Session is shutting down in 90 days
getsession.org
getsession.org
The corollary for this is as a user, you should determine whether or not the business you are planning to depend on has a business model before you choose to depend on them. If there is no apparent income stream, then the business will close at some point and you may as well skip all the heartburn and choose not to use that business for anything you care about. BlueSky, I'm looking at you right now.
Keeping the servers online for 90 days is a very good thing.
This final donation run doesn't change the timeline unless it gets a big amount of money, in which case is it supposed to be bad for them to change plans?
That's a mighty broad brush you're painting with over there.
That's not a reasonable definition. The distrust in the institution is actually a side effect of questioning the authority for authority sake. Anarchists aren't a bunch of individualists that want to burn down whatever we've got in terms of mechanisms in the society regardless if they are necessary. It's just the manifestation of the dialectical opposite of the expression of power and authority.
And privacy enthusiasts just know very well that power shifts and what once was a necessary mechanism can be abused by an elected authoritarian leader.
Not in tech you don't. The business plan these days is try and get as much investment money as you can to redistribute to your friends, have a few parties, hand out some Macbooks and try to get acquired by Google before your runway runs out.
I know you're trying to be snarky, but this is itself a business plan and will impact how the company is operated.
My last job was one of these. Everyone except the CEO and one designer quit. The money was drying up, CEO spent all his time chasing flashy big name customers who didn't want anything to do with us while ignoring customers begging to buy our product.
And on the user side, treat this outcome (company whose product you use being acquired by Google) the same as the company announcing it will go out of business within the next year, because Google will almost certainly shut the service down.
It had to be long, in-depth, and include everything you mentioned.
I was incredibly surprised when I entered the tech and startup workforce that these were generally absent.
I had misunderstood the class and instructor and thought that you couldn't even start a business without one.
Then, when I started raising money for my own venture, I thought for sure a complete business plan was a prerequisite.
Nope. A few graphs, preferably hockey-shaped, and a good story were all that was necessary.
My venture failed, of course. But if I were to do it again, I would do myself the favor of having a complete plan. It would definitely save a lot of headaches and guessing in the moment.
"We'll gather a bunch of talented people together, figure out what this industry needs and then do that, let's hope we can do that before the money runs out" can be a viable business plan. There's no guarantee it's going to work, there's never a guarantee a plan is going to work, but it can work sometimes.
Closest thing I could find poking around.
Here is an example of one of their core growth plan items from the strategy above:
"Social Media Campaigns, Organic and Paid Driving key messages around digital hygiene, decentralisation, and security on social media platforms to raise awareness."
The whole pdf is basically a collection of the remedial "go-to" SaaS growth blog posts everyone thinking about startups read: make content, build a community, turn your community into advocates, write about things people care about etc etc.
Given I've done this stuff for some 20+ years now, here is what is missing and frankly what most folks miss/don't want to admit:
This document basically has no ICP, who is the ideal customer? What is their persona? Who specifically are they, like, super specifically! You can't start with "oh anyone who wants anon-privacy first msg'ing!" That would have been like me at digitalocean saying "oh it's for anyone who needs a VM" - you can't execute a series of steps with that, you can't boil the ocean so to speak, we had to work through communities one at a time, we did: rails, node, php, devops/config management, in that order, split up over quarters and years, maybe it looked like we just...did developers, but we didn't, we slowly worked our way through all the developer communities slightly tailoring towards them while keeping things general enough.
The biggest problem here tho is the classic vitamin vs. aspirin problem. They're selling "better privacy" and "decentralization" - these are vitamins for the vast majority of people - they're things people say they care about in surveys but don't actually switch apps for. The 85% of adults who "want to do more to protect their privacy" aren't switching off WhatsApp. Are they the most secure messenger, or are they a token ecosystem with staking? Those attract fundamentally different people with different motivations...so just bolting them together creates confusion.
