hckrnws

I like everything Matthew Garrett writes but I can't resist being annoying about this:

Signal has had forward secrecy forever, right? The modern practice of secure messaging was established by OTR (Borisov and Goldberg), which practically introduced the notions of "perfect forward secrecy" and repudiability (as opposed to non-repudiability) in the messaging security model. Signal was an evolution both of those ideas and of the engineering realization of those ideas (better cryptography, better code, better packaging).

What's so galling about this state of affairs is that people are launching new messaging systems that take us backwards, not just to "pre-Signal" levels, but to pre-modern levels; like, to 2001.

Let's not forget three things from prior leaks:

1. Core Secrets said the FBI "compelled" companies to secretly backdoor their products. Another leak mentioned fines by FISA court that would kill a company. I dont know if you can be charged or not.

2. They paid the big companies tens of millions to $100+ million to backdoor their stuff. Historically, we know they can also pressure them about government contracts or export licenses. Between 1 and 2, it looks like a Pablo Escobar-like policy of "silver or lead."

3. In the Lavabit trial, the defendant said giving them the keys would destroy the business since the market would know all their conversations were in FBI's hands. The FBI said they could hide it, basically lying given Lavabit's advertising, which would prevent damage to the business. IIRC, the judge went for that argument. That implies the FBI and some courts tell crypto-using companies to give them access but lie to their users.

Just these three facts make me wonder how often crypto in big platforms is intentionally weak by governemnt demand or sloppy because they dont care. So, I consider all crypto use in a police state subverted at least for Five Eyes use. I'll change my mind once the Patriot Act, FISC, secret interpretations of law, etc are all revoked and violators get prosecuted.

There is no such thing as "fines by FISA court". FISA doesn't hear adversarial cases and doesn't have statutory authority or even subject matter jurisdiction to enforce compliance on private actors. FISA is an authorizer for other government bodies, who then use ordinary Article III courts to enforce compliance. Other than the fact that they're staffed by Article III judges and not directly overseen by Article III courts, the FISA court functions like a magistrate court, not a normal court. So: I immediately distrust the source.

People are going to come back and say "well yeah that's just what they tell you about FISA court, but I bet FISA courts fine people all the time", but no, it's deeper than that: private actors aren't parties to FISA cases. It's best to think of them as exclusively resolving conflicts between government bodies.

You are just wrong:

> In some circumstances, nongovernmental parties may litigate the lawfulness of FISA orders or directives to provide information or assistance to the government. For example:

> A private company or individual that has been served with a directive to assist in acquiring information under Section 702 may petition the FISC to modify or set aside the directive. Conversely, the government may petition the FISC to compel the recipient to comply with the directive.

> In responding to the government’s petition, the private party has the opportunity to show cause for the noncompliance or argue that the order should not be enforced as issued.

> In 2007, Yahoo! Inc. refused to comply with directives issued by the government under provisions of FISA that have been replaced by Section 702. The government filed a motion with the FISC to compel compliance.

https://www.fisc.uscourts.gov/about-foreign-intelligence-sur...

The warrants the court issues do apply to private parties. Failure to comply with a warrant is contempt of court and the court can compel compliance by fines and other sanctions. You can read what that looks like in this FISA court ruling against Yahoo.

PDF warning: https://donohueintellaw.ll.georgetown.edu/sites/default/file...

It was a big company that said they'd be fined per day for non-compliance with mass surveillance. Core Secrets etc says that was done by FBI for FISA warrants. So, whoever enforces that.

I dont know the mechanics of it, like jurisdiction. It might be as you say. I just know they and their targets were both clear at different times they could force a company to do it.

I have no idea, I just know they weren't facing fines from a FISA court.

The part nobody mentions about Crypto AG:

https://inteltoday.org/2020/02/15/crypto-ag-was-boris-hageli...

We've always done this.

And it's going to remain that way as long as people download apps written on PC through App Store.

On PC? What do you mean?

if this's using ephemeral keys with no forward secrecy and no ledger of interactions, what part of it’s actually bitcoin style besides the name?

It uses cryptography (a little-known and mostly-useless offshoot of Crypto)

Plus, one of the simplest forms of cryptography is a basic SHA, so the words is practically meaningless without more details

Having no actual use?

Bitcoin is great for prospecting, laundering money across borders, and scamming gullible people. It's also easier to hide a stash of stolen bitcoins from the authorities for after you get released from jail than it is to hide a stash of actual money. Bitcoin is certainly no alternative to actual money but it's not entirely useless.

I think these Twitter DMs only does the scamming the gullible part, as you need to pay to use the feature and this is scamming people into thinking they're paying for secure messaging.

prospecting? like, finding diamonds or oil or copper or something?

is the bitcoin a fundraising mechanism for juniors or something?

can you explain tbe mechanism?

I think he means prospecting like pyramid scheme prospecting

[flagged]

[flagged]

[flagged]

Have you stopped to consider that the intelligent people actually do understand it?

If they truly understood it, then they would not make bold claims such as "cryptocurrencies have no use".

I am growing tired of explaining its "legitimate" uses. Go buy your beer with BTC (you can!).

The great gp didn't wrote it has no use. They listed the uses bitcoin was the best at (forgetting paying for porn btw).

