The incorporated 501c3 named Signal is, in IT terms, a vendor. Is it not?

The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are rare.

Suppose you configured an instance of the Signal server software and others you know ran also a somewhat modified Signal client that could access that instance of the Signal server software.

But the centralized namespace of the hosted Signal service hosted by the incorporated 501c3 named Signal would not be accessible through that server instance now would it.

And, as dictated by the incorporated vendor of the centralized namespace, and other reasons, in practice, this client would have to run as a separate piece of software. "Another app".

This is vendor lock-in.

The service hosted by the 501c3 named Signal seems widely open yet is a permissioned namespace. A physical location tracking number aka phone number or a credit/debit card is required to access the namespace. This is for slaves. The profane.

  Open Signal on your phone to keep your account active

This vendor is abusive.

And, I don't think this is what Moxie wanted.

Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.

▲ amiga386 2 hours ago | parent | next [-]

> I don't think this is what Moxie wanted.

I think this is exactly what he wanted, as these were the complaints levelled against the service when he was still in charge.

From 2018: https://drewdevault.com/blog/Signal/

> Moxie knows about everything I’ve said in this article. He’s a very smart guy and I am under no illusions that he doesn’t understand everything I’ve put forth. I don’t think that Moxie makes these choices because he thinks they’re the right thing to do. [...] Moxie can’t come out and say it openly, but he’s made the decisions he has made because they serve his own interests.

And it looks like it's working. The Signal social network is growing. Revenue is growing (revenue pays for ongoing maintenance). Alternative servers are not sapping user metrics. It's still easy to push both security fixes and eye-catching new features because one central server, and client upgrades are aggressively pushed. Spam is not a plague because registration remains expensive - you need a genuine phone number you control, or Google to vouch for you (who in turn have their own robust defences against account creation).

If it was a free sign up where you just need an IP address to play, spammers would have hundreds of millions of accounts and you'd get as much nuisance friend requests as you get email spam. Most people would leave. You've seen the scraperpocalypse, every sketchy person on the planet has money to fund a million sign ups each from a unique US residential IP (thanks to "smart" TV vendor neglect/corruption allowing residential proxies), IP reputation is worthless.

Personal instances of Signal would hide until spammers found them but you'd better have your own locked down registration because you can't hide forever. Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting, moreso than using Signal's centralised services.

Its tradeoffs all the way down.

	▲	jon128 an hour ago \| parent [-]
		>> I don't think this is what Moxie wanted. > I think this is exactly what he wanted You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted? A self-described anarchist who described the original cypherpunks as his teenage heroes? When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk? That looks like crazy talk. In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends already had for free, is on its face absurd. _ > Spam is not a plague because registration remains expensive The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this. The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace. Very simple concept. Simple enough for a mediocre dev to implement without an LLM. The spectre of spam does not justify the demand for a tracking device, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved. The spectre of spam does not justify any of this horse shit. "Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal. The new, grossly degenerated Scope of Choice. Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them. Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible. An invite token personally sent by Alice or read aloud by Alice to Bob, is not. But if somebody wants to harass a specific user on Signal, that's relatively cheap to do. _ > Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server. On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not. Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users. _ > Alternative servers are not sapping user metrics. This imperative is not the users' problem and runs counter to the best interests of the users. _ > Its tradeoffs all the way down. Right. In Matthew's view, the horse shit is a tradeoff. I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.

▲ RunSet 3 hours ago | parent | prev | next [-]

> Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.

Session is a decentralized Signal fork that creates the account on the device without associating it with a phone number.

https://getsession.org/

See also maqp2's comment here regarding Simplex:

https://web.archive.org/web/20250302182017/https://reddit.co...

	▲	ada-h00k 2 hours ago \| parent [-]
		You should definitely avoid Session. While its decentralized nature is a positive, the developers have implemented many features insecurely and have also removed forward secrecy. There are blog posts by a cryptography expert on this topic: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

▲ komali2 3 hours ago | parent | prev | next [-]

> And, I don't think this is what Moxie wanted.

Moxie as far as I know is still involved in the project and is the source of decisions such as requiring a phone number. My understanding is he is leaning hard on "encryption for anyone and everyone" over all other considerations such as decentralization.

A common criticism is "huh, not very anarchist of him!" Which, maybe? If decisions like that can get Signal into as many hands as possible, and if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date, I think that's an improvement in material conditions.

Your bio has a pretty frank indication of the maximally decentralized, encrypted alternative, and how user hostile that still is:

> If you want to DM, I am generally open to chat. Generate a https://SimpleX.chat invite and paste it into a file simplex-invite.txt, then run the commands below and include pasted contents of DM.txt in one of your comments in any thread we're both participating in.

	▲	jon128 4 minutes ago \| parent [-]
		> other considerations such as decentralization. I'll steelman this a bit and mention there was a broad argument against software fragmentation. This can be overcome with API versioning under the hood. If you have worked with backend services you may recognize prefixes in paths like /api/v1/ or /api/v1.2/ along with a holistic approach that doesn't fail to gracefully signal disparities and their implications however small or big. The holistic design and initial implementation does need to be there. I am not optimistic about it but I'm willing to say it should be striven for, in lieu of an existing satisfactory implementation, rather than give in to vendor lock-in, even if that vendor didn't have the same abusive behavior cited in the comment at the top of this thread. _ > If decisions like that can get Signal into as many hands as possible The phone numbers were useful for leveraging existing contact graphs. How that has been twisted into excuse to abuse the users, demanding sustained participation in the PSTN (not the initial friction, the sustained friction), which is not an open network and user neutral network like Internet Protocol, is something different. It does not pass the smell test. Something is wrong on a fundamental level there. In the other comment I posted, the false spectre of spam is knocked down. _ > if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date Signal can't hide which users talk to which other users. This metadata is visible to Signal's servers. Users using the centralized namespace functionally can not opt out of this. Other systems have solved this problem and other larger problems surrounding it. _ > an improvement in material conditions. It was. That was a long time ago. We are in this decade now. _ > Your bio has [..] the maximally decentralized See the graphic here `https://yourtechdiet.com/wp-content/uploads/2026/06/Centralized-and-decentralized-and-distributed-networks.jpg.webp` The implementation of a protocol, not "platform", implementation of a protocol, suggested there is distributed. The delta between decentralized and distributed may look not too significant on the surface. In real-world practice the functional differences are major. _ > and how user hostile that still is: Look at the two words at the top-left corner of this website. Do you see "User News"? The use of GnuPG there renders the potentially posted data as functionally a "direct message" that other users can not see. This approach also confines the message to originate from the specific account of this site, which eliminates the potential for unsolicited+inauthentic messages. You can probably surmise as I have there are many on here who aren't "hacker", who aren't even really software developer, or worse ought be more cautious posting in a place labeled like such. The approach with GnuPG is extra, and a reasonable IQ filter. Among not excluding below-average IQ users of SimpleX, sans those who truly can not locate their own asshole, copying and pasting a string to onboard for the first time really hasn't been a problem. It has been far less friction than Signal and with absolutely zero exposure of individual users to spam.

▲ commandersaki 3 hours ago | parent | prev [-]

	▲	jon128 3 hours ago \| parent [-]
		[flagged]