Folks need to stop thinking "we're going to do marketing" = "we're going to build a business" marketing, go to market, growth.. these are tiny components of overall business strategy. </rant>
we’ll never actually have this data, but I bet there isn’t much correlation if any between having a business plan and being successful.
have you started a successful business?
There's a lot of corpse businesses around. The walking dead, just operating with zero profit and no realistic plan to be profitable. Their investors are usually just stupid or they think they can eventually squeeze the market so severely they can't go out of business.
In general, observable factors doesn't strongly correlate with success. Probably both because there are so many to choose from and because the real world is complex and typically doesn't align well with any predefined plan.
Not having a business plan looks like "we'll release a free thing, have no way to generate income, lose money for a few years, and then beg for a million dollars." That's not a business plan. That's a waste of your time & your users' time.
> have you started a successful business?
Not yet, but I am actually working on it! Having a meeting with a local business tomorrow to discuss potential market pricing options so I have some idea of how much money I can expect to make. Business plan!
This is literally the foundation story of numerous billion-dollar businesses. In fact OpenAI managed to beg their way into a trillion dollars after losing money offering no kind of product for many years. It sounds like it's just a business plan that you don't like very much.
Off the top of my head, I believe Twitter, Youtube, Discord, Reddit, Imgur each had no monetization at all for the first 3~5 years of their existence. Or more recently there was uv, that write-it-in-Rust Python package manager that had no avenue for monetization but received millions in investment funding a team working on it full-time until successfully getting bought out by OpenAI.
OpenAI, for example, is not profitable as far as I know. I think the users they have now will be in for a rude awakening once they have to come up with a business model in order to pay back their investors. Startups that don't have a business model and get bought also regularly get shut down shortly later, leaving users stranded, look at Nest or Keybase for example off the top of my head.
It's pretty clear that you don't have the faintest idea of what you're talking about.
yes, their business plans was always to engage a lot of users losing VC money until you are a platform with enough moat to add monetization. It was the plan all along
It is the plan for plenty of startups: when it works you become a tech giant, otherwise you fail and no one knows you
Some of the slippery slopes include the wanton privatization and outsourcing of government especially for things that create perverse incentives like for-profit prisons, education, and healthcare, and so-called private-public "partnerships" that usually turn out to be predatory "gotcha capitalism" monopolies that charge people for things that were previously free and paid for with taxes as commonwealth services.
OTOH, another pathology can happen in all sorts of money collecting organizations by putting profits/fees before mission, such as by making worse products or services to sell more of them, seeking maximum fines or fees unreasonably without offering value or a public service, or charging unreasonable fees for things that cost almost or nothing.
Considering how fiercely anti-encryption the UK is/has become (because "only child molesters care about encryption!"), this is sadly reason enough for me not to trust it.
Do I believe they have a backdoor in their software? No.
But if the UK passes a law demanding they introduce one...
What government are you certain will never introduce a backdoor requirement?
Vast majority of products and services can continue on or near zero, with slow or zero velocity.
Really, you can't fire half the team if you have to and keep operating?
1.75M MAU requires very small infrastructure.
You can scale down money.
But you can't scale down commitment arbitrarily.
Why not outsource this to a cheaper country? For example, here in Germany salaries are about half of that, and the talent pool is excellent.
So $150k+ is overpriced.
The gross income to the employee might be 75k in Germany, but the cost to the employer is roughly twice that amount in turn.
In my (very naive) mental model, US salaries are higher, have less "overhead" for the employer, but leave more responsibility (healthcare, retirement) to the employee.
Unfortunately this time, AI does not have vacations, healthcare, retirement or bills to pay and is available 24/7, 365 days on demand.
Many companies only see this as an opportunity to cut down on employees in 2026 and Session will do the same.
So that is why to answer your question:
> ...Germany is one of the most expensive countries for employing white collar jobs?
The main reason why the downsizing will continue until "AGI" is achieved internally.
What true though is that after taxes you might just receive 60% of your total salary once you deduct taxes and insurances.
