U can make multiple so I got a backup in a secure location.

I use QubesOS with anti evil maid. U have a usb u carry with u (and ensure the safety of) and that verifies the PC which then proceeds to boot itself.

I use signal for communicating with normies who just wanna download an app. Just cos signal is better than most doesn’t mean we shouldn’t demand better. Why can’t we have both? With self hosted federated signal servers and no phone number requirement we can have our cake and eat it.

Dr GPT found something on it. It was a federation between Silent Phone 2014-2015 (a secure messaging app developed by Silent Circle, a company co-founded by Phil Zimmermann, the creator of PGP) and TextSecure (the precursor to signal).

The point is we cannot trust they run the software they claim to run. Identifying a sender despite sealed sender is trivial if u have a centralised server.

Say I am the signal server and all the clients run the known/provable secure clients that are used. I as the signal server an subject to wiretap and gag orders so I can be obligated to run software that is not the published server software and into tell anyone. As a server I by definition have everyone’s IP address. A message with signal protocol has a sealed sender and a known identity recipient. As the signal server I can see when u send a message and from what IP and to which identity and what ip that identity is. I can then simply associate IPs and identities.

I trust the app I cannot trust the server. A reproducible build does not prove anything about the server it only proves the client.

I mean long before that with one of the 3rd party apps they used to federate their own server with signal iirc.

Hey signal is better than most of the mainstream bs. I use it myself and I’m confident that the messages themselves are secure. However, it had issues.

Since we cannot verify the software they run on the server is the software that is open source then we must assume it is not.

We know for a majority of cases a phone number = a real identity. Signal implements sealed sender but since signal is a centralised point they can correlate the sealed sender extraordinarily easily. We must therefore assume signal knows when and who is communicating (We can verify they don’t know what is being said) this therefore means signal could theoretically have a full social graph of real identities for every singe user.

This is of course after we remember signal received funding from BBG which is an organisation funded by the us government purely for the purpose of promoting american propaganda.

Also I believe they used to have federation but all evidence of this seems to have been wiped from the internet.

Signal can either adapt and prove themselves with more than a “trust me bro” or they can die. Just cos they are better than the alternatives does not mean we should not demand better.

Pretty good. Just testing out an obliterated version of deepseek r1. Hopefully its a drop in replacement for my current ai engine.

https://www.youtube.com/watch?v=BKCj6A4CHV4

Not necessarily docker but gives a good vibe for self signed certs. Also i don’t see why u need encryption if ur only accessing ur data over local network (I presume via a vpn) its unnecessary unless ur worried about someone snooping packets on ur lan.

Personally I have my services available to the internet with a letsencrypt cert for a domain served via nginx that served my services at relevent routes. SSL isn’t really nessasary unless ur transporting across an untrusted network (such as the internet instead of over a VPN).