Launch HN: Dex (YC S19) – personal CRM that reminds you to keep in touch - <AUTHOR> Hi HN!
I'm Kevin, founder of Dex (https://getdex.com/). Dex is a personal CRM that reminds you to keep in touch with people you might otherwise forget.
I started working on Dex because I felt like I was falling out-of-touch with people I cared about. I wanted to be aware of "how long it had been" and more proactive about maintaining my relationships.
Looking to solve this problem, I tried data tools like Airtable, Notion, and Google Sheets. It was easy to setup a sheet to track relationships, but I eventually found these tools difficult to keep up with. I'd end up procrastinating on updating my records and would rarely find the time to revisit them.
Dex is a personal CRM that aims to be simple, intuitive, and accessible.  To get started, users sign up for a web application that connects with their Google contacts and calendar (and optionally Facebook and LinkedIn data).  With this information, Dex suggests people to contact every day. Over time, these suggestions become better as users customize how frequently they'd like to reach out.
Dex includes the functionality you might include from a CRM: logging notes, setting reminders, and organizing contacts. A feature which makes Dex unique is a Chrome extension, which allows you to view relationship history and add people without leaving social networking sites like LinkedIn, Messenger, Twitter, and Facebook.
Most people realize the value and fulfillment that come from maintaining relationships, but occasionally still fall out of touch due to forgetfulness. Dex helps these people with a system of regular reminders to keep in touch.  I've noticed many people already have their own 'system' for managing relationships, and I'm always interested in hearing about different people think about dealing with staying on top of relationships.
I'd also welcome any other feedback about Dex! Feel free to also email me directly at kevin [at] getdex [dot] com. Thanks for your attention! :) <comment><USER3> It seems you have fullstory.com tracking all input & mouse events. Can you confirm?

Every few seconds, a large payload goes to fullstory with all details:

      47: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day blank"]]}
      63: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "15", 96]]}
      71: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], "23", 96]]}
      72: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sat", [93, 2], "24", 96]]}
      73: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day weekend sun", [93, 2], "25", 96]]}
      74: {When: 397746, Kind: 2, Args: [8881, -1, [[4405, 2], "cell day", [93, 2], 5593, 96]]}
      90: {When: 397746, Kind: 2, Args: [9087, -1, [94, "Last note6m ago on 8/14/2019"]]}
      91: {Kind: 4, When: 397746, Args: [8984, "class", "cell month selected"]}
      92: {Kind: 4, When: 397746, Args: [8986, "class", "cell month"]}
      94: {Kind: 6, When: 397746, Args: [8294, " in 14d"]}
      95: {Kind: 6, When: 397746, Args: [8876, "Aug 2019"]}

<comment><USER4> How would any website or application these days work _without_ full-blown analytics tracking the hell out of every user?

<comment><USER5> By using a business model that doesn't require raiding the customer's personal information.

<comment><USER6> Hmm, FullStory would be hard to use for evil. It's used to creators can track down issues and bugs and provide better customer support, not to do anything malicious.

You can still argue you don't want your data sent to them, and that's very fair, but the only way this helps their business model is if their business model is "provide really good, tailored customer support."

</comment></comment></comment></comment><comment><USER7> An open-source alternative, Monica, has been discussed before:

* (2018) "Monica – Personal CRM, Remember everything about friends and family" -> [https://news.ycombinator.com/item?id=18318547](https://news.ycombinator.com/item?id=18318547)

* (2017) "Show HN: Monica, an open-source CRM to manage friends and family" -> [https://news.ycombinator.com/item?id=14497295](https://news.ycombinator.com/item?id=14497295)

<comment><USER8> I've been using Monica for a couple of years now and I'm very happy with it for my personal network. It's a great tool to remind me who is connected to whom and what to ask about before attending a party. The online version is here: [https://app.monicahq.com/register](https://app.monicahq.com/register)

<comment><USER9> Any thoughts on the security model for the hosted service?

<comment> o-__-o We stopped using them at our workplacedue to compliance. they have a lot of issues and not interested in fixing them

<comment><USER10> Can you expand on these issues?

<comment> o-__-o No. But if you're a startup you are probably okay. If you are a Fortune 500, probably not. May I recommend reaching out to their sales team to find their customers or better recent customers and why they left

<comment><USER8> Why would you use Monica at a start-up or Fortune 500 company? I had assumed that Monica was purely for personal use. It never occurred to me that a start- up, much less a Fortune 500 company, would use Monica for anything.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Do you have a demo or some more insightful screenshots of what the app is? Even if I wanted to sign up to the site, I'd have to fill in a bunch of stuff to actually have a meaningful overview of the UI.

I appreciate you have two-way contact syncing with Google Contacts which is a big thing that's lacking in monica.

I also appreciate the Chrome Extension you mentioned. Is there deeper integration there, eg. do you allow me to back up / view data on my facebook friends through Dex?

What I looked for in Monica, and simply did not find, was a true single- source-of-truth for all my contact interactions, be those on Facebook, Twitter, Discord, SMS, Hangouts …. It's less a matter of wanting to keep in touch with people (I love being able to set reminders for specific things, but lacking a good UI I just end up making those in Google Calendar), and more a matter of being able to quickly find things I may have discussed with someone.

For example I talk to my girlfriend through all three of Messenger, Discord and SMS, and I'd like to be able to have a single history to sift through should I look for something she told me (groceries to get, an address / door code to remember, a photo she sent …).

Again, to me the selling point of these kinds of personal-service websites are to offload parts of my brain to software that is more efficient at the task. Notion does a great job being a generic note-keeping / database app. Calendar does a great job at helping me remember everything time-bound events. A personal CRM should do a great job at helping me remember everything there is to remember about another person / a relationship with that person.

<comment><AUTHOR> Re: demo / screenshots, I totally get this. Honestly the landing page hasn't been a huge concern, but I'll take your feedback that you actually want to see the feedback first; we'll make changes.

The Chrome Extension unfortunately doesn't do a deeper integration -- we're looking into how to make this happen! You're absolutely right that a personal CRM needs to be a single source of truth -- the hard part is getting data in the actual product!

<comment><USER11> Do you consider messaging history as mentioned to be in scope? I'd love to be able to quickly refer to emails, convos etc. And the best CRMs do let you keep track of people based on conversations.

I get you that getting the data in is difficult though. A lot of API work. This is one thing where if you were open source and had a plugin / provider API people could contribute. I certainly would.

<comment><AUTHOR> Emails is definitely a straightforward thing to do. SMS is also pretty possible. For really interesting use0cases like Messenger, the difficulty becomes more of collecting and storing user permissions. I recently came tooling like [https://github.com/Schmavery/facebook-chat- api](https://github.com/Schmavery/facebook-chat-api)

</comment></comment></comment></comment><comment><USER12> Oh my god I have had the same idea and have hacked on the first pass.

Yes. Keep going ! It's a good idea.

1\. Tiny bit confused over whether I was signing up or logging in.

2\. I can't read their names on my phone (portrait mode). Landscape is ok. Maybe reduce the font size or something

3\. What's the algorithm for displaying the recommend "get in touch"? Some people are friends I have a beer with some Inhomestly can not recognise

My idea was to only recommend people whom I had replied to on email - <USER2> presumption being I must have wanted something

So perhaps in the info field show me their last email or two so I can work out who they are

Keep up the good work !

<comment><AUTHOR> Appreciate the product feedback -- it's super actionable. We haven't completed a full-on email integration yet because we want to be relatively conservative and make an email integration opt-in (but to come son!)

The algorithm is primarily focused on your calendar data and when you've last had an event (if you don't use your calendar, these recommendations might not be great but will get better as you snooze/check off people)

I like your idea on emails that you've actually replied too - will consider that for a future release!

<comment><USER12> Some more notes

1\. You recommend I get in touch with me ... and I am only third on the list :-)

2\. I generally don't book events / calendar things. It's one of the reasons i think focusing on emails is so useful - I do those all the time and there is digital footprint that can be used to help me (as opposed to sell me ads)

3\. Maybe I missed something but I tried to click on the arrow and then the mail icon, but no mail popped up - I would like to send a mail right there and then as a minimum "get in touch"

<comment><USER13> Maybe #1 means you've recently connected with yourself and so it isn't the most urgent, but something is still there needing addressing, so it stays close to the top of the stack until you connect with yourself around it? ;)

Don't mind me. I'm just having fun projecting meaning onto things.

<comment><USER12> I have been searching for the real me for many years but never found myself.

Perhaps they are using a MetaPhysics engine to help me find myself?

If I feel connected I will tell you :-)

</comment></comment></comment></comment></comment><comment><USER14> I signed up and tried to skip adding a Gmail account but it wouldn't allow me. I really don't want to just dump all contacts into an app like this because I don't really use Gmail as my contact repository and there might be stuff in there I just don't want to see. I might trigger myself. And I would rather give it a spin before committing a load of my real info.

I instead used an alt which doesn't get much use. No contacts. Seems to work fine, why couldn't I just go with no contacts in the first place?

I added a contact manually and...

No pic? I can't upload a face? I'm visual. And what if I wanted to use this as my black book? I want pics! ;)

Nice effort but I'll need to hang on the sidelines a bit. Congrats on the launch!

<comment><AUTHOR> Thanks for sharing your experience -- as you mentioned we've built Dex around the import experience for now [since typically those people get more value out of the product], but definitely trying to make Dex more fully featured for folks who would prefer to add manually!