Donations are fine, but something needs to change or people are just propping up a non-viable business.
An anecdote I have: a friend once had narcotics shipped intl. through Session a few years ago.
> In most markets Senior developers often command salaries exceeding $150,000 USD per year
Not really, there's basically a single sub-market in the US market where that is the norm.
"Session is an end-to-end encrypted messenger that protects your private data. A decentralized app designed, built, and operated by a global community of privacy experts."I also had a contract in Switzerland for a brief, beautiful moment and in 2020 it was not weird to have an hourly rate exceeding 90CHF/h in this role.
Permanent employees were making anywhere in the range of 100-130k CHF, so the 140k USD figure is close adjusted for inflation.
How does that look when you correct for costs of living, because I imagine that would put London at the bottom of the list, as one of those places where senior-level tech salary is not enough to afford living in the city itself (and I don't mean the City of London, but the rest of it too).
That salary would be above the median for most perm senior dev positions in London, but still well within the usual range for established tech companies and well-funded startups.
And yes, a senior dev will be on half that in the public sector outside London - but only if you exclude the pension.
I don't have figures for anywhere in Cornwall. Is there actually much of a tech industry there?
When you've got 90 days till the doors close you cant be picky about your hiring pool.
Once the server and other costs have been paid, the have money for... maybe a part-time junior in Cambodia.
I actually ran a few numbers based on current costs. If you're making $120K/yr in Florida and paying the average cost for a 1-bedroom rental in Tampa ($1,642/mo, as of April 2026 according to Apartments.com), your after-tax take home is $98 (24% federal tax bracket, no state tax) and you have $78.4K after rent. If you're making $180K/yr in California and paying the average cost for a 1-bedroom rental in San Jose ($2,705/mo), your after-tax take home is $130.5K (24% federal tax bracket, 9.3% CA state tax bracket) and you have $98K left after housing.
You can keep fiddling with the numbers, but in most cases, the premium for getting a tech job in Silicon Valley is sufficiently high that you really are making more in absolute dollars despite the higher cost of living.
They're big on dark web drug markets.
Even a decade ago, seniors could easily be pulling 120-150k in markets like Houston/Atlanta/Miami/etc... The relatively cheap markets.
I'm in Atlanta and I'd actually say 150k is a lowball offer for a senior in this market at this point. I'd expect 175k+.
Now - the flip side of this is that current competition is fairly insane with all the recent tech layoffs. So it's possible we're seeing some market correction. But I don't really think it's going to come down much. Between inflation and rising costs... 150k just isn't what it used to be. If it comes down... it's going to be because we're entering a real depression.
---
The amount of money the US government has printed in the last 7 years is... insane. And while it was starting to taper back down in 2023 and early 2024... then we got the GOP, and the GOP is objectively bad with money (not that the dems are that much better...). So m1 supply is rising at a relatively steady rate again.
We going to feel the consequences for a LONG time (or very, very badly for a medium time... with unknown results).
If we knew what it was, we might want to help.
It could still use a paragraph or two of "why we believe it's important for this particular decentralized private messaging app to exist when there are about six hundred other decentralized private messaging apps out there that nobody but people who care passionately about decentralization are using", though.
(This is not a question that I feel their FAQ addresses, either: https://getsession.org/faq)
"Send messages, not metadata"
Project(s) whom, moreover, have often weird shills that, if you squint your eyes just a little bit, suddenly look like xxxINT moles.
So if only for that tagline, thanks a huge lot: metadata are more important than the content of the messages themselves and you have no privacy if your phone number and contacts are known.
Excuse me, what?! Spending $22k a month in infra as a pre-money startup is insane.
Haha. The wording's equal too!
20k per month in infrastructure. Excuse me, what?
> approximately $65,000 in donations. This is enough to maintain critical Session infrastructure for the next 90 days. We are extremely grateful for the support Session has received from the community, but unfortunately this is not sufficient to retain full-time developers. As a result, all paid staff and developers will have their final working day on April 9, 2026. After this date, some team members will continue on a primarily volunteer basis to help maintain Session until July 8, 2026.
