this post was submitted on 03 Jul 2024
232 points (87.2% liked)

Technology

59091 readers
4728 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 195 points 4 months ago* (last edited 4 months ago) (21 children)

There are good reasons to dislike Telegram, but having "just" 30 engineers is not one of them. Software development is not a chair factory, more people does not equal more or better quality work as much as 9 women won't give birth to a baby in a month.

Edit:

Galperin told TechCrunch. “‘Thirty engineers’ means that there is no one to fight legal requests, there is no infrastructure for dealing with abuse and content moderation issues.”

I don't think fighting legal requests and content moderation is an engineer's job. However, the article can't seem to get it straight whether it's 30 engineers, or 30 staff overall. In the latter case, the context changes dramatically and I don't have the knowledge to tell if 30 staff is enough to deal with legal issues. I would imagine that Telegram would need a small army of lawyers and content moderators for that. Again, not engineers, though.

[–] [email protected] 33 points 4 months ago

And lawyers are pretty likely not staff at all.

[–] [email protected] 10 points 4 months ago

I can understand if someone like Google or Microsoft employs lawyers directly, as they have the resources and scale to do so. But someone like Telegram should really not do that. They should use an external legal office when needed. Even keep them on retainer, but definitely not open a legal office inside the company.

load more comments (19 replies)
[–] [email protected] 87 points 4 months ago (5 children)

To be fair, in a large company, there is usually only about 30 people who are actually good and know what is going on, and hundred of others who are checking in trash.

[–] [email protected] 50 points 4 months ago (3 children)

It's not even about the quality of individual people. The organizational structure of large companies encourages pointless work.

Internal mobility and cross department collaboration are frowned upon. So you get many people doing duplicate work, new ideas don't propagate, and even if someone has an idea it's quickly shut down.

The only way to achieve anything substantial is to be both: 1. assertive and energetic, and 2. at the correct level of hierarchy. And make no mistake even if you pull a miracle there will be no reward. Maybe a 3% raise at the yearly review.

Sorry for the rant, I currently work in a company like this.

[–] [email protected] 25 points 4 months ago* (last edited 4 months ago)

Yeah. The most secure companies I’ve worked at actually only had a small group, of very competent people, who were paid well, treated with respect, and not presented with a lot of organizational or infrastructural red tape.

I’ve worked with teams of 10 that had shit locked down tight, and teams of hundreds who had software that was exploding and getting exploited left and right.

If someone tells you more head count = security, I would not consider them an expert.

load more comments (2 replies)
[–] [email protected] 8 points 4 months ago (1 children)

30? Sometimes very less, 2 or 3. It's incredible that some piece of software used by milions/billions of people, have been written and sometimes maintained by 2 or 3 guys.

[–] [email protected] 8 points 4 months ago

There’s an aphorism, “give me 10 engineers and I’ll build it in a year, give me a hundred engineers and I can get that down to just five years.”

[–] [email protected] 7 points 4 months ago

I see this parroted now and then. Often the people I've heard it from are the type of folks who would drastically underestimate the complexity and effort needed to make things. I've also seen and worked on codebases made by such folks and usually it ain't pretty, or maintainable, or extensible, or secure, or [insert fav cut corners here].

[–] [email protected] 7 points 4 months ago

Even if every employee was equally competent, decision making needs to be consolidated enough that it can be decisive and shared throughout large companies. Complex systems that need to change rapidly gain no benefit from having too many people wanting to make decisions, you only need most of them to be competent enough to complete the work based on the decisions of a small group or the work will end up getting too convoluted and unmaintainable.

There really isn't a benefit to have everyone understand all of the parts of a large and complex system, if they only have time to work on a portion or to facilitate decisions that take into account the knowledge of the people in the different parts.

[–] [email protected] 85 points 4 months ago (1 children)

Headline is terrible. The big red flags are that they don't do end-to-end encryption by default, the servers are in Dubai, and use a proprietary algorithm.

Last part should be clarified further. They didn't reinvent AES or anything. It's more like a protocol that puts together existing algorithms. It means they can use transport layers without TLS or anything else that wraps your messages in crypto otherwise.

https://core.telegram.org/mtproto

I'd still say this is a red flag. How you wrap encryption around your messages has several pits you can fall into. It's not as bad as reinventing AES, though.

[–] [email protected] 15 points 4 months ago (1 children)

Headline is terrible

They do explain though that given how below average their headcount is, it means they're likely understaffed, overworked, and have zero capacity to respond to intrusion attempts.

[–] [email protected] 8 points 4 months ago

They seem to have 0 clue what they are “explaining “ though. I don’t know if those engineers are overworked or how (in)competent they are, I don’t even use telegram. But they apparently do have other non-engineering people on staff and content moderation and dealing with legal issues aren’t the job of an engineering team.

