities.If you focus too much on the $$$, you risk destroying the business and doing a disservice to your customers. You also have a responsibility to your employees who depend on your business for their livelihood, and so forth.

I think you might be taking my words a bit to the extreme. Of course you still have to operate a business. I'm not trying to argue that and apologize if it came off that way.

Certainly some engineers have to float in the middle too. Bridging engineering and business. Vise versa too! But there is good value in splitting focus between groups (even if those two groups are in the same person). One hat focusing on the product, ensuring that you make the thing that the customer needs, to provide value to the customer. The other hat to focus on making the company not just operational, but as profitable as possible. Together you need to make the company operational. Combined: the engineer constrains the manager to make as profitable while providing maximal value to the customer; the MBA constrains the engineer to not get too lost in technical problems and make profits so that more time can be spent doing those things.

I am not arguing for "no business people". That would be a silly argument. Nor am I arguing this need to be a complete dichotomy. Most people will fall somewhere on some spectrum and realistically that location will change over the course of their career. Traditionally that is moving more towards business but hey... the only reason that happens is because we (or rather business people) decide it is that way. There's no reason it has to be.

I hope you understand I'd never make the argument that you'd go so far as kill the business because the product isn't perfect. Certainly it can be too bad but that's a different case all together.

> Personally, I believe as engineers our focus should be on the product. The profits are the domain of the business people.

This is the dumbest idea in tech. Please don’t listen to this advice. If you’re just starting your career I’m begging you not to laser focus on coding widgets better for the sake of it.

Care about your customers and what problem they are trying to solve and be involved in figuring out how to make solving those problems a profitable endeavour.

All code is throwaway, all code is worthless, solving real needs, wants and pain points for customers is the real source of value.

This is as naive as you’re arguing the parent is. I agree you need to care about customers first, and make sure you’re solving their problem, but you absolutely do need to care about the code and if you treat it as always throwaway you can logically get to a justification for vibe coding. Of course you can get far witn these approaches, but they lead to unmaintainable messes which ultimately make it hard or impossible to actually do the thing you want: to deliver customer value.

I'd argue if you care about your customers, vibe coding will be a no-go. Most of us aren't against it not on principle, but because it's just too risky or too inefficient to bring real value in most applications.

If someday it produces messy but actually reliable code my opinion will change, but at this point, it's just too early (not saying it will ever work, but one can hope)

> All code is throwaway,

It could be, but it cost my company a billion dollars over almost 10 years (not exact numbers, but close enough) to rewrite our current product from scratch. If you work on trivial projects you can throw away code at will. However for a lot of projects the cost to rewrite is so high that the business cannot afford to throw away code that works. The business needs new features so they can sell upgrades and make more money. The whole reason they were willing to pay that billion dollars over a decade is the old codebase was bad enough that adding new features became expensive and hard - the rewrite was an investment to make adding more features cheaper in the long run.

Which is why engineering a good product is important. People who make the product technically good pay for themselves in the long run when the business gets an idea. This is very important to business as well.

> If you’re just starting your career I’m begging you not to laser focus on coding widgets better for the sake of it.

How is that focusing on the product?

Focusing on the product means solving problems for your customers, exactly what you said they should be doing

You're both arguing for the same thing

I agree. I'm a bit confused by the response as well. Idk what I need to clarify but I'm open to suggestions.

I was hoping that dichotomy of sacrificing product for profit or profit for product would help but I'm unsure. Multiple people seemed to have misunderstood but I'm also unsure what was confusing. Frankly I'm having a hard time understanding how they reached such a dramatically different interpretation.

Anyone staring your career: maybe start focusing on making money and potentially lots of it from the very beginning. Because unless you are moxie or had an “exit” (he had an exit) you are doing it for the money. Don’t get distracted in the brouhaha of industry-speak and career-speak.

No? I could do several other things if I just wanted money. I do tech work because that is what I am called to do.

Such as?

The business people sure seem to make a lot more money... I can tell you that I have multiple family members that work in sales and make boatloads. My cousin spends at least 15hrs a week playing golf (something he really likes) on the company dime and getting fancy meals. That's also while making over $300k/yr. Others don't play golf but still do the lunches and meals, getting paid similarly. I'd say that this is a much easier work life than what we do...

Certainly you have non-techncal managers that are making more money than you and do you think they do more work? Certainly some do but I doubt all.

That's illegal in my country… you can't pay fancy lunches. If you want the people getting them must declare them in their taxes :D

Really? I live in a country where the tax authorities are very competent. But company representation is still allowed.