Oh please, you can even get groceries with BTC at some places. It is not used exclusively for illegal bs, as the other people have implied.

Bitcoin isn't a secure communication channel either?

Its all out in the public....

Key derivation from a PIN? Although that's an implementation detail of the key backup rather than anything inherent in the actual messaging so who knows.

They use a hash function.

He didn't say it was Bitcoin style, just that it used "(Bitcoin style) encryption".

I was going to point out that Bitcoin does not use encryption; but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.

So, in the most charitable reading, it using ecliptic curve asymmetric encryption. Presumably for the purpose of exchanging a symmetric key, as asymmetric encryption is very slow. In other words, what basically everything written this decade does. Older stuff would use non EC algorithms, that are still totally fine, but need larger keys and would be vulnerable to quantum computers is those ever become big enough.

> but technically I think it's signature algorithm (ecdsa) can be thought of as a hashing step, followed by a public-key based encryption step.

It really can't. If you're extremely drunk you can think of it as similar to hashing followed by a public-key based decryption step (signing uses the private key, as does decryption) but that's about as good an analogy as calling a tractor-trailer a container ship because both haul cargo. The actual elliptic-curve part of the operation isn't encryption or decryption, and thinking of it as such will lead to error.

RSA does have a simpler correspondence in that the fundamental modular multiplication operation is shared between decryption and signing (or between encryption and verification). But modular multiplication alone isn't secure, it's the "padding" that turns modular multiplication with a particularly-chosen modulus from some basic math into a secure encryption/signature system. And the padding differs, and the correspondence doesn't hold in real systems. RSA without padding is just sparkling multiplication.

I was going to point out that Bitcoin does not use encryption

Yeah Musk as not very technical person would hardly know the difference.

Bitcoin does use encryption for messaging, but I don't know if this is what Musk was referencing: https://bitcoinops.org/en/topics/v2-p2p-transport/

Earlier discussion:

X's new "encrypted" XChat feature doesn't seem to be any more secure

https://news.ycombinator.com/item?id=44178008

Thanks. The top comment there gets pretty technical and ends with:

> ... As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.

https://news.ycombinator.com/item?id=44178544

The top comment is written by the person who wrote the blog post this thread is discussing.

Ah, thanks. I try not to be guilty of just comment surfing, but this was not one of those times. :/

Username matches the current URL

It would be better to use separate software for encryption, and to get the public keys by meeting with them in place.

Question: I plan to visit Peking soon, can I use Twitter there without a VPN? Thanks.

Some roaming SIM cards aren't restricted by the Great Firewall, but in general, yes you'd need a VPN.

ALL roaming SIMs aren't restricted unless the home telecom company cooperates. The roaming traffic passes over a global MPLS network to the home mobile network, so it's not restricted by the national firewalls.

[dead]

> All new XChat is rolling out with encryption [...] This is built on Rust with (Bitcoin style) encryption

What does "Bitcoin style encryption" mean? Isn't Bitcoin mostly relying on cryptographic signatures rather than "encryption" as we commonly know it?

It doesn't mean anything, just sounds cool to people who don't know the tech well enough. Same reason why your HDMI cable is "gold plated for 10x speed!"

Gold plating electrical contacts does at least do something useful though, it helps to prevent oxidization/corrosion. A better analogy would be gold plated TOSLINK cables, which unfortunately do exist.

A lot of quack tech is technically somewhat useful. Oxygen-free copper, occasionally used in "audiophile" cables - technically is a better electrical conductor (compared to regular copper), by a whooping low single-digit %.

Exact same effect could be achieved by making conductor that very same single-digit % thicker. Which is an order of magnitude cheaper. And ohmic resistance is not that important for audio-cables anyway.

Sure, but we were talking about high-speed digital cables, not audio cables. When you're pushing 48gbps over copper (as in HDMI 2.1) the cable construction and connection integrity absolutely does matter, older HDMI cables don't work reliably at those speeds (if at all) despite having exactly the same pinout as the newer ones.

Gold-plating of contact surface of electric connectors is indeed genuinely useful, on account of preventing contact oxidation.

Assuming good contact in connector(s) is achieved, gold-plating does not further help with high-speed signals. What matters here - is wire/cable itself, specifically, tight control over where conductors are relative to each other and insulation, so that impedance is well matched throughout, cross-talk is minimized, etc, etc...

True audiophiles hold out for Low-background steel enclosures.

https://en.wikipedia.org/wiki/Low-background_steel

I can tell you're no connoisseur. Gold-plating a digital connector like HDMI makes sure the zeros are really round and the ones are really pointy. If you have the right setup you can definitely tell the difference.

The source of that comment is provably not someone with deep technical expertise so take that with a grain of salt.

Its there because he knows it’s going to trigger people and will get more attention

It's explained in this video https://www.youtube.com/watch?v=sJNK4VKeoBM

It's just a buzzword meant to add perceived value.

For me it feels like that after sending messages over 5 years, you need 1TB storage just for the Twitter app.

e2e encryption is easy if everyone knows public keys for everyone else. This is how GPG works for example.

