I don't quite understand why so many people still don't use containers. You can easily use devcontainers in VS Code. That way, each repository has its own container, and the risk of infecting your system with malware is much lower.
I prefer to do the vetting before running other people's code. If someone asks me to do a interview project that has a virus on it, I will just waste my time even if I don't get hacked.
A blanked allowance would be the answer. Claude is just a tool, after all. Neither Ghidra nor IDA tells me what I'm allowed to decompile and what I'm not. If someone then uses it to create something whose distribution would constitute a copyright infringement, that is the responsibility of the person who did so, not the software manufacturer.
Several AI companies are getting sued for what their products allow users to do, as was Google for what YouTube allowed its users to do.
YouTube is probably an instructive example here: they can refuse to host certain content on their servers, and this is Anthropic refusing to have the AI on their servers perform certain tasks.
I have my own third-party client called Corvus. However, it's only for the desktop, and uses a native Qt GUI. I haven't gotten the impression that Signal is doing anything to block third-party clients per se. https://github.com/ada-h00k/Corvus
Sure, it doesn't contradict what I said. The number of Signal users connecting through Corvus is probably a rounding error for Signal, it's not worth doing anything against it.
Signal is a non-profit. They won't shut you down because they want to make profit. They may shut you down if they think you lower the quality of their service. I'm pretty sure that with Corvus you're not on their radar because probably almost nobody is using Corvus, right? Or do you have tens of thousands of users?
Right now, it's probably only being used by a small number of people in the lower double digits. However, it's based on signal-cli, which a lot of people use and which Signal apparently has no objection to.
You should definitely avoid Session. While its decentralized nature is a positive, the developers have implemented many features insecurely and have also removed forward secrecy. There are blog posts by a cryptography expert on this topic: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/
From the page you link (and in which I see nowhere the author designates themself a "cryptography expert", albeit they may be one):
> The main reason I said to avoid Session, all those months ago, was simply due to their decision to remove forward secrecy
I often see this complaint. But it seems to me that, since Session allows users to generate a new private key arbitrarily on the device (and without even associating it with a phone number on a central server) it benefits less from the feature.
> Forward secrecy protects past sessions against future compromises of keys or passwords. By generating a unique session key for every session a user initiates, the compromise of a single session key will not affect any data other than that exchanged in the specific session protected by that particular key.[0]
Sometimes I get the feeling that Signal hates users who aren't total normies. Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client. Just as they could easily offer a Google free version for F-Droid or simply for people who want nothing to do with Google. But they just refuse. Just like it took years for nicknames to be introduced, and registering without a phone number has only recently become possible and only through the Google Play Store.
Using the preinstalled Google services effectively turns your smartphone into spyware. In the standard Android that comes preinstalled on most smartphones, Google services run with system privileges and can collect all kinds of data including location data. If Signal exclusively supports this, it reinforces dependence on Google and discourages people from using versions of Android that don’t include Google’s spyware.
The whole point is that it's unusable without Google services due to battery drain. Meta got it right with WhatsApp and a battery-efficient WebSockets implementation for notifications without Google services, but Signal's implementation is poor.
This is an exaggerated take. I've been running Signal on LineageOS for years across at least 5 different phones in exactly this manner with no Google services installed. I'm currently using a Motorola G84 and charge every 2 days with moderate usage; Signal is my primary communication method with family.
The G84 has a very good battery by default though, judging from its predecessor. It can take some additional strain. Something weaker will suffer more.
I have run Signal on LineageOS or GrapheneOS for nearly a decade, no Google services, and I have always had satisfactory battery life, i.e. ~2 days of normal use.
I bought a PinePhone, so I definitely know what truly unoptimized battery life looks like, lol.
It's a moot point, as Signal isn't going to support self-hosted notification servers any more than it'll support self-hosted communication servers.
Signal works without GMS or any alternative, at the cost of more phone wakeups. This is much more preferable to everyone whose WiFi or data service you use see you connect to "push.myownname.com", or for you to rely in some rando gatekeeping your message delivery.
