techcrunch.com

Manmoth , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

Someone needs to make a browser extension that hides any article with "experts say" in the title

sit_up_straight , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@sit_up_straight@lemmy.blahaj.zone avatar

telegram isn't e2e encrypted by default?! that seems like the major concern here.

i double checked the ui and i had to create a new secret chat to see any indicator of encryption presence or absence

XioR112 ,
@XioR112@lemmy.ml avatar

Yes, e2e encryption in Telegram only works in secret chats.

corsicanguppy , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

The security software I maintained had one engineer.

Your move, sec nerds.

RagingRobot ,

That's a red flag!

rob200 , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

There was a post about this on lemmy awhile ago, I'm not sure which specific community it was i'm subscribed to a few tech related ones, but it was atleast a week or 2 or more ago about this same story.

I do agree that there should be more workers than 30 on one of the most known encrypted messaging apps.

Imgonnatrythis , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

Engineer to lawyer ratio is the best indicator of how worried to be. What's the demoninator for telegram?

dandi8 , (edited ) to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@dandi8@fedia.io avatar

There are good reasons to dislike Telegram, but having "just" 30 engineers is not one of them. Software development is not a chair factory, more people does not equal more or better quality work as much as 9 women won't give birth to a baby in a month.

Edit:

Galperin told TechCrunch. “‘Thirty engineers’ means that there is no one to fight legal requests, there is no infrastructure for dealing with abuse and content moderation issues.”

I don't think fighting legal requests and content moderation is an engineer's job. However, the article can't seem to get it straight whether it's 30 engineers, or 30 staff overall. In the latter case, the context changes dramatically and I don't have the knowledge to tell if 30 staff is enough to deal with legal issues. I would imagine that Telegram would need a small army of lawyers and content moderators for that. Again, not engineers, though.

pooberbee ,

And lawyers are pretty likely not staff at all.

nao , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

talking to carlson is a red flag

knightly , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@knightly@pawb.social avatar

I'm still waiting for the furries to switch to Matrix.

romp_2_door ,

that wasn't a very good movie, specially matrix 5

helenslunch , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@helenslunch@feddit.nl avatar

Add it to the pile of reasons not to use Telegram.

Ghostalmedia , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@Ghostalmedia@lemmy.world avatar

To be fair, in a large company, there is usually only about 30 people who are actually good and know what is going on, and hundred of others who are checking in trash.

flamingo_pinyata ,

It's not even about the quality of individual people. The organizational structure of large companies encourages pointless work.

Internal mobility and cross department collaboration are frowned upon. So you get many people doing duplicate work, new ideas don't propagate, and even if someone has an idea it's quickly shut down.

The only way to achieve anything substantial is to be both: 1. assertive and energetic, and 2. at the correct level of hierarchy. And make no mistake even if you pull a miracle there will be no reward. Maybe a 3% raise at the yearly review.

Sorry for the rant, I currently work in a company like this.

Ghostalmedia , (edited )
@Ghostalmedia@lemmy.world avatar

Yeah. The most secure companies I’ve worked at actually only had a small group, of very competent people, who were paid well, treated with respect, and not presented with a lot of organizational or infrastructural red tape.

I’ve worked with teams of 10 that had shit locked down tight, and teams of hundreds who had software that was exploding and getting exploited left and right.

If someone tells you more head count = security, I would not consider them an expert.

snooggums ,
@snooggums@midwest.social avatar

Even if every employee was equally competent, decision making needs to be consolidated enough that it can be decisive and shared throughout large companies. Complex systems that need to change rapidly gain no benefit from having too many people wanting to make decisions, you only need most of them to be competent enough to complete the work based on the decisions of a small group or the work will end up getting too convoluted and unmaintainable.

There really isn't a benefit to have everyone understand all of the parts of a large and complex system, if they only have time to work on a portion or to facilitate decisions that take into account the knowledge of the people in the different parts.

Magister ,
@Magister@lemmy.world avatar

30? Sometimes very less, 2 or 3. It's incredible that some piece of software used by milions/billions of people, have been written and sometimes maintained by 2 or 3 guys.

prex ,
avidamoeba ,
@avidamoeba@lemmy.ca avatar

I see this parroted now and then. Often the people I've heard it from are the type of folks who would drastically underestimate the complexity and effort needed to make things. I've also seen and worked on codebases made by such folks and usually it ain't pretty, or maintainable, or extensible, or secure, or [insert fav cut corners here].

eager_eagle , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag
@eager_eagle@lemmy.world avatar

“Without end-to-end encryption, huge numbers of vulnerable targets, and servers located in the UAE? Seems like that would be a security nightmare,” Matthew Green, a cryptography expert at Johns Hopkins University, told TechCrunch. (Telegram spokesperson Remi Vaughn disputed this, saying it has no data centers in the UAE.)

good job Remi, that was the main concern lmao

MMNT ,

Just use signal ffs.

eager_eagle ,
@eager_eagle@lemmy.world avatar

don't have to tell me that, I even donate to signal

BearOfaTime ,

Signal sucks from a UI/UX standpoint, when they dropped SMS support I lost any ability to convince people to switch, and everyone who had already switched left.

