Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The difference between an 'abuse filter' and a censorship mechanism is semantics. By classifying political speech or image hashes you don't like as "spam", you've effectively implemented a political censorship mechanism and just gave it a different name. This is also why many privacy and security advocates are against on-device CSAM scanning. By classifying hashes of memes shared among political opposition parties as CSAM, you enable censorship, or even worse, targeted tracking of individuals over protected political speech. These systems need to be evaluated by what they can be made to do, not by what we're told they're for.

I have personally witnessed political messages being censored on Signal, server-side.

I recognize that keeping that private is what makes it effective. The argument being made isn't that the filter would be more effective if it were open source, the argument is that the filter is being abused to perform censorship, and that's the reason why it's not open source.

One of many downsides of trusting centralized platforms/services like Signal.



You seem to be under the impression that this filter is based on message content. It's not. All content is e2ee, and this filter is not downloaded to the client. The filter is to stop abusive network behavior, e.g., someone enumerating every phone number to get a list of all Signal users. If you'd like, I can link you to some of the research that has been done to determine some of what they're doing (or you can search google scholar).

edit to add: I guess I should clarify, the messages in Signal are properly e2ee with ephemeral keys, and there is no content hashing or the like to leak anything to the server. It's not public yet, but if you'd like, I can share some of my research into the structure of an actual Signal message, from the TCP layer down to the encrypted payload.


Evidence?


Be more specific. I already linked to the exact line number in Signal's code where they admit both that a server-side message filter exists and that the implementation is private, look at the top level comment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: