feat: the Nextcloud stack on the board, above everything else
Christian: 'Let's have every NextCloud thing come back as well-rated as it should be. It's deserving of the same level of scrutiny everybody else is.' Priority 20, above Slack and Kino, because this is the replacement we recommend to clients. If we will not grade our own recommendation, nothing else we publish is worth reading. 14 products: Server, Files, Talk, Mail, Calendar, Contacts, Photos, Notes, Deck, Office, Passwords, the spreed signaling stack, and both migration bridges (Dropbox, Google Drive). The migration apps matter most, because a migration tool that does not work makes the off-ramp a slogan. Nextcloud Server is the one to grade first. Every app score is conditioned on the platform underneath it, so grading the apps before the server would be measuring the second thing. None of these has a score yet, and none will get one until it has evidence. The recently-added attestation ladder and the reproducible-build cap both apply: Nextcloud is open source but has no reproducible build practice yet, so verifiability cannot exceed 3 on any of these today no matter how good the code is.
This commit is contained in:
CLU
parent
c994a785a4
commit
f8f9756687
6 changed files with 1054 additions and 52 deletions
BIN
deploy/bigtech-sucks-site-2026-10-29.tar.gz
Normal file
BIN
deploy/bigtech-sucks-site-2026-10-29.tar.gz
Normal file
Binary file not shown.
78
packages/core/db/seed/0004-nextcloud-stack.sql
Normal file
78
packages/core/db/seed/0004-nextcloud-stack.sql
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
-- =====================================================================
|
||||
-- 0004 — the Nextcloud stack, 2026-10-29
|
||||
--
|
||||
-- Christian: "We should prioritize running all those NextCloud applications
|
||||
-- through the processor. Let's have every NextCloud thing come back as
|
||||
-- well-rated as it should be. It's deserving of the same level of scrutiny
|
||||
-- everybody else is."
|
||||
--
|
||||
-- Priority 20: above Slack and Kino, because this is the replacement we
|
||||
-- recommend to clients. If we will not grade our own recommendation, nothing
|
||||
-- else we publish is worth reading.
|
||||
--
|
||||
-- NOTE THE ASYMMETRY WE EXPECT AND MUST NOT DESIGN AROUND:
|
||||
-- Nextcloud scores on a dimension Signal can never win, because there is no
|
||||
-- third-party server to subpoena. It will also likely score worse than Signal
|
||||
-- on verifiability and incident surface. "As well-rated as it should be" is the
|
||||
-- instruction. Not "as well-rated as we hope."
|
||||
-- =====================================================================
|
||||
|
||||
INSERT OR IGNORE INTO product
|
||||
(id, vendor_id, name, category_id, platform, source_url, license,
|
||||
sovereign, boss, art_slot, monthly_cost, priority, notes)
|
||||
VALUES
|
||||
('nextcloud-server', 'nextcloud-gmbh', 'Nextcloud Server', 'files', 'server',
|
||||
'https://github.com/nextcloud/server', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'The platform every other Nextcloud app sits on. Grade this first, because every app score is conditioned on it.'),
|
||||
|
||||
('nextcloud-files', 'nextcloud-gmbh', 'Nextcloud Files', 'files', 'web',
|
||||
'https://github.com/nextcloud/server', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Google Drive and Dropbox.'),
|
||||
|
||||
('nextcloud-talk', 'nextcloud-gmbh', 'Nextcloud Talk', 'messaging', 'web',
|
||||
'https://github.com/nextcloud/spreed', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Slack and Teams. Backed by the spreed signaling stack.'),
|
||||
|
||||
('nextcloud-mail', 'nextcloud-gmbh', 'Nextcloud Mail', 'email', 'web',
|
||||
'https://github.com/nextcloud/mail', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Gmail and Outlook.'),
|
||||
|
||||
('nextcloud-calendar', 'nextcloud-gmbh', 'Nextcloud Calendar', 'calendar', 'web',
|
||||
'https://github.com/nextcloud/calendar', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Google Calendar.'),
|
||||
|
||||
('nextcloud-contacts', 'nextcloud-gmbh', 'Nextcloud Contacts', 'calendar', 'web',
|
||||
'https://github.com/nextcloud/contacts', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Google Contacts and iCloud Contacts.'),
|
||||
|
||||
('nextcloud-photos', 'nextcloud-gmbh', 'Nextcloud Photos', 'photos', 'web',
|
||||
'https://github.com/nextcloud/photos', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Google Photos and iCloud Photos.'),
|
||||
|
||||
('nextcloud-notes', 'nextcloud-gmbh', 'Nextcloud Notes', 'notes', 'web',
|
||||
'https://github.com/nextcloud/notes', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Notion and Evernote for plain note capture.'),
|
||||
|
||||
('nextcloud-deck', 'nextcloud-gmbh', 'Nextcloud Deck', 'project', 'web',
|
||||
'https://github.com/nextcloud/deck', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for Trello and Asana boards.'),
|
||||
|
||||
('nextcloud-office', 'nextcloud-gmbh', 'Nextcloud Office', 'productivity', 'web',
|
||||
'https://github.com/nextcloud/richdocuments', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Collabora-backed document editing. Replacement for Google Workspace and Microsoft 365.'),
|
||||
|
||||