However, the challenge is distributing those keys in a trustworthy way - because if someone can tamper with the keys during distribution, they can MITM any connection.

I assume this "bitcoin style" encryption is a blockchain or blocktree of every users public key now and throughout history. Ship the tree root hash inside the client app, and then every user can verify that their own entry in the tree is correct, and any user can use the same verified tree to fetch a private key for any other user.

I’m not sure you appreciate how large that data structure would be if you had to ship it inside the app.

The idea is to only distribute the root of the tree to a client, query the server for the username you want to look up, which then returns the key and a short proof that this username maps to that key within the hash tree identified by the known root.

How is that substantially better than an API that returns a user’s key?

If the service provider (ie. the X.com servers) are evil, then the API can return false data and the client has no way to know.

However, with a merkle tree, the root hash is embedded into the app, and the servers return the data together with info chaining to the merkle root (typically a few kilobytes, even if the whole tree is hundreds of gigabytes).

With that info, the app can verify the chain to the root and be sure that the servers aren't returning false data.

To clarify the above. It protects against endpoint compromise but depends on the assumption that the service operator (the one computing the root hash) is trustworthy. In other words it significantly reduces attack surface.

It can be done with Merkel trees. You just ship the root hash.

Merkel trees are snapshot/read only though - so you then use a bitcoin style Blockchain to ship refreshed versions of the root tree hash (you can even ship it in the actual bitcoin Blockchain if you like, piggybacking on its proof of work to ensure different people don't see different root hashes)

I'm sure shipping a >150GB file to every user is perfectly fine and sound engineering.

Parent comment writes: "ship[ing] the tree root hash", for a merkle tree ("bitcoin style") this would just be a single (small) hash no matter the tree size, i.e. 32 bytes is enough.

It's not _that_ far off from shipping a 3GB chrome webapp disguised as a desktop app (cough electron)

What’s a couple orders of magnitude between friends?

We pretty much know this can't be practically done in a distributed way. Even the public federated stores for gpg keys have been flooded so much they stopped being usable.

Would the real XChat be able to sue X-Twitter for name infringement?

http://xchat.org/

Man, I remember being an IRC regular during the transition from XChat to HexChat. Now I learn HexChat is also dead :( [0]

[0]: https://hexchat.github.io/news/2.16.2.html

Maybe? XChat would have to show an established market in commerce in each market that x is infringing that they have an established commercial precense in. Also it's harder if xchat doesn't have a trademark in each of those regions.

No, they would have to show an established market in commerce in ONE market that X is infringing.

I do find it funny that the library Twitter is using (according to TFA anyway) self-describes itself as:

> Caution

> Experimental library!

and

> While this library is just a wrapper around the well known Libsodium library it still comes with high potential of introducing new attack surfaces, bugs and other issues and you shouldn't use it in production until it has been reviewed by community.

[0]: https://github.com/ionspin/kotlin-multiplatform-libsodium

Move fast and break encryption.

The Twitter brand is so strong it survives even after a rebrand.

The footnote elaborates on why the author used the old name.

> I'll respect their name change once Elon respects his daughter

It’s going to get confusing when trademark offices start getting submissions to expunge the “Twitter” trademark for lack of use.

Given that Signal is pushing new code updates all the time, isn't it trivial for them to push new binaries that harvest messages/keys/whatever-they-want?

Their client is open source and is routinely audited. Their Android builds are fully reproducible. You can also build and run the app yourself if you want instead of downloading it from the app stores. It is virtually impossible for them to ship a backdoor, at least on Android, without the security community noticing.

What exactly prevents them from doing a Windows build with an non-published change, signing it with the keys they control, and pushing it to an individual client through the upgrade servers which they control?

Desktop clients communicate through mobile clients, so they don't have access to the key material.

I don't believe that is the case. You can turn your phone off and the Signal desktop client will continue to work just fine.

There is a window of vulnerability between a theoretically malicious update being pushed and the security community noticing that it doesn't correspond to a build of the published source. That might only be a few hours, or even minutes - but milliseconds would be enough to do most of its work.

Correct me if I'm wrong here -- let's say the Signal folks are breached or have been secretly waiting for just the right moment to push out some malicious code. How would they coordinate rolling it out to client devices to take advantage of that gap? I mean, depending on what the exploit was, they might be able to whack some percentage of users -- but it would be caught fairly quickly. I'm curious what sort of attack you're theorizing that would be worthwhile here.

> it would be caught fairly quickly

Noticing something and reacting to it are very different things. Signal could fairly trivially grab all historical data for all online users within a fairly limited window. However it would be a one off event so the value proposition of such an act is dubious.

> fairly trivially

Show your working otherwise this is utterly spurious.

What is complicated about having the local client upload its database to a remote endpoint? It's literally opening a network connection and proceeding to write out a database dump to it.

Anyway the difficulty of the task itself is traditionally taken to be irrelevant when performing cryptographic threat analysis. The question is about what is and is not mathematically impossible for an adversary to do.

What's especially frustrating about all of these "Signal could flip a switch and steal everybody texts!" histrionics is that if they were interested in doing that they... wouldn't work at Signal. They'd go join/start the hundreds of other companies we've heard of in the past few years that have stored/leaked incredibly sensitive data with an insignificant fraction of the effort Signal have put in to establishing their credibility (the TeleMessage scandal being just the latest). People should hold Signal accountable, constantly, forever. But the baseless FUD is frankly hysterical from a forum of ostensible technologists.

This comment does not follow the context of the discussion.

Circling back up. Article author: Twitter might be untrustworthy and could bruteforce your keys. Use Signal.

Me: That's unreasonable. You also have to trust Signal.

Your answer just now: Why are people picking on Signal?!?

In fact, what the world really needs, rather than 3rd-party controlled encrypted messaging solutions like Twitter and Signal, is public apis for public key cryptography on non-trusted infrastructure, not tied to single groups. Everybody knows this. The reason that we instead have bodies like Signal -- a company that just so happens to tie every encrypted message to a real phone number and real human identity for no easily explained reason -- and the reason we have people who surely know better defending bodies like Signal in public, is an exercise left for the reader.

They control the update servers. So it's possible to target a single user with a single build that no one else ever sees. What percentage of users verify every release?

In theory, Binary Transparency (https://binary.transparency.dev/) solves that among other things. To pass verification, an update has to prove that it's included in a public log of releases.

But I guess Signal doesn't implement it?

It's distributed in the Play Store, so Google controls the update servers, no?

Edit: or Apple, whathaveyou

Sure, but only if you are blindly auto installing every update as soon as it is pushed. All you have to do to protect yourself is download the bundle, run a checksum and then install it.

Then you audit and build it on your own? Or implement your own client?

No free lunch. If comms security is that critical for you, outsourcing its assurance via trust is never going to cut it.

How easy would it be for them to ship a backdoor on iOS? With Apple's DRM it should be difficult to decrypt the IPA and compare it to the source code.

If your HW/OS doesn't allow verification of binaries, but your threat model requires doing that, then you need to use proper HW/OS that allows the verification. Also, iOS is proprietary so who knows what the OS is doing anyway. Also, this https://thehackernews.com/2014/01/DROPOUTJEEP-NSA-Apple-iPho...

If you are in the EU you can build the app from source and sideload it on your phone. Everyone else is out of luck. So yeah, either Signal or Apple can insert a backdoor into the app.

> It is virtually impossible for them to ship a backdoor [..] without the security community noticing.

OpenSSH was trivially backdoor'd [1] and distributed in several major distributions and the security community _did not_ notice until after it was already wild.

[1] https://www.ssh.com/blog/a-recap-of-the-openssh-and-xz-liblz...

1) That was not "trivial", by any stretch of the definition. It was a 3-year long campaign by a (suspected to be) nation-state (or similarly resourced) actor! I don't think you can get any farther away from "trivial" if you tried.

2) From your link, it says: "Ubuntu 24.04LTS was a month away from being shipped with this backdoor, with other distros being on the same boat. Maybe the best way to describe it is this: had it gone undetected, Linux servers would have been running with a bomb waiting to be activated remotely." and "Luckily this backdoor was discovered in an early stage, and most of the Linux user community stays safe"

So, the security community _did_ notice.

That was an attack targeting an optional dependency that receives significantly less scrutiny than OpenSSH proper. Which to be fair, is probably also the most plausible path if you wanted to attack Signal.

I would quibble with calling it "trivial" though.

Sure. If you don't trust Signal to not do that, then you likely aren't using Signal.

Signal is open-source [1]. You can compile the code yourself and review each PR if you're that paranoid.

[1] https://github.com/signalapp/Signal-Android

Looks like the build is even reproducible. That makes me trust Signal even more.

https://github.com/signalapp/Signal-Android/blob/main/reprod...

Yes but an app that never pushes update can also do that

Which one do you trust more?

At this point i don't care if it's encrypted, just make it better.

I don't get most of the hype around end-to-end encrypted messages when the app's source code isn't available for audit.

[flagged]

why people keep giving it the good press connotation by calling it by the old name?

"X" is a _terrible_ name; in a headline it looks like someone forgot to fill out a template.

Twitter wouldn't be the first rebrand where people just decide they're not going to bother with this. Notably, there the odd year or so where the Royal Mail attempted to rebrand to 'Consignia' (in the alternate universe where the Iraq War didn't happen, this would be what everyone remembered about the Blair era), and Netflix's attempt, some years before scrapping it entirely, to rename its DVD delivery business to 'Quikster'.

It will always remain Comcast to me. Fixing your public image requires correcting your wrongdoing, not changing your name.

Semi-related, parking your company name on widely used words in the dictionary like “Apple” and “Meta” really irks me.

Let’s just start some companies with the names:

- Let’s - Just - Start

You get the idea…

Interestingly, Apple (then Apple Computer) themselves fell afoul of this; they were repeatedly sued by Apple Corps (The Beatles' record label) over their name.

Git Pull LLC

I keep calling it Twitter, and urge everyone else to do so, because "twitter" is a better search term than "x", especially if you are using a search that doesn't let you specify word match.

Sorry, but I use a search engine where I can specify "site:x.com" for example, or better yet, "site:m.xkcd.com", and it shows me exclusively results on that site’s domain, rather than clumsily trying to pretend with a content keyword.

