Mastodawn

𝔰𝔥𝔦𝔟𝔠𝔬

In 2015 I was on a beach in Hawai'i helping build the prototype of what became Signal. I argued that the app needed pseudonyms because abusers know their victims' phone numbers. I lost the fight that day. History proved me right, and Signal would move to usernames under @Mer__edith's stewardship.

In this new essay, I trace the line from Barlow's Declaration of Independence of Cyberspace through smart-home forensics, metadata killings, and Archive Team's non-consensual Tumblr scrape to ask: when did we decide that a jpeg is a photograph, that a profile is a person, that storage is memory?

The answer involves a boat off Honolulu, the early days of Signal, Iran's missiles over Amazon's Dubai AWS facilities, and the communities already building for a world where the server goes dark. This is an essay about infrastructure, memory, archiving without consent, and what we lose when we mistake the filesystem for memory.

It is also the angriest and most personal text I've ever written. I'm furious, and you should be too. We bet an entire civilisation on a brutal and unreliable stack. Now, fate has come to collect that wager.

California has a lot to fucking answer for.

https://newdesigncongress.org/en/pub/who-will-remember-us-when-the-servers-go-dark/

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@shibacomputer @Mer__edith

(edit to try to minimize distraction: apologies for derailing discussion a bit early on! Signal is a relatively small part of the writing, it's much broader. it was just literally a discussion point for me minutes before seeing this)

ironically, I was just discussing Signal with my wife, and she refuses to install it ever since it spammed people who had her phone number in their contacts the moment she signed up, with no warning or option. and I don't blame her one bit. so many of those "it's good for the social graph" decisions are obviously dangerous and directly at odds with the other stated/advertised purpose of "the best option if your safety is at risk". and it put up such a fight to try to force you to sync contacts, for so long.

wild, insane stuff, every step of the way. I'm still reading through, but wanted to say thanks for the attempts, and the write-up

just adrienne Mar 12

@groxx @shibacomputer @Mer__edith I'm forced to use it for some stuff, these days, but i resisted installing it as long as i could because i have never forgiven and will never forgive it for that decision.

just adrienne Mar 12

@groxx @shibacomputer @Mer__edith (And it still isn't completely shifted to usernames; it still requires you to have a phone number and to reveal that phone number to Signal in order to do initial setup. Which is still fucking unacceptable. If you have the option, use Threema instead.)

fluffy 💜Mar 12

@adrienne @groxx @shibacomputer @Mer__edith when I finally signed up for Signal, in the 30 seconds between my account being created and me being able to disable “find me by my phone number,” an aunt who I did not want to talk to about things connected to me and started talking to me about things.

@fluffy @adrienne @shibacomputer @Mer__edith since I'm still trying to find conclusive info about "is this fixed now": when did you sign up? most of my info is from at least 5 years ago, but it's extremely difficult to test it out due to needing a new phone number + unknown backend delays before contacts sync or whatever.

the last major attempt was here, closed by Moxie, which I don't read as "it does not do that any more" for some reason: https://github.com/signalapp/Signal-Android/issues/7409

quick searches show it at least in 2021: https://medium.com/swlh/if-signal-is-so-hot-on-privacy-why-did-it-tell-everyone-i-joined-d85cda54a322 (I can't believe this isn't a more broadly visible issue, but at least some talk about it)

but yeah contact stuff has been an issue for a long time: https://github.com/signalapp/Signal-Android/issues/6750
it's much more polite about contacts syncing nowadays (I don't sync and it has never prompted me again and it works just fine). last I've seen they still relied on SGX for contact privacy, and I don't really trust that... but it's a decent approach for contact-sharers, and opting out is now trivial, so that's fine

I have it installed and use it when I can and am broadly happy with the changes under Meredith, to put this all in context. it's still probably the best big option. there's just a lot of deeply undesirable muck to walk out of, and it'll take time.

Make "just joined Signal" notification optional · Issue #7409 · signalapp/Signal-Android

Bug description Upon registration everyone who has my phone number gets a notification "X just joined Signal". Steps to reproduce Register with a new phone number Actual result: Everyone having my ...

