Privacy is priceless, but Signal is expensive • Hacker News Board

Re: Privacy is priceless, but Signal is expensive

#781

Post by 8organicbits » Fri, Nov 17, 2023, 8:56 AM UTC

jillesvangurp wrote: post #770

Drblessing wrote: post #710

2022 Salaries for those interested: https://projects.propublica.org/nonprofits/organizations/824... Compensation Key Employees and Officers Base Related Other Jim O'leary (Vp, Engineering) $666,909 $0 $33,343 Ehren Kret (Chief Technology Officer) $665,909 $0 $8,557 Aruna Harder (Chief Operating Officer) $444,606 $0 $20,500 Graeme Connell (Software Developer) $444,606 $0 $35,208 Greyson Parrelli (Software Developer) $…

Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure. > We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. Simple solution, go distributed. 6M $ for that. Stop doing that. What do d…

Have you tried verifying your contacts? It's clunky, but I believe this is how signal handles the problem:

https://support.signal.org/hc/en-us/articles/360007060632-Wh...

Using signal without verifying contacts is like bit like using HTTPS without verifying certificates. It prevents passive monitoring.

Re: Privacy is priceless, but Signal is expensive

#782

Post by austin-cheney » Fri, Nov 17, 2023, 9:00 AM UTC

As a counterpoint imagine instead if the cost of messaging went from $50 million per year to the even more lean $0 per year.

Messaging operations are expensive because they need servers to route your traffic. They need to route your traffic to navigate around the restrictions of IPv4 NAT. In a world of IPv6 there is no NAT (but firewall restrictions still apply).

I have created a relationship model that solves for privacy without need for third party servers and then routes messages based upon that model, but it’s limited by IPv4.

Re: Privacy is priceless, but Signal is expensive

#783

Post by eviks » Fri, Nov 17, 2023, 9:02 AM UTC

kortex wrote: post #599

DavidSJ wrote: post #586

Earlier quoted context omitted.

I expect messages to disappear when I turn on disappearing messages and not when I don’t turn them on. But yes, I agree it’s not the right choice for me and many others who want to have full ownership over our data, and they should make that clear in advance.

> But yes, I agree it’s not the right choice for me and many others who want to have full ownership over our data, The whole point of Signal is you have full ownership of your data. You said you can transfer the data to another device, right? I get that inability to export cleanly is an annoying bug, but technically you have full control over your data the whole time. It seems to me that it's easier to guarantee no o…

Control isn't the same as ownership, so even technically it doesn't work

Re: Privacy is priceless, but Signal is expensive

#784

Post by eviks » Fri, Nov 17, 2023, 9:06 AM UTC

benreesman wrote: post #516

conductr wrote: post #509

I'm seeing all the comments about the $6m Twilio expense, but nothing commenting on how their cost per employee is $380,000 totaling $19m. I think they could optimize this easier if the will was there. I know HN is very SV/tech centric, and that number makes sense there given the run up of VC money, etc. but I'm willing to bet they could source talent from cheaper places and slash this in half; if they wanted to. Jus…

It grinds my gears when people on a hacker forum lobby for hackers to make less. When it’s people who are running a worldwide communications network on the cheap without getting hacked all the time? Absolute pros. I don’t downvote, let alone flag, but I hate this comment.

Or they lobby for more hackers to make more, which can happen with a change in location with an overall reduction in budget

Re: Privacy is priceless, but Signal is expensive

#785

Post by jwestbury » Fri, Nov 17, 2023, 9:07 AM UTC

jillesvangurp wrote: post #770

Drblessing wrote: post #710

2022 Salaries for those interested: https://projects.propublica.org/nonprofits/organizations/824... Compensation Key Employees and Officers Base Related Other Jim O'leary (Vp, Engineering) $666,909 $0 $33,343 Ehren Kret (Chief Technology Officer) $665,909 $0 $8,557 Aruna Harder (Chief Operating Officer) $444,606 $0 $20,500 Graeme Connell (Software Developer) $444,606 $0 $35,208 Greyson Parrelli (Software Developer) $…

Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure. > We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. Simple solution, go distributed. 6M $ for that. Stop doing that. What do d…

> which I agree are a problem

Are they? These salaries are much lower than most tech competitors. I know we like to call out "high" salaries when a useful service is struggling - but they'll struggle even more if they can't retain good talent because their pay is too low. There's a reason tech skill in government is generally lower than that in industry, for instance.