</comment></comment><comment><USER15> Give me an option to pay and be more clear in your data policy and maybe I'll give it a shot.

I've been wanting something like this for a while but the privacy policy is pretty vague and far too broad for me to trust a service like this:

[https://getdex.com/privacypolicy](https://getdex.com/privacypolicy)

<comment><AUTHOR> I'm happy to take your money and also clarify the privacy policy -- will follow-up with you when that's done!

<comment><USER16> The data security / privacy policy is super important. I've also wanted a personal CRM for some time so this definitely hits my pain point. However, I anticipate this would become most useful when I start adding personal, honest notes for all my contacts. That's obviously a problem if this database were ever to be leaked, or (worse) subpoenaed.

I'd be much more excited about this product if it used zero-knowledge encryption for my data. Yes you can't data-mine it (and if I lose my password I'm hosed), but I'd prefer having the only copy of the decryption key.

</comment></comment></comment><comment><USER17> I'm confused; it goes beyond the big, GP social networks by focusing on more meaningful relationships (how?) but I create them by pulling directly from these sources of relationships?

What exactly is a "personal" CRM that doesn't focus on selling? A curated address book?

>> Most people realize the value and fulfillment that come from maintaining relationships, but occasionally still fall out of touch due to forgetfulness

I think these is the fundamental premise that I don't personally agree with; the value of the relationship is what keeps you engaged. It's not simple forgetfulness that causes you to lose touch - you are prioritizing other activities over the relationship.

This doesn't seem right or make me feel good though; it makes me seem like a self-centered jerk, so can't be true - I must be lacking (yet more) networking applications that "promote keeping in touch".

I think there is opportunity for very specific purpose networking tools, like linkedin before they decided to be a general-purpose social network or centered around communities and activities. I don't think "relationships" is specific enough, unless you're focusing on physical relationships like dating or hookups.

Also, the amount of private information you're asking to expose right out the gate is a non-starter for me. If it's curated (and thus meaningful) make your on-boarding & setup reflect this. I realize it's largely due to eas-of-use, but to me the process is a giant data vacuum.

<comment><AUTHOR> I agree with your statement that the value of a relationships is what keep relationships alive. I'll add we do believe forgetfulness plays a role in how you prioritize. One benefit of using Dex is just having visibility into who you know so you can do this prioritization better.

Dex as a 'personal CRM' does intend to provide professional utility as a tool that helps you keep in touch. People who depend on relationships for their work, but might not already have a CRM with their company, are part of Dex's core target audience.

Thanks for your point on private information: we know that our onboarding experience isn't perfect and it's something we're working on.

</comment></comment><comment><USER18> Why the extension is targeted for Chrome only! What is so difficult about porting it to Firefox? When you come up with a product for mass user consumption, please don't assume everybody use Chrome by default.

When a product is targeted for Windows only, that means the product doesn't make sense to run in Linux. But, if the product is applicable to Linux, and the person or company who developed didn't consider porting it to other platforms, then it is left to the pain of users to find the possibilities to make it run on Linux. Or pray god one day it will be available in Linux.

In case of Extension for browsers, it doesn't make sense for users if the extension says it is targeted for Chrome browser only. Also, most of the extensions developed are not open source, so users don't have a chance to taken an effort to make it run on other browsers.

Hope you consider porting your Extension to support other browsers as well.

<comment><USER19> This, so much this. Chrome and Firefox both use the WebExtensions standard. There's no reason not to write one extension for both. There are a few incompatibilities here and there but I wrote a FF extension (with around 1K MAUs) that I ported and added Chrome support in less than 2 hours.

<comment><AUTHOR> This is a great point -- will look into this. I have to admit I haven't looked into this but agree it's a good idea + probably a quick thing to do!

</comment></comment></comment><comment><USER20> Great project. I don't see privacy being mentioned in your message nor on the website, that + the comment about the extension's permissions are a big no for me.

It's 2019, I would expect such info to be given when reaching to the HN audience. We know you need to make money, the website doesn't say how, the logical assumption is that we're giving data to pay you and personally I like to know how much I have to pay before trying a new service.

<comment><AUTHOR> Totally get your concern. We'll surface the privacy policy more prominently (+ work on making this more clear), which you can access here [https://getdex.com/privacypolicy](https://getdex.com/privacypolicy).

Dex is run as a subscription service ($7.99/mo), something we'll also make more clear on the site. Appreciate your feedback here -- this helps me understand what I need to change!

</comment></comment><comment><USER21> > Add "Dex for Chrome"?

>> It can:

>> Read and change all your data on the websites you visit

No thanks

<comment><USER22> With chrome extensions, unfortunately that's the only option for developers; read all urls/data or no access to urls/data

<comment><USER23> Are you sure that's current? I made an extension (just for myself) a few months back and I could restrict the domains via the permissions array in the manifest.json

[https://developer.chrome.com/apps/declare_permissions](https://developer.chrome.com/apps/declare_permissions) (see reference to "match pattern")

This then in turn populates the list of sites in the extension settings where you can choose to deny access to the aforementioned websites listed in the manifest

<comment><USER22> Oh sorry, yes I am mistaken (been a while for me). I guess a lot of developers just use permissions "host": " * " because it's easier...

What extension did you make? I made [1] an extension a while ago, and spent more time than I'd care to admit. Now that I think about it, I used "host": " * " too! (even though it's necessary for that particular extension)...

[1] [https://newsit.benwinding.com/](https://newsit.benwinding.com/)

<comment><USER23> Hey neat! See your extension would obviously need access to all sites to check against reddit/HN so that makes sense.

My extension wasn't published, it was targeted to a specific site (so could narrow the scope of the permissions) and was just set up to allow downloading of images individually (via an overlayed button) and an album as a zip. Pretty legal grey area hence me not publishing it.

</comment></comment></comment></comment></comment><comment><USER24> Wow, this sounds an awful lot like the exact app I want. Was thinking about how to build it, but wasn't sure what services could be integrated.

Tell me if does this:

\- Connects with FB, WhatsApp, Messenger, LinkedIn, and Gmail

\- Checks the message history for each person

\- Optionally coalesce users based on simple heuristics (similar name)

\- Give you a list of people according to last contact

\- Tells you the my turn / your turn of each conversation

<comment><AUTHOR> I would really like for the version of the product to move towards something like this -- a big struggle with relationship management now is some degree of fragmentation.

Some of the integrations you mention (FB/WhatsApp/Messenger/LI) are hard to do since these companies don't expose API access (and we'd have to ask for user credentials, which aren't always straightforward!). I'm very curious -- would you be open to sending your credentials to Dex to enable these integrations?

<comment><USER24> When I looked at the docs it seemed a lot of the features used to be there but have now been removed, but I didn't spend much time on it.

Would I send my creds, I guess if it did what I need I'd click one of those give access buttons. I hope you don't mean give user / pwd.

<comment><USER25> Yeah it would likely be user password for services that don't give API access. Access button means API.

</comment></comment></comment></comment><comment><USER26> Ugh, I wish this existed before I went to build a simpler extension to help remember my Facebook friends better! ([http://trybackstory.com](http://trybackstory.com) \- shameless plug)

It's great that you support all the social sites - it was enough work for me just to integrate private notes and tags into Facebook. If only I had put in more time into Backstory to turn it from a side project into a full-fledged product like yours!

One thing I don't like is how intrusive the sidebar integrations are. They take up so much space that I can no longer see the other content in the sidebar at first glance. The Messenger integration also doesn't seem to be working for me.

Congrats on launch! I'm going to start using Dex, hope it helps me keep up with friends in the next few weeks! :)

<comment><AUTHOR> Backstory looks super interesting! Will definitely try it out too :) Thanks for the feedback about the sidebar integrations; we're in the process of revamping it and will likely move some of this information to a popup instead.

</comment></comment><comment><USER27> I was very excited to try this. Particularly as a hypersocial super-connector, I've dreamed about my ideal personal CRM.

What I want is:

* The ability to do something like a spaced repetition with my contacts. If it proposes I connect with someone, and I'm like "great", they stay high priority. Or I can snooze that contact for a little while or a long while. (There might be an orthogonal feature to track who is important but I only need infrequent contact with.)

* The ability to accurately search my contacts. e.g. Friends who are into crypto and art.

So I went all in on Dex for ten minutes and granted read permissions for my calendar + contacts and added the extension access to read and change data on all websites.

The results were pretty underwhelming. It showed me a handful of contacts scraped from Google, many of which I didn't even recognize. I understand that this is perhaps I'm not much of an email guy, so I do know that a scrape of my Google contacts (or even my emails) will poorly reflect my social graph.

Here's what I want:

* Scrape and import my contacts across all platforms. If you need to use a Chrome extension to read my Facebook activity (not the messages, but just the people involved), fine. If you want me to spend 20 minutes downloading Facebook exports that don't include message text, or maybe screenshotting my message feed subjects for Facebook and Instagram and emailing them to you to OCR, to avoid you being liable for TOS breaking, fine.

* Auto-tag contacts, and allow me to update my tags.

* Auto-prioritize my contacts, and allow me to update the priorities.

Dex isn't really what I need, but thank you. I appreciate you trying to solve this problem.

[edit: Give me a Chrome extension to take screenshots of pages with key information about my social graph, whenever I browse onto them, that will then find sensitive info like message text and black them over and then allow me to easily email them to you?]

<comment><AUTHOR> Appreciate this feedback -- I recognize Dex is underwhelming for you and we''re working to fix that. We actually do have an experimental feature for Facebook import (it does take a few steps), but I don't think we come close to the automation you're looking for unfortunately (we're trying to get closer!)

