A lot of privacy guides suggest avoiding Telegram. I understand that in its default mode there’s no E2EE (and no E2EE for groups at all). If people I know don’t wanttko use Signal, isn’t Telegram the lesser evil given it’s nicer privacy policy (than other popular ones)?
Say I use the FOSS version of it.
We don’t know what anyones server code looks like. The code that is published may not be the one they are actually running.
In fact Signal stopped publishing server side code a few years back, and only resumed after the community got angry: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/
Well, that’s true. But if there’s published server code, it’s at least better than none.
There’s a point where you either decide to use the service, or just withdraw from any of them at all, if you go down that road.
The server’s trustworthiness does not matter for Signal. The app is designed to work securely regardless of the server. Moreover, even if the server software is open source, you cannot be sure that they run the same code that they publish.
I don’t think that they published it as a response to the angry users. We wern’t that loud and signal had a reason to do so. That was when they worked on the cryptocurrency and the spam protection. In signals case it dosn’t matter much if the server is compromised since the important part happens on the client side. The server can only forward encrypted salad or not deliver a message. Or log the meta data of the messages. E2e will always be there, despite the server being compromised.
What bothered me was that Signal fanbase was trashing Telegram for not publishing the server source, while Signal was doing this.