Folks have taken exception in the past with my claim that SimpleX is "run by nazis".
I base that on the fact that it presents popular/recommended "rooms" as part of the UX, and a bunch of those are nazi shit.
No, "that's just algorithmic outside their control" is not an excuse. If you're publishing an app and find it in any way promoting nazi shit, especially to someone who didn't actually seek that out, and you're not a nazi, that's a maximum-priority bug to be fixed. By removing the recommendations entirely if nothing else.
If you're ok with it being there, you're fucking nazis.
SimpleX is fucking nazis.
Haelwenn /элвэн/ likes this.
reshared this
Cassandrich
in reply to Cassandrich • • •Hot take: A privacy-conscious messenger does not try to onboard users into "popular rooms". That's how you get popped by state authorities. By getting introduced to people who supposedly share your values, but with no one you know having vetted them and no actual basis for trusting them.
At best it's engagement farming shit from a wannabe Telegram.
More likely it's an op by feds.
Richard Stephens
in reply to Cassandrich • • •Cassandrich
in reply to Richard Stephens • • •@richardstephens I would assume it's something like just popularity among userbase.
That tells me all I need to know about who the developers' communities they got their seed users from were.
Tris
in reply to Cassandrich • • •Cassandrich
in reply to Tris • • •@triskelion LOL not surprising.
I just bring this up again and again because I see it (SimpleX) and other similar shit promoted way too often on fedi. Contrarian edgelord brainworms kinda thrive here and we need to be calling that shit out before it takes hold. Nazi bar theory.
Tris
in reply to Cassandrich • • •And I just saw this post: mstdn.social/@rysiek/114630877… xD
Michał "rysiek" Woźniak · 🇺🇦
2025-06-05 12:59:43
Ember
in reply to Cassandrich • • •it's definitely no coincidence social.coop/@ambiguous_yelp/11…
🌱@ambiguous_yelp:ahimsa.chat
2025-05-23 23:26:54
Cassandrich
in reply to Ember • • •@Ember Thanks for the citation.
For those who don't need to actually see the vile receipts (don't click thru unless you really do), the lead dev of SimpleX posts vile shit on birdchan (of course) in favor of abuse of trans children.
DO NOT USE SIMPLEX. DO NOT PROMOTE SIMPLEX. CALL FOLKS OUT WHEN THEY DO.
Cassandrich reshared this.
FoolishOwl
in reply to Cassandrich • • •Cassandrich
in reply to FoolishOwl • • •@foolishowl @Ember QC attacks on classical encryption have a theoretical basis but the engineering obstacles to actually making a physical machine that could do the things are astronomical.
"Postquantum encryption" is a domain with a lot of bad state-sponsored actors pushing new algorithms that aren't known to be subject to the quantum attacks, but that might just be fatally flawed in other ways that aren't known due to the low level of scrutiny they've been subjected to (since they're new and not yet protecting anything important enough to motivate attack budget), as *replacements for* classical encryption.
Any legitimate system using PQ is doing hybrid with proven classical so that it can't be compromised without compromising both. But PQ is still unnecessary for the forseeable future, IMO.
d@nny disc@ mc²
in reply to FoolishOwl • • •d@nny disc@ mc²
in reply to d@nny disc@ mc² • • •draeath
in reply to d@nny disc@ mc² • • •@hipsterelectron @foolishowl @Ember I'll caution that it does seem to exist and it is apparently already proven to break things, but the key sizes it can work with are as-yet tiny (the example in thinking of was only a 50-bit key RSA)
The barrier is scale-up, and I think assuming that can't ever happen is dangerous.
Here's the report I'm thinking of. I don't speak or read Chinese so I can't read the paper for myself: livescience.com/technology/com…
Here's the paper though, to save a click if someone wants to try to read it: cjc.ict.ac.cn/online/onlinepap…
Chinese scientists claim they broke RSA encryption with a quantum computer — but there's a catch
Peter Ray Allison (Live Science)Cassandrich
in reply to draeath • • •@draeath @hipsterelectron @foolishowl @Ember The line of reasoning you're going by doesn't take scaling into effect. It's like saying "because we can make solar panels, we can make a dyson sphere".
Also, every claim to have "broken N-bit factoring" so far has been basically on the level of saying "printf("3 times 7"); factored 21!" - the machine is not doing arbitrary calculations but setup for a specific problem with a known solution.
Ember
in reply to d@nny disc@ mc² • • •d@nny disc@ mc²
in reply to Ember • • •d@nny disc@ mc²
in reply to d@nny disc@ mc² • • •d@nny disc@ mc²
in reply to d@nny disc@ mc² • • •Cassandrich
in reply to d@nny disc@ mc² • • •ity [unit X-69]
in reply to Cassandrich • • •@Ember I fucking called it when evgeny went on a rant about adding an IP logging backdoor for the sake of complying with possible future law enforcement requests
Or how he refused to fix a critical vulnerability in their proxy implementation
Or a myriad of the other things, lmao.