I think the end goal of a product we're looking to build might not be too far off from what you're looking for, and I appreciate your comments on what you want. (it's always nice when someone directly lists features they are looking for). I'll make a note to follow-up when Dex is a better solution for you!

<comment><USER27> Reading your responses up on the thread, where people are also like: "Free my WhatsApp contacts" and your only response is: "Would you give me your username and password?", you're thinking about this in too basic a way.

Legal and safe ways to help users export their own data from other platforms could be the innovation of your entire company.

I might not give you username and password, but if you gave me an Electron app to run (with source code I could verify, executables for the newbies) that would read, using machine vision, certain websites, WhatsApp desktop app, etc. you could get a lot more data without breaking the TOS. Since it is _I_ the user who is initiating the data transfer.

</comment></comment></comment><comment><USER28> Funny coincidence, just today I was toying around with Monica and looking around for another person CRM.

I'm a bit frustrated by the lack of features in Monica.

What I want is this, reminders to stay in contact with someone. I want a notification to appear on my phone saying something like, "hey you told us to stay in touch with Bob every month, click to open WhatsApp and message them." Or slack, text, email, etc.

I also want a central location for all my contacts and info about this. Notes, when we last got in touch and how we communicate (messenger, slack, email, LinkedIn, etc.) I really want it to stay synced with iCloud, Google, Next loud, etc.

I want as much automation as possible.

Every CRM I've looked into seems to revolve around a lot of manual work.

I'll have to give getdex a try.

<comment><AUTHOR> Automation is definitely an area I've thought a lot about -- it's the most common feature request by far. If you actively use your calendar, Dex does a reasonable job of integrating your calendar events with your records. Email is on the roadmap.

We've built the Chrome extension as a temporary substitute, but full automation is definitely the eventual vision. Unfortunately the more interesting channels (Messenger / Facebook) don't have accessible APIs so integrating with them has been an ongoing challenge. Would appreciate any automation suggestions as you try it out!

</comment></comment><comment><USER29> I really, really need something like this in my life. In a previous life, I ran for political office and raising money would have been so much easier if I had kept those contacts warm over time. Big problem here is that it requires Google Contacts. Do people actually use that? Phone/FB contacts would be much more useful in my book.

I actually was just thinking about this type of product just yesterday while walking around a part of the city I've never been to -- how cool would it be to proactively shoot folks a text whenever I'm in their part of town (determined by GPS)? I end up doing this manually and I always forget folks until it's too late.

<comment><AUTHOR> Google Contacts are useful for email data (since folks often add to Google Contacts, which does create issues with noise...)

I'll add you can add your iCloud contacts into Dex if you're an iPhone user!

</comment></comment><comment><USER30> Cool! I keep a personal CRM in Airtable. But, my biggest problem is that it doesn't have an awareness of when I contact people (e.g., via email, messenger, Whatsapp, Twitter, etc). How do you plan on addressing this with Dex?

<comment><AUTHOR> Right now we do this with the Chrome extension (you can have a panel in Twitter / Messenger without leaving the page). The calendar integration also helps if you use calendar invites, but that isn't relevant to all interactions. Email is on the roadmap.

For other channels like Messenger and Whatsapp, a big constraint is no API for messages. Making an integration for these channels the 'right way' is a challenge we're still working on -- we could ask for user credentials but that doesn't seem like a great long-term solution.

</comment></comment><comment><USER19> I've tried Monica, and am optimistic about the future of personal CRMs, but nobody has taken advantage of the most obvious data source for determining frequency of communication:

Why are there no apps that will read my SMS / call history and remind me to follow up with people I haven't interacted with?

Monica only allows contact import, there's no direct syncing and no automatic updates when you call / text / email someone. That seems like a no brainer of a feature before anything else? Is there some huge technical barrier I'm missing here?

<comment><USER31> Would like to add that there is a "siri suggestion" in iPhone since iOS 12 that might remind you to call someone back if you missed their call.

[https://www.idownloadblog.com/2018/10/16/siri-shortcuts- sugg...](https://www.idownloadblog.com/2018/10/16/siri-shortcuts-suggestions- iphone-lock-screen-tutorial/)

<comment><USER19> Interesting, but I think this would be relegated to the same category as the "nudges" that Google gives you to follow up on an email in the new Gmail.

That's not really what I'm (and perhaps most people) looking for in a personal CRM. I think the potential value add is the ability to "follow up" with long neglected personal relationships. (Friends who you've fallen out of touch with, etc...)

</comment></comment></comment><comment><USER32> Trying to fetch my Gmail contacts at the first sign-up? No option to continue without that?

I am sorry, I can't do that. I don't know anything about your offer, how you will be using my data. Will it be resold later? In your privacy policy, there is an option of using my data (my contacts network) to run targeted advertising, etc.

While I need something like this, I'll now have to search for more privacy- conscious alternatives.

</comment><comment><USER33> Great stuff!

I've been thinking about a way to solve the exact same problem on and off for a long time (I'm terrible at proactively keeping in touch with friends).

My original solution was the same as yours, but it quickly broke down for me because I just couldn't get all of the data (in particular when I last talked to someone) into the app. I imagine you'll face the same challenge.

Two approaches have worked well for me though...

1\. a dumb version of Dex. Basically just a list of friends/acquaintances and a periodic reminder (weekly, monthly, quarterly) to make sure I'd been in touch

2\. a weekly prompt to reach out to _anyone_ who fits a certain set of criteria. For example, "send a message to the last person you met at a networking event" or "reach out to the contact you'd be most likely to recommend for a marketing role"

Weirdly, the latter version has been way better for me at maintaining and growing relationships outside of my closest circle of friends. Especially on the professional side of things.

If you want to chat more about my experience or the problem in general, my email is in my profile and I find this super interesting :)

Good luck!

<comment><AUTHOR> Will follow-up via email :). I'll note I think one thing that Dex does different is it tries to be actionable as best as possible (like your #2 weekly prompt). Without a prompt, it's much harder to get regular value out of the product!

</comment></comment><comment><USER34> A suggestion that I also proposed to the Monica's founder (with no reply, though) - make it possible to organize contacts around interests. In real life there almost always is some kind of common interest that you share with people - computer games, politics, cars, cooking, whatever. However with different people you have different shared interests.

<comment><AUTHOR> Thanks for this suggestion -- this is something I've thought about (especially in relation to helping users remember a good reason to reach out). You can do this sort-of with the tags in Dex now, but admittedly not a perfect solution.

</comment></comment><comment><USER35> How do you plan to make money?

Right now everything seems to be free. I'm asking because I hate to be surprised after investing time to curate a CRM.

<comment><AUTHOR> There is a free tier now; we'll be building out the features of a premium tier ($7.99 / month) for other features. Since data is meant to be private and never shared, we're following a subscription model.

<comment><USER32> Why you are collecting personal contacts pervasively, then?

<comment><USER36> I mean, the app is meant to help organize your contacts, is it not?

If I see an app ask for my contact data without good reason, I'm immediately out in most cases. But they've got a good reason: it's what the app is supposed to do...

<comment><USER32> The app is "a personal CRM that reminds you to keep in touch". There are people that I want to keep in touch with (which I can add manually), and the rest of my contact list, who don't need any organizing.

</comment></comment></comment></comment></comment><comment><USER37> My first CRM implementation in a large enterprise was back in 2004, so 15 years ago, OMG. Since then, I have seen and heard of many implementations that failed miserably because one critical factor: data entry was too hard/complicated. Just look at any CRM solution out there, pick up any entity, let's say, an Account. Click 'add new' and you will see 3 thousand different fields populating your screen, for those you won't have 30% of the data to fill in. Some process will mandate that you fill in at least 60% of that data somehow, so you cancel that creation and move ahead using a workaround.

In my opinion, CRM data entry should always be incremental/progressive, very granular, allowing processes to flow without frustrating users. That is key to user adoption and to any project success. Just my 2cents on this.

</comment><comment> the-peter Interesting product! I recently used a mind-mapping tool to make a web of everyone (EVERYONE) I've ever known. I started with my family, all of my jobs and all of my schools, added everyone from those places and methodically looked at each person in the list adding people I met through them. Later I added trips like vacations, conferences etc and added everyone I met there. I was a nice nostalgic trip but I was amazed how many people I genuinely liked but haven't talked to in years. The thought crossed my mind to somehow track 'last contact' dates and have something popup to remind me to get in touch with people but it seemed too daunting a task to keep it up to date. I'll take a look a Dex for this now.

</comment><comment><USER38> Sounds exactly like what Socialfly was doing several years ago. (Different Socialfly from what you'll find from a Google search now. I couldn't seem to find any trace of the Socialfly I'm referring to online.) Anyway, I did find that service helpful so I hope Dex works out.

<comment><AUTHOR> Thanks for the note! Curious to hear more about Socialfly if you have any more info -- there have been a lot of attempts at a Personal CRM and always interested in learning from past examples.

<comment><USER38> I don't remember much about it tbh. It would import contacts and let you add birthday info and other personal details and schedule follow ups. I don't think it was anything groundbreaking tech-wise, but the concept seemed unique at the time.

</comment></comment></comment><comment><USER39> Looks like you are heavily utilizing Segment to funnel lots of private user data to unknown third party providers as also use CloudSponge -- which also basicall sucks up to all of my contacts and nobody knows what with it. That's too much third party data access without proper justification.