[–] [email protected] 55 points 4 months ago (3 children)

Someone needs to make a browser extension that hides any article with "experts say" in the title

[–] [email protected] 51 points 4 months ago (1 children)

Experts say that is not possible.

[–] [email protected] 9 points 4 months ago

Experts say that hurt their feelings

[–] [email protected] 10 points 4 months ago

Someone

We have now selected you to be that person.

load more comments (1 replies)
[–] [email protected] 55 points 4 months ago (1 children)

The security software I maintained had one engineer.

Your move, sec nerds.

[–] [email protected] 22 points 4 months ago (1 children)
[–] [email protected] 12 points 4 months ago (1 children)
load more comments (1 replies)
[–] [email protected] 43 points 4 months ago (2 children)

The count of engineers means absolutely nothing.

load more comments (2 replies)
[–] [email protected] 15 points 4 months ago

talking to carlson is a red flag

[–] [email protected] 13 points 4 months ago (3 children)

“Without end-to-end encryption, huge numbers of vulnerable targets, and servers located in the UAE? Seems like that would be a security nightmare,” Matthew Green, a cryptography expert at Johns Hopkins University, told TechCrunch. (Telegram spokesperson Remi Vaughn disputed this, saying it has no data centers in the UAE.)

good job Remi, that was the main concern lmao

[–] [email protected] 12 points 4 months ago (2 children)
[–] [email protected] 12 points 4 months ago (2 children)

Signal sucks from a UI/UX standpoint, when they dropped SMS support I lost any ability to convince people to switch, and everyone who had already switched left.

Then there's the seamless switching between devices...which it doesn't do.

[–] [email protected] 9 points 4 months ago

Using SMS through signal defeats the purpose of signal...

The UI is fine, what more do you expect out of it? It has a list of chats, a menu button with menu options, like it's a messaging app not a social media platform akin to discord or telegram.

[–] [email protected] 4 points 4 months ago* (last edited 4 months ago) (1 children)

I'm a signal donor and while I disagree with your point regarding UI (have you used in the past couple of years? It's went from feeling dated to feeling pretty modern), I agree with the rest.

Even worse, though, is that the EU offered them the opportunity to become relevant on a silver platter, by forcing WhatsApp to open up their app and be cross-platform with others who want to. Signal said no thanks.

I get it, WhatsApp stores metadata, and Signal doesn't like that. But they were fine with (way way worse) SMS for a while? The day Signal chose that path was the day Signal willingly chose to be irrelevant for the vast vast vast majority of people.

I love this app but the way the project is managed baffles me sometimes.

[–] [email protected] 8 points 4 months ago* (last edited 4 months ago) (1 children)

.... agreeing to be directly compatible with Whatsapp would mean they agree to surrender the privacy for every single instance of Signal-WhatsApp communication.

If the whole reason for your foundations existence is privacy, it seems that it would be an existential danger to create a partnership with the implicit understanding that it will destroy privacy.

[–] [email protected] 4 points 4 months ago* (last edited 4 months ago) (2 children)

Some level of privacy, yes. Solely in WhatsApp-signal chats. And users can be notified of that, like they were with SMS.

But you know what the alternative is? Nobody using signal. And that's objectively worse.

Cross-compatibility with WhatsApp would mean way more people on signal, and way more people willing to try, meaning more signal-signal chats. Meta would scrape metadata like when two accounts send messages and the like, but the contents of the chats would of course still be E2EE.

Signal-SMS is FAR less private, but they were fine with that for years, and people are still angry about it being removed.

Cross-compatibility removes the biggest hurdle for Signal - the chicken and egg problem of nobody using signal because they can't talk to anyone. It would act as a Trojan horse for pushing signal-signal communication.

load more comments (2 replies)
[–] [email protected] 3 points 4 months ago

don't have to tell me that, I even donate to signal

load more comments (2 replies)
[–] [email protected] 13 points 4 months ago

Engineer to lawyer ratio is the best indicator of how worried to be. What's the demoninator for telegram?

[–] [email protected] 12 points 4 months ago* (last edited 4 months ago)

This journalist writes with the same amount of confidence as ChatGPT.

[–] [email protected] 10 points 4 months ago (3 children)

I'm still waiting for the furries to switch to Matrix.

[–] [email protected] 4 points 4 months ago

As a furry, real

[–] [email protected] 4 points 4 months ago

Furries are the ones that have escaped the matrix via their fursona

load more comments (1 replies)
[–] [email protected] 9 points 4 months ago (4 children)

telegram isn't e2e encrypted by default?! that seems like the major concern here.

i double checked the ui and i had to create a new secret chat to see any indicator of encryption presence or absence

[–] [email protected] 19 points 4 months ago (1 children)

Yes, e2e encryption in Telegram only works in secret chats.

[–] [email protected] 5 points 4 months ago

And only on mobile.

load more comments (3 replies)
load more comments
view more: next ›