Ooh! This release looks excellent.

deleted by creator

Looks like there are prebuilt binaries in the release.

Lots of good advice here. Best method arises but cannot be sought. When you run into something broken or you don’t like, don’t set it aside hoping somebody else will fix it. Fix it.

Even if the maintainer doesn’t want your change. This is the best way to grow the seeds of software freedom you’ve already planted by caring. This is the fundamental ethos in my view of a good steward of the community. When something isn’t ideal, they make it work for themself and then are willing to share if others find it useful.

They don’t seem to realize that higher level languages help us understand the code. Language models will be similarly capable of reading the binaries they ship. So what they doing is hiding code from users, not machines.

To clarify, I don’t mean right now. They haven’t been sufficiently trained on machine code and that lacks some semantic help. But the future they fear will have transformers just as capable with lower level code.

I think tools like Open Collective, Ko-fi, et al. are sort of that already. So you’d be building centralization atop centralization. That may be useful, but it is another place that would require a rake to keep the lights on, so again less money donated.

And what happens if two or more such services exist? Then you need a layer above that.

Not necessarily untrue, but you end up both with baggage you don’t need and worse yet, not understanding how you got what you do have.

Neovim all by itself is a very capable editor with no plugins at all. The reason you should know plugins is irrelevant, in my view. You should not need to know any, unless you want to do. And then the reason is just because you want it.

To each of their own needs of course. I don’t begrudge anybody their use of distros; I just don’t see them as optimal.

I’ve been using vi through Neovim since the early 90’s, and I’ve tried the distros; a few anyway: Astro, Lunar, Lazy, Chad. But I always comeback to a bespoke config and am left wondering why people use distros.

They’re good for getting some ideas about what you might be missing, but one’s own config is pretty easy these days. It wasn’t in the vimscript and early packager complexity, but now it is easy.

And with the new vim.pack, even using package managers seems like unnecessary complexity for a little gain in api utility.

Everybody’s config is usable to them. Cool to share these as there is always inspiration hiding in another’s config. A bespoke config is really the way to go though. My config feels perfect for me. People using distros doesn’t make sense to me.

It also matters if you value organizations changing terms after attracting a community and changing to non-transparent solutions while claiming to be “open”. It matters if your values are different.

But you’re right too. If not logging in, your liability is probably not changing.

Nice. This is one of a few promising forks. I think they’re on Codeberg too.

This is a really good article and refreshing to see this being recognized as the double edged sword it is (albeit with one edge much sharper than the other). It will be interesting to see how different organizations deal with this. The temporary interaction limitation will be a bandaid in some cases but the deluge will just keep coming.

I’ve been interested in Mitchell Hashimoto’s new trust tooling. I’m not sure it will become a standard, but is a very interesting attempt, and dead simple.

Yes, subpoena was poorly worded. NSL is more likely. But still it is a time-forward threat, which means there is value while the server is or was accepting sealed sender.

And I wasn’t suggesting timing attack is required to defeat sealed sender. I was, on the contrary, pointing out that was a threat even with sealed sender. Though that is non-trivial, especially with CGNAT.

So in summary. You’re right. Sealed sender is not a great solution. But it is a mitigation for the period where those messages are being accepted. A better solution is probably out there. I hope somebody implements it. In the meantime, for somebody who needs that level of metadata privacy, Signal isn’t the solution; maybe cwtch or briar.

Sure. If a state serves a subpoena to gather logs for metadata analysis, sealed sender will prevent associating senders to receivers, making this task very difficult.

On the other hand, what it doesn’t address is if the host itself is compromised where sealed sender can be disabled allowing such analysis (not posthoc though). This is also probably sensitive to strong actors with sufficient resources via a timing attack.

But still, as long as the server is accepting sealed sender messages the mitigation is useful.

Don’t mistake me for saying you’re wrong. I agree with you, mostly. But sealed sender isn’t theater, in my view. It is a best effort attempt to mitigate one potential threat. I think everybody would like that solved but actually solving it isn’t easy as I understand it. Maybe not intractable, but if you have a solution, you can implement it. That is one of the things I like about free software.

In any case, I’m only saying Signal is good for a subset of privacy concerns. Certainly not that it is the best solution in all cases.

It isn’t a meme. It is a fact of modern cryptography in many settings. For example TLS, which is a huge bulk of the traffic, guarantees again privacy not anonymity. I’m not saying one shouldn’t care about metadata privacy. Every communication one engages in requires risk benefit analysis. If your threat modeling shows that for a given message, anonymity is required, then signal, and nearly every single other protocol out there is insufficient.

That doesn’t mean TLS or lib signal, or any other cryptographic tool is not useful, especially in conjunction with other tools.

There are many cases where I want my messages to be private and the cost of entry for the message receiver to be low. Signal is great for that. But I’m not saying no other tools should be considered, just that signal is good at what it does.

You’re the one making insults and I’m smug? Care to actually dispute anything said with reason?

Cool strawmen; I didn’t say any of that. Signal protocol is awesome for privacy, not anonymity. Maybe I don’t have half a brain, but I happen to think the double ratchet implementation is an impressive piece of tech. Maybe I’m as dumb as your fever dream, but compromised exits doesn’t make tor any less of an achievement. Though i2p is also superb. I guess my brain is too weak to understand why those statements are mutually exclusive.

It isn’t. But I see this same post over and over. Really feels like there is a campaign against signal. Also tor developed by US Naval Research, so I guess it’s bad too.

You can really just stop. If you leave it to languish and the community wants to continue, it will be forked. Nature of the beast. And nobody can fault you for that as long as you tell the community, “I’m out”.

I’m not saying that is the best method, but for anybody out there feeling a ton of pressure to the point it affects your wellbeing, you can stop.