BTW, Kevin, in your graphics you have a Russian name as an example. Are you Russian and just pretending to be westerner or you just like Russian names?

</comment><comment><USER40> It looks like Dex is fairly early stage and has a single founder(?). Many people including myself see this as a fairly rare occurence though YC insists otherwise (and YC is likely correct). I wanted to ask you a few questions about your company and journey leading up to to YC.

* When did you start the company and how many founders are there?

* What was your traction (MAU or anything else) prior to being accepted into YC?

* How do you plan to grow the userbase? Content marketing, ads, partnering with other companies?

* How do you plan to make money?

* How big is the market size?

* Are there any adjacent markets that you could see yourself expanding into?

Good luck!

<comment><AUTHOR> You're right on both counts. The company started approximately 9 months ago, focused on different ideas in the relationship management space; traction prior to YC was minimal.

The plan to grow the userbase is content marketing + advertising as we figure out unit economics. The plan to make money is to charge $7.99/month for the product. Market size estimates this early are tough to get right, but we believe anyone who uses LI (645 million users) can manage relationships better with Dex.

</comment></comment><comment><USER41> I've been thinking about solving the same problem for myself personally (Even made an app here: [https://apps.apple.com/us/app/prim-relationship- manager/id14...](https://apps.apple.com/us/app/prim-relationship- manager/id1455596937)).

How are you avoiding manual data entry given social media's reluctance to release this information? Semi-related, how are you respecting user's data?

<comment><AUTHOR> Thanks for sharing Prim! Really interesting. Manual data entry as you know is the hard part -- any personal CRM will require some data entry. We try to make this easy with a calendar integration and Chrome extension, but it's not perfect and always a challenge.

With user data: our privacy policy is here ([https://getdex.com/privacypolicy](https://getdex.com/privacypolicy)) and we chose a subscription model so your data stays yours -- and private.

</comment></comment><comment><USER42> Well, I plan to built this since last year, but haven't got energy to actually build that. Congratulations on launching!

From the website it seems that your MVP is a Chrome extension. A lot of time I remember to keep in touch with my friends are when I'm outside, away from my keyboard. When using computer my mind is habituated for works and leisures. Do you have any plan to build apps for mobile?

</comment><comment><USER43> From the privacy policy:

 _We also may collect limited information from the people with whom you interact by email when you use the Site and Services. This information may include the recipient's name and email address, the number of times that the recipient opens your email, the recipient's IP address and the computer platform that the recipient is using._

Is there a way to turn this off?

</comment><comment><USER44> I've been looking for something like this for a while -- months.

The key for me -- other than privacy etc -- is that it be automated. It should take the info from my email, Facebook and maybe messenger/text and figure out who my friends are and who I have not been in touch with.

How does this decide whom to recommend to reach out to?

<comment><AUTHOR> Right now the recommendations are based on your calendar history and your past activity with recommendations -- we're hoping to include more signals as we develop ways to ingest this data.

One of the biggest challenges is the interesting integrations (Facebook/SMS/etc) aren't super easy to do (unless we straight up ask for credentials!). It's an area we're still working on, as more automation is the most requested direction of features.

</comment></comment><comment><USER45> Interesting because I did contract work for a very similar app about a year ago.

[https://apps.apple.com/us/app/sunny-organize-your- contacts/i...](https://apps.apple.com/us/app/sunny-organize-your- contacts/id1399782974#?platform=iphone)

<comment><USER46> What happened to the company/app since?

<comment><USER45> I don't think they got much traction.

</comment></comment></comment><comment><USER47> Comparison with Monica?

<comment><AUTHOR> Overall: Dex isn't open source, but integrates with your Google Calendar, has a Chrome extension that integrates with social media workflows.

We're definitely solving a similar problem, and in the past I was a user of Monica until I found it too much work to keep up with. Monica notably does have more fields and performs functions (like journaling) that Dex does not.

<comment><USER48> Keep up the good work. Some HN types beg for freeware and yet wonder why they cant escape the rat race. Quality software should be rewarded and should not be free of cost.

<comment><USER49> Free =/= open source. What these HN types you are so aggravated by are asking for is open source (not free as in beer) software, which some (like me) consider an ethical imperative.

<comment><USER50> Can you explain why having the source code to the software you run is an "ethical imperative"?

<comment><USER51> See the entire exhausting body of "Open Source is not Free Software" arguments from fsf apologists. RMS literally stated once he wanted proprietary software to be illegal.

Properly answering the question you asked is a whole can of worms, much like asking "vim or emacs" or "macOS or Windows or Linux" or maybe even "python or ruby or rust / go?".

</comment></comment></comment></comment></comment></comment><comment><USER52> I think a personal CRM should include knowledge of Dunbar's number.[0][1]

Like,

"You are spending too much time with C people. Is C person Andrew now a B? B people like Joe and Jane need more attention."

"You could use another A relationship. The following B people might be good candidates based on your contact frequency."

This is mostly tongue-in-cheek, but it is often true that people don't attend to relationships with apprppriate priority. And, knowing your situation with regard to various relationship levels provides insight for growth.

[0] [https://www.newyorker.com/science/maria-konnikova/social- med...](https://www.newyorker.com/science/maria-konnikova/social-media-affect- math-dunbar-number-friendships)

[1] [https://royalsocietypublishing.org/doi/abs/10.1098/rspb.2004...](https://royalsocietypublishing.org/doi/abs/10.1098/rspb.2004.2970)

<comment><AUTHOR> This is an interesting insight -- definitely aware of Dunbar's number but haven't thought about the best way to incorporate it into Dex. Appreciate the suggestions!

</comment></comment><comment><USER53> Shit. Companies with "my idea" keep getting into YC ... I always feel that my ideas are too crazy but then I see companies with exactly my idea getting into YC. I should just start building them out I guess ...

Looking forward to what you guys build, Dex!

<comment> o-__-o Are you me?

do you want to pair up on something and mash something out over the course of a few weekends?

<comment><USER53> Hell yes, feel free to reach out to me (website is in my profile)!

</comment></comment></comment><comment><USER54> I thought I was going to have to build something like this myself but finally found a "good enough" app (ABC / Always Be in Contact). It has a few warts but since it's free I can't complain and it's definitely helped me stay in touch with people

</comment><comment><USER51> [https://github.com/dexidp/dex](https://github.com/dexidp/dex) is an existing project which was part of CoreOS's commercial kubernetes offering.

<comment><USER50> "dex" is also the file extension for Dalvik VM bytecode files, and "Pokedex" is for keeping lists of Pokemon, "Roladex" is yet another product for keeping lists of people, and it means "dexterity" in role playing games, but nobody is getting confused with CoreOS's thing.

<comment><USER51> I have literally no idea why I'm getting downvoted for pointing out something with the same name. I just figured it added value to the "dex" convo. I realize it isn't going to confuse people as it is vastly different. It is _still_ relevant as it has the same name, even if you downvote me.

<comment><USER55> It is probably because you seem to be unaware of rolodexes, which is what everyone used to manage contacts before computers, and the source for all the "dex" naming trends: [https://en.wikipedia.org/wiki/Rolodex](https://en.wikipedia.org/wiki/Rolodex)

<comment><USER51> I was born in the early 80s, can confirm, am aware of a Rolodex :)

</comment></comment></comment></comment></comment><comment><USER56> Congrats on launching, and good luck with your startup. Personally I am much more old fashion - I stubbornly don't want a CRM to remind me of keeping in touch. I want to have my own mind to tell me...

<comment><USER36> > _Personally I am much more old fashion - I stubbornly don 't want a CRM to > remind me of keeping in touch. I want to have my own mind to tell me..._

My own mind has proven itself incompetent at this task, so I'm good with a little assistance.

I was actually planning on re-reviewing Monica soon, so I'll add this to compare against. For me my goal is just about tracking what people enjoy or don't, what we last did, important developments in their lives, whether I've updated them on my own important developments, etc...

Just offloading all the things my brain has repeatedly failed at in favor of garbage like song lyrics or API documentation.

</comment></comment><comment><USER57> Nice. I so wanted something for quite a while. Brainstormed, sketched out quite a few times with my friend. Would be intereting how this progressed.

Was using Contactually but was not happy.

</comment><comment><USER58> I don't use Chrome. Or Gmail. Am I SOL?

Also, I used to use Contactually for this a few years ago, was great with email integration and FB before they killed the API. Good luck!

</comment><comment><USER59> I currently use Notion for my personal CRM but I'm frustrated by the reminders and poor note taking features. Will be giving Dex a try.

<comment><USER11> I'm curious, what's your workflow in Notion for CRM stuff?

</comment></comment><comment><USER60> I built something just like this years ago!

It's called Contact - People Organizer by App Addiction

PS: I don't track anything you do!!

</comment><comment><USER61> Do you have a privacy policy? I don't see anything on your landing page, or in the web app.

<comment><AUTHOR> Yup, the privacy policy is on the start page ([https://getdex.com/start](https://getdex.com/start)) and can be found at [https://getdex.com/privacypolicy](https://getdex.com/privacypolicy). I'll work to make it more clear!

<comment><USER51> It took me awhile to literally find the exact same thing. What is your goal for monetization? This looks really nice, but how do you plan to make this viable in the long run? You can have a million users and still lose money. Just look at Uber as an idea of how not to build a company!

</comment></comment></comment><comment><USER62> A personal CRM should be federated. I shouldn't need to keep my friend's contact details up to date manually. If they run a digital address book of some kind, my software should just ask their software for the latest data and subsequently update my local data. This should be an open protocol like email or calendaring.