But not providing one does seem to follow with their "be a normie as much as possible in order to not stand out" mantra, even if (to me) providing that extra service for non-GMS users seems harmless. Maybe it's not, I don't know.
Anyway, however much more battery it uses, from my experience, it hasn't been an inconvenience, the phone still lasts a couple of days without charging.
There is no reasonable reason why they shouldn't support it. Having my cell phone battery drain faster is a much bigger drawback for me than simply hosting my own push server at home.
I'm not sure if the comment above you is correct, but if it is (meaning Signal would benefit from the anonymity of every client being the same/similar, like TOR), then this would go against that.
That being said, I've never heard this mentioned as a benefit of Signal, and I figured the main benefit was y'know robust and proven E2E encryption.
This argument doesn't make sense, Signal is fundamentally not an anonymity tool. It's a privacy tool.
They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.
"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.
One of the goals of Signal is that they do not know who is talking to whom. Sealed sender and all that. This can possibly break down in certain scenarios with some server-side correlation. But they certainly do have a design goal that the social graph is entirely private.
I am aware of sealed sender, I even mentioned it in my comment. ;)
My point is that by construction they are not an anonymity tool, no centralised server can be. They can add features to make it less easy to track users but that's not the same as providing anonymity, and it's important to not confuse the two.
To give an example: my email provider has a feature to auto-encrypt all inbound emails to a PGP public key. Is this a nice feature to make it harder for someone to read my past emails if someone gets access to their infrastructure? Sure. Does this make my emails end-to-end encrypted? Absolutely not. In a similar vein, Signal making social graph correlation harder is a welcome feature but is not the same as making it anonymous.
Yes, I know you're aware of them :) And maybe I'm splitting hair here--I agree with you that Signal isn't as robust wrt anonymity as, e.g. Tor.
Signal explicitly considers anonymity/a private social graph to be a design goal. Their documented considerations of things like sealed sender and use of Intel SGX's remote attestation clearly demonstrate this.
Yes, these measures are imperfect. Like you say, it's a centralized service and has weaker anonymization properties because of that. However, because of its design, to de-anonymize Signal users requires the server operator to do continual, non-trivial work as long as they want to de-anonymize users.
In other words, deanonymization attacks against Signal users works just like any other kind of attack: the question isn't whether it can be done, but whether the attacker has the resources to do it. Presumably you'd consider Tor to be an anonymity tool. Yet, even though they're distributed, deanonymization attacks against certain users can succeed, given enough resources. (I don't mean to imply that Signal is equally resistant as Tor!)
Note: big fan of the work you all are doing at Amutable! I'm following the news eagerly. Best of luck!
I still think the original point I was replying to ("don't stand out") doesn't apply to systems with "soft" anonymity like Signal. Even more importantly, arguing that specific features like custom servers or non-Firebase notifications are problematic because they "stand out" is particularly silly -- those features are the exact kind that are already fingerprintable by virtue of Signal's inbox design. Even if the social graph is somewhat anonymised, Signal does not attempt to hide that you are using Signal. (You could argue custom servers leak some data about your social graph but I'm not sure it is much worse than the theoretical leaks we spoke about earlier. And it's kinda notable that when Moxie argued against federated servers as a concept, that wasn't among the arguments he made.)
> When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.
You're also hedging against mandated government backdoors.
A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.
>You're also hedging against mandated government backdoors.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
There just is a contention between software freedom and privacy that people don't want to acknowledge sometimes. Signal is firmly on one side of the divide, and their software is open source because it is the convention to have the source public and auditable, not because they are interested in user freedom and respect.
It's not that they're not interested in user freedom and respect. They just have different ideas about what's important. If Signal federates, that will bring to the table all sorts of 3rd party clients who will have say in how Signal does things, yet no duty to comply with the Signal's spec sheet and deploy timely protocol updates and features. Any clients not keeping up are damaging the brand, as was in the case of Matrix clients' poor support for E2EE. Then there's the aspect that the larger the organization managing the spec becomes, the easier it is to infiltrate and clog with bikeshedding.