GitHub

fluffy 💜Mar 12

@groxx @adrienne @shibacomputer @Mer__edith This was in November 2024.

Also I never opted into my contacts being shared (which is its own separate permission in iOS).

@fluffy @adrienne @shibacomputer @Mer__edith thank you! so apparently they haven't even switched it to "only notify mutuals", which some other privacy-oriented ones have done. I'll bet abusers are thrilled

I'm also assuming that happened before you had the opportunity to change that "find me" setting, which iirc needs you to set up a username, which can only happen after it's too late?

("mutual contact data" does not at all imply "desire to contact" so I think this is still horrifically bad if not opt-in, bit it would at least be slightly less horrifying)

fluffy 💜Mar 13

@groxx @adrienne @shibacomputer @Mer__edith yeah and in this case I didn’t even have my own contact info uploaded, it’s that my aunt had me in hers.

d@nny disc@ mc² Mar 12

@adrienne @groxx @shibacomputer @Mer__edith that was a moxie marlinspike special. whether the rot can be removed after the fact is your call

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@hipsterelectron @adrienne @groxx I have had the pleasure to work with the Signal team since, and watched them move to usernames. I think it's worth thinking about how teams and their work change over time. There were very specific people who were responsible for those decisions and they are long gone.

d@nny disc@ mc² Mar 12

@shibacomputer @adrienne @groxx i have as well and was the first to add documentation strings to many of the cryptographic operations with immense help from jordan rose. this would become relevant when moxie blocked me on twitter

d@nny disc@ mc² Mar 12

@shibacomputer @adrienne @groxx white boy with dreads should never have been allowed anywhere

dissident Mar 12

@groxx @shibacomputer @Mer__edith I wasn't aware that Signal was ever coded to spam users' contacts without asking first. Are you absolutely certain that your wife didn't accidentally approve this action?

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@dissident @groxx Signal used to alert you to someone on your contact list joining Signal, with no opt out and no prompt in the interface.

dissident Mar 12

@shibacomputer @groxx Fair enough. Sorry, I wasn't aware of that being a feature.

gusseting Mar 12

@shibacomputer @dissident @groxx
Meredith also wrote about
Origin Stories: Plantations, Computers, and Industrial Control (https://logicmag.io/supa-dupa-skies/origin-stories-plantations-computers-and-industrial-control/), after being funded by Andrew Forrest, Australia's 2nd richest billionaire who made his fortune by being a sexist, racist, industrial mining + agriculture colonialist.
https://www.afr.com/rear-window/andrew-forrest-greenwashing-fortescue-billions-in-huon-takeover-fight-20210817-p58jke
archive:
archive.md/iPRb8

Origin Stories: Plantations, Computers, and Industrial Control

The proto-Taylorist methods of worker control Charles Babbage encoded into his calculating engines have origins in plantation management.

Logic(s) Magazine

Aral Balkan Mar 12

@dissident @groxx @shibacomputer @Mer__edith No, this is by default. If you’re in someone’s phone book, it automatically snitches on you that you’ve joined Signal.

So, say, your abuser is still in your phone book (so you can know to avoid their calls) and they’re on Signal. The moment you join, they’ll be notified that you’ve joined Signal.

(I got a notification when a prime minister I met once but had the number of joined.)

That, and it’s “won’t take no for an answer” (remind me later) antipattern when it comes to enabling notifications are two major issues with Signal that, sadly, remain unaddressed.

dissident Mar 12

@aral @groxx @shibacomputer @Mer__edith There does now seem to be the option to prevent this behaviour with the 'Who can find me by number' setting.

Aral Balkan Mar 12

@dissident @groxx @shibacomputer @Mer__edith There’s a big difference between “I’m ok with someone who knows my number searching for me” and “inform everyone whose phone book I’m in the moment I join Signal”.

You should, of course, be able to set those preferences separately and they should default to their most private state.