</comment><comment><USER63> Any functionality to log text messages, WhatsApp, and email?

</comment><comment><USER64> So basically a smarter address book?

</comment><comment><USER65> I need this in my life. Great idea!

</comment><comment><USER66> What's behind the name?

<comment><AUTHOR> It's meant to evoke 'Rolodex' but not directly :)

</comment></comment><comment><USER67> I also planned on doing a startup for this, but didn't have enough time. Best of luck to you!</comment>


Bitcoin Is Not the Future of Payments – A Glimpse from China's Digital Wallets - <AUTHOR> http://www.visualcapitalist.com/china-digital-wallets-payments/ <comment><USER2> I don't think comparing Bitcoin to Ali/Wechat Pay is fair. One could build the same payment experiences (qr codes, ride hailing, red packets, etc.) on top of a Bitcoin wallet app. Bitcoin is a "layer" apart from the payment experiences the Chinese wallet apps enable.

Building an ecosystem of services and checkout experiences is not an incredibly hard problem for a company like Coinbase to solve. The reason why Coinbase (and other Bitcoin wallet apps popular in China) aren't aggressively cloning the Ali/WeChat Pay experience is probably because a majority of their userbases hold Bitcoin for investment and speculation — not to make day to day payments. These wallets and exchanges are better off spending a majority of their time building for these investors / speculators.

<comment><AUTHOR> Huh, I don't understand. If it's so easy why don't they do it? Oh the "value of store" goalpost pivot. Right!

Let me add some reality checks here. Irrespective of the fees problem - I know Segwit, Lightning network etc will solve everything, the real reason they don't is because Bitcoin/cryptocurrency is difficult for people to understand and use.

Most of the discussions about bitcoin et. al forget at the end of the day your system should be able to cater to a layperson. Currently, looking at Bitcoin discussions reminds me of this scene from Silicon Valley TV series:

[https://www.youtube.com/watch?v=Ml92QEqE- RQ](https://www.youtube.com/watch?v=Ml92QEqE-RQ)

<comment><USER2> Bitcoin is an asset (or a currency). Not a user experience. I think you should distinguish between the UX of a Bitcoin wallet app (which is analogous to Alipay and WeChat Pay) and the "asset" Bitcoin (which is more analogous to CNY or a stock you hold).

Bitcoin can be made user friendly with a user friendly Bitcoin wallet app. Coinbase could streamline KYC by partnering with banks / regulators, request Uber rides in-app, or enable QR based merchant payments (basically make it's app exactly similar to Alipay/WeChat Pay).

None of that has anything to do with the success / failure of Bitcoin. Bitcoin is failing because it is not a good store of value for consumers at the moment. It's too volatile and too hard to acquire. It's more of an investment class asset than a stable store of value I can purchase and not worry about.

The Alipay vs. Bitcoin comparison doesn't make sense — you're comparing apples and oranges.

</comment></comment></comment><comment><USER3> The killer feature IMO for block chain technologies is their trustlessness. Mobile payments in China had the benefit of an extremely well built out cultural infrastructure of QR codes and also because the incumbent method of credit cards did not have a strong hold. It will be interesting to see if trust reduced systems translate into powerful global cultural infrastructure.</comment>


If you're rich, you're more lucky than smart. And there's math to prove it - <AUTHOR> https://www.pbs.org/newshour/economy/making-sense/analysis-if-youre-rich-youre-more-lucky-than-smart-and-theres-math-to-prove-it <comment><USER2> I'm sympathetic to the above viewpoint, but the argument presented in the article sounds really dumb.

> _" But think about it, the authors suggest. If smarts and talents and even > effort are so normally distributed and wealth is so abnormally distributed, > what's missing to explain the disparity? "We suggest that such an ingredient > is just randomness," write the authors."_

Just because talent is normally distributed, but outcomes are abnormally distributed, doesn't suggest in any way that this is caused by randomness. A winner-take-all game-format would perfectly describe the above phenomenon.

This can be trivially seen when the same logic is applied to sporting competitions. _" If Tennis ability is normally distributed across the population, how can we explain a small handful of players like Federer and Williams winning an abnormally high number of championships? Clearly it must be because they're more lucky than talented."_

<comment><USER3> Do you have any evidence that tennis skill is normally distributed?

<comment><USER4> The question whether it's normal distributed doesn't even make sense. Tennis skill and intelligence are both Ordinal Scales.

IQ is normal but that is just because we take everyones intelligences and assign them to a value from a normal distribution. [http://www.mymarketresearchmethods.com/types-of-data- nominal...](http://www.mymarketresearchmethods.com/types-of-data-nominal- ordinal-interval-ratio/)

<comment><USER5> What do you mean by an ordinal scale, and what does that imply? I'm completely blind on this usage of the expression.

<comment><USER6> It means that values are ordered, but not really numbers.

E.g. what does 2x better tennis skill mean?

An under that idea, the distribution curve doesn't really mean anything.

<comment><USER5> It would mean what this particular variable has been operationalized [0] to mean. Once upon a time things such as _" heat"_ were just words, and as words they were used in a variety of different implicit senses in which at the time people didn't distinguish -- for whatever reason -- but that people thought that nonetheless were informative about the thing in question. Which is to say that words were used as heuristics, partly as reasonable descriptions, partly as expressions of gut feelings. With the association of heat with thermal expansion and the development of better apparatuses (e.g. the ordinary mercury column thermometers) as well as the diffusion of this concept among laymen though stuff such as weather prediction, it became the most salient form of _" heat"_, and thus the standard use of the word when unqualified came to mean just that: what a thermometer reads. But other forms of heat i.e. the personal feelings of heat associated with climatic comfort, or the action of capsaicin or even wounds -- and this is the origin of the word _" inflammation"_ \-- came to be used only when qualified. These are all said to be _" subjective heat"_. Now, I can only claim that all that I've said is merely opinion, since I haven't quite yet worked out to properly cite just who might have said this prior to me and for what reasons -- and which I currently wont, because it's scattered over stuff and I don't know even how to begin -- so this is all provided as is.

About ordinality, as opposed to cardinality, I can only say that I didn't see the connection at the beginning, but now that I've thought a little while about it, it does seem like a philosophically uncomfortable idea. But I'm not going to be the one to say _why_ , at least not now.

[0]: [https://en.wikipedia.org/wiki/Operationalization](https://en.wikipedia.org/wiki/Operationalization)

</comment></comment></comment></comment></comment></comment><comment><USER7> The model assigns opportunities every 6 months for 40 years and decides whether the talents of the potential beneficiary are adequate to exploit the opportunity.

It doesn't work this way. People waiting for opportunities don't encounter them with the same frequency as people actively looking for and/or trying to manufacture them. An opportunity for me to double my assets or income might exist, but will I even be aware of it? If I am, and my talent is adequate to exploit it, what kind of risk does it come with and what is my tolerance for such risk?

The last event in my life roughly conforming to the opportunities generated by this model was something I actively sought, carefully selected among hundreds of similar opportunities, and took enormous (stupid, I'd be saying now if it hadn't worked out) risk to exploit.

<comment><USER5> I think the whole point of the paper which the writers at PBS might have glossed over is simply _" we can reproduce this outcome with an extremely simple set of hypotheses"._ That's how I read it, at least, and that's something that's bound to cross the mind of someone familiar with agent based modelling. And if all they want is produce a power law distribution over income, that's all they need. Further model complications only become relevant if they lead off to new conclusions, or different outcomes from the generally expected outcome under particular circumstances. What you're suggesting would be, on the simple basis of some academic pragmatism -- and the fact that they still have to start from _somewhere_ \-- left to further studies, adding stuff to this model while citing the original paper.

But all that you're suggest would indeed bring back at least some degree of agency to the whole thing, even if just as being able to find, sort and act upon opportunities.

</comment></comment><comment><USER8> Some criticisms I have read about this paper include:

1) Their model assumes all persons start with the same initial wealth/capital, which is not true in real life

2) The model also assumes people's talent/ability remains constant and does not increase as they get older

In the end it is a model, and models are limited in how much they can match the real world. I do not believe the paper actually "proves" the hypothesis that "If you're rich, you're more lucky than smart" as the pbs.org title implies.

<comment><USER9> As I have gotten older, I have made more money and gotten wealthier. My skills have increased, my knowledge has increased, and I am more valuable.

Did the authors look at wealth as something that is static and to be distributed? Or did they look at it as something that can be created (or destroyed)?

I reckon they have never actually ran a business or created any wealth themselves - but that is just a guess.

<comment><USER10> It's trivial to find someone that has equal skills that have either more wealth, or less. In fact, longer term studies have shown that wealth is inherited, and it takes I believe four generations to change from the lowest to the highest economic quintile. All of this is easily quantified, and has been repeatedly studied. The results are just sociopolitically unacceptable mythbusting. Read the wikipedia article on socioeconomic mobility [0], or perhaps the article about the economist that setup identical real world experiments, and found success was random chance.[1]

Anecdotally, the vast majority of the money I've come across in my life is pure luck. Skills, education, and not a sufficent (or even a necessary) condition of gaining wealth.

[0] [https://en.wikipedia.org/wiki/Socioeconomic_mobility_in_the_...](https://en.wikipedia.org/wiki/Socioeconomic_mobility_in_the_United_States) .

[1] [https://www.npr.org/2014/02/27/282939233/good-art-is- popular...](https://www.npr.org/2014/02/27/282939233/good-art-is-popular- because-its-good-right)

</comment></comment></comment><comment><USER11> I believe that the situation is simpler and more powerful than what the article claims.

Basically you need two things:

1) Some slight advantage

2) The network effect, that is, for example, the probability of competing depends on the current winnings.

If you have these two things, you get 80-20 like distributions, you get the explanation for why winners keep winning. If you are interested, you can find my simulation and analysis at

[http://www.cs.toronto.edu/~arnold/research/80-20/](http://www.cs.toronto.edu/~arnold/research/80-20/)

Kind of shocking how well this works. The intuition is, why has Coke won, well they had some initial advantage, and so they won a bit. Now that they have won a bit, they can finance themselves into more competition. For example, they can place themselves into more stores, into more restaurants etc. Now they get a chance to compete more. When I run with rules:

r1) Actors have normally distributed abilities,

r2) Actors are chosen randomly based on current winnings, the more you have won, the more you compete,

r3) Winner of competition wins one point from the loser,

You get interesting results, for example, in the two columns below, the left is Household income in 1970 broken into quintiles. The right column is simulation results.

        4.1%                         6.7%

       10.8%                        11.5%

       17.4%                        16.0%

       24.5%                        23.3%

       43.3%                        45.6%

Interesting how well the top 3 or 4 quintiles match between the simulation and the real world data.

If you run the simulation with different rules, the real world quintiles do not match the simulation quintiles nearly as well. You can tweak the simulation to see this as well.

The simulation can be tweaked to handle cases such as inheritance, so an actor with different ability inherits the wealth of a past actor. When I run this simulation, around 80-90% of top 20% actors lose all wealth in 3 generations. See for example:

[https://www.theglobeandmail.com/globe-investor/globe- wealth/...](https://www.theglobeandmail.com/globe-investor/globe-wealth/..).

</comment><comment><USER12> _...having been born on 3rd base, she (or he) grew up thinking she had hit a triple..._ \- (Various, 2013)

</comment><comment><USER13> _But think about it, the authors suggest. If smarts and talents and even effort are so normally distributed and wealth is so abnormally distributed, what's missing to explain the disparity?

"We suggest that such an ingredient is just randomness," write the authors_

I think it's more due to the power of compounding. If you're a little tall, that doesn't help you get any taller. But, if you get a little rich, that helps you get richer, which helps you get even richer, and so on.

</comment><comment><USER14> So many people assume that everyone wants to be rich. Some people don't. Many of the smartest never chased money.

</comment><comment><USER15> And if you're smart, that's luck too. I didn't earn my IQ.

<comment><USER16> Meritocracy man.

</comment></comment><comment><USER17> See also, the book "Outliers".

The example from that book that stood out to me is that most professionAL hockey players have their birthday in the first 3 months of the year. It's suggested that's because when tryouts happen, those children in their age group are the oldest, and therefore most skilled at the time of selection for grooming (well, focused training for their team).

In short, yeah talent is good, but often _skill_ is the result of some luck factor amplifying your talent.

</comment><comment><USER18> "Lucky" has a negative connotation. Is there a better word that implies something closer to "he made good choices and they worked out even better than expected" or at least something neutral?

</comment><comment><USER18> What is the distribution of good choices? Those aren't luck or smarts or effort, but they matter.

</comment><comment><USER5> tl;dr path dependence.</comment>


Wrong signal - <AUTHOR> https://it-kollektiv.com/wrong-signal-das-falsche-signal-engl/ <comment><USER2> It sometimes feels like the security community is a bucket of crabs where any time something starts getting traction due to ease of use a lot of others try to pick at it due to it not being perfect even if many of those things are trade offs

\- phone numbers allow for signal to be a drop in replacement for other messaging apps with minimal to no registration required, I doubt I could have gotten my mother to use signal without switching from texting being so low- friction.

\- lack of federation means ows can control spam better unlike in a federated environment where lazy/malicious operators can cause lots of problems. Take a look at the 2 big federated protocols email and irc where due to spam and other issues they are both increasingly centralized.

<comment><USER3> This isn't the security community. The security community is pretty much unanimous in supporting Signal over all other secure messengers. That's not to say that security people aren't critical of Signal, which isn't perfect for all the reasons this blog post points out --- Grugq is a pretty good source for these kinds of criticisms through the lens of an infosec person. But security people tend to deliver these criticisms as, you know, criticisms --- not angry appeals for people to abandon Signal.

The entities most harshly critical of Signal are supporters of other messaging applications and protocols.

I think the most important thing to understand about secure messengers is that messaging in general is a back-ally knife fight of a market, one of the most vicious I've seen in my career. Perhaps it's because of the WhatsApp outcome and a general belief that there's another such outcome for some other messaging app. Or it could just be the network affect. Messaging applications themselves are interesting UX challenges, but as programming challenges they're pretty close to socket projects. So there are a lot of entrants in the market. Whatever the reason, the knives are out for Signal.

I don't so much care what messaging system you use to talk to your friends or chat with your gaming guild. But if you have real adversaries, the _security_ part of your messaging system has to work, even more than the _messaging_ part. For that situation, Signal is the only messaging system I'd recommend unreservedly.

<comment><USER4> How can you reasonably suggest trusting a mobile device if you have "real adversaries"? If you define your threat model to include any serious governmental interest, you cannot trust a cell phone. They have an always on network connection, remote auto-upgrade capability (at least for the baseband, if not the user software), and built-in microphone, cameras, gps, and other sensors.

<comment><USER3> Some of these concerns aren't valid (for instance: the baseband of your phone is less powerful, in its systems design, than is supposed by open hardware advocates), but mostly the issue is: security is about costs and prioritization, not absolutes. The systems people propose instead of Signal are likely to cough up secrets directly to adversaries; switching from Signal to something else reduces security.

If you believe people with state-level adversaries should exclusively use transparent and open hardware, that's fine; you should see Moxie's comment on this thread to learn how you might go about ensuring that the tiny minority of users with that hardware have access to Signal on it.

</comment></comment></comment></comment><comment><USER5> I'm happy to use Signal today.

In the long run federated protocols and servers demonstrated their resilience regarding third parties and time, see irc for example.

Probably Signal is just a reference implementation, the big deal is implementing Signal protocol in different systems (whatsapp, allo, fb messenger..).

Having said that, I would be happier to not give my phone number for registration, and contact discovery but this is today a user interface well understood and accepted outside geek communities that's hard to eradicate.

<comment><USER6> I'm surprised to see that matrix.org / riot.im is not mentioned as an alternative to Signal. They have a federated, open protocol, usable open- source apps for web/Android/iOS, registration without a phone number (even email is optional), do not require Google Play, and support double-ratchet encryption (in beta, it's not activated by default yet, but it will be activated by default in private rooms in the future).

<comment> vertex-four Because, frankly, the UX around encryption in Matrix is dire, as well as being beta. I've never seen someone actually use the same keys for two conversations over as many days, due to switching devices, logging out of the web interface, etc.

</comment></comment></comment><comment><USER7> Given that we've seen exactly how little information Signal maintains about its users [0], this seems to me to be alarmist spreading of FUD, potentially to advance the author's agenda of dfederation in Signal, which the developers have already addressed at length already [1].

For example, their assertion that "... metadata is abundantly available here" appears to be patently false, given [0].

0: [https://www.aclu.org/blog/free-future/new-documents- reveal-g...](https://www.aclu.org/blog/free-future/new-documents-reveal- government-effort-impose-secrecy-encryption-company)

1: [https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

<comment><USER8> Regardless of the merits of Signal, much of the criticism voiced in that article is nonetheless valid. Signal and other chat platforms employing the protocol are run as data-silos by design, using strongly identifying codes (phone numbers) as the required identifier — i.e., it is nearly impossible to create a throw-away account, because getting an anonymous phone number is no longer a practical possibility in a lot of (Western!) countries.

Whether or not such metadata is available to adversaries (either through OWS or gathered elsewhere) depends on who your adversaries are and whether or not a corporate entity can be trusted to be completely transparent about what kind of data they retain.

As for [0]; even if no relevant metadata is collected today by whoever owns the servers, nothing stops the party providing the service from doing so tomorrow.

<comment><USER7> > As for [0]; even if no relevant metadata is collected today by whoever owns > the servers, nothing stops the party providing the service from doing so > tomorrow.

This is a point I see bought up a LOT. I don't believe it to be useful however - proceeding down this rabbithole rapidly leads us to a place of advanced paranoia where we can't get anything useful done. Once you start assuming actual malice on the part of the software developer, even open-source code with the ability to run your own service doesn't protect you - there's multiple ways backdoors can be inserted in sufficiently subtle ways it's extremely unlikely they will be spotted before it's far too late for you.

> using strongly identifying codes (phone numbers) as the required identifier > — i.e., it is nearly impossible to create a throw-away accoun

Identifiers are only valuable if there is something to link that identifier to. Account creation time and last active time are very unlikely to be valuable to your adversary (for any definition of "your adversary" you had a chance at defending against in the first place). In other words, as long as the only data they have is your phone number, then that's not helpful. All that is is a record of a) this phone number exists (which is not secret) and b) this phone number uses signal (which isn't a secret either to any even mildly motiviated attacker).

<comment><USER9> > proceeding down this rabbithole rapidly leads us to a place of advanced > paranoia

When it comes to security, today's advanced paranoia is next year's common sense. Remember that folks used to think that telnet over the Internet was harmless.

Would OWS refuse to implement a court order directing them to collect and forward metadata? I don't know.

