Since a lot of people might not reach the conclusion at the bottom of the post:
Just use SimpleX.
Just use SimpleX.
This guy?
And you might want to tell us how this affects the privacy or security of SimpleX why you're at it.
But it does risk his app being associated with that and therefore discouraging everyday users. I wouldn't be surprised if it ends up as the next EncroChat.
EncroChat was not open-source, so it was much easier to be infiltrated.
That is quite the Twitter timeline.
If they are revealing their identity so that we can vet their credentials, then it makes sense that they would want us to judge them based on their online persona.
If we believe all of this to be true - it’s not really cancel culture, it’s by design that the creator of SimpleX has implemented this filtering mechanism for their users.
Your comment promotes cancel-culture, and as filthy as it is in general, it's even more so in the technology world. Don't do it. Please.
Evident world views far off reason, reality, compassion and pragmatic self-regulation, don't speak for a stable, predictable and reasonable personality.
If a person thinks some humans deserve less rights than others, how could you trust any update to not reflect this world view?
Additionally you may be becoming technologically dependent on a person whose actions may be detrimental to your safety or wellbeing in other parts of your life.
You may also just don't like to promote this person's work.
It's fair to inform others about the person behind the software they are running. Everybody can make their own informed choices.
If the users' communications are encrypted — which they are — there is no way for the creator to "reflect his world view", whatever it might be, in the form of undermining the security or privacy for some part of the user base.
Anyway, since we're talking concrete software, could you point to such code reviews from vibe-independent auditors for continuous verifiable simplex builds targeting common communication platforms?
If not, your point is moot for the subject at hand. Decisions have to be made on the basis of reality not cozy fantasies.
I am not sure I run a single piece of software where this is done. Sporadic audits tend to bring evidence of soundness and security, not continuous absence of malicious functionality.
And yet you run it. Have you vibe-checked every such software? Did that bring you enough information about individuals creating it? If not, if there are no readily available signs, have you vetted their own, private beliefs otherwise — in order to ensure they don't clash with your own?
What if Linus Torvalds turned out to be secretly a Nazi pedophile for the whole time? Would that make you stop using Linux?
But yes, I vibe checked the software projects I use. They are mostly large enough, where single individual failings are of no consequence and unhinged people are usually removed from executive control through various means. But it's trust based on feelings and the information I got. Most people involved in these projects are mature and controlled enough to not mix politics with their work. It's not a good sign to not be in control of such impulses.
And I rather take a chance with the unknown bad, than rationalize the known. Luckily most people with a collectivist FOSS mindset don't turn out to be monsters. Who could have predicted that?!
Your turn.
If you fail to understand why human rights and state repression stances don't matter evaluating trust in secure and private communication means, we indeed don't need to discuss any further. It is a bit silly tho.
>could you point to such code reviews from vibe-independent auditors for continuous verifiable simplex builds targeting common communication platforms?
and sandblast has written a lot of words that indicate “no”, so they’ve been pretty consistently arguing not to use simplex.
Unless you mean that only users personally capable of walking through the code line by line and their immediate friends and family should run code written by neo nazis
Because until there are other means of forming trust available, everyone only got the vibe check. Some perfect world scenario ain't gonna cut it.
If I wanted to make a honeypot that undermines users' privacy and anonymity, I would make sure to be as nice to everyone as possible. The "vibe check" is irrelevant, the false positives are far too common.
You do you. As I said, we all should be able to make informed choices as we please.
However, human being human beings, they find it very hard to sequester their beliefs, emotions from their work. It's a common human failing. Often they are not even aware of it.
Having politically or socially divisive beliefs publicly also makes such a person a target of coercion and encouragement to yield to a "harmless" temptation by way of appropriate 3 letter like agencies.
To ensure that this does not happen will require maintaining a paranoid level of vigilance on the code all the time. That is a lot of work, very expensive and is unlikely to happen. Perhaps not fair to his creation, but that's just how it goes.
My comment is at a high level. This is the first time I heard of Simplex chat, so I don't even know what views its developer has.
You are much more secure blending in the vast masses using WhatsApp than on a ultra-targeted ultra-small app like SimpleX.
black markets and opposition members i’ve used / talked with focus on disposability not security
the premise of their communications is always “the platform is bugged” and in case of opposition members “the government can always just beat you and trick you into unlocking your phone”
deals happen on messenger all the time and burning messages / rotating phones and accounts is very common. for opposition members, messaging apps are purely for benign communication and actual discussion happens in person or in truly destructible formats or it’s not recorded at all
periodically anon burner message apps appear on app stores and rotate out pretty fast once they start getting too much attention
the idea of a perfectly secure app for communication is currently mostly a fantasy; if a malicious actor wants to get your info and communication they will. this doesn’t mean give up completely and be insecure but instead just be in a position to ditch the app when it becomes necessary, if you need that level of security
it’s better people be trained to understand the reality of what can be done with the communication methods they use and how they can be punked so they can make informed decisions — i’m fine with signal’s goals and efforts but i’m not a fan of signal advocates treating security and privacy like another round of the OS wars, that teaches people the wrong lesson and makes it harder to convince ppl privacy and security are a problem we need to take seriously not just for criminals but for everyone. privacy and security benefit us all or it benefits no one
So where exactly is that "much more security" you're touting?
There are many about how they were caught because the used ultra-secure "phones for criminals".