I don't trust Signal
&quot;trust&quot; is one of those words which has contextual meaning. I actually do &quot;trust&quot; signal, for low risk things. I don&#x27;t routinely do high risk things and so I can make a cost&#x2F;benefit decision facing who might exploit what I am doing and the consequences for me.<p>Other people live in the margins of what either their own, or some aggressor society wants and information from&#x2F;about them is key. I can understand somebody having a heightened sense of what should be the foundation of &quot;trust&quot; in these circumstances. But that said: simply using signal is probably putting a giant red flag over you in some circumstances. Or, PGP. Any self-installed cryptographic technology you are associated with, puts a marker against you for some problems.<p>I don&#x27;t &quot;trust&quot; closed source. I prefer that people have review, and that objective groups of people I trust in a personal sense (because I know them, no matter how vaguely, from online lists, and IETF wg and the like) tell me from their position of contextual knowledge, and I admit some authority, where trust can be well placed. Some of them are American. Some of them work for agencies related to the state, like the FCC and in some cases the NSA. I again have to re-frame &quot;trust&quot; into the sense of what it means when somebody who works for an agency like those tell you something. (others of them are not american, do not work for these agencies, or sister agencies in five eyes or other economies. But I observe, if you are competent to speak about cryptography you almost certainly DO engage with people who work for state enterprises like NIST and the NSA, even if in other economies. Its just the way the world IS: academics who work on cryptography have a circuit of relationships which includes the mathematicians inside these agencies)<p>I don&#x27;t &quot;trust&quot; Moxie quite as much as I did, because some of the actions around Signal confused and worried me. And, I saw little to no desire to engage. Well, he doesn&#x27;t owe me anything, financial or moral. I have no direct relationship, and in the end if he decided trying to assuage a million edge users like me (edge user not edge lord) was a loosing game, I can&#x27;t fault his logic but the other side of that logic is I don&#x27;t &quot;trust&quot; him as much as I used to.<p>I do trust Meredith. I have met her (once or twice) and she seems to me to behave in an open, direct manner, and when she says things I see them reflected in what she does. And, I trust the kinds of statements she has made about signal and the kinds of things I see emerging around governance of something like signal.<p>In due course I do hope she and the board can say something about source code, and future development, and how we can re-build or build from scratch some reasoned trust in the code, and its cryptography and the trust in systems behind the code.