X.com is distinctive and unambiguous. Wikipedia has entertained at least 12 proposals to change the article name; 100% of them have failed, and they are issuing 3-month moratoriums on discussion now.

Honestly the new name is a bit of a prank on porn addicts. If someone is watching over your shoulder while you try to type "x.com" into the URL bar, autocomplete may reveal how many other sites begin with "x" that you’ve visited lately.

That's fine when you are searching for things on x.com.

But what about when you are searching a comment thread on another site to try to find a comment you remember where x.com was mentioned? The comment is probably not going to say "x.com".

It's not a good press connotation. Quite the opposite. As for why? The answer is in the article.

> [1] I'll respect their name change once Elon respects his daughter

That is an interesting concept as it seems that Elon Musk's main battle is against people's right to not be called by an old name. Xitter transition have not been very successful.

It's still running fine for me with actual interesting content. I don't get this take, feels like only people who don't use it at all (anymore) say it's been a bad transition or "X sucks now" but they're not using it.

It's still just Twitter, but you're not being banned anymore. So ACTUAL discussions can take place without having the thought police running around with a banhammer.

The Amazing actual discussions:

https://x.com/elonmusk/status/1876168991330439314

Yeah I'm not going to return to a website that doesn't ban people unable to have a civilized conversation.

> I'm not going to return to a website that doesn't ban people unable to have a civilized conversation

That's your choice! Perfectly fine. For me, I don't want to close my eyes for what the world is actually thinking, even when they're in rage-mode. I think that makes your own thinking very narrow.

Also, it's a conscious choice they made - they're the only platform I know of that allows you saying anything with no penalty except for maybe a algorithmic one. That doesn't mean it sucks, or is a bad platform, or the transition failed.

Twitter won't open my eyes to the "world is actually thinking". It is a rather minor social media in the big picture:

https://www.statista.com/statistics/272014/global-social-net...

There are certainly much better ways to learn what the world is thinking than a website without effective moderation. The problem was never "censorship" or "people are not allowed to say everything". The problem is the quantity of garbage the information supersewer generates and finding what is true and relevant.

It’s interesting to me that we can have such different views of the same platform.

“Garbage”. “Supersewer”. I simply don’t see what you mean. Of course there IS garbage, but you’d actively have to seek it out. You’d have to scroll down all the replies to get to the shit. If you want to see that, it’s there, but if it doesn’t have value, it stays there. Up top are the sensible replies and discussion threads.

We can keep talking, but if you don’t want to see it, you’ll never see it.

> Of course there IS garbage, but you’d actively have to seek it out

I still instinctively open Twitter up most days. I scroll for a bit, see a couple of interesting tweets, but the majority is either garbage spam for views, overtly general racist tweets, purposeful right-wing distortion of facts to incite hate.

You go into any comments of a tweet that has gained a traction - the first comment will usually be "@grok is this true?", OF replies boosted by the original post (because the thread was garbage spam and they're getting paid), or obvious ChatGPT responses.

It feels really disheartening, especially having grown my career from the stuff i've seen and connections i've made on Twitter. Shell of its former self.

Every time I open a Twitter link, most of the comments will be garbage.

Except for criticizing musk in the papers, as he's banned journalists, people "doxing" him by publishing his plane, etc

There's a million things you cant say, its now you are happy that the right wing nutjobs get to have their peace in public - that's the only part of the conversation that's "now allowed"

I’ve already addressed the first part of your comment in another comment.

I don’t think there’s a million things you can’t say. I see tons of posts criticizing Elon. But I also see tons of people defending him in replies. This is what we should want. Discussion. Open talking. And that includes “right wing nutjobs”.

If the vision you’re seemingly okay with censoring is so damaging that you can’t fight it with words, is the opposing vision strong enough?

I won't speak for others, but I refuse to use a service that doesnt work if I'm not signed in. But when it did work, there didn't appear to be overzealous banning, and all the banning conversation appeared to be coming from sources that deserved to be banned, imo.

So when you say "it's still good" while also mentioning thought police, I take what you're saying with a huge grain of salt, as I never noticed thought police to begin with, so less of something unnoticable sounds very close to "complete anarchy, nazis, and that's how we like it". Like 4chan put on a business suit.

If you never noticed the thought police, you were of the kind of people that Twitter wanted there to exclusively be. That's okay, but not a realistic view of the world. However, people with differing ideologies were pushed away. Yes, that includes literal nazis. But that also includes people who don't agree with the status-quo and want to see something different. The old twitter gave the impression of a world where 99% of the people agree with the current state of things, which is just not reality.

X is the only platform where you can see the real state of the world, raw, unedited. That's INCREDIBLY valuable and I'm absolutely baffled by how everyone here seems to celebrate censorship. We fought wars over this.

Yeah the censorship is overbearing now. I've since deleted my account of a decade but just using the word "cis" got a post of mine immediately auto-moderated.

I think people talking about how new-Twitter is somehow a bastion of free speech or whatever are just telling on themselves about what they think speech is.

Are you banned? Is your post deleted? No? Then it’s not censorship.

Again, if you don’t match with the vision, don’t use the platform. But you have to accept that the platform exists, is very popular, and allows free speech, and you can’t change that.

