![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://lemmy.ml/pictrs/image/2QNz7bkA1V.png)
That argument makes absolutely no sense. These server-side code does almost nothing. The only task it really has is passing around encrypted packets between clients.
So it knows about all metadata, plus registration with phone number, etc. got it.
The Signal protocol, which is used for client-side, local, on-device end-to-end encryption has always been fully open, and it can be used by any app/platform.
you conveniently leave out how you need to use the client built by Signal, with dependencies from Google Services and the like, and you can’t use one built from the source they provide. Which at that point means they can introduce whatever they want in whichever version.
Decentralisation is the only safe way.
https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/
https://www.xda-developers.com/signal-updates-public-server-code/
https://tech.hindustantimes.com/mobile/news/signal-updates-its-open-source-server-code-after-nearly-a-year-71617778373810.html
Look into their MobileCoin and how they implemented it. They are just banking on people forgetting about it.
Anybody pulling these antics with a cryptography product loses my (and others) trust immediately. I’m a security soft dev, and my colleagues and I migrated to Element and Matrix network when it happened. I remember the disgust vividly.
Of course all of this is not going to be the Signal wikipedia page… It’s amazing how their fanbois work.