Note that Google Pixel hardware is just fine and not evil, and they're looking at a different vendor for the next version anyway, because Google is making it so the Pixel will only run approved OSes.

Works on macOS and Windows, too.

I use it some but it’s just not the same. Very useful and well built don’t get me wrong.

I don't have a definitive opinion on such messaging apps. I like that it bridges between different services, trying to free the users from the lock-in, but...

If I talk to someone on Signal today, I know that they are probably using the official Signal on the other side. With the guarantees that I know from Signal. Now what if half of the users of Signal were using a third-party app? How much can I trust this app?

Say Matrix has a bridge to Signal. I talk to someone over what looks like Signal from my end, but it goes to some third-party server that pretends to be Signal and then relays those messages to my friend on their Matrix client. As a Signal user, I cannot know it, but my conversation is not E2EE anymore. And it kind of defeats the point of using Signal entirely, doesn't it?

I guess my point is that in terms of security, there is value in making it possible to verify that both ends are using the official Signal app, by locking it as much as possible (e.g. with DRM-like technology). But of course it's annoying to be locked in. Even though I don't feel personally super locked into Signal: I could move to another similar app in a minute. But again people tend to be lazy and don't want to switch apps. It's a hard problem, I guess.

The European Commission has recently put WhatsApp under scrutiny in terms of the Digital Services Act, and forced them to open up allowing interoperability with other messaging applications.

Perhaps we'll see a return of apps like Pidgin soon.

But it doesn't make Signal bad. If Americans blindly process our messages without knowing what's inside, it's worse than not depending on them, but better than showing your private correspondence to somebody.

At least we don't seem to have things which are close by UX and security at the same time.

Simplex is fine, but still feels a bit raw.

Everything else is either untrustworthy because of the closed code or no e2e encryption or custom encryption schemes (WhatsApp, Telegram, any Asian messenger) or unusable from UX perspective (Tox, Matrix).

For the context of this thread, it's infinitely better to depend on Signal than to depend on WhatsApp.

> but it's a lot of work, so very few do.

sure but a nation state that takes digital sovereignty seriously could easily devote some resources towards maintaining their own fork. Thats the point. Hell, north korea has their own special linux distro

You can fix bugs on open source hardware too.

> You can but the firmware that is needed to run it is America

This thinking is part of the reason for the momentum behind RISC-V and LoongArch.

RISC-V is a lot like Linux in that it benefits from International cooperation and innovation while offereing the ability to seize control if needed.

But you are correct that even an open ISA does not protect you from a proprietary hardware implementation at the chip or firmware level that you still do not control. This requires additional open standards.

Bigger picture, it means "domestic" chip design and fabrication capabilities. The world is just starting to wrap its mind around this. But again, RISC-V is really helping here. There are emerging RISC-V chip capabilities in Europe and even in places like India for example. It is easy to laugh off these efforts as non-competitive. But not only will many of them find niches where they will be economically pheasible but they offer an important backstop to geopolitical risk and the flexibility to at least of enough domestic capability to keep the lights on if needed. Building and rolling out a RISC-V ecosystem will take years or decades. But once there, it can be pivotied to or maintained on any RISC-V chip. As long as you have the ability to produce some kind of RISC-V chip, this ecosystem can never really be taken away from you.

And RISC-V offers the same kind of international collaboration that allows both pooling of efforts and protection from reliance on any one actor or region that could become a political threat.

RISC-V understands its role in this regard. It too was an "American" technology but Linux International was setup in Switzerland for a reason.

Reduce where you can right now, plan to fix what you can't replace right now.

Some improvement is far better than no improvement.

OpenBSD is technically Canadian.

Also, RISC-V also started at Berkeley but it is based out of Switzerland now.