I don’t think Elon is particularly principled on the topic of free speech, seeing the way he blocked those outgoing links to competitors a while ago.

Regarding the auto moderation of that word, what does happen when a post gets auto moderated? Does it get like, semi-hidden or something?

They go to the bottom, behind a button you have to press to reveal them.

*allows free speech Elon agrees with

which isn't really all that free after all.

I recognize the benefits of open communication, while also not wanting to participate in something so gross. I'm absolutely baffled by people claiming censorship free is the only option, and that any moderation at all is bad. A free for all is not what I want, in any platform or space I participate in.

I think this might be a reaction to the previous moderation which seemed to be extremely biased. The moderation that’s currently in place seems much less so, however some people seem to argue it’s now the same, just the other way around.

In my opinion a free-for-all is what the online world needs. But it’s just that, an opinion. Feel free to not participate. I’m interested in what you do participate in, except for HN, though - is there something better that doesn’t ban me for defending Elon, for instance? To put question marks by global policy? etc etc. That’s at least as popular as X is? We can just talk to huge names there, and call them out on their bullshit, if they spew it. That’s unbeatable.

Well 2 years ago Elon completely broke twitter for me by requiring an account. 10 years of using twitter then poof no more twitter access.

I don’t know why an account is necessary to read updates from government agencies and local organizations after 10 years of not needing to do that.

"ACTUAL discussions" like what?

Because it would seem hate speech has had quite a surge:

https://journals.plos.org/plosone/article?id=10.1371/journal...

Of course it surges when you re-instate complete free speech. But now you could interact with them, discuss with them, maybe sway them another way. Or you just ignore them and scroll away, or even block them, so the algorithm knows you don't want that content.

They're already being pulled down by the alg. It's just allowed now, and why shouldn't it be? I think it's better for humanity overall if these people are not pushed into a small echo-chamber but instead can speak freely and openly.

We should go back to sticks & stones. Let hate flow off you and instead look for love, which is also still there.

And when all the hate speech proponents flood the platform with bots? What happens when pushing down is not enough because there is too much? What happens when there are so many new accounts posting hate speech you can’t block them either. Free speech and word detection algorithms are not good moderation they are lazy moderation that refuses to address the problem most people have with Twitter.

Twitter is not the US and does not guarantee free speech. To insist that it must because it’s a US company is entirely missing the point. Banning people is essentially ignoring people. Which is what the text of “sticks and stones” is instructing.

I’ve never mentioned “because it’s a US company” so I’ll ignore that part of the message.

Sticks & stones is a general thing that’s missing in a lot of people nowadays. Trying to protect everyone from bad words will only make them react more when they inevitably will encounter said bad words.

As for the rest of the “what if”s, I guess we’ll see what happens when it happens. As of right now, my For You page is filled with science, discussions, tech, friends, well-known people having normal discussions with “plebs”, etc.

If you don’t find value in the platform, simply don’t use it. Use Bluesky if you want.

Correct I mentioned it. If Twitter wasn’t a US company we’d never be having a conversation about freedom of speech so be ignorant about that all you want. However it’s silly you choose that reasoning.

Isn’t your suggestion to remember the words of “sticks and stones” the same as you advocating for how everyone should protect themselves from bad words?

I don’t use either platform because I find short form writing utterly valueless for anything than marketing purposes. You may say “but I read a lot of good discussions on there”. Great for you but the discussions are still mostly short form rhetoric with little value other than “talking out loud”. The other half of discussions is split between jobless comedians and hate-speech-as-freedom-of-speech advocates. I will never get my science, news, etc from a quote box. There’s a reason I deleted my account 10 years ago.

FYI long-form is possible since a few years, and actively used by a lot of people.

As much as I hoped Blue Sky might succeed where Mastodon didn't, it's by far the platform where I've gotten the most unwanted dickpics and thirst traps, and the general vibe feels so shallow and performative.

The signal to noise ratio is so low even when curating feeds, it feels pointless to post anything meaningful anymore, it just gets drowned in the noise and bots.

Oh wow, didn’t know that. I never left X but saw a lot of talk about BS when the transition happened. I just assumed it was a clone of Twitter with mostly the people who left.

That sucks tho. I’m not against other places existing if it makes people feel better.

The purpose of Bluesky isn’t to make people feel better it’s to stave people off from being indebted to an advertising heavy society. Software like Twitter that’s designed to keep you engaged and defending it regardless how harmful it’s been in the last decade is the reason Bluesky exists.

> Of course it surges when you re-instate complete free speech.

what? Elon routinely complies with random countries asking him to ban users, and routinely bans people he personally doesn't like. he even banned someone who was just reposting public flight data!

what on earth does "complete free speech" mean to you??!

Routinely? I doubt that. Of course I don't agree with everything he does, but I agree with his vision.

First thing that pops up on google:

https://www.washingtonpost.com/technology/2024/09/25/elon-mu...

Anyone still swayed by his vision is painfully naive

His vision seems to be "freedom for me, not for thee"

Nice. Good discussion.

[flagged]

One word causing post visibility restriction is not enough for your post to make sense. Other slurs also cause this to happen, which you would probably agree with. The post is still available for reading, and will still appear under the post it's a reply to, just at the bottom behind a button.

