𝔰π”₯π”¦π”Ÿπ” π”¬Mar 11

In 2015 I was on a beach in Hawai'i helping build the prototype of what became Signal. I argued that the app needed pseudonyms because abusers know their victims' phone numbers. I lost the fight that day. History proved me right, and Signal would move to usernames under @Mer__edith's stewardship.

In this new essay, I trace the line from Barlow's Declaration of Independence of Cyberspace through smart-home forensics, metadata killings, and Archive Team's non-consensual Tumblr scrape to ask: when did we decide that a jpeg is a photograph, that a profile is a person, that storage is memory?

The answer involves a boat off Honolulu, the early days of Signal, Iran's missiles over Amazon's Dubai AWS facilities, and the communities already building for a world where the server goes dark. This is an essay about infrastructure, memory, archiving without consent, and what we lose when we mistake the filesystem for memory.

It is also the angriest and most personal text I've ever written. I'm furious, and you should be too. We bet an entire civilisation on a brutal and unreliable stack. Now, fate has come to collect that wager.

California has a lot to fucking answer for.

https://newdesigncongress.org/en/pub/who-will-remember-us-when-the-servers-go-dark/

Show threadgroxxMar 12

@shibacomputer @Mer__edith

(edit to try to minimize distraction: apologies for derailing discussion a bit early on! Signal is a relatively small part of the writing, it's much broader. it was just literally a discussion point for me minutes before seeing this)

ironically, I was just discussing Signal with my wife, and she refuses to install it ever since it spammed people who had her phone number in their contacts the moment she signed up, with no warning or option. and I don't blame her one bit. so many of those "it's good for the social graph" decisions are obviously dangerous and directly at odds with the other stated/advertised purpose of "the best option if your safety is at risk". and it put up such a fight to try to force you to sync contacts, for so long.

wild, insane stuff, every step of the way. I'm still reading through, but wanted to say thanks for the attempts, and the write-up 

Show threadjust adrienneMar 12
@groxx @shibacomputer @Mer__edith I'm forced to use it for some stuff, these days, but i resisted installing it as long as i could because i have never forgiven and will never forgive it for that decision.
Show threadjust adrienneMar 12
@groxx @shibacomputer @Mer__edith (And it still isn't completely shifted to usernames; it still requires you to have a phone number and to reveal that phone number to Signal in order to do initial setup. Which is still fucking unacceptable. If you have the option, use Threema instead.)
Show threadfluffy πŸ’œMar 12
@adrienne @groxx @shibacomputer @Mer__edith when I finally signed up for Signal, in the 30 seconds between my account being created and me being able to disable β€œfind me by my phone number,” an aunt who I did not want to talk to about things connected to me and started talking to me about things.
Show threadgroxxMar 12

@fluffy @adrienne @shibacomputer @Mer__edith since I'm still trying to find conclusive info about "is this fixed now": when did you sign up? most of my info is from at least 5 years ago, but it's extremely difficult to test it out due to needing a new phone number + unknown backend delays before contacts sync or whatever.

the last major attempt was here, closed by Moxie, which I don't read as "it does not do that any more" for some reason: https://github.com/signalapp/Signal-Android/issues/7409

quick searches show it at least in 2021: https://medium.com/swlh/if-signal-is-so-hot-on-privacy-why-did-it-tell-everyone-i-joined-d85cda54a322 (I can't believe this isn't a more broadly visible issue, but at least some talk about it)

but yeah contact stuff has been an issue for a long time: https://github.com/signalapp/Signal-Android/issues/6750
it's much more polite about contacts syncing nowadays (I don't sync and it has never prompted me again and it works just fine). last I've seen they still relied on SGX for contact privacy, and I don't really trust that... but it's a decent approach for contact-sharers, and opting out is now trivial, so that's fine

I have it installed and use it when I can and am broadly happy with the changes under Meredith, to put this all in context. it's still probably the best big option. there's just a lot of deeply undesirable muck to walk out of, and it'll take time.

Make "just joined Signal" notification optional Β· Issue #7409 Β· signalapp/Signal-Android

Bug description Upon registration everyone who has my phone number gets a notification "X just joined Signal". Steps to reproduce Register with a new phone number Actual result: Everyone having my ...

GitHub
Show threadfluffy πŸ’œ

@groxx @adrienne @shibacomputer @Mer__edith This was in November 2024.

Also I never opted into my contacts being shared (which is its own separate permission in iOS).

Mar 12 at 9:19pmWeb
Show threadgroxxMar 12

@fluffy @adrienne @shibacomputer @Mer__edith thank you! so apparently they haven't even switched it to "only notify mutuals", which some other privacy-oriented ones have done. I'll bet abusers are thrilled  

I'm also assuming that happened before you had the opportunity to change that "find me" setting, which iirc needs you to set up a username, which can only happen after it's too late?

("mutual contact data" does not at all imply "desire to contact" so I think this is still horrifically bad if not opt-in, bit it would at least be slightly less horrifying)

Show threadfluffy πŸ’œMar 13
@groxx @adrienne @shibacomputer @Mer__edith yeah and in this case I didn’t even have my own contact info uploaded, it’s that my aunt had me in hers.