('nextcloud-passwords', 'nextcloud-gmbh', 'Nextcloud Passwords', 'passwords', 'web',
|
||||
'https://github.com/nextcloud/passwords', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'Replacement for LastPass and 1Password. Community app, not a core Nextcloud GmbH product.'),
|
||||
|
||||
('nextcloud-spreed-signaling', 'nextcloud-gmbh', 'Nextcloud Spreed Signaling (HPB)', 'messaging', 'server',
|
||||
'https://github.com/strukturag/nextcloud-spreed-signaling', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'The standalone high-performance backend for Talk. Appears in Mint Software Manager as nextcloud-speed-signaling, client and proxy. Written by Struktur AG.'),
|
||||
|
||||
('nextcloud-migrate-dropbox', 'nextcloud-gmbh', 'Nextcloud Dropbox Migration', 'files', 'web',
|
||||
'https://github.com/nextcloud/migration', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'The off-ramp bridge. Christian: "Then we can do the Dropbox app."'),
|
||||
|
||||
('nextcloud-migrate-gdrive', 'nextcloud-gmbh', 'Nextcloud Google Drive Migration', 'files', 'web',
|
||||
'https://github.com/nextcloud/migration', 'AGPL-3.0', 1, 0, NULL, 0, 20,
|
||||
'The off-ramp bridge. Christian: "and we can do the Google Drive app."');
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"generated_at": "2026-10-29T21:22:40.574Z",
|
||||
"generated_at": "2026-10-29T22:18:53.099Z",
|
||||
"method_version": "btr-0.1",
|
||||
"dimensions": [
|
||||
{
|
||||
|
|
@ -588,6 +588,50 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-calendar",
|
||||
"name": "Nextcloud Calendar",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-contacts",
|
||||
"name": "Nextcloud Contacts",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "salesforce",
|
||||
"name": "Salesforce",
|
||||
|
|
@ -874,6 +918,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-mail",
|
||||
"name": "Nextcloud Mail",
|
||||
"platform": "web",
|
||||
"category_id": "email",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "outlook",
|
||||
"name": "Outlook",
|
||||
|
|
@ -1072,6 +1138,94 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-dropbox",
|
||||
"name": "Nextcloud Dropbox Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-files",
|
||||
"name": "Nextcloud Files",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-gdrive",
|
||||
"name": "Nextcloud Google Drive Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-server",
|
||||
"name": "Nextcloud Server",
|
||||
"platform": "server",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "ocis",
|
||||
"name": "Ocis",
|
||||
|
|
@ -1468,6 +1622,50 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-spreed-signaling",
|
||||
"name": "Nextcloud Spreed Signaling (HPB)",
|
||||
"platform": "server",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-talk",
|
||||
"name": "Nextcloud Talk",
|
||||
"platform": "web",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "parla",
|
||||
"name": "Parla",
|
||||
|
|
@ -1666,6 +1864,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-notes",
|
||||
"name": "Nextcloud Notes",
|
||||
"platform": "web",
|
||||
"category_id": "notes",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "notes",
|
||||
"name": "Notes",
|
||||
|
|
@ -1996,6 +2216,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-passwords",
|
||||
"name": "Nextcloud Passwords",
|
||||
"platform": "web",
|
||||
"category_id": "passwords",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nitrokey-app2",
|
||||
"name": "Nitrokey App2",
|
||||
|
|
@ -2282,6 +2524,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-photos",
|
||||
"name": "Nextcloud Photos",
|
||||
"platform": "web",
|
||||
"category_id": "photos",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "photocollage",
|
||||
"name": "PhotoCollage",
|
||||
|
|
@ -2480,6 +2744,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-office",
|
||||
"name": "Nextcloud Office",
|
||||
"platform": "web",
|
||||
"category_id": "productivity",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "asana",
|
||||
"name": "Asana",
|
||||
|
|
@ -2502,6 +2788,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-deck",
|
||||
"name": "Nextcloud Deck",
|
||||
"platform": "web",
|
||||
"category_id": "project",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "trello",
|
||||
"name": "Trello",
|
||||
|
|
@ -2851,7 +3159,7 @@
|
|||
],
|
||||
"evidence": [
|
||||
{
|
||||
"id": 44,
|
||||
"id": 55,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "local_data_exposure",
|
||||
"claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.",
|
||||
|
|
@ -2862,7 +3170,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 45,
|
||||
"id": 56,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.",
|
||||
|
|
@ -2873,7 +3181,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 46,
|
||||
"id": 57,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.",
|
||||
|
|
@ -2884,7 +3192,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 47,
|
||||
"id": 58,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.",
|
||||
|
|
@ -2895,7 +3203,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 48,
|
||||
"id": 59,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "verifiability",
|
||||
"claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.",
|
||||
|
|