> "other slurs"

Yeah, "cisgender" is a normal descriptive word, not a slur, and it's really quite strange that anybody would think it is

I would like not to be talked to that way, but I agree that it shouldn’t be a bannable offence (which it isn’t).

But this comes down to opinion. Would love to discuss the 99% other content of my comment though.

What about the word 'cisgender' causes you to not want it to be said to you?

This is not something I want to discuss here, as we’re completely off-topic already.

Rest assured I have nothing against Trans people.

So you're willing to make several posts about it, but not explain yourself?

That seems to be a fair summary of what I’ve said, yes.

I’ve already gone too far, as evidenced by us even having this discussion. I don’t want to discuss such private matters with you, here. I’ll have to explain myself over and over again and open up another can of worms that I’m simply not wanting to open. It is what it is.

That's certainly your right.

Similarly, it is the right of anyone reading this exchange to speculate on why you have a problem with the word "cisgender", and why this question was the point when you chose to stop engaging.

Absolutely! Speculate all you want. If, however, you want to speculate anything other than what I’ve clearly stated (I have nothing against Trans people + I don’t want to go on another unrelated/irrelevant detour) plus the fact I have to wait an increasingly larger amount of time to be ABLE to reply in this thread (currently 30+ minutes), that’s more telling about you than me, like you’re trying to fit me into some compartment that you’ve put loads of others in. It’s not that deep.

I’ll stop engaging on this point here, now. :)

It implies a sexist worldview. Just like using racial slurs imply a racist worldview.

cisgender is not a slur

I think it depends on how it’s said, and opinion. It would be nice if both of you addressed the actual point I’m trying to make instead of trying to gotcha me.

That’s a pretty damning study, post-purchase hate speech is nearly half the Twitter content. Sounds like hate speech is the “actual discussions”.

That seems like a weird take. If 80% of the internet is spam (which it very well could be), is spam the internet?

I guess censorship is a popular thing now on HN. Never thought I would see all you people advocating FOR censorship. I’m happy Elon seems unmoving in his stance on this. We need to progress.

A lot of spam is censored by laws like CAN-SPAM act and fraud laws. Private mail services also censor spam with their own terms of service, with rules like DMARC.

I believe it’s called a “coherent speech product,” not censorship.

I loathe the poorly educated.

The internet isn’t Twitter, people aren’t advocating for censoring the internet, they’re advocating for censoring a person on a digital service platform. If you don’t think you’d see people advocating for censorship on HackerNews then you don’t understand what HN platform is, because bans, downvotes, flagging, etc are all types of censorship.

If you don’t like the platform censoring you, go somewhere else or do what Elon did and buy the platform and change the rules for yourself.

I only see bluesky types keep calling it twitter fwiw.

I am by no means a bluesky person. I hate Twitter and all its clone sites, because I think they're tearing apart the social fabric by training people to interact in bite-sized hot takes in a cycle of outrage. I will still call it Twitter until the end of time, because I refuse to respect corporate rebrands. Whether it's Twitter, Facebook, Comcast, or anything else, I'm not going to play along with their silly name games.

[flagged]

[flagged]

>...you're still relying on the Twitter server to give you the public key of the other party and there's no out of band mechanism to do that or verify the authenticity of that public key at present.

...

>Signal doesn't have these shortcomings. Use Signal.

Dunno that Signal is a really good counterexample for this particular aspect of E2EE messaging. The option exists to compare a 60 digit decimal number but the usability of this feature is such that most users don't even know that this is something they have to do. Just having a feature is not valuable if no one knows that feature exists and have no idea what any of it means.

I like the approach used by Briar Messenger. They just have the user use the number that represents identity in the system. There is no misleading feature that maps a phone number to the actual cryptographic identity. This makes it much harder for the user to unknowingly use the system in an unsafe way. A Briar identity looks like this:

    briar://bafybeiczsscdsbs7ffqz55asqdf3smv6klcw3gofszvwlyarci

[flagged]

Umm what ? Are you saying that we need to call Twitter X? And if not, we should get flagged?

If that's the case I'd like to say it will always be Twitter for me.

People should call it by its name. Using an old name that no longer describes it is confusing.

[flagged]

[flagged]

Signal doesnt have a backdoor. You might be misguided By the media. Signal is one of the best software and foundations to exist. Period.

I'm assuming this is about TeleMessage

https://www.404media.co/the-signal-clone-the-trump-admin-use...

With all the ways devices leak data, even now with all the AI integration and the screen recording happening in Windows, it is safe to assume encrypted messaging is not as secure as it used to be. Onscreen keyboards and device notification systems also offer other areas that can leak what you type.

The financial and legal consequences for companies that refuse backdoors are just too great.

> even now with all the AI integration and the screen recording happening in Windows

What!

> Onscreen keyboards and device notification systems also offer other areas that can leak what you type.

The keyboard one is really pervasive.

The google keyword for the screen recording is: "Microsoft Recall". In summary: yes it's true. But only for PC equipped with some niche hardware (and Windows 11). Also, Microsoft promises these data don't leave your machine. Overall consensus is that this is a terrible idea.

