Everytime Wired or Vice publish one of this articles I cannot help but wonder who is pushing that narrative and why?
[flagged]
[flagged]
Signal walks the line between anarchism and pragmatism
151–160 of 342 posts
Re: Signal walks the line between anarchism and pragmatism
#152Earlier quoted context omitted.
You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.
Would it be unfair of me to rephrase as, "It is possible to do this ridiculous, difficult thing that doesn't even always work in order to get some insight into a situation which would be trivial if the source were available with reproducible builds"?
Reverse engineering is not onerously difficult if you have the right tools, some experience, and a decent grasp of assembly language. It's only really annoying if you can't use a debugger.
Re: Signal walks the line between anarchism and pragmatism
#153Earlier quoted context omitted.
The second amendment is all that is left of a philosophy about how the national defense should be done. Originally the intent was that there would be no standing army because it would be too dangerous to democracy. In cases of emergency the militia (armed citizens) would be called upon to defend the nation. It would make perfect sense to have all the necessities for fighting a defensive war in private hands.
Even second amendment supporting politicians don't want the public to have access to high powered sniper rifles and plastic explosives. One thing that always amused me to death is how firearms are banned from the Republican convention.
Odd example, only a small handful of states restrict 50 BMG rifles e.g. "high powered sniper rifles", and basically none restrict the normal sort of rifles that would normally be used by snipers. You can even go over 50 calibre with a background check and a tax stamp.
Even with plastic explosives, basically anybody who isn't a fugitive, convicted felon or a drug user is allowed to get a federal license for explosives.
Re: Signal walks the line between anarchism and pragmatism
#154Earlier quoted context omitted.
You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.
Would it be unfair of me to rephrase as, "It is possible to do this ridiculous, difficult thing that doesn't even always work in order to get some insight into a situation which would be trivial if the source were available with reproducible builds"?
Security auditing an app by source is not automatically easier than security auditing an app from its actual runtime behavior. Source can be a 1mloc tangled mess or have some vulnerable dependency deep in your dependency tree causing app to behave insecurely which could be quickly detected by monitoring how the app behaves in use, network packets sent, memory etc. How else do you think many 0days to closed products were found?
What you say can be true if source is readable and well written and you have somehow a guarantee that source is not modified before publishing the app. Or if you just are inexperienced with auditing the app other than reading the code (I know I am).
Re: Signal walks the line between anarchism and pragmatism
#155Earlier quoted context omitted.
> If a judge ordered you to unlock your phone and hand over all your messages, you’d probably be sour but you should also be morally ok with complying. No. It is not my moral obligation to obey the orders of other human beings. Ever. If you want this to be a moral issue you must first prove that there is a moral basis for compliance and I've yet to hear one. Pointing a gun to my face and telling me what to do doesn't…
There doesn't really have to be a moral basis nor does there have to be consent. You can refuse, and you can choose to live outside of society. That might be very difficult, but you have the choice. For many, society doesn't provide any advantages and so they choose non-compliance and all the consequences that come with it.
"Live outside of society" has a nice ring to it, but the meaning of those words when choosing to disobey court orders converts via bailiff to residing in jail cell. That's not living "outside society" or its constraints. It's very inside of them.
If you want to actually live outside of society, perhaps the only way to do that is on a simple sailboat like Moxie did for a while:
https://archive.org/details/holdFastADocumentaryByMoxieMarli...
But even that only works temporarily because eventually something breaks or runs out, and you will be re-confronted by reality (some society somewhere) once ashore. For example your hypothetical phone unlock is what happened to Moxie. From Wikipedia:
"While entering the U.S. on a flight from the Dominican Republic in 2010, Marlinspike was detained by federal agents for nearly five hours, all his electronic devices were confiscated, and at first agents claimed he would only get them back if he provided his passwords so they could decrypt the data. Marlinspike refused to do this, and the devices were eventually returned, though he noted that he could no longer trust them, saying, "They could have modified the hardware or installed new keyboard firmware."
Re: Signal walks the line between anarchism and pragmatism
#156Earlier quoted context omitted.