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
But that is my point, there is a contention and they made their call. It is not wrong for them to do so, there are just plenty of people who prefer the other side.
Signal isn't anonymous. The server has access to your IP addresses and the server can at will build social graphs about the users.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
Discovery is important and a hard problem, worth making some trade-offs for. Signal published a good blog post about this, including this passage:
> In order to turn the address book on a device into a social graph for Signal, the Signal client needs to be able to determine which of the device’s contacts are Signal users. [...] The obvious problem with this method is that the hash of a user identifier can almost always be inverted. [...] This method of contact discovery isn’t ideal because of these shortcomings, but at the very least the Signal service’s design does not depend on knowledge of a user’s social graph in order to function.
When they say "social graph for Signal", afaik they don't mean 'on Signal servers' but 'social graph on your phone'. It's a personal social graph that exists on the end-user device.
I don't remember how the hash issue is dealt with, however.
> Signal is not peer-to-peer. It is a centralized, client-server architecture.
It's not a P2P mesh, but Signal's servers are involved only for certain functions. I think communication tx is P2P - to send a message via server (used to hide sender IP address from onlookers and the recipient), you need to enable relaying. Possibly finding the recipient still relies on the server - if I want to send a P2P message to Abel, to what IP address do I send it?
The official signal.org blog post I linked does actually explain how it works. They write that the client sends parts of hashed phone numbers to Signal:
> The client transmits those truncated hashes to the service. The service does a lookup from a set of hashed registered users. The service returns the intersection of registered users. The obvious problem with this method is that the hash of a user identifier can almost always be inverted. Regardless of whether the identifier is a phone number, a user name, or an email address, the “keyspace” of all possible identifiers is too small.
Also: Signal messages are currently never P2P. They always pass through Signal servers, which see (but apparently not retain) your IP and timing metadata. The Signal WebRTC calls are partially peer-to-peer, that is what the relaying in the Signal settings panel is about.
>I think most messages are P2P unless the user activates relaying?
No they're all routed through the servers. It's only the calls that can be sent P2P and you have to opt in for that. The issue is that leaks your IP address to the contact who may not be trustworthy, so it's not used by default.
(Not to object the degoogeling, but:) To create a Signal account, you have to validate a phone number. So Signal is currently largly about privacy, not anonymity.
FWIW I wouldn't know why to message someone if I didn't know who they were. The same goes for them not knowing who I am. What would we even talk about?
The service operated by the incorporated 501c3 has full visibility into who else a user messages and when. This is not good for privacy.
What the non-low-value users are generally looking for is the option to not opt-in to discard anonymity with any potentially involved third parties such as server operators and network operators, and left at the discretion of the users solely.
Other systems have already solved this. One user can be not anonymous while another can choose to not opt-in to not be anonymous.
The users still know who the user on the other side is.
They could still implement these things in the app and put them behind a switch for users who care about independence more than one specific type of anonymity. Explain the tradeoffs on the settings screen.
The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.
No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.
>Just as they could easily offer a Google free version
Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
Hates users who are not total normies and designed explicitly for normies are not opposite. In fact an app that hates not normies would be designed for explicitly for normies.
> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
You're misreading. In 2024 they had $415k of revenue against $1.4 million in expenses, with $28.7M in assets (which I assume is what you're confusing). Assets have been steadily declining since 2022 as expenses have been consistently higher than revenue.
> They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.
> unicorn
Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.
One of the most frustrating decisions from them was to stop allowing signal to be a catch-all messenger for encrypted and non-encrypted messages. I was able to onboard so many people, including very non techy relatives, because switching to a secure app for a small subset of people was never something they really wanted to do.
For security and privacy to really win out and raise the bar, it has to be able to happen in the background without the user even realizing it.
Making an app for enthusiasts is fine but Signal is going to remain niche if they can't make it more of an open ecosystem.