</comment></comment></comment></comment><comment><USER10> I love Signal. I use it as the primary means of contact for several close friends and have contributed patches. However, it drives me nuts that OWS won't allow federation or LibreSignal and requires phone numbers as user IDs. In the past, their justification has been that their primary goal is thwarting dragnet surveillance and none of these proposals further that goal (which is debatable in itself). I wish they would move more in the direction of an actual open source standard like they sort of purport to be rather than just an open source library with a closed implementation.

<comment><USER11> You probably already know this, but OWS detailed their reasoning for not supporting federation at this time in their blog a while ago: [https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

<comment><USER10> I've seen it, I just disagree with it. IMO it's a dick move to say "no federation" and to also say "no 3rd-party clients." What's the point of GPL if you're completely locked to their official clients & servers anyway?

<comment><USER12> Code auditing.

<comment><USER10> lol no. You could accomplish that with an all-rights-reserved copyright.

<comment><USER12> You're thinking of free software.

</comment></comment></comment></comment></comment></comment><comment><USER13> There are always security trade-offs (especially when it comes to ease of use) but until you can show me a better app, _which I can get my non-techy friends to use_ , Signal remains the best option for the mass market.

<comment><USER14> Phone-number as identifier is pretty terrible user-experience choice. I am traveling and my phone-number has changed half-a-dozen times in the past year alone, my email has been the same for over a decade.

I tend to use Whatsapp because other people already have it but I have absolutely no motivation to use encourage other people to use Signal.

Edit: Whoever down-voted this, want to explain how this isn't a huge user- experience regression from giving your email and using gchat?

<comment><USER15> You also have the reverse problem which is alluded to in the article, that a Phone number for a non-traveller, is pretty static and unlikely to be changed by the user often. However Email is more disposable and I can spin up and shut down email accounts that I could register with Signal et., al. for what I believe to be sensitive communications.

I feel that providers that use number-as-identity know this and use it as a way of assuring they have greater confidence of knowing their user, especially after everyone failed so spectacularly at real names policies.

<comment><USER14> > Phone number for a non-traveller, is pretty static and unlikely to be > changed by the user often. However Email is more disposable

I entirely disagree. Even without traveling outside the US - my US phone- number has changed several times (change of carrier etc.); while it is possible to spin-up and shutdown email accounts (e.g. dummy accounts for services requiring registration) -- by this time _most_ individuals should have a single _serious_ account (and a larger percentage in the future): online bank statements, online bills, online shopping -- do you really not have a single primary account?

</comment></comment></comment></comment><comment><USER16> _" After Donald Trump's victory in the US presidential election in particular, many tweets recommended using hard disk encryption and the ostensibly secure messenger app Signal while discouraging the use of competitor apps Threema and Telegram."_

Oh FFS. We've seen a continuation of invasive, Bush-era policies under Obama...but now _Trump_ is terrifying?

Spoiler alert: it has _been_ a problem for quite some time, and given the alternative to Trump it was going to _still_ be a problem regardless of who won the election: freedom ponies and rainbows were never an option.

Get a damn grip, people. Can we end the partisan pity party?

<comment><USER17> > We've seen a continuation of invasive, Bush-era policies IRT the NSA under > Obama...but now Trump is terrifying?

Uh, yeah. The Bush/Obama surveillance policies have largely been seen as dangerous not because of actual concrete harms that have materialized, but because if continued they raise the prospect of a much worse (because of the increased scope possible with modern tools) version of the kind of political targeting based on surveillance that was done by Nixon (prompting legal limits, notably the original FISA act.) And perhaps even beyond that, to the kind of retaliation for dissent seen in authoritarian regimes.

Trump is seen as the kind of figure that would be more likely than a more conventional candilate of either party to make those theoretical risks into concrete harms.

<comment><USER16> I'm not buying it.

The house is already on fire, and people are wringing their hands because the new owner might have a can of lighter fluid in his pocket.

<comment><USER17> I would say that many people view the Bush/Obama surveillance policies more as unreasonably dangerous highly flammable fuel stored in the house than an actual fire, and Trump as more analogous to someone carrying an ignition source than additional fuel.

I don't think many serious observers think that, whatever the potential, the actual substantive harm has yet been even close to Nixon levels, though the potential scope of intercepted communication (and hence, potential for harm with simply a change of intent at the top) is much broader.

</comment></comment></comment></comment><comment><USER18> This is a fairly clear and level headed criticism, while I think the 'problem' of centralisation is over stated and the accusations about Signal's motivation are unfounded I do appreciate that the author(s?) understand why Signal is popular - "The success of OWS can also be attributed to elitist and bureaucratic positions in the open source community. "

I don't see the federation issue as being particularly relevant - at least not until someone else actually sets up a non-OWS server and gains some users for it.

<comment><USER19> The article also shows the problems with federation, although they do not acknowledge it:

> The drafted protocol is called OMEMO and combines the advantages of jabber > and Signal. Even though the XEP Process will still take some time, the > protocol is stable and can already be used today. On Android devices, users > have the 'Conversations' client [8], which offers an experience comparable > to Signal, and on the desktop there is a plugin for 'Gajim' [9, 10] under > active development, which still has room for user experience improvements. > Using one of the readily available tutorials, it is possible today to get > started on Linux and Windows. iOS users will have to wait some time due to > license issues.

</comment></comment><comment><USER20> Has anyone else noticed a huge uptick in their contacts signing up for Signal this month? I've added 12 contacts just in November bringing me to about 30 contacts subscribed to Signal total, which is a large increase. None of these new contacts know each other, and only 25% of them know how to write software.

Does Signal publish registration numbers?

<comment><USER21> I imagine it's maybe down to the new Investigatory Powers bill in the UK, and maybe Trump in the US. The former at least seems to have led to some journalistic recommendations for Signal.

</comment></comment><comment><USER22> I'm repeating myself on many of these points, so I've cut and pasted some of my previous responses:

> Signal uses servers controlled by OWS. Other organizations could conceivably > operate their own servers because OWS open sources the software, but because > OWS strictly opposes federation (meaning the interconnection of > independently operated servers which the XMPP protocol (jabber) or e-mail > allows), only the users connected to the OWS-run server can communicate with > each other.

I've tried to write about why I don't feel like this is going to be a part of our future here: [https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

However, I would love it if someone proved me wrong. The Signal clients and server already support federation, so there shouldn't be any technical hurdles stopping the people who are really into federation from using our software to start their own federated network that demonstrates the viability of their ideas.

If anyone needs help doing that, let me know. I'd be happy to help.

> If a government does not approve of the use of Signal, it can simply block a > single server farm, solving the problem for the state actor, and resulting > in total loss of service to the users.

The authors of this article conflate a lot of things with federation. Federation = anonymity, federation = metadata protection, federation = censorship circumvention.

I don't think any of those are true. Email is federated, and I run my own mail server, but almost every single email I send or receive has GMail at the other end of it -- so running my own server does not provide me with any meaningful metadata protection, even though it is a federated protocol. The idea that everyone in the world is going to run their own mail server (or messaging server, or whatever) has not born out in practice, even in environments that natively support federation.

I think serious metadata protection is going to require new protocols and new techniques, so we're much more likely to see major progress in centralized environments that can change rather than federated environments that are stuck in time (in the same way that Signal Protocol is now on over two billion devices, but we're unlikely to ever see even basic large scale email end to end encryption).

In the case of censorship circumvention, I think it's much more common that people use censorship circumvention tools like VPNs or Tor rather than changing their entire federated identifier (and somehow re-discovering their entire social graph doing the same) every time a service gets blocked, particularly since censorship isn't just as simple as host-level filtering these days.

Again, I think we're more likely to see the incorporation of these types of censorship circumvention techniques into centralized rather than federated services.

> The community reacted to this by developing a version that does not rely on > GCM, however, OWS refused to merge the changes into the Signal code.

I don't believe this is true. To clarify this for casual readers, no data at all is transmitted over GCM. GCM is only used as a push event to tell the Signal Android client to wake up and connect to the Signal server to retrieve messages from the queue if the app isn't in the foreground.

This is pretty fundamentally just how Android works. However, people who want to use Google's OS without any Google services flash custom ROMs onto their devices that are missing this dependency.

I have said many times that I have no problem with supporting these custom ROMs. But I would like someone from that community to submit the PR: "I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services."

Nobody has done it.

> The final point of criticism is that OWS distributes the Signal app > exclusively via Google Play while actively preventing the distribution of > independent builds.

We'd love to distribute Signal outside of Play, and have written about what we would need to be able to do so. As of yet, nobody from the FOSS community has stepped in to help.

We'll get there eventually on our own, but we have a lot of work on our plate, and have to set our priorities according to what we think is important for Signal as a whole.

> The community's demands for decentralized web services controlled by the > users themselves, or by designated professionals elected by the users, seems > like a burden to them.

I do not feel like the FOSS community is a "burden," however I do wish they recognized that many of their desires are unique to a very small minority of Signal users. I wish that they'd take more responsibility for manifesting those desires themselves.

This is the second time in two months that someone from the FOSS scene has written up a list of complaints, but as far as I know, in neither case have the authors ever contributed anything to Signal in an effort to meet their own needs.

<comment><USER23> > I do not feel like the FOSS community is a "burden," however I do wish they > recognized that many of their desires are unique to a very small minority of > Signal users. I wish that they'd take more responsibility for manifesting > those desires themselves. > This is the second time in two months that > someone from the FOSS scene has written up a list of complaints, but as far > as I know, in neither case have the authors ever contributed anything to > Signal in an effort to meet their own needs.

