Mastodawn

📣THREAD: It’s surprising to me that so many people were surprised to learn that Signal runs partly on AWS (something we can do because we use encryption to make sure no one but you–not AWS, not Signal, not anyone–can access your comms).

It’s also concerning. 1/

Show thread

Meredith Whittaker Oct 27

Concerning, bc it indicates that the extent of the concentration of power in the hands of a few hyperscalers is way less widely understood than I’d assumed. Which bodes poorly for our ability to craft reality-based strategies capable of contesting this concentration & solving the real problem. 2/

Show thread

Meredith Whittaker Oct 27

The question isn’t "why does Signal use AWS?" It’s to look at the infrastructural requirements of any global, real-time, mass comms platform and ask how it is that we got to a place where there’s no realistic alternative to AWS and the other hyperscalers. 3/

Show thread

Meredith Whittaker Oct 27

Running a low-latency platform for instant comms capable of carrying millions of concurrent audio/video calls requires a pre-built, planet-spanning network of compute, storage and edge presence that requires constant maintenance, significant electricity and persistent attention and monitoring. 4/

Show thread

Meredith Whittaker Oct 27

Instant messaging demands near-zero latency. Voice and video in particular require complex global signaling & regional relays to manage jitter and packet loss. These are things that AWS, Azure, and GCP provide at global scale that, practically speaking, others (in the western context) don’t. 5/

Show thread

Meredith Whittaker Oct 27

This isn't ‘'renting a server.' It's leasing access to a whole sprawling, capital-intensive, technically-capable system that must be just as available in Cairo as in Capetown, just as functional in Bangkok as Berlin. Particularly given the high stakes use cases of many who rely on Signal. 6/

Show thread

Meredith Whittaker Oct 27

Such infrastructure costs billions and billions of dollars to provision and maintain, and it’s highly depreciable. In the case of the hyperscalers, the staggering cost is cross-subsidized by other businesses–themselves also massive platforms with significant lockin. 7/

Show thread

Meredith Whittaker Oct 27

Meaning that infrastructure like AWS is not something that Signal, or almost anyone else, could afford to just “spin up.” Which is why nearly everyone that manages a real-time service–from Signal, to X, to Palantir, to Mastodon–rely at least in part on services provisioned by these companies. 8/

Show thread

Meredith Whittaker Oct 27

But even if Signal had the billions needed to recreate AWS, it’s not just about money. The talent to run these systems is rare & concentrated. The expertise, the tooling, the playbooks, the very language of modern SRE came out of these hyperscalers, and is now synonymous with 'the cloud.' 9/

Show thread

Meredith Whittaker Oct 27

o, yes, Signal runs on AWS. It also runs on your phone, which runs on iOS (Apple) or Android (Google). And on Dekstop, via Windows (Microsoft). Each of these presents similar dependencies on large entrenched tech companies, and concomitant barriers and risks. 10/

Show thread

Meredith Whittaker Oct 27

In short, the problem here is not that Signal ‘chose’ to run on AWS. The problem is the concentration of power in the infrastructure space that means there isn’t really another choice: the entire stack, practically speaking, is owned by 3-4 players. 11/

Show thread

Meredith Whittaker Oct 27

So, Signal does what we can to provide a service w integrity in the concentrated ecosystem we're working in. We protect your comms w end-to-end encryption, so that we can use AWS and others as a highway across which to send Signal data in ways that don’t let AWS, or anyone else, gain access. 12/

Show thread

Meredith Whittaker Oct 27

To conclude: my silver lining hope is that AWS going down can be a learning moment, in which the risks of concentrating the nervous system of our world in the hands of a few players become very clear. And that this can help us craft ways of undoing this concentration and creating real choice ❤️ 13/

Show thread

yawnbox Oct 27

@Mer__edith

The tor network has had 100% uptime. 100%

Show thread

Meredith Whittaker Oct 27

@yawnbox I don't think you have a clear understanding of what you're talking about, and it might be fun for you to look a bit more deeply into how TOR works and its dependencies.

Show thread

yawnbox Oct 27

@Mer__edith

With respect Meredith, i’m talking about decentralized protocols and their capability to not depend so heavily on the service providers you’re arguing for. Tor Project has shown how possible it is (i used to work there, and it’s spelled Tor not TOR).

I listened to Moxie’s aversions to decentralization for years. That’s what I keep seeing now, with posts like these. I also understand the value of huge cloud providers, I’ve worked for many companies who use them, and have worked for them, and I understand why you depend on them and how important that is to a high quality service. Thank you for all that you all do.

But what conversations does Signal Foundation actually have on the topics of resiliency through decentralization? How much money could you save by allowing the community to take on aspects of the network? How much resiliency and trust could be gained, without losing performance?

Show thread

Lin

@yawnbox @Mer__edith

The problem is that social software and instant messaging are heavily state-dependent—which Tor is not, and its state management and persistence issues are much smaller.

Show thread

Kevin Karhan

Nov 4

@linrui @yawnbox @Mer__edith so we have a solved problem!

Kevin Karhan :verified: (@[email protected])

@[email protected] @[email protected] @[email protected] @[email protected] granted, @[email protected] chose to be bad! - As in: It's easer, faster, cheaper, more resilient, private and secure to onboard #TechIlliterates woth #XMPP+#OMEMO over @[email protected] / #Tor using @[email protected] #Orbot @[email protected] / #monoclesChat than to do so for #Signal for the last [15+ years](https://infosec.space/@kkarhan/115492199979302447) ! And [I did try to like Signal - honestly!](https://infosec.space/@kkarhan/114935952643402592)

Infosec.Space