[corty]

Signal claims to specially protect some of that data, such claims need verification. Storing or not storing that data needs verification, without the trust that they do what they say they are no better than their competition. Trust is earned e.g. by openness about the source code. And that a server backdoor isn't strictly necessary is also beside the point because the server is the easiest and most obvious way to get at all that data.

Also, there is competition like Briar which has less of those pesky metadata problems (but some other problems instead)

[tptacek]

I don't recall Signal ever having made implausible claims about traffic analytic attacks. I also don't buy into the idea that platforms are as trustworthy as their source release policies are orthodox.

[corty]

It isn't advanced difficult traffic analysis if it is all your servers. Or all your logs landing in one logstash.

[morelisp]

The goalposts now seem to be at "someone might subpoena Signal's logs for some metadata", having moved pretty far from the original claim of "Signal's server code hasn't been updated because it has been secretly backdoored or intentionally weakened." It's difficult to see this as good faith security analysis rather than fearmongering.

[tptacek]

What difference does this make? In your threat model the only serious countermeasure between you and state-level adversaries is a Logstash implementation?