Representation ≠ corruption

Exactly. But I suppose this guy were doing the golfing and lunchenoing as a part of representation.

Doesn't explain why the biggest, most profitable tech companies also seem to have the most user-hostile products. I guess maybe the whole "The users and the customers are not the same people" thing...

  > Care about your customers and what problem they are trying to solve and be involved in figuring out how to make solving those problems a profitable endeavour.

This is, in fact, what I'm arguing for.

What I mean by "the product" is making sure it is solving what customers need. And to be clear, by "customer" I mean the people that actually buy it, not share holders.

  > All code is throwaway, all code is worthless, solving real needs, wants and pain points for customers is the real source of value.

It is not. You can replace code, but you cannot just throw it away and continue to solve problems. That by definition makes it not worthless.

And again, I fully agree we should focus on needs, wants, and pain points. What I'm trying to argue is if you'll forgo that for making profits. Clearly this is what big tech companies are doing. They're shoving in things that are half baked, people don't want, and solve no problems. But they do it because it increases share prices. I'm saying, don't do that

I don't get why you feel your positions are so far apart. Caring about customers and focusing on the product at their most different seem to be perspectives on the same thing, and then only if a really squint.

You switched the object of focus from profit to customers as if they were interchangeable. You are also using code and product/tech interchangeably, forgetting that there is a lot of effort put into architecture, design and usability.

Caring about the customer is caring about the product. Caring solely about profit is what enshitifies products.

I don’t really see how you guys are in opposition. They said to focus on the product, not to focus on the code.

The engineer’s job is to care deeply about the technical aspects of doing well by the customer.

Yes, this is the exact opposite viewpoint parent was talking about. You're taking the MBA stance here.

I think you touch on a key point. Many people assume that developing tech involves VCs. My guess is that one can set technical advancement or market share gains.

The original SV was focused on technical advancement and the current generation sees the technology as the vehicle to their goals.

why do people hate on signal?

- They claim reproducible builds, but use a binary blob… which invalidates the whole concept.

- They claim full open source but for several years they did not release the server.

- They claim federation is impossible… yet matrix has it.

- They claim openness but are actively hostile to linux distributions and f-droid.

- Related, getting signal from an app store is no more secure than getting any random proprietary app.

- There's a lot of allegations that they don't need VCs because they have backing from the USA army.

There also was this one controversy they had with F-Droid. To be on F-Droid, you have to let them build the binaries, because otherwise they'd be shipping untrusted blobs. They demanded an exemption and got promptly denied, so there's that. Their official client also uses Google's push notification services, breaking on deGoogled ROMs. And to top that off, their Git is updated in giant commits like "Released verison X", which makes independent code review challenging. And they require a phone number, which goes against some people's threat model.

> - They claim openness but are actively hostile to linux distributions and f-droid.

Yet take zero action against TeleMessage.

Brian Acton put $100m into Signal and I thought that was the reason that they don’t need funding

I rather think the money for Signal comes (or originally came) from the CIA. Evidence:

> Signal facing collapse after CIA cuts funding

> https://english.almayadeen.net/articles/analysis/signal-faci...

The initial funding for Tor came from the Navy (where it was created) and the State Department (where it was helpful for Arab spring)

Association with the CIA or In-Q-Tel is not necessarily a bad thing. They have unique requirements for operational security like many other Signal users?

The CIA has access to zero-days. They will just use those for targeted attacks and are generally not in the business of mass surveillance? Whereas the FBI and NSA sorta are to achieve their respective mandates

The State department has since walked back its love for international freedom of speech with the populist movement in Brazil. They’re active in suppressing speech there, just like they were in promoting it in the Middle East.

  > funding for Tor came from the Navy

Notably they want it more widely used because it's really not useful if the only people that connect to Tor are spies. Makes finding spies super easy ("X connected to Tor. Okay, let's go arrest X"). How do you prevent that? Doesn't take a genius to figure that out...

Similarly, CIA/Navy/whatever doesn't want their tools to have zero-days. You might think "zero-days for me, but not for thee" but come on... we all know that doesn't work. If there's an exploit, the exploit works for anyone. You may have an edge in knowing where to look, but you're not going to maintain that edge for long. Worse, good luck finding out if someone else finds out. How do you prevent adversaries from exploiting your tools? Doesn't take a genius to figure that out...

