[cs702]

> We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers.

Yes. Ultimately we have no choice but to trust trust itself.[a] That said, if the OP were a non-technical friend asking me the same question, I would respond more or less like this:

"Of all the widely used messaging services, Signal is the only one known to be designed to minimize the amount of user data needed to operate, and all indications are that they are operating as designed[b], so Signal is likely your best choice today if privacy is your main concern."

[a] http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...

[b] https://news.ycombinator.com/item?id=25764526

[nwsm]

I've seen [a] on HN three times in the last week. Don't know if it's recency bias, Baader-Meinhof, a legitimate increase in common popularity/knowledge, or a sign of the times.

edit: after a quick algolia search, it has indeed been posted much more this year than years before.

[chc4]

It's been relevant recently due to the SolarWinds supply chain hack, too, since the implant was inserted into the build process, so I've been seeing it a lot more too. It wasn't used to infect a compiler, but still makes people think of Trusting Trust.