Yeah this resulted in a mass exodus of my contacts from Signal. The worst part is some of them never deactivated their Signal accounts, they simply uninstalled it from their devices. For a good while, I was sending messages to the void because Signal thought they were still active users.
I only have 2 people in my contacts that use it now. Every now and then somebody will install it for a couple weeks and ditch it again.
Yeah, the hostility toward F-Droid and wanting to run their app on LineageOS without gapps made me ditch Signal years ago. It seemed like the main gimmick back then was that it was also your SMS app, which IIRC isn't a choice anymore. So what's the draw now? Why would you not use XMPP+OMEMO or Matrix which work everywhere, don't need a phone number (at all, ever), and have free as in freedom clients and servers? It's insane to me.
To put it simply, I need a messenger app to talk to other people. Most people I talk to are not programmers or very tech savvy.
Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.
Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.
Before the smartphone era, non-tech-savvy young people were still pretty tech-savvy compared to modern computer (= phone) users, who rarely step outside a few corporate phone apps and have even lost the concept of the file and the directory. You can't expect the same curiosity and willingness to make an effort from normies today as back in the XMPP era.
Well I bet you didn't have to convince them to leave messenger back then.
It's not that they are not capable of figuring out something more complex. It's that it's hard to convince non-tech savvy friends to switch apps and it becomes much harder if the alternative needs setup or feels unfamiliar .
You can both appreciate Signal overall and be critical of some aspects.
What the user criticizes is due to sheer choices, which affect some users a lot; for example, numberless registration and full cloud backups can only be purchased with a Google or an Apple account, which clashes a bit with the privacy objectives.
And it's not a problem of not having the infrastructure to support other payment methods, since the donations support all the common ones, and there's now even a cryptocurrency integrated in the platform.
Disallowing and ostracizing other clients is a choice, they spent effort to enforce it (for example by adding mechanisms to recognize the official clients).
Hear hear. It’s been my observation that HN in particular has become much more combative. It’s full on like the meme where someone says “I like strawberries” and someone else complains “oh, so you hate pineapples?! They’re a fruit too, you know?! My great-grandfather ate pineapples. You’re a monster”¹. Yeah, chill, no one said anything about pineapples, stop assuming things or thinking everyone is against you. Don’t succumb to the tribalism.
¹ Unfortunately, I feel I must point out that I’m (I hope obviously) exaggerating for comedic effect.
What really disturbs me as I’m watching myself engage it more frequently. I’ve left other sites because I didn’t like the side of me that came out. Feeling a little bit like that these days here.
2 years ago when I got a new phone, I had to re-register in both WhatsApp and Signal.
Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.
This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.
I understand you’re being a bit overdramatic to make a point, but no, Signal and Facebook messenger are not the same levels of secure for the user. That’s not the same as “trust them wholly,” but surely you understand they are on very different ends of the spectrum.
I’m pretty sure it’s for security reasons, it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor. It’s hand holding yes but it’s a trade off in favor of non-technical users.
Signal hates anyone who even thinks about using this IM app as the de-facto IM app, or with more than that one person who also tries Singal as an annual ritual in your friend circle. I tried to use the app again after a year or so. Gave it full contact permission and it wasn't able to pick friends who are alreasy on Signal. I was not even able to send them messages using the number. But a friend was able to send it a message to me. After 2-3 days finally the app started showing friend's name that's in contact. Tut there were scary warnings (I know, I know that's for my safery). The whole UX just feels at odd with anything and everything I've used. They manage to look and feel worse than WhatsApp of today and that I'd say is an achievement.
Signal is not good for normies: compare sending a message with Signal to WhatsApp. Didn’t go through? WhatsApp will try try try to resend. Signal tries far less then shows the dreaded red exclamation point. Not great while travelling or with poor reception.
Signal developer here: we should retry with reasonable backoff for 24 hours before showing a delivery failure. If that's not your experience, please file a bug if you get the time!