Edit: here is a snippet from google AI:
Signal is a secure, user-friendly WhatsApp alternative requiring a phone number, while Session prioritizes maximum anonymity with no phone number, onion routing, and a decentralized networkOne thing that I've learned is that privacy is a secondary concern. It's never a primary one.
If your app's main differentiation is privacy, it won't sell. Users just don't care about it that much.
When I say privacy, I mean supporting the company promises a stronger privacy mechanism e.g. run locally, e2e encryption where the company itself cannot access your private info. This is the case for Session.
It turns out most users are okay with you promising not to use/access their private info for other means. That's already sufficient. Then, other factors e.g. usefulness are more important.
"No no, that's not what I mean. I mean, privacy is this only, specifically this set of technologies applied to this very specific set of products, and nothing else. Whatever definition will allow me to make this conversation as uninteresting as possible."
Look, I guess my point is, privacy is complicated. In my example, I suppose OpenAI could authorize access to something. They already do, for training. Right? And in some sense, something valuable leaks from one users' data to another. It is still privacy when access to your data is limited in some important way from other people, even when you (or a lot of people, or other people) could benefit from such access. The biggest apps in the world have very, very complicated privacy stories.
"Why not use $COP_APP?" "It's not private" "Well it's by a private company, it's not run by the government or anything - what the fuck are you talking about, corporal?"
Support told me that login method had been around for a while, and I didn’t know it. So suddenly, I was locked out and couldn’t access MY ACCOUNT. I used to promote Session, but since their support response was basically a big “fuck you,” I say “fuck you too,” and I hope people switch to SimpleX.
Grounding identity in a phone number is very reasonable for almost all normal usage. It makes recovery simple. It does block the ultra paranoid use cases though. Oh well.
Session aims to provide anonymity, Signal aims to provide privacy.
Obviously, I'm not really claiming that it's not possible people are experiencing this issue, but it can't possibly be widespread.
I feel like most likely people are using android skins that aggressively kill apps in the background.
There's something deeply wrong with the way signal delivers messages...
It's worth mentioning that Session had started out as a fork of signal.
For this reason, it's hard to trust them. The encryption quality is irrelevant if the slop coded client is blasting random photos to random contacts.
Send a GIF to Contact A, Contact B receives random private images? Absolutely inexcusable slop code project. This class of state management bugs should not be possible with a well-architected client, period.
Signal's E2E encryption is more like End 2 Random End.
From GitHub comments: https://github.com/signalapp/Signal-Android/issues/10247
Greyson:
> Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21)
They had a difficult to reproduce problem reported in late December 2020, and got the fix rolled out seven months later.
Not sure your criticism "absolutely inexcusable slop code" is well considered.
Knowing that bug COULD exist, means that you cannot be sure that messages you send in Signal will make it to the recipient you intend given the poor quality. This means the E2E encryption is fundamentally broken, by the way. Because the client is lying to you about the true state of who it's about to send to.
The recipient text has fundamentally zero relationship to the true recipient of the message given that bug.
Having the UI and message sending code reference two different versions of state is incredible incompetence.
In many jurisdictions, telecoms form an abusive oligopoly, and you need to provide a state-issued identity document to get a phone number.
That is not at all reasonable for normal usage - unlike well-known non-abusive authentication methods, such as a keypair; or its even simpler cousin, the username/password.
Oh, so there are "wrong questions" now? Yeah, I guess I'll have to get better at asking those real quick.
On top of that so many other things just inherently expect one to have a phone number. It would be somewhat odd to not have a phone number for most of the people I know and talk to through platforms like Signal.
So to your question of which is easier, having the state ID and a phone number is easier because I'll already have that for a multitude of reasons.
If you live in a place where its rare to have a phone number, then yes I agree Signal probably isn't a good choice.