I really hate these conspiracies. Like come on. Yeah, we should be highly critical of US spy agencies and apply a lot of scrutiny. But not everything they touch results in a landmine. They aren't all powerful gods. And they're up against some serious adversaries like China, Russia, and yes, Israel, and the most important one of them all... themselves! Spooks are spooks. They don't trust their neighbors, they don't trust themselves.

And if they were omniscient, surely they'd know the very first rule of security: if there's a backdoor, somebody will find it at the least conveniently possible time.

> I really hate these conspiracies. Like come on.

The Washington Post:

  In a statement, WikiLeaks indicated that the initial stockpile it put online was part of a broader collection of nearly 9,000 files that would be posted over time describing code developed in secret by the CIA to steal data from a range of targets. WikiLeaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States.

https://archive.ph/QgK0a#:~:text=In%20a%20statement,the%20Un...

and:

  The experience of O.S.B. engineers bore some resemblance to the Apple TV+ drama “Severance,”

https://archive.ph/K59TS#:~:text=The%20experience%20of%20O.S...

If they had good access, why cut the funding? To subvert the security product where they actually have backdoor?

This is a pretty conspiratorial article…

However, widely disseminating an app that supports secure e2e messaging can serve a positive purpose for the CIA in running its agents.

> - There's a lot of allegations that they don't need VCs because they have backing from the USA army.

Citation needed. Strange allegations (and from whom?) when the pentagon itself has discouraged using Signal in an official capacity...[0]

[0]https://abcnews.go.com/Business/what-is-signal-messaging-enc...:

> The Pentagon's internal watchdog criticized a former official's use of the Signal app in 2021, calling it a breach of the department's "records retention policies" and an unauthorized means of communicating sensitive information.

> "Signal is not approved by the DoD as an authorized electronic messaging and voice-calling application," the report asserted, adding that "the use of Signal to discuss official DoD information does not comply with Freedom of Information Act requirements and DoD's records retention policies."

The highest military council in the country uses Signal to communicate. I think violating FOIA is probably part of the appeal. Or they use that modified Israeli client that stores messages to address those concerns.

They don't use Signal. They use an app that wraps around Signal. There is in fact a difference. Specifically because the purpose of that app is to do exactly what you're accusing Signal of doing. If Signal already did this... why would they pay for the other app?

What am I "accusing Signal of doing"?

> - They claim federation is impossible… yet matrix has it.

I believe the claim was that it's hard to adapt to changing markets and be federated [1]. Comparing Signal's market share to Matrix's is obviously not a direct cause-and-effect, but Matrix hasn't yet proven that you can get mass adoption that way.

> - They claim openness but are actively hostile to linux distributions and f-droid.

I'm too lazy to find the specific GitHub comment, but IIRC there was a specific list of features they'd need to actively support F-Droid. It is now available in the Guardian Project's F-Droid repository though [2].

[1] https://signal.org/blog/the-ecosystem-is-moving/

[2] https://guardianproject.info/apps/org.thoughtcrime.securesms...

> but Matrix hasn't yet proven that you can get mass adoption that way.

Neither has signal. I can contact more people with GPG than with signal.

No, but Signal doesn't have to prove that centralised services can be successful: other services have already done that for them.

At the same time, it has reached far more regular users than Matrix has. I believe market penetration is at about 15% here in the Netherlands, which is a ways off from WhatsApp, but a pipe dream for Matrix.

> - They claim federation is impossible… yet matrix has it.

They absolutely do NOT claim that, at least from a technical point of view:

https://signal.org/blog/the-ecosystem-is-moving/

> Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.

> They claim full open source but for several years they did not release the server.

Specifically, they didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 [0] while they secretly added a cryptocurrency payment system to which Moxie was a paid technical advisor [1], which Moxie denied they were doing in January 2021 [2].

0: https://www.androidpolice.com/2021/04/06/it-looks-like-signa... (source was published shortly after the publication of that article)

1: https://news.ycombinator.com/item?id=26715013 (comment from founder of MobileCoin)

2: https://www.theverge.com/22249391/signal-app-abuse-messaging...

See? Mostly nerdy stuff. Like these complaints are weird to put side by side with how we'd critique all the big companies. Its not that we shouldn't critique them (we should) it is that it's weird when we are discussing big tech and act like companies like Signal, Mozilla, ffmpeg, or whatever aren't good models to look up to because they aren't perfect. Because right now the alternative is the status quo.

I mean the critiques are mostly valid but wanted to point out they're mostly technical.

I really wish the server was fully open. I feel like that could actually create a mixed federated ecosystem. At worst be optional, right? I can get where he's coming from (and now Meredith), but I think there's a lot of value in it and they've solved hard problems before. Even just the ideas of mesh nets in local areas could be a real win for privacy and security.