@dissident @aral @shibacomputer @Mer__edith that's UI for after signup though, related to / rolled out with the username feature, isn't it? or is that now shown before the blast when creating an account?

I'd just test it myself, but I don't have dozens of phone numbers to just throw away if it's inconclusive. or even a second handy, I'd have to go buy one just to test it once.

Cassandrich Mar 12

@aral @dissident @groxx @shibacomputer @Mer__edith It's not a matter of whether your abuser's number is in your contact book but the other way around. If your number is in theirs and you allow finding you by number, they can see when you join.

Cassandrich Mar 12

@dissident @groxx @shibacomputer @Mer__edith It wasn't spamming your contacts book, but rather letting others who had you in their contacts book and who were already using Signal see that you joined Signal. This was a gross privacy violation. Nowadays there's control over whether others can see that and even whether you can be looked up by phone number at all.

@groxx @shibacomputer @Mer__edith also. I've never heard of this supposed "spamming" behavior. I wish more people knew about signal but I'm glad they're not being spammed

@groxx Indeed, we talk about Signals phone number choice every week having friends with secret numbers being hunted by ex:es. And getting random "Your friend Xyz has signal!" even though Xyz does not have that number any more...

some kind of orange shape Mar 12

@shibacomputer I still feel like there was an obvious way Archive Team could've satisfied all parties in their tumblr scrape: they could have just not hosted the archive online. If someone wanted their blog, they'd have emailed Archive Team, who would have sent that blog, and only that blog, to that person.

I think I even mentioned this to Jason at the time, but never got a reply on Twitter...

@shibacomputer @Mer__edith I'm pretty sure I used Signal in 2014 and Wikipedia also says it was released in 2014. Did you mix up the years here? Or what were you building in 2015?

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@b0rn_dead the original Signal announcement was a kind of iphone only zombie version of Redphone, Whisper Systems' earlier app. Signal as you know it (calls and messaging, cross platform, etc) didn't exist until mid 2015.
https://signal.org/blog/signal/

Free, Worldwide, Encrypted Phone Calls for iPhone

At Open Whisper Systems, we want everyone to have access to advanced secure communication tools that are as easy and reliable to use as making a normal phone call or sending a normal text message. Over the past year, we’ve been working to bring the privacy software we’ve developed for Android to ...

Signal Messenger

@shibacomputer @b0rn_dead Wikipedia has a handy timeline: https://en.wikipedia.org/wiki/TextSecure#Open_Whisper_Systems_(2013%E2%80%932015)

@shibacomputer fantastic piece, thank you

Alex / catileptic Mar 12

@shibacomputer this is a fantastic read, thank you so much for putting it out there! :)

in the bookshelf of my mind, i set your essay alongside @Mer__edith's essay on the origins of computing strategies: https://logicmag.io/supa-dupa-skies/origin-stories-plantations-computers-and-industrial-control/

and alongside David Golumbia's Cyberlibertarianism

all excellent writing that challenge the dogma of "freedom" that white-washed so much pain caused by and amplified by digital tech

Origin Stories: Plantations, Computers, and Industrial Control

The proto-Taylorist methods of worker control Charles Babbage encoded into his calculating engines have origins in plantation management.

Logic(s) Magazine

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@catileptic if you liked Cyberlibertarianism, please keep an eye out, because there's a new piece coming that will be right up your alley.

Also thank you for reading <3

Ken Milmore Mar 12

@catileptic @shibacomputer @Mer__edith I see the pivot to AI differently, as more of a frustration with "Peak Logic" by companies that replaced workers with IT systems and are now frustrated at their inflexibility. It parallels a contempt for the post WWII world order, which has created a lot of "red tape" that deters would be tyrants and monopolists from doing whatever they want. It signals a withdrawal from objective thought, reasoning and design in pursuit of short term goals.

ericjames* 🐺‼️ (they/it)Mar 12

@shibacomputer brilliant, concise writing. thank you for bringing awareness to all of this

@shibacomputer Wow, amazing read, thanks for sharing!

Thanks also to @aral for boosting.