What's easier, using a tool that's already in your hand or going to the tool store, searching for a new one, and swapping to that one? Just using the tool already in your hands, that you're already using, that you've been using for a long time.
It's exactly what you asked, just not the perspective you cared to look at.
If you insist that 2+2 equals "3 or 5 depending on perspective", ok sure let's work with your scenario of comparing registering a pre-existing state/telco ID with creating a brand new user/pass account (again: instead of what I asked you to compare). Well, suppose you were to lose your ID and/or your SIM - do you think you'd be able to renew them and regain access to your stuff in the same amount of time it's taking me to write this now?
Plus, I guess you've never seen bad actors buy fake ID/SIM accounts faster than you can block 'em - and much more quickly than any individual good-faith actor (with a single ID/SIM honestly linked to meatspace) would able to get out of harm's way in such a scenario.
>What's easier, using a tool that's already in your hand or going to the tool store, searching for a new one, and swapping to that one? Just using the tool already in your hands, that you're already using, that you've been using for a long time.
Hammers, nails... You're trying to make it make sense by dumbing it down.
In the end (again conforming to your framing), the "easier thing" is the one that fewer people will expend energy to prevent you from doing. And this last consideration kinda-sorta makes your reply be an answer to my question, except that I had to do the work of connecting the two, so now you owe me 100EUR.
I've answered it twice. Its easier to use the thing you already have than it is to make something new. Is that really difficult to understand?
> you could've registered a brand new account with username, password, email confirmation, and OTP 2FA, on any service that supports those
And then spend the many, many, many hours to share that new unique identifier with all the people I want to talk to. Or I can just continue using the same identifier they already know me by and have known me by for decades.
> I guess you've never seen bad actors buy fake ID/SIM accounts as quickly as you can block 'em
Whaaaa I thought you just told me a phone number is such an incredibly hard and challenging thing to get, now you're telling me anyone can easily get them anytime they want?
So phone numbers are incredibly challenging to get and yet people get them all the time easily. Otherwise, if phone numbers aren't hard to get and anyone can just freely get them what are we even really debating about?
For billions of users, having a phone number as their identifier isn't a challenge and is for sure the easier process and having to make a new unique identifier is a bigger deal and introduces far more roadblocks to effectual adoption. Its why WhatsApp uses it, its why iMessage uses it, its why Telegram uses it, its why WeChat uses it, and many others.
I asked which is easier to make.
This is, evidently, an extremely difficult question to understand.
>Whaaaa I thought you just told me a phone number is such an incredibly hard and challenging thing to get, now you're telling me anyone can easily get them anytime they want? >So phone numbers are incredibly challenging to get and yet people get them all the time easily.
Not phone numbers; accounts gatekept by them.
Not anyone; only bad actors.
>I thought you just told me
What I just told you is written in the parent post.
You have the right to misread it any way you like, and think whatever comes to your mind easiest. But since that's not how a conversation works, I will ask you to exercise that right somewhere I can't see you - and by the way you still owe me 100EUR, but since I'm not an actual cyberstalker, I won't be chasing you down to collect. So relax.
Which is easier to make? The one I don't even have to make, I already have.
Which pizza is easier to make, the premade pizza that's already ready to eat and is right in front of you, or the pile of ingredients in the pantry and fridge? Uhh...the pizza in front of you ready to eat? Put it on a plate and eat, it's there, it's ready to go. And practically everyone already bought their pizza and it's already in front of them.
And no, you didn't ask which is easier to make.
> What's easier: to obtain state ID, or to sign up to a website with your preferred username and password?
Where's the word "make" in that?
> Well, suppose you were to lose your ID and/or your SIM - do you think you'd be able to renew them and regain access to your stuff in the same amount of time it's taking me to write this now?
Well, I'll end up wanting to replace that ID and SIM for once again a multitude of other reasons, so having that identifier tied to that really doesn't increase any complexity. Its really not that big of a challenge for billions of users, its something they're going to already do. When the school needs to urgently get a hold of me, they'll call my phone number not refer to me by some handle on a jabber server with a population of one. This same thing applies over and over and over and over for tons of people.