Being a Linux user and signal user for quite some time I'm confused at that critique. What's hostile? That it's electron? I mean that does suck but I've used various open source desktop versions and some TUIs. No real issues so far. What am I missing?

Generally the talk I hear about government money is implications of back doors. Just seems like they are more interested in getting encrypted communications into other people in other countries hands. At least that's my understanding of the mission of the organization that's funding them. They'd want that as secure as possible. Government isn't a single entity. If the complaint is morally taking money from the government, yeah it was a weird move. Kinda seems out of character. But not too crazy. Personally I'm okay if they aren't building weapons and there's no strings attached. My understanding is it's not enough money to justify that.

They're not really technical. If you say you do reproducible builds and you don't it's just… dishonesty?

Like selling you no chemical fertilisers vegetables and then using them anyway.

It's hostile because they want you to use their binary build… which you don't know if it corresponds to the source they have online. And can't verify due to the binary blob.

edit: you trust the USA army to not ask any control in exchange for that money? Remember there's no reproducible builds really, and that installing via app store which is linked to an account is very easy to send vulnerable versions to journalists or whistleblowers.

I don't know how you say "not technical" and "reproducible builds" in the same breath.

Look, I'm mostly with you. My point is that the issues we argue over are only things us nerds care about. Not the average person.

  > you trust the USA army to not ask any control in exchange for that money?

Warrants suspicion, for sure. I stated so.

From what I know, the money was not through the military. It was through Radio Free Asia, an organization suspected to have ties to the CIA. Notably, the CIA is concerned with foreign targets, not at home. So like I argued, it is entirely reasonable for "the government" to want perfectly encrypted communication systems in the hands of people they want overthrowing a current regime while also not wanting that service to be used at home.

The government isn't a single super intelligent entity working together. It is a fucking shit show of organizations (and sub-organizations) with entirely opposing goals.

They're a non-profit... their books are open. If you are really concerned, switch to Molly. Or idk, use iMessage, WhatsApp, or Telegram. Because those have far less suspicion, right? Sure, you could use Matrix, but I can't get my grandma to use Matrix, but I can Signal. I'll take what I can get.

Lol Radio Free Asia… suspected?

> but I can't get my grandma to use Matrix, but I can Signal

Why not? On the phone they look just like any other messaging app.

> I don't know how you say "not technical" and "reproducible builds" in the same breath.

I don't know how you can cherry pick the technical detail and and ignore what that means without making me suspect you're being dishonest.

Just in case you are honest. It means that you cannot verify the application, so it's no more secure than any proprietary application.

And signal is marketing themselves as MOST SECURE THING EVER!!!!! People should be aware that their main marketing point is false.

I never hated on Signal, on the contrary I recommend it too many people but I can say that the energy consumption on Android is in many cases abysmal for multiple years now and related issues in the Github issue tracker are being ignored. This is for me unacceptable for someone claiming to build high quality software and accepting my donations.

Related issues:

https://github.com/signalapp/Signal-Android/issues/13704 https://github.com/signalapp/Signal-Android/issues/12341 https://github.com/signalapp/Signal-Android/issues/10336 https://github.com/signalapp/Signal-Android/issues/9729

Signal spends a lot of time doing things it doesn't need to do.

For example: Signal doesn't need a cryptocurrency implementation. Signal does need a commercial product offering so they're not just donation funded (there's several obvious, useful applications here - they're doing none of them).

Signal isn’t good engineering though, it just happens to be a decent chat app, of which there is a long history. I only use it because some friends are on there.

None of the builds are actually verifiable so all of the security claims are marketing at best and actively harmful at worst. Safety numbers change and nobody ever bothers to verify them. Random people are added by phone number with no verification (signalgate), etc.

Making a messaging app like this is the “make a TODO” of the single user app world. Which ones achieve popularity has zero correlation with engineering skills.

What is this FUD regarding lack of reproducible builds? The documentation about them is right here: "Signal has supported reproducible builds since Signal Android version 3.15.0, which was first released in March 2016." https://github.com/signalapp/Signal-Android/blob/main/reprod...

Those steps assume you can get images pulled off of your Android device that are actually running. This is the problem with all of these ecosystems.

Regardless, those instructions are useless for iPhone: https://community.signalusers.org/t/add-reproducible-builds-...

If you include a binary blob that you can't verify in the steps… what's exactly the point to obtain an identical artifact?

Reply on news.ycombinator.com