@ -2906,7 +3214,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 49,
|
||||
"id": 60,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "server_retention",
|
||||
"claim": "Grand jury subpoena response returned two timestamps and nothing else.",
|
||||
|
|
@ -2917,7 +3225,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 50,
|
||||
"id": 61,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.",
|
||||
|
|
@ -2928,7 +3236,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 51,
|
||||
"id": 62,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.",
|
||||
|
|
@ -2939,7 +3247,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 52,
|
||||
"id": 63,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.",
|
||||
|
|
@ -2950,7 +3258,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 53,
|
||||
"id": 64,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.",
|
||||
|
|
@ -2961,7 +3269,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 54,
|
||||
"id": 65,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "user_control_exit",
|
||||
"claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.",
|
||||
|
|
@ -2974,7 +3282,7 @@
|
|||
],
|
||||
"findings": [
|
||||
{
|
||||
"id": 21,
|
||||
"id": 25,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "high",
|
||||
"title": "Received attachments are stored unencrypted on disk",
|
||||
|
|
@ -2983,7 +3291,7 @@
|
|||
"cve": "CVE-2023-24069"
|
||||
},
|
||||
{
|
||||
"id": 22,
|
||||
"id": 26,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "No verified reproducible build for the Linux package",
|
||||
|
|
@ -2992,7 +3300,7 @@
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 23,
|
||||
"id": 27,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "Local database key is held in the OS keyring",
|
||||
|
|
@ -3001,7 +3309,7 @@
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 24,
|
||||
"id": 28,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "low",
|
||||
"title": "Registration requires a phone number",
|
||||
|
|
|
|||
|
|
@ -39,7 +39,7 @@ export interface CatalogDimension {
|
|||
}
|
||||
|
||||
export const catalog = {
|
||||
"generated_at": "2026-10-29T21:22:40.574Z",
|
||||
"generated_at": "2026-10-29T22:18:53.099Z",
|
||||
"method_version": "btr-0.1",
|
||||
"dimensions": [
|
||||
{
|
||||
|
|
@ -628,6 +628,50 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-calendar",
|
||||
"name": "Nextcloud Calendar",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-contacts",
|
||||
"name": "Nextcloud Contacts",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "salesforce",
|
||||
"name": "Salesforce",
|
||||
|
|
@ -914,6 +958,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-mail",
|
||||
"name": "Nextcloud Mail",
|
||||
"platform": "web",
|
||||
"category_id": "email",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "outlook",
|
||||
"name": "Outlook",
|
||||
|
|
@ -1112,6 +1178,94 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-dropbox",
|
||||
"name": "Nextcloud Dropbox Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-files",
|
||||
"name": "Nextcloud Files",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-gdrive",
|
||||
"name": "Nextcloud Google Drive Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-server",
|
||||
"name": "Nextcloud Server",
|
||||
"platform": "server",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "ocis",
|
||||
"name": "Ocis",
|
||||
|
|
@ -1508,6 +1662,50 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-spreed-signaling",
|
||||
"name": "Nextcloud Spreed Signaling (HPB)",
|
||||
"platform": "server",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-talk",
|
||||
"name": "Nextcloud Talk",
|
||||
"platform": "web",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "parla",
|
||||
"name": "Parla",
|
||||
|
|
@ -1706,6 +1904,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-notes",
|
||||
"name": "Nextcloud Notes",
|
||||
"platform": "web",
|
||||
"category_id": "notes",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "notes",
|
||||
"name": "Notes",
|
||||
|
|
@ -2036,6 +2256,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-passwords",
|
||||
"name": "Nextcloud Passwords",
|
||||
"platform": "web",
|
||||
"category_id": "passwords",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nitrokey-app2",
|
||||
"name": "Nitrokey App2",
|
||||
|
|
@ -2322,6 +2564,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-photos",
|
||||
"name": "Nextcloud Photos",
|
||||
"platform": "web",
|
||||
"category_id": "photos",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "photocollage",
|
||||
"name": "PhotoCollage",
|
||||
|
|
@ -2520,6 +2784,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-office",
|
||||
"name": "Nextcloud Office",
|
||||
"platform": "web",
|
||||
"category_id": "productivity",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "asana",
|
||||
"name": "Asana",
|
||||
|
|
@ -2542,6 +2828,28 @@ export const catalog = {
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-deck",
|
||||
"name": "Nextcloud Deck",
|
||||
"platform": "web",
|
||||
"category_id": "project",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "trello",
|
||||
"name": "Trello",
|
||||
|
|
@ -2891,7 +3199,7 @@ export const catalog = {
|
|||
],
|
||||
"evidence": [
|
||||
{
|