Cassandrich reshared this.
ity [unit X-69]
in reply to ity [unit X-69] • • •@Ember he also annoyed me enough with the stupid disappearing messages impl so now I have a patch sitting around for removing that.
Codebase is in Haskell, so yea.
I decided that I will write a replacement for SimpleX. Idk if anyone is interested, but yea.
ity [unit X-69]
in reply to ity [unit X-69] • • •@Ember I also briefly thought about working on a fork, but decided that it is not worth it.
Making a gay fork of Nazi software, yk.
Cassandrich
in reply to ity [unit X-69] • • •ity [unit X-69]
in reply to Cassandrich • • •Cassandrich
Unknown parent • • •@tanith They may have since taken out the promotion, I dunno. I don't use it to test. My information was from SimpleX apologists, who specifically said those rooms were promoted and that it was nbd.
Elsewhere in this thread you can find receipts for the lead dev saying explicitly nazi things on birdchan.
It's a project run by nazis.
Cassandrich
Unknown parent • • •@tanith Direct link: blobfox.coffee/@Ember/11463098…
Ember
2025-06-05 13:26:44
Cassandrich
Unknown parent • • •Audrey Winter
in reply to Cassandrich • • •Altair
in reply to Cassandrich • • •This discussion is taking the focus off of where it belongs: keeping our own safe. 🏳️🌈 🏳️⚧️ 🏴 ☂️ At the end of the day, what matters is queer survival, and at this stage we essentially have a cold war declared on us. We can't afford to be getting distracted with trivialities like the politics of the being who created what we use to protect ourselves; yes, Evgeny is clearly against us, but the security of our communications is just as important to us as it is to them. SimpleX is a free app, using it for free doesn't support bigots or bigotry to any degree more than increasing its popularity — as long as that minuscule boost is outweighed by queer lives protected, that seems like winning to me.
And as for the argument that we should use something else instead… the E2EE messenger space has precious few viable options. 🗣️ Matrix leaks metadata of exactly the kind governments are using to identify and track queer beings, 💧🪣 Session is essentially just SimpleX with weaker encryption and less reliable message delivery, and except for Signal, others are effectively non-viable for various reasons (though the most egregious in my opinion is that some are _proprietary software_, which I would have _hoped_ that everyone would understand is inherently untrustworthy).
Signal is possibly the only real solid alternative, but Signal is still not viable for everyone, the worst issue being its dependency on phone numbers and phones. Some users' phones or phone number usage are too closely monitored, some can't afford them, some (quite reasonably) don't trust them, and there are probably other valid reasons too. Regardless, Signal's obstinacy on the phone requirement issue seems unshaken, which means that a decent number of users who need protection of the kind it offers **simply can't use it**.
If you have a problem with Evgeny's politics or what SimpleX's algorithms are promoting, by all means, address that issue in its appropriate context — call them out, aim to prevent his company from actually making money, etc. 💸 If you're aware of a _concrete_ vulnerability in SimpleX that puts its users in danger, by all means, raise the alarm. 🚨 📣 But if a tool can be used to further our survival and eventual liberation, better than other available tools in our own situations, then it should be used. 🔧 Icky feelings about it are a luxury we can't afford when the global right is ramping up towards genocide. ⚠️ Simple as.
English isn't my first language, but I hope what I wrote sound firm but respectful.
Cassandrich
in reply to Altair • • •@Altair You have multiple other legitimate cryptographic marvels you could be using to protect yourselves. VeilidChat and Cwtch are the two strongest. Signal is still far better than SimpleX in all ways that actually matter, but if you're opposed to it, use one of the two that's actually legit.
SimpleX is a fucking honeypot run by nazis. Eventually the client is going to ship malware. If it isn't already. It's going to have intentional "bugs" that compromise your privacy.
There is utterly no reason to defend using it as self-preservation.
Altair
in reply to Cassandrich • • •VeilidChat is a _proof of concept_, categorically _not_ real competition at this point.
Cwtch is good to a degree, and probably the best option for highly specific use cases, but in addition to the fact that it isn't available for iOS users (and while you can say users who care about privacy shouldn't be using iOS and be correct, we're talking about actually protecting beings as they exist here, not what they _should_ be doing — especially if that then leads to "well, buy a new phone then", which would be an incredibly privileged take), the Android version is buggy to the point of unusability, and it always has the pure P2P messenger issue of requiring both contacts to be online simultaneously to function.
Add that all up, and you get something that is _not_ going to attain wider adoption, nor be practically usable for a majority of possible users. If you argue that VeilidChat, Cwtch, and Signal are the options, well, that's down to just Signal now, and I already explained why that isn't always usable at all.
