ZH version is available. Content is displayed in original English for accuracy.
Advertisement
Advertisement
⚡ Community Insights
Discussion Sentiment
76% Positive
Analyzed from 2158 words in the discussion.
Trending Topics
#signal#wire#should#https#phishing#messenger#matrix#data#blame#something
Discussion (56 Comments)Read Original on HackerNews
I was actually on site at the Bundeskanzleramt and they had requirements of being able to install the entire server stack airgapped. We ended up building quite a cool delivery method based on Nix to ship the whole closure of the system and the containers inside and spin up a Kubernetes cluster with it. I'm wondering if it is still being used.
Amazing to see it's still going strong :)
> PVC backing
Yeh. But wire's storage is based on Cassandra which handles replication of storage. So you could deploy it on local nvme drives as well using a local storage CSI.
That's also how the wire.com cloud is/was run. Large Cassandra cluster on top of EC2 Instance Store as opposed to EBS.
What I'm saying is - just because the BSI authorizes something, doesn't mean that it has to reach the Bundestag ;)
Meanwhile the rest of Europe (and much of the rest of Germany) seems to have converged on Matrix as a genuine open standard with various different commercial vendors (Element, Rocket Chat, Famedly, connect2x etc), avoiding vendor lock and so giving actual digital sovereignty: https://element.io/matrix-in-europe
But on a different point, Wire is inferior to Signal. Signal has a painfully slow data transfer when switching devices. But given some time, the data transfer does work completely.
On Wire, my experience has been that all media in chats are stored on the Wire servers and the backups don’t contain the media. They contain links to the media, while the media may be erased on the servers after sometime. I’ve lost a lot of media from chats on Wire when switching devices and restoring the backup from the original device. Only the text of the messages remain. At that time, Wire’s backups were also device/platform specific.
Since I place a very high level of importance on retaining and transferring data, I wouldn’t recommend Wire to anyone who wants to retain chats for longer durations.
[1] https://www.samyoung.co.nz/2025/03/building-better-idiot.htm...
“A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools.”
[1] https://www.goodreads.com/quotes/6711-a-common-mistake-that-...
But also sufficiently different that I have no doubt a lot of people have independently coined some variant or other. There's also the decades older (sometimes attributed to Einstein, but there appears to be no evidence that he said it) "Two things are infinite: the universe and human stupidity; and I'm not sure about the universe." It seems sayings about the extent of human stupidity are quite widespread in many variations.
Any idea why Signal is deemed a "commercial platform" by DBT administration?
And my understanding is that there is minimal meta data to hand over as the message contents are unreadable without the keys.
And there is also the darker side of some eu parties pushing for more surveillance, and in that case stuff like signal would be kind of a problem as well.
She thinks she was "hacked" on signal, and now wants to switch to something which is clearly better! Let's wait where she will want to go once she gets "hacked" there too...
While there are valid reasons for germans not to want their politicians to use private messenger apps on their private phones for official business, and american ones at that, this switch would of course change nothing about all of these problems. But at least they can claim they did something, right?
Personally, I am starting to think we should ban politicians from using smartphones altogether possibly followed by other technological restrictions. It is part of my: "They Will Hate it: Good" portfolio of ideas to improve the world or at least make it a little more funny.
the best on ux is probably telegram, but i'm trying to move a few people off it anyway
You can run your own matrix server but tbh it’s easier for someone else to do it.
Not to mention the obvious advantages of their bridges into the closed networks of WhatsApp/fb/x/instagram etc
here you have chart comparison
https://www.messenger-matrix.de/messenger-matrix-en.html
and alternative
https://www.securemessagingapps.com
personally I like Element (Matrix) and Threema
edit: btw. signal best UX? do they finally show users how to force send unencrypted SMS or you still have figure it out with google? I remember their great UX when they were forcing PIN verification with nag screens taking half or whole screen, which was the last drop I moved with whole family away from that PoS, let alone how unreliable it was, whole network down because admin in US sleeping waiting hours until he fix it, their approach (aka hatred) to users reminds me Firefox devs, left Signal even before it became popular
That's a nice comparison table.
Also doesn’t help that the humans doing the legislating tend to be of the “I print out my emails” generation
The median age of Bundestag members is 45.4
https://data.ipu.org/parliament/DE/DE-LC01/
In the US Senate It's 63.9.
https://data.ipu.org/parliament/US/US-UC01/
But since this whole ordeal started, I'm divided where to place the blame (besides the attacker, of course):
- Can we really victim-blame someone for falling for an attack? Sure, people in positions this important should know better, but I don't think we should put the blame on the victim. - Should we blame Signal for even providing the functionality that allowed the phishing in the first place? Signal announced changes that supposedly makes phishing harder, so apparently, something could've been improved before? - Should we blame the software-world entirely that having credentials that can be shared is even a thing? (Looking at passkeys) - Should we blame society that the knowledge about phishing attacks isn't ingrained into every person? (being a bit hyperbolic here) - Should we blame the administrative staff that allowed exposed politicians to even have apps that make phishing possible? It would be possible to make a super-secure messenger that needs much more verification than just "having the credentials". It's just super annoying and impractical for most people. Should we prevent exposed politicians from even having access to not super-secure messengers?
I feel like things could be improved to prevent phishing attacks in the future. I just don't know what is the most sensible point to start.
The victims may well be those who are potentially endangered by the leakage of information caused by the decision maker. Regardless of that hypothetical, the person responsible for the leak is not the victim.
If you deal with highly confidential information in your day-to-day work, you should be held accountable for keeping it confidential. This is nothing new in the corporate world, so I don't see why public officials should be held to different standards.
Remember: It was apparently a phishing attack. Someone literally asked her for her credentials. It is within the capabilities of an adult to refrain from handing out important information when asked in a no trust environment. If that's truly beyond their capabilities, they should consider another profession.
I'm not arguing for a witch-hunt or anything against this specific person. Learnings should be constructive and this could have happened to many other public officials. Just, maybe.. if you or I breach protocol, let's not call us the victims.
Media education would be a great start.
As so often, the biggest GDPR problem is missing enforcement.
But actual enforcement of GDPR has always been shoddy. First the “legitimate use” loophole, now this.
It’s a bit ironic that heise does this, since they probably have one of the most sensitive readerships to this.
So, national messengers, controlled by experts, that archive communication and run on trusted hardware, would be the best solution for the work of democratic goverments I would think.
Of course, the possibility of software quality and security experts in service of the goverment is probably just wishful thinking.
Good idea, let's all live in peace and harmony. (But first we need to sanction and regime change all the bad countries.)