I think that the interest in the FOSS community is relatively low given the centralized format in which Signal is offered. I know many people who are deeply into FOSS who would love an alternative to IRC but cannot be found even using Signal. But "their own needs" are completely out of bounds for you, and it seems pretty clear that this isn't something that's going to be fixed in patches and code, so expecting them to come and fix it because you have an open code base is rather disingenuous.

If you started by promoting Signal as a generic protocol or backend to other projects, it would get much more traction in the FOSS community, as they are attracted to components on which other things can be built.

You can claim that this is a reason to ignore the criticism. But, you will always be right in dismissing critiques like this as you've set up the environment in a way which limits the kind of constructive collaboration that is the hallmark of FOSS.

You will probably say this is not true and cite existing public contribution to the project. But what I am saying is that the interest and contribution would be orders of magnitude larger if you really ran the project in a traditionally open way. One hallmark of this would be federation. Whether or not this makes sense practically (the gmail metaphor applies obviously), it is something that people want an need to order to feel they have ownership of their work on a messaging platform. You're simply not going to talk your way out of this.

For human and community reasons, the upside to federation is probably a lot higher than you appreciate. I hope you consider it. You have built a nice platform, but for your work to make a lasting impact you need to share it with others.

<comment><USER22> > _But "their own needs" are completely out of bounds for you, and it seems > pretty clear that this isn't something that's going to be fixed in patches > and code, so expecting them to come and fix it because you have an open code > base is rather disingenuous._

Many of the things listed in these articles, such as making GCM optional, or supporting distribution outside of Play, are not "completely out of bounds." We've expressly indicated support for them and enumerated the work required, but nobody has committed to doing the work.

I don't expect anyone to do the work, but I do think it's strange when someone from the FOSS community complains that we haven't done it for them.

> _If you started by promoting Signal as a generic protocol or backend to > other projects, it would get much more traction in the FOSS community, as > they are attracted to components on which other things can be built._

Signal is broken into three layers, two of which are designed to provide exactly that:

A crypto protocol that can be incorporated into other projects: [https://github.com/whispersystems/libsignal-protocol- java](https://github.com/whispersystems/libsignal-protocol-java)

A service protocol that can be pointed at any back end: [https://github.com/whispersystems/libsignal-service- java](https://github.com/whispersystems/libsignal-service-java)

The service protocol even includes support for federation. I don't think it's a good idea for the reasons I've enumerated, but anyone can use this code to start their own federated network and prove me wrong.

> _For human and community reasons, the upside to federation is probably a lot > higher than you appreciate. I hope you consider it. You have built a nice > platform, but for your work to make a lasting impact you need to share it > with others._

We've done more than consider it, we've done it. We started Signal as a federated service, and it was kind of a disaster.

I'd definitely reconsider if people have a plan for avoiding the problems that we encountered the first time, beyond "federation is good." In the mean time I'm happy to help anyone deploying Signal in their own federated environment.

<comment><USER23> > Many of the things listed in these articles, such as making GCM optional, or > supporting distribution outside of Play, are not "completely out of bounds." > We've expressly indicated support for them and enumerated the work required, > but nobody has committed to doing the work.

> I don't expect anyone to do the work, but I do think it's strange when > someone from the FOSS community complains that we haven't done it for them.

The linked article notes that you have not been so supportive of such developments in the past:

> The community reacted to this by developing a version that does not rely on > GCM, however, OWS refused to merge the changes into the Signal code. When > the project was forked, they prevented the newly established LibreSignal > project [5] from connecting to Signal's servers and prohibited the use of > the term "Signal" in their name.

Reading through the comments that are linked it looks like you mostly had technical concerns about the work. Is that correct?

Clearly the perception of your actions is different than you intend. In your comment here you make it sound like no one had even attempted to do resolve these issues. But that's not what the author of the article believes, and given the public record I'm inclined to agree.

> I'd definitely reconsider if people have a plan for avoiding the problems > that we encountered the first time, beyond "federation is good." In the mean > time I'm happy to help anyone deploying Signal in their own federated > environment.

Your key point is that you're content if people do federation in their own, outside of your domain. That's fair. But what I'm saying is the dream of a federated secure messaging system that's also popular is something which you have the power to chase if you commit to it by making it a core feature of Signal.

<comment><USER22> > _Reading through the comments that are linked it looks like you mostly had > technical concerns about the work. Is that correct?_

> _Clearly the perception of your actions is different than you intend. In > your comment here you make it sound like no one had even attempted to do > resolve these issues. But that 's not what the author of the article > believes, and given the public record I'm inclined to agree._

From that original discussion on LibreSignal:

"If the only thing that the remaining people here want out of LibreSignal is a websocket-only solution and gmscore isn't an option for whatever reason, I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services. However, I also realize that still won't help people that are trying to build a Google-free experience on Google's platform, since we still don't have the things we need to be comfortable distributing software outside of Play."

I have repeated that many times. That was June. Nobody has done the work, but plenty of people have written articles like this. The latter is definitely easier.

> _Your key point is that you 're content if people do federation in their > own, outside of your domain. That's fair. But what I'm saying is the dream > of a federated secure messaging system that's also popular is something > which you have the power to chase if you commit to it by making it a core > feature of Signal._

Again, we already committed to making it a core feature of Signal, and it was a disaster. We've learned from our mistakes.

If it's something that you think is important, please get involved in the project and come up with a plan to introduce federation in ways that actually deliver on the promise of metadata hiding, anonymity, and censorship circumvention as well as avoid all of the problems that we documented based on our initial attempts.

</comment></comment></comment></comment></comment><comment><USER24> My main beef with signal is that they release their encryption libraries as GPLv3 not LGPLv3, preventing the use of them in any commercial product that doesn't want to open their source code.

Yet, they "worked with" Facebook and WhatsApp to incorporate their protocols presumably providing them with an alternative license. It sure would be nice if companies who wish to add encryption to their messaging products, but didn't have the pull of the bigger guys to warrant OWS's attention, could just use an LGPLed library to do so. If OWS's mission is to bring about widespread encrypted communications, playing favorites with a few larger messaging companies seems to send the wrong message.

(The points made in the article, while valid, seem to be splitting hairs relative to the overall net good Signal has provided.)

<comment><USER25> Why do you think that might be? I can imagine that requiring others to open their source makes their implementation verifiable.

<comment><USER24> Exactly, which is why they should have required Facebook and WhatsApp to comply with the GPL. Alternatively, they should have created a more flexible license that could be used by Facebook, WhatsApp, or other companies to integrate their software. My point isn't about the GPL per se, but about the unfair playing field they are creating.

<comment><USER26> I think the GPL is actually a perfect license in this case. Anyone who wants to use their cipher in another GPL project is free to. Commercial entities who won't do this can pay OWS for their time, expertise and IP in order to get a different license.

<comment><USER24> That makes sense -- I guess what it boils down to is it would be nice if OWS were more open about their commercial licensing options, and make it easy for a company to license + integrate their work. As it stands right now it feels like you have to be a Facebook/WhatsApp level company to be able to be worth their time to work with.

</comment></comment></comment></comment></comment><comment><USER27> I do not see any comments to tackle the weakest link: exploits on the OS. Federated or not, the tunnel can be encrypted. On the servers static data can be encrypted. How can a _regular_ user know his/her device's OS is not compromised? That is the problem to solve now and it seems that a formally verified OS code is the only long path.

<comment><USER11> That's not an argument for or against Signal, though, as it affects all messenger apps in the same way. While OS trustworthiness is an interesting topic, it's not really the one being discussed here.

<comment><USER27> It seems you did not read the article thoroughly. The argument being made is that Signal is sending the WRONG signal by making the user think/feel that encrypting the tunnel and passive data is enough to guarantee privacy and security.

Quoting:

 _There are many things users can and maybe should be concerned about: Hackers, providers, promoters, crooks, spooks, shareholders or maybe the person on the next seat in the bus. Do they want to prevent their data from being used for other purposes than communication itself? Maybe they want their messages to be tamper-evident, or perhaps they want plausible deniability or immunity against eavesdropping? What is the use of end-to-end encryption when there could be a key logger or a rootkit on their device, transmitting everything they do to a remote entity? Encouraging users to believe in a general sense that Signal makes their communication safe, will tend to promote a false sense of once-and-for-all security (regardless of the indisputable and substantial increase in end-to-end encryption). It is very important to remember that even though encryption will increase security, some information should not be stored in IT systems at all – and especially not if they are provided by a third party.

However this is no argument against the use of the Signal messenger or protocol itself. We instead want to think about the problems created or supported by OWS' promise of security._

</comment></comment></comment><comment><USER28> Im surprised nobody has mentioned Quellen-TKÜ -- is there any evidence that governments can force handset vendors to push malware to devices?

I don't believe this, as it would make programs like QUANTUM* unneeded. Why subvert global internet infrastructure if the providers do the dirty work?

This would be explosive if true</comment>


Yammer acquired by Microsoft - $1bn+ - <AUTHOR> http://wsj.com/article/SB10001424052702303822204577467312505454118.html

<comment><USER2> Anyone got a non paywalled link?</comment>


Hack the Pentagon - <AUTHOR> http://istartup.today/2016/06/19/the-pentagon-expands-program-for-hackers-to-test-its-security/ <comment><USER2> Apparently when the hacking began it took all of 13 mins. to find the first hole. Sounds like fun actually.</comment>