There's a case to be made that encryption/private communication has gone through the same sort of progress as personal weaponry has, only on a much shorter time frame and to a much greater extent. In weaponry, it's taken ~200 years to go from bespoke muskets with a firing rate of a couple rounds per minute to semi-automatic and automatic weapons capable of firing multiple rounds per second. In just the last 20-30 yea…
> personal weaponry It's really only just the US being an outlier here. There's no other western country where people think it's normal or a fundamental right to carry automatic weaponry. I therefore cannot see the comparison to encrypted communication. Everyone communicates, increasingly through software. To keep things that once were private private, encryption is a key ingredient.
There’s also no other western country with anything nearly as strong as the first amendment.
Not sure what your point is.
(Also, the production of new automatic weapons for the civilian market has been illegal since 1986, and civilian ownership of automatic weapons is heavily regulated).
Re: Signal walks the line between anarchism and pragmatism
#157Earlier quoted context omitted.
There's a case to be made that encryption/private communication has gone through the same sort of progress as personal weaponry has, only on a much shorter time frame and to a much greater extent. In weaponry, it's taken ~200 years to go from bespoke muskets with a firing rate of a couple rounds per minute to semi-automatic and automatic weapons capable of firing multiple rounds per second. In just the last 20-30 yea…
> I'm just saying that almost no one advocates for the 2nd amendment right to a bazooka This isn't necessarily true. To believe that the 2nd amendment allows the right to carry a concealed weapon basically anywhere sort of requires one to believe every citizen has the right to carry any weapon. The amendment is meant to indicate that congress simply can't regulate whether citizens choose to own and carry around weapo…
I absolutely believe I should be able to own a bazooka, and that the second and first amendments are equally critical for a free state.
People use exactly the same arguments you’re making to justify speech restrictions.
It’s my belief that there’s an underlying social pathology wherein some people are happy to hand power to the state in order to feel safe, regardless of the ultimate consequences, whether we’re discussing arms or speech or any other fundamental right.
Re: Signal walks the line between anarchism and pragmatism
#158”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.” It wasn’t copied from Signal — at the protocol level, it is Signal: https://signal.org/blog/whatsapp/
Also as a slight but important aside, the article mentions end-to-end encryption technology that existed prior to Signal in its opening sentence. It may be that Signal pioneered E2EE chat, but it didn't pioneer E2EE itself. It built upon it in a way that was perhaps more accessible or appealing to a mass audience.
That prior technology, by the way, PGP, is not and was never universally hated. Many businesses continue to use PGP today to exchange encrypted communications with suppliers and customers. It's mostly file transfers, but some businesses even support secure email via PGP, and it's been integrated into a modern secure email product from a Swiss company, Proton, targeted at both consumers and businesses.
Re: Signal walks the line between anarchism and pragmatism
#159Earlier quoted context omitted.
There's a case to be made that encryption/private communication has gone through the same sort of progress as personal weaponry has, only on a much shorter time frame and to a much greater extent. In weaponry, it's taken ~200 years to go from bespoke muskets with a firing rate of a couple rounds per minute to semi-automatic and automatic weapons capable of firing multiple rounds per second. In just the last 20-30 yea…
In my opinion, the comparison to weaponry is pretty loaded and unreasonable. It evokes scenes of mass shootings, secure communication has no similar destructive power. Warrants are still a thing! The government in the US can still get a warrant and they can compel you to show them the contents of your Signal messages. No fancy E2E backdoors are required. ;-)
Unfortunately, it’s not a fringe opinion that speech is similarly dangerous and should be similarly regulated.
It’s also not clear that the US government can compel you to reveal a password, much less compel you to incriminate yourself.
Re: Signal walks the line between anarchism and pragmatism
#160Earlier quoted context omitted.
You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.
Would it be unfair of me to rephrase as, "It is possible to do this ridiculous, difficult thing that doesn't even always work in order to get some insight into a situation which would be trivial if the source were available with reproducible builds"?
>if the source were available with reproducible builds
Does Signal itself even have reproducible builds?