The concern about the trustworthiness of SimpleX's codebase is valid, and their code releases should be watched very closely for compromising updates, but saying that an open-source program _is_ unsafe without citation of any specific issues comes across as scaremongering. In particular, I note that throughout the history of the internet, wholly unsubstantiated accusations that such-and-such is a "honeypot" have been _widely_ used to scare users away from secure software so the government can continue monitoring them without issue. I'm not saying that you, in particular, are a fed, but what I am saying is that _that kind of thinking_ is exactly what they promoted and what they want.
Cassandrich
in reply to Altair • • •zeh
in reply to Cassandrich • • •@Altair
No it's not. Decentralized, foss, security model includes metadata by avoiding getting it and protecting it. It was audited by trail of bits, well respected. That is just not true.
And I'm very worried about the Nazis around it. We should be ready to fork it.
Cassandrich
in reply to zeh • • •zeh
in reply to Cassandrich • • •What face value? The code is there, you can and people did verify.
You're doing hypothetical arguing now.
Cassandrich
in reply to zeh • • •Altair
in reply to Cassandrich • • •@zeh "Experts who've looked seem to say it doesn't."
You're going to have to be more specific. While I acknowledge that the Trail of Bits audit isn't terribly relevant at this point since it was so long ago, and I am aware of some well-founded criticisms of SimpleX as a technology, such as their use of client-side moderation (is this really worse than the server-side moderation most services use?), or the protection provided by their IP-hiding system being overstated (so use a VPN or Tor like with everything else),
I have yet to be aware of any serious issues that aren't trivially mitigated or present in competitors also. Frankly, if you're aware of serious and relevant issues, you should have _led_ with citing them, as it would have made your message much more effective — which makes the fact that you _aren't_ being specific indicative that you don't actually have any specifics to give.
Cassandrich
in reply to Altair • • •I am not here to do technical research for a nazi team to convince people who demand technical arguments to dismiss the idea of trusting nazis not to have fucked up (intentionally or by incompetence that comes with being nazis) making a high stakes cryptographic product that will put in danger people targeted by nazis if anything is wrong with it.
If you are demanding technical teardown when there are already abundant human reasons not to step anywhere near SimpleX, that's a you problem I can't fix. And it makes me seriously distrust you as someone I'd want to interact with.
Cassandrich
in reply to Cassandrich • • •@Altair @zeh If I'm not mistaken, folks more familiar with the technical details have written about some of that and linked it from various crossed threads (either mine or one of the others I replied into or boosted) over the past few days.
I'm not going to go trying to dig up and evaluate all of those, because I have something of a person rule not to spend my efforts reviewing what's wrong with tech products by bad people in ways that could lead to improving them.
Altair
in reply to Cassandrich • • •Cassandrich
in reply to Altair • • •Cassandrich
in reply to Cassandrich • • •@Altair Sorry for being terse, but I don't really have any other response than that to the premise that the nazi darknet bros have some amazing new technology you're going to be missing out on if you don't use SimpleX.
That's just not remotely founded in reality.
Fake secure private messengers from sketchy people are dime-a-dozen.
I'm sorry you've been bedazzled by their marketing.
zeh
in reply to Cassandrich • • •that wasn't terse, it was disrespectful.
you made claims about a piece of tech that you didn't back up and you were challenged on it. you repeatedly tried to derail. you claim it's fake, tell us why. that's not demanding research of you, it's basic social interacting.
if you leave every place that has nazis, why are you here, or on the internet? or the streets?
we make choices and we fight when we can and when it's worth it.
@Altair
jamesfreeborn
in reply to Cassandrich • • •khm
in reply to jamesfreeborn • • •lol this motherfucker really just made an account to stan the fash
CC: @dalias@hachyderm.io
Cassandrich
in reply to khm • • •Pirate Praveen
in reply to Cassandrich • • •Cassandrich
in reply to Pirate Praveen • • •@praveen Why would you want to?
You use and potentially fork Firefox because it's currently the only non-Chrome option in its domain, and because it's going to take very large amounts of time, money, and effort to build a complete replacement.
None of this applies to SimpleX. There's no big asset there. It was not some astronomical effort to build. You don't need it for interoperability with the existing web. It's an over-hyped piece of garbage designed to make money and influence for nazis who built it. It does not solve any problem anyone has.
Pirate Praveen
in reply to Cassandrich • • •Pirate Praveen
in reply to Pirate Praveen • • •for example see this answer fosstodon.org/@cwtch/114660341…
No other app correctly balances server and peer to peer (no metadata on server) yet. More clients could do that in future for sure, but right now Simplex Chat has a unique proposition and I don't want to give up on that value because I disagree with its founder. Being Free Software means we have more options than a simple boycott when a project we care about does things we don't agree with.
