Personal blog of Michał "rysiek" Woźniak, writing on privacy, decentralization, encryption policy, web technology, and tech hype.
HN commenters cite it for essays like "The hype is the product" and for its views on encryption bans and protest against surveillance laws.
Yes, let's see
* Not end-to-end encrypted by default
* No end-to-end encrypted groups
* No end-to-end encryption on any desktop client by the vendor, forcing cross-platform users to drop secret chats. This includes 81% of working age people who sit on their computer during work day, and 100% of college students and IT workers.
* No post-quantum key exchange
* No future secrecy
* No per-message forward secrecy
* Bullshit claims about distributed keys https://security.stackexchange.com/questions/238562/how-does-telegrams-secret-splitting-scheme-work/243172#243172
* Lacks ALL metadata protection from server like phone number, IP-address and thus geolocation, contact list, group memberships, quantity and schedule of communication, data types. In fact --
* Secret chats leak additional metadata about intent to hide content from TG as the vendor.
Also,
History of poor encryption implementation
* 2013: A cracking contest https://news.ycombinator.com/item?id=6932648
* 2013: Telegram, AKA "Stand back, we have Math PhDs!" http://unhandledexpression.com:8081/crypto/general/security/2013/12/17/telegram-stand-back-we-know-maths.html
* 2015: IND-CCA issues https://eprint.iacr.org/2015/1177.pdf,
* 2015 64-bit complexity MITM attack https://web.archive.org/web/20160425091011/http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html
* 2021 Valsorda "The Most Backdoor-Looking Bug I've Ever Seen"…
Monetization and abuse has been mentioned a bunch as things to consider as you gain more users, but I'll add a couple more I think are relevant, at least once the service is big enough.
Your payment processor. Payment processors might get triggered by the fact that adult content is pretty much explicitly allowed. They might also just generally deem you "high risk" and kick you out. I think this is one of the biggest risks you run. For example Stripe, according to their legal docs, prohibit "Cyberlockers, regardless of whether they host adult content", whatever that means, but it sounds a lot like file sharing in general is a prohibited business.
Ever-tightening think-of-the-children laws. You may not want to implement expensive and privacy invasive scanning (note that even local scanning may be privacy invasive[1]), but you might be forced or face a fine. You could always do like Google and budget it in as an expense, love that "fines" line in their reports. This may also be relevant to the previous one, since payment processors might deem you higher risk if you have no scanning.
Getting blacklisted for hosting malware. Specifically the support for non-media files. You could end up being blocked by browsers, search engines and whatnot. See for example Google Safe Browsing.
[1] https://rys.io/en/173.html
Log-log of daily growth vs total cases is a neat graphics hack, one I'd not seen before, let alone thought of.
FT have been headlining a semi-log plot of deaths per country, normalised to days after the first ten deaths were reported.
https://www.ft.com/coronavirus-latest
Because dead bodies tend to behave characteristically, are inconvenient both directly and via surviving relations, and present a smaller testing target (about 1% of total cases) as well as representing a full course-of-illness endpoint, these data should be generally more reliable and cross-regionally consistent than confirmed cases. Deaths are, however, lagged by about two weeks.
FT also provide numerous other graphical representations, including an excellent small-multiples (Tufte fans) matrix of multiple countries' case trajectories.
My view is that all serious reporting should lead with similar visualisations.
Wikipedia's COVID-19 pages have similarly featured semi-log plots from early on, as does Worldometers.
https://en.wikipedia.org/wiki/2019–20_coronavirus_pandemic#Diagrams
https://www.worldometers.info/coronavirus/
(Numerous additional pages with regional and specific behavioural characteristics within both sites.)
Anoter data visualiser, allowing arbitrary multi-country comparisons:
https://rys.io/covid/
This reminds me of a similar article that might have been posted on here about tech now focusing on hype as the product.
https://rys.io/en/180.html#hype-is-the-product
> In fact, increasingly, hype is the only thing that counts, as larger and larger chunk of investment money is chasing it – to the detriment of everything else that happens not to bolt the hyped tech onto its unrelated but otherwise solid product or service.
> The bubble grows. The line goes up.
> Because the hype is the product.
The ban is not about encryption: http://rys.io/en/149
Of course they can't expect to effectively police the ban if it's put into law. But they don't have to. Everybody will encrypt anyway and that's fine, because once they want somebody put away, they will be able to simply by saying "that person broke the Snooper's Charter by using SSH".
It's not about banning encryption, it's about having a convenient law to put tech-savvy people away.
Do what people did when ACTA was about to be signed - protest on the streets. A few tousand people on the streets of most big cities in a country speak to politicians louder than online petition signed by 1 000 000 people.
Polish politicians have learnt their lesson last year and now they know to not even try: http://rys.io/en/109