> Microsoft promises these data don't leave your machine

I guess all is good then!

FWIW signal opts-out of recall. There is a blog post about it.

That was a modified client you're referring to.

It didn’t have a back door.

A third party client was used whose only purpose was to log conversations. That third party client’s archive was then hacked.

Any client must by definition have access to the unencrypted data (in order to display it to the user). If you deliberately create a client that logs all communication, well, then all communication will be logged.

No.

https://github.com/signalapp/Signal-Android/issues?q=is%3Ais...

[flagged]

[flagged]

That’s not true. Skepticism is good and welcome. Random allegations like “it has a backdoor” are not.

If someone has demonstrable evidence that Signal is compromised, I’d delete it immediately. Until then it’s just unwarranted speculation, seemingly intended to make people “both sides” it and switch to something more popular and less secure.

Here you go: https://consumerrights.wiki/Signal_Data_Collection

I would never, ever trust anything that asks me to login using my phone number - which by nature is identifier. They have their own motivation to require phone number - but I will never buy this kind of things.

That said, being open source doesn't mean it's private - at the very least they can collect enough metadata tied to my phone number. If my messages are sent via centralized servers owned by someone other than me who already have my identifier, there is no reason I have to trust them.

Saying something against Signal always hurts some people's feelings, as if Signal is sacred object.

There, I said it. You are free to downvote me. But that won't change the fact that they have collected data, just like WhatsApp et al.

I’m not saying that article is wrong. I’m not going to read through that wall of text and vet every unlikely claim. I am saying it could hardly be more opinionated, directly calling the Signal team liars. Even the site’s own header throws a large grain of salt at it.

I unfortunately did read it. All of the claims are disputed, and everything with actual citations refutes them.

That was my first impression, too. I saw a couple of specious claims and stopped looking.

I’m not a Signal fanboy but I’m suspicious at the amount of unmerited criticisms it gets from random posters. My inner conspiracy theorist keeps whispering that people want us to stop using it.

[flagged]

I read the first sentence and thought "that take sounds rather warm", but then I realized you were talking about Elon. Yeah, you don't get to casually throw a Sieg Heil at a public event and not get called a nazi, I have to agree.

And someone who is (or at least until recently was) a part of the US government, with overreaching authority. Yeah, these are the people I trust to keep my communication private...

[flagged]

So you are saying that it’s not possible for someone who grew up around slavery and benefiting for apartheid to have racist ideology?

[flagged]

It's very relevant. The intersection of: providing a platform with "encrypted communication" used world wide, vindictive behaviour, and Nazi leaning - it may result in some people who assume their private chats are protected being thrown under the bus in the future. The world is political and it matters.

[flagged]

[flagged]

His support for far right parties in Germany and in the United States. I'm sure it's just a coincidence, though.

Yes, he's pretty clear about his ideologies, none of which include hating Jews. In fact, he's a outspoken proponent of Israel. I really don't understand how people's brains make that into a Nazi.

> outspoken proponent of Israel.

Oh okay, so if you dogwhistle to Nazis by seig heiling at an event (twice!) and replying "interesting" to neo Nazi posts on Twitter then all of that is wiped away by supporting Israel? You seem unable to read between the lines.

I’m very capable of that last statement actually. It’s also called “being a conspiracy theorist” if you do so with people/entities that others agree with.

You could also turn it around - so if you support Israel and be outspoken in support of Jews but reply “interesting” to a few posts completely wipes out support?

This comes down to opinion (and, be honest, wanting something to be true). Have the opinion you want. Just know that if the media stands behind you and agrees with you, it’s in no way confirmation of your opinion. It’s just the opinion most well-suited for the media’s investors.

It’s hard at first, but to realize that the opinion you hear most is NOT always the opinion most people have is golden. Suddenly it makes sense why stuff happens in the world.

[dead]

Considering that a lot of extreme-right party and neo-nazi groups have supported Israel for their genocide of the Palestinian people, this is not the defense you think it is.

Damned if you do, damned if you don't, huh? :)

[flagged]

I have no idea what you’re trying to say here.

[flagged]

Oh really, then show me a video of someone specifically raising, in a very straight fashion, the right arm and hand at a fast speed. The straightness and speed is important. No a simple salute made with the right arm just does not look the same. You know it, I know it, Elon Musk knowns it. Let's not pretend he did not explicitly made a fascist salute.

[flagged]

Also openly endorsing a Nazi party like the German AfD [1], and if I had to link every single Musk's tweet where he says or endorses something homophobic, transphobic, racist, sexist or antisemitic I'd hit my character limit.

[1] https://www.theguardian.com/world/2025/feb/24/elon-musk-cong...

Yes people forget but Elon was defending white supremacists on Twitter well before he owned the company.

It's ridiculous and offensive to call someone a nazi who is clearly not a nazi considering there are literally people targeting Jews and their supporters in this country [1] [2] [3].

[1] https://apnews.com/article/israel-embassy-jewish-museum-shoo...

[2] https://www.cnn.com/us/live-news/boulder-colorado-antisemiti...

[3] https://www.ed.gov/about/news/press-release/us-department-of...

It is probably better for Xitter/Elon's plans.