Thank you for all you do. All of my grandparents joined Signal to message me and they have no issues for the most part. Although, one of them didn't know to press the download icon on photos I sent. I'm not sure why they weren't downloaded automatically.
Also please accept cryptocurrency for buying username-based accounts. The overlap between people that want to buy an account and those that want to use a fully identified payment method is not a lot.
I spend about half of every year traveling the mountains and deserts of the world, often ones with poor infrastructure. I use Signal more than any other messenger app, and I have never had the deliverability issues you complain about; messages do all get through eventually.
> Sometimes I get the feeling that Signal hates users
one would think this is a well known fact already after the PIN nag screen forcing users to use PIN or have half of the screen blocked (at that time we left with family and never returned back) or removal of SMS feature, which would be only reason why to keep Signal in the phone for those few people who use it since you could use it at least to receive SMS
TBH Firefox devs are not much better, I remember waiting years and years for pull down to refresh while they kept playing with features nobody asked for (on related note Vivaldi for Android supports already extensions) or Proton Mail devs requiring Android 10 minimum to install the app, while all other clients (Nine Mail, Gmail, etc) are fine with older Android (I mention it because I was setting up old extremely locked phone for my kid recently, I have A16)
Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.
But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
So that means your messages are all there, on your device, running open-source software, and yet you cannot get them.
This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"?
(I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.)
So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it.
Makes me wonder:
Does this mean users suffering this need to GDPR-request their data out from Signal?
> Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
This is not something exclusive to iOS; Android does the same thing.
I'm not sure about Signal, but I had a similar issue with another app, a SQLite db inaccessible. I found that you could take a computer-based full backup and then there are various 3rd party tools that will poke through that backup for whatever "hidden" app data you need. One I previously used is iMazing, but I'm sure there are free open source ones as well.
Something doesn't connect here. I have a workout tracker app I use, and while I can't access the sandbox from the outside, the app has a feature to import/export workout history and it lets me dump a sqlite db copy via iOS share sheets just fine.
To be sure this would mean Apple has to allow for 3p installs that have self signing keys that can let one gain visibility into the data of the app(in this case its in the sandboxes), yeah?
An owner of a device in physical possession of it and with the knowledge of all keys and passwords involved, they should be able to get all their personal data stored on it out of it, yes I think so, no matter who signs what on whatever app store.
The whole point of signal is that they cannot provide you with your data - they do not store it.
Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.
I've used F-Droid for years. It's simple, has good apps that aren't full of ads, just works. PGP... sucks a lot, I never really got along with it. Maybe an age thing, but hardly anyone I've met uses PGP/GPG. Yet I have many friends/family on Matrix.
I also would like it to have stable supported libraries. But this doesn't seem to be a focus. It's a pitty, we have a Foss solution and it's hard to integrate with it....
As I understand it, Signal falls back to a persistent websocket when Play services are not available. FWIW.
I agree that working around a reliance on FCM by default would be a position that better aligns with the expectations from the freedom & privacy set, though.
This really undermines trust in Proton, not just from a data privacy perspective, but also simply in terms of security and reliability. If they don't issue a statement proving that this is all just made up, or announcing that they're firing the CEO and restructuring the company, I'll switch to another provider in the long run.
We need to find ways to prevent the console from calling home, that way we can prevent situations where Nintendo can tell me if I'm allowed to use or not the hardware I paid for. Literally the greediest company out there, selling decade old games for 80 bucks.
That's very easy. With the Switch 1, the usual approach was simply to use a DNS that blocks all Nintendo servers. The problem with that, however, is that a large part of the console’s appeal depends on its online features. On the Switch 2, many games aren’t available as physical cartridges but only as download codes or as cartridges where the module merely verifies ownership, but you still have to download the game. That doesn’t work if you block Nintendo’s server. So you can either use it without jailbreaks entirely or "pirate" all your games.