John Faithfull 🌍🇪🇺🏴󠁧󠁢󠁳󠁣󠁴󠁿🧡✊🏻✊🏿Mar 12

@shibacomputer @Mer__edith Powerful. Beautifully put:

There is no such thing as an inert digital object

I think about the hype about write-once media that hold petabytes and last for thousands of years. But without the energy-intensive and fragile infrastructure, technology, and the culture that goes with them, the nano-scale binary fluctuations in the medium are basically indistingishable from random noise.

Petra van Cronenburg Mar 12

@shibacomputer I almost didn't read the text because I thought it was about Signal only.

Fortunately, I clicked on it anyway and am impressed. What a great essay on so many levels (including the literary one)! This interweaving of body, landscape, ideologies and virtual spaces says so much between the lines.
I read this text as someone who works with cultural heritage: in museums, in living traditions and storytelling. I remember when the Taliban destroyed the giant Buddhas and there was a rush

Petra van Cronenburg Mar 12

@shibacomputer to digitise everything. As if we could preserve our cultural heritage forever in the cloud, safe from threats.
And now comes the next thread, AI hallucinations, datacenters (and wars).

"Violence, then rebuild; profit, then philanthropy – repeat!" This is so much the USA acting at the moment.

Thank you so much for this brillant essay, these inspiring thoughts, I'll read it several times!

Cliff'sEsportCorner Mar 12

@shibacomputer @Mer__edith Really glad to read this, mirrors my own thoughts and concerns from beginning when learning that to use Signal you had to use phone number. Never understood how anyone serious could recommend it for privacy over security with that model. 🙁 Real disconnect from IRL Opsec just for domestic abuse victims and people being trafficked.

𝔰𝔥𝔦𝔟𝔠𝔬 Mar 12

@CliffsEsport take a read of the essay, it talks about more than just Signal and puts that entire decision into context 👀

jesse jarnow Mar 12

@shibacomputer oh wow, can't wait to read this in full! i just presented a less-articulated & more informal version of that historical line on a barlow roundtable at the popular culture conference in albuquerque & was hoping someone would do it properly.

jesse jarnow Mar 12

@shibacomputer this did not disappoint! thanks for writing it. the thread that i'd now love to see someone trace in more granular detail is how policies favored (or ignored) by the very pro-privacy barlow/EFF resulted in the exact opposite.

Taran Rampersad Mar 12

@shibacomputer @Mer__edith 1/

I lived this.

I would not call it angry, sibling... I call it defiance.

I participated at the wsis twice trying to influence policy in a forum the tech leaders avoided.

I helped build what would have been twitter before twitter, a full year earlier, focused on emergency communication. The Alert Retrieval Cache. I halted work because of the 'trusted sources' problem.

Silicon Valley did not care about trusted sources.

And it accelerated.

Taran Rampersad Mar 12

@shibacomputer @Mer__edith 2/

Most days I feel that defiance lurking, entire generations having been raised with this normalized stew, never having heard of Barlow.

His name once shouted is barely whispered now.

Here we are, decades later.

My defiance remains.

Thank you for reflecting the same defiance.

Memory is written by the survivors.
History too.

This defiance must survive. To be human.

////

Maria Langer | 📝💎🌵🛥️Mar 12

@shibacomputer @RalphBassfeld @Mer__edith I have a question, though. Doesn't Signal have the ability to block abusers? Suppose I get a nasty message from a fucked up bastard. Can't I simply block him? Block his number?

Unpopular opinion warning: I believe that aliases online empower people to say shitty things to each other and share misinformation. If people had to stand behind what they said with their real identities, they might not be such assholes. 🤷🏼‍♀️

Josef Davies-Coates Mar 12

@shibacomputer @Mer__edith I've never been notified that a contact has joined Signal, unlike on Telegram

Anꞇóin Ó B.Mar 13

Only half way through it and I'm going to be thinking about this for months, at the very least.

daniel lublin Mar 13

@shibacomputer rewarding read, thank you. actually haven't seen Lain, gonna get the coalgirls release obvs