Cwtch (@cwtch@fosstodon.org)
FosstodonCassandrich
in reply to Pirate Praveen • • •@praveen Even if SimpleX had useful privacy characteristics, folks need to realize that getting people onto the platform is immensely harmful to their safety.
You're getting them to install a mobile app that a known-bad-actor can publish updates for at any time. Updates that may compromise the privacy of their past or future conversations, add trackers that compromise their identity and location, or try to dupe them into doing things against their interests.
I don't buy the technical claims to begin with, but if you do, get them verified by someone willing to do that (who's not paid by SimpleX) and fork *now* not later. Or better yet, don't fork but use whatever concepts make sense (I suspect it will turn out to be very few) in a completely new implementation. It's not like they've built something giant and elaborate that's hard to replicate.
Pirate Praveen
in reply to Cassandrich • • •there are general defences against such moves like using fdroid which builds from source independently. I don't think they can hide such moves easily and that is a big deterrant in itself for trying something like you suggest. This is part of the advantages Free Software provides - we don't have to blindly trust anyone.
I hope to take those ideas to @prav so we can avoid collecting metadata. But this will take time. A fork or other implementations will also take time.
Cassandrich
in reply to Pirate Praveen • • •@praveen @prav Uhg this is so frustrating.
YOU might choose to get SimpleX from fdroid, but if you're promoting it, 99.999% of Android users you convince to use it are going to get it from Play store.
Even on fdroid tho, Android data permission model is tied to signing key that ships the app.
Without extreme expertise, you can't get your data out of the app and switch to a fork later.
aspiring retiree
in reply to Pirate Praveen • • •I just found out about this #Simplex situation
do you by chance know who else is involved in the project an how they position themselves in regards to the views of the founder?
because I think the tech is sound and a fork may be in order
to this end poaching the team for the good people among them could be necessary
Cassandrich
in reply to aspiring retiree • • •@roy_calum @praveen All I know is they're all people who are ok with working with a nazi, afaik not even getting paid for it. We have a word for such ppl.
Folks are waaaay in too deep already thinking there is some revolutionary tech in SimpleX worth forking though. "Secure messenger" products with flashy sounding cryptographic algorithms are dime-a-dozen.
Haelwenn /элвэн/ likes this.
LisPi
in reply to Cassandrich • • •> We have a word for such ppl.
Collaborateurs?
Cassandrich
in reply to LisPi • • •aspiring retiree
in reply to Cassandrich • • •@praveen
Well so far I haven't seen a better solution for some of my use cases.
You seem to know many solutions to possibly similar situations.
Could you recommend a messenger that has the following properties:
- accessible to lay people on all major mobile platforms and linux
- intuitive UX and rich text
- on-device password protection
- easy export/backup of data
- anonymous connections and group chats
- (video) calls
- ability to self-host relays
- tor routing
- resistance to spam/scams
- strong chat permission management
- message timers etc.
data0
in reply to aspiring retiree • • •@roy_calum @praveen only tangentially related, but look at their job postings and tell me it's not a forest of red flags. That alone tells me it's not a project I want to rely on.
simplex.chat/jobs/
Join SimpleX Chat team
simplex.chatLaurent Bercot
in reply to data0 • • •Cassandrich
in reply to Laurent Bercot • • •Pirate Praveen
in reply to Laurent Bercot • • •Cassandrich
in reply to Pirate Praveen • • •Pirate Praveen
in reply to Cassandrich • • •Pirate Praveen
in reply to Cassandrich • • •the technical claims can be verified independently. Many of those are built on other commonly understood building blocks - not totally out of the blue. The brilliance is the exact combination they chose.
simplex.chat/blog/20241014-sim…
The people who does auditing has to maintain their reputation. Are you saying this specific company who audited Simplex Chat is unreliable? Now you are going too far, if we can't even trust independent audits.
SimpleX network: cryptographic design review by Trail of Bits, v6.1 released with better calls and user experience.
simplex.chatCassandrich
in reply to Pirate Praveen • • •Pirate Praveen
in reply to Cassandrich • • •I don't see any recommended groups in Simplex Chat. Is it only shown when you join Simplex Chat? Can you share how to reproduce it or even better open an issue in simplex chat repository at github.com/simplex-chat/simple… ?
If they don't fix it, there is always the possibility of forking.
Issues · simplex-chat/simplex-chat
GitHubDivya Ranjan
in reply to Cassandrich • • •Cassandrich
in reply to Divya Ranjan • • •@divyaranjan Um, the evidence has piled up extensively since then. If you haven't seen it you're either oblivious, purposefully not paying attention, or just lying to simp for SimpleX.
The lead dev is on the record spewing vile transphobia (yes this is fundamentally nazi) on birdchan. I'm not going to do your homework for you. Go look.