Re: Privacy is priceless, but Signal is expensive

#786

Post by jwestbury » Fri, Nov 17, 2023, 9:08 AM UTC

charles_f wrote: post #279

You have to appreciate the complete transparency, gently nudging towards giving without ever begging for it. Refreshing compared to the alternative that Wikipedia is showing, with the tantrum-like emails we receive from their CEO like "LAST REMINDER" or "We've had enough" ; which they ironically send to people who gave.

> which they ironically send to people who gave

I'm a lifetime member of my university's alumni association. This means I routinely get physical mail with headlines like, "YOUR OFFER INSIDE," and then the "offer" is to give them more money.

Sigh.

Re: Privacy is priceless, but Signal is expensive

#787

Post by tylersmith » Fri, Nov 17, 2023, 9:09 AM UTC

theshrike79 wrote: post #774

jefozabuss wrote: post #763

Earlier quoted context omitted.

2M in comp distributed between 4 people is not a lot at this scale in my opinion.

It is for a non-profit asking for donations. If they want half a mill salaries, they should become for-profit instead.

Profit or non-profit is not about paying market rates. Even non-profits have to pay reasonably competitive salaries to attract and retain good employees.

Re: Privacy is priceless, but Signal is expensive

#788

Post by Canada » Fri, Nov 17, 2023, 9:10 AM UTC

rglullis wrote: post #769

Canada wrote: post #753

Earlier quoted context omitted.

Great, you go ahead and get all your friends in family using Matrix. I'll join you there when all that is sorted out and it's practical to get my lawyers and doctors and accountants and friends and family onboard. Until then, we'll keep using Signal.

First, you talk like Signal never had any issue with usability or functionality, which is far from the truth. Signal amount of bugs and security issues with their client is notorious, and the insistence of requiring phone numbers is just a silly "let them have cake approach" that is conveniently ignored for too long. Second, are you hedging your bets and supporting Matrix or XMPP as well, or will you only encourage p…

Yes, I am encouraging people to donate to Signal because I prefer it. Why would I be soliciting donations for something I don't favor? If you want to contribute to something else go right ahead, but this is a thread about Signal's financial needs so it shouldn't surprise you that Signal supporters encourage other supporters to donate.

I also use Matrix. Element has been pretty good for a few years now, but it's still not smooth enough for mainstream use. (Encryption state in chats gets messed up sometimes, for example. It feels like Signal 10 years ago, and it's had security issues in its client also)

The Matrix protocol is also inferior to Signal in that all metadata is stored in cleartext on the server. You get to choose or run a server, but the protocol still leaks the user info to whoever runs the home server and to any foreign server that has a user in the same channel if you are using it in a federated context. Signal manages all of this by peer to peer messages where cleartext is only available to clients, which is really slick.

XMPP is just dead. Forget about XMPP. Matrix is the clear leader in the federated messaging system category. I'd like to see Matrix displace things like Telegram, Discord, and Slack. I may donate to Matrix affiliated projects in the future, as I also donate to other open source projects from time to time, but I'm not going to promote any of those things in this thread.

Re: Privacy is priceless, but Signal is expensive

#789

Post by CranberryDefuse » Fri, Nov 17, 2023, 9:18 AM UTC

> Signal spends around $2.8 million dollars per year on bandwidth to support sending messages and files (such as photos, videos, voice notes, documents, etc.) [...] At current traffic levels, the amount of outbound bandwidth that is required to support Signal voice and video calls is around 20 petabytes per year (that’s 20 million gigabytes) which costs around $1.7 million dollars per year in bandwidth fees just for calling, and that figure doesn’t include the development costs associated with hiring experienced engineers to maintain our calling software, or the cost of the necessary server infrastructure to support those calls.

20 petabytes per year is around 5000 Mbps only for audio and video calling. So 5000 HD video calls all year round.

Signal is known for the large bandwidth needed for calling but that sounds too much and not really scalable in the future.

Re: Privacy is priceless, but Signal is expensive

#790

Post by bomewish » Fri, Nov 17, 2023, 9:33 AM UTC

tylersmith wrote: post #787

theshrike79 wrote: post #774

Earlier quoted context omitted.

It is for a non-profit asking for donations. If they want half a mill salaries, they should become for-profit instead.

Profit or non-profit is not about paying market rates. Even non-profits have to pay reasonably competitive salaries to attract and retain good employees.

Yeah but half of these should be competitive enough. Come on.