Meanwhile if I've got other accounts tied to other processes that get lost in their own unique ways, I'll have separate issues to get those unique identities recovered. Sounds like more work, not less work.
You now owe me 20,000,000,000,000,000,000EUR, but since I'm not an actual cyberstalker, I won't be chasing you down to collect. So relax. Such a useless thing to add to the conversation.
My condolences to any children who have to interact with you.
>You now owe me 20,000,000,000,000,000,000EUR, but since I'm not an actual cyberstalker, I won't be chasing you down to collect. So relax. Such a useless thing to add to the conversation.
Nah chill, I'll be there shortly with the money.
Yeah if you compare that with Facebook messenger and other such services but if you want secure communication it's not reasonable.
Hack Club almost went insolvent in 2017. We would have, if it wasn’t for 2 friends who stepped in near the end and saved us. Today there are tens of thousands of teens involved and doing amazing things.
I’m disappointed by all the negativity in the comments. I’m not familiar with Session, but raising donor funds is a very different skillset than software engineering and anyone who is trying to do both has my respect.
Certainly, there were enough people making money through it that they should have been able to cover operating expenses. How did they go about appealing for donations - was there a notification inside the app, or did they rely on word of mouth?
I just checked and they claim to have moved their infra to Switzerland.
There are many other issues, some I've forgotten about since I would never trust it in the first place. They also require a phone number even!
Seeing them go, I feel neutral. It's always good to have more anonymity software, just not this for me.
> They also require a phone number even!
"You don’t need a mobile number or an email to make an account with Session." - https://getsession.org/faq#identity-protection
"The developer of Session, an encrypted messaging app, has moved operations to Switzerland as ‘being in Australia just threatened our credibility as a privacy tool’."
What else in particular are you talking about?
With the phone number, I may have not remembered correctly for this particular software. If I could edit my comment, I would add a note.
But when going to the FAQ link I remembered how bad this piece of software was especially promoting cryptocurrency. I would never want a messenger to promote crypto, such a "Signal"
Edit: used different quote from the article
My understanding is that the government could compel Facebook to publish a version of WhatsApp with a special mode that sends all messages to the police if the user ID is 1234567. This introduces a vulnerability but it is limited to one specific person. If your user ID is not 1234567, you're completely unaffected.
However my understanding is that the government cannot compel Facebook to compel a version of WhatsApp that, when it receives a special message, silently starts sending plaintext copies of every other message it receives to the police. Such a mechanism would be a systematic weakness that affects people other than those for which a warrant has been issued, so the notice would "have no effect".
The government could also not compel a source-available app with verifiable builds to stop distributing them so that it can add a secret user ID branch like the one I mentioned above for WhatsApp.
[0]: https://classic.austlii.edu.au/au/legis/cth/consol_act/ta199...
[1]: https://classic.austlii.edu.au/au/legis/cth/consol_act/ta199...
See: https://lowendbox.com/blog/australian-police-will-soon-have-...
"These new warrant powers include:
1. Data disruption 2. Expansion of targeted devices to include all devices a suspect uses or might use 3. Account takeovers"
Australia is extremely draconian.
No? Where did you get this from? I have used the app and was never asked anything. I was given an id I could share with others and that's it. Very simple. I wish more apps had this easy onboarding process.
Translation:
Our product makes no money, has no use case and we need $1M to survive.
Two ways a PE "cost saver" would fix this:
1. Claude + 1x senior engineer (in India).
2. CTO + Claude and no senior engineers / employees.
Given we have (allegedly) achieved "AGI" (heavily disputed) they don't need as many employees.
Especially those that are after $150k+ which when you can vibe code with Claude for less than $10k anyway. /s
Job done.
They're hoping one of the rich dark web drug lords that use the app will sponsor them with crypto.