Then there's the seamless switching between devices...which it doesn't do.

TheGrandNagus , (edited )

I'm a signal donor and while I disagree with your point regarding UI (have you used in the past couple of years? It's went from feeling dated to feeling pretty modern), I agree with the rest.

Even worse, though, is that the EU offered them the opportunity to become relevant on a silver platter, by forcing WhatsApp to open up their app and be cross-platform with others who want to. Signal said no thanks.

I get it, WhatsApp stores metadata, and Signal doesn't like that. But they were fine with (way way worse) SMS for a while? The day Signal chose that path was the day Signal willingly chose to be irrelevant for the vast vast vast majority of people.

I love this app but the way the project is managed baffles me sometimes.

pandapoo ,

.... agreeing to be directly compatible with Whatsapp would mean they agree to surrender the privacy for every single instance of Signal-WhatsApp communication.

If the whole reason for your foundations existence is privacy, it seems that it would be an existential danger to create a partnership with the implicit understanding that it will destroy privacy.

TheGrandNagus ,

Some level of privacy, yes. Solely in WhatsApp-signal chats. And users can be notified of that, like they were with SMS.

But you know what the alternative is? Nobody using signal. And that's objectively worse.

Cross-compatibility with WhatsApp would mean way more people on signal, and way more people willing to try, meaning more signal-signal chats.

Signal-SMS is FAR less private, but they were fine with that for years.

pandapoo ,

Those choices don't occur in a vacuum.

What do you think happens to the nonprofit foundation built entirely around a fanatical devotion to privacy, if they partnered with Facebook. Not just partnered with, but in doing so, weakened the overall privacy of their platform.

Putting aside adoption rates, how does that impact their organizational sustainment and viability e.g. their ability to draw in donations, retain talent, or stay independent?

Hellmo_Luciferrari ,

Using SMS through signal defeats the purpose of signal...

The UI is fine, what more do you expect out of it? It has a list of chats, a menu button with menu options, like it's a messaging app not a social media platform akin to discord or telegram.

corsicanguppy ,

The uae is a huge concern. Their terms demand they get to see your code. When the vPBX company I worked for tried to get into the uae, it was a 10mil boondoggle that ended up ruining them.

eager_eagle ,
@eager_eagle@lemmy.world avatar

so it's a concern for the company, not the users, you're saying?

ForgottenFlux OP , to Technology in Telegram says it has 'about 30 engineers'; security experts say that's a red flag

Summary:

  • Telegram founder Pavel Durov claimed in an interview that the company only employs "about 30 engineers."
  • Security experts say this is a major red flag for Telegram's cybersecurity, as it suggests the company lacks the resources to effectively secure its platform and fight off hackers.
  • Telegram's chats are not end-to-end encrypted by default, unlike more secure messaging apps like Signal or WhatsApp. Users have to manually enable the "Secret Chat" feature to get end-to-end encryption.
  • Telegram also uses its own proprietary encryption algorithm, which has raised concerns about its security.
  • As a social media platform with nearly 1 billion users, Telegram is an attractive target for both criminal and government hackers, but it seems to have very limited staff dedicated to cybersecurity.
  • Security experts have long warned that Telegram should not be considered a truly secure messaging app, and Durov's recent statement may indicate that the situation is worse than previously thought.
henfredemars ,

proprietary encryption algorithm

Oh God why would you do this.

mozz ,
@mozz@mbin.grits.dev avatar

The quote leaves out the best part.

people have cast doubt over the quality of Telegram’s encryption, given that the company uses its own proprietary encryption algorithm, created by Durov’s brother

sunzu ,

Durov’s brother = FSB?

knightly ,
@knightly@pawb.social avatar

So they can implement their own backdoor

catastrophicblues ,

To be fair: someone somewhere has to make algorithms that we use. I honestly don’t know if Telegram’s encryption is strong or how strong based on their white paper, but I’m interested in an unbiased evaluation.

henfredemars ,

Developers should not design encryption algorithms. They should instead implement algorithms that were designed by a mathematician.

technocrit , to Technology in Zuckerberg disses closed-source AI competitors as trying to 'create God'

This is worse than it sounds since Zuck worships a genocidal god.

maxinstuff , to Technology in Zuckerberg disses closed-source AI competitors as trying to 'create God'
@maxinstuff@lemmy.world avatar

I think Zuck is right about this, insofar as the comments in the article are concerned.

OpenAI have done a brilliant job of selling the dream - but there will not be one "god model," - there will be many specialised, smaller models.

You can already see it going that way with new hardware shipping with NPU's. These workloads are expensive to run and shipping them to your device is a top priority.

WalnutLum ,

ChatGpt already is multiple smaller models. Most guesses peg chatgpt4 as a 8x220 Billion parameter mixture of experts, or 8 220 billion parameter models squished together

floridaman , to Technology in Zuckerberg disses closed-source AI competitors as trying to 'create God'

The same Zuck that is training "AI" off their platform's user data?

  • All
  • Subscribed
  • Moderated
  • Favorites
  • kbinchat
  • All magazines