While I can't agree with how protective Nintendo are of there ips and some other shitty descisions they make, $80 really isnt that bad for a complete quality video game. I can remember seing ps1 games in 96 for $40 - $50 bucks and thinking how cheap that was. Unlike Microsoft and Sony, Nintendo is a video game company and selling software is really the only thing that keeps them going. They are certainly not the greediest company by being overly protective of their business. I say this as someone who gave up on them because of the virtual game card crap.
Mario Kart 8 Deluxe is $60; I don't think it's correct to add the DLC price to that.
Also Deluxe is improved in a number of ways: new characters, new battle mode with 8 new courses, two items at once, smart steering, etc. And it supports 12 players in LAN mode (though MK World supports up to 24!)
Super Smash Bros Ultimate is also significantly improved vs. its Wii U incarnation (its roster includes basically every character from the series - hence "ultimate"), and is also $60 (though DLC will almost double that if you want everything.)
They are both fantastic games that you can basically play forever. The Wii U games were also great - but the Switch versions are even better.
Historically Nintendo game cartridges were expensive than disc-based games for PlayStation etc., but these game cards at least are still $60 - same price as the Wii U disc versions (and the Wii U game prices are equivalent to $84+ in 2026 dollars.)
Nintendo's deal is that the consoles are platforms for their outstanding games, and first-party exclusives are the biggest reason to buy a Nintendo console (though they are also great handheld systems and support local multiplayer gaming without an internet connection.)
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
Not every newspaper offers the option to share gift links. Besides, it's unrealistic to subscribe to every single newspaper. I have 2 regular newspapers that I read every day, and other than that, I'm usually interested in just 2 or 3 articles from other papers. I can't subscribe to 50 different newspapers a month. Besides, the articles that could be archived using archive.today is all content that was once available online without a paywall. If a site posts an article that’s publicly accessible, people should be allowed to archive it. If they later add a paywall or use some weird cookie mechanisms to annoy people it's their problem. If they don’t want it to be archived, they have to put it behind a login wall.
One legal way to share news stories which generate controversy is to have an AI make a summary of the article, rewording it to remove any copyright from the article (this legal trick only works when the news site in question is reporting on factual events, since facts can’t be copied as per Feist vs. Rural 1991, and I make sure that the summary has “a different sequence, pace, and setting than the original article” as per legal judgments on whether an AI summary of factual events as reported by a news source is subject to copyright).
What about just a copy and paste into an HN post comment? What is the legality of that? What if someone who reads a share, and then pastes it as a comment?
While Righthaven LLC v. Hoehn did rule that copying and pasting an entire newspaper article is fair use, this ruling was vacated on appeal and instead the lawsuit was nullified because they ruled Righthaven never had the right to bring the lawsuit in the first place. So, yes, one can be sued for copying and pasting a newspaper article verbatim.
It might be useful for your own memory since you can decide that you trust what was written. IE you trust that when it was written, you agreed at the time that it was an accurate summary, and later you only have to trust your earlier self.
But "My ai said that the site said ~essentially~ this on this date." is useless for anything else.
But it suggests an interesting idea. Maybe if we had some ai equivalent of trusted vetted accountable court reporters who write down notes and draw sketches in rooms where cameras aren't allowed.
That is purely second-hand reporting that we more or less trust, partly because there is usually more than one of them from competing venues reporting on the same event, partly because they are people with something to lose if they are unfaithful or even merely inept, partly because the facts are ultimately vettable with some effort for those who really need to.
There's no such ai yet. Even if one exists that could do the job, there is no consensus or basis for it, for everyone to recognize it as a trustworthy source of second hand reporting. But maybe if there were more than one and operated by different camps, they could grow to become recognized as a valid source of info.
For me, the main reason to use Ghostty is simply that mouse support works right out of the box. In Konsole clicking a spot to move the cursor only works if you're using Bash. While it also works with the Fish Shell on Ghostty.
Same here. ghostty + fish = just works out of the box, no plugins or dotfiles needed. Plays well with accessing remote tmux claude/codex sessions as well.
reply