||||
"id": 44,
|
||||
"id": 55,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "local_data_exposure",
|
||||
"claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.",
|
||||
|
|
@ -2902,7 +3210,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 45,
|
||||
"id": 56,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.",
|
||||
|
|
@ -2913,7 +3221,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 46,
|
||||
"id": 57,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.",
|
||||
|
|
@ -2924,7 +3232,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 47,
|
||||
"id": 58,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.",
|
||||
|
|
@ -2935,7 +3243,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 48,
|
||||
"id": 59,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "verifiability",
|
||||
"claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.",
|
||||
|
|
@ -2946,7 +3254,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 49,
|
||||
"id": 60,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "server_retention",
|
||||
"claim": "Grand jury subpoena response returned two timestamps and nothing else.",
|
||||
|
|
@ -2957,7 +3265,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 50,
|
||||
"id": 61,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.",
|
||||
|
|
@ -2968,7 +3276,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 51,
|
||||
"id": 62,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.",
|
||||
|
|
@ -2979,7 +3287,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 52,
|
||||
"id": 63,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.",
|
||||
|
|
@ -2990,7 +3298,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 53,
|
||||
"id": 64,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.",
|
||||
|
|
@ -3001,7 +3309,7 @@ export const catalog = {
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 54,
|
||||
"id": 65,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "user_control_exit",
|
||||
"claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.",
|
||||
|
|
@ -3014,7 +3322,7 @@ export const catalog = {
|
|||
],
|
||||
"findings": [
|
||||
{
|
||||
"id": 21,
|
||||
"id": 25,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "high",
|
||||
"title": "Received attachments are stored unencrypted on disk",
|
||||
|
|
@ -3023,7 +3331,7 @@ export const catalog = {
|
|||
"cve": "CVE-2023-24069"
|
||||
},
|
||||
{
|
||||
"id": 22,
|
||||
"id": 26,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "No verified reproducible build for the Linux package",
|
||||
|
|
@ -3032,7 +3340,7 @@ export const catalog = {
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 23,
|
||||
"id": 27,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "Local database key is held in the OS keyring",
|
||||
|
|
@ -3041,7 +3349,7 @@ export const catalog = {
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 24,
|
||||
"id": 28,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "low",
|
||||
"title": "Registration requires a phone number",
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"generated_at": "2026-10-29T21:22:40.574Z",
|
||||
"generated_at": "2026-10-29T22:18:53.099Z",
|
||||
"method_version": "btr-0.1",
|
||||
"dimensions": [
|
||||
{
|
||||
|
|
@ -588,6 +588,50 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-calendar",
|
||||
"name": "Nextcloud Calendar",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-contacts",
|
||||
"name": "Nextcloud Contacts",
|
||||
"platform": "web",
|
||||
"category_id": "calendar",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "salesforce",
|
||||
"name": "Salesforce",
|
||||
|
|
@ -874,6 +918,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-mail",
|
||||
"name": "Nextcloud Mail",
|
||||
"platform": "web",
|
||||
"category_id": "email",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "outlook",
|
||||
"name": "Outlook",
|
||||
|
|
@ -1072,6 +1138,94 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-dropbox",
|
||||
"name": "Nextcloud Dropbox Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-files",
|
||||
"name": "Nextcloud Files",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-migrate-gdrive",
|
||||
"name": "Nextcloud Google Drive Migration",
|
||||
"platform": "web",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-server",
|
||||
"name": "Nextcloud Server",
|
||||
"platform": "server",
|
||||
"category_id": "files",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "ocis",
|
||||
"name": "Ocis",
|
||||
|
|
@ -1468,6 +1622,50 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-spreed-signaling",
|
||||
"name": "Nextcloud Spreed Signaling (HPB)",
|
||||
"platform": "server",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-talk",
|
||||
"name": "Nextcloud Talk",
|
||||
"platform": "web",
|
||||
"category_id": "messaging",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "parla",
|
||||
"name": "Parla",
|
||||
|
|
@ -1666,6 +1864,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-notes",
|
||||
"name": "Nextcloud Notes",
|
||||
"platform": "web",
|
||||
"category_id": "notes",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "notes",
|
||||
"name": "Notes",
|
||||
|
|
@ -1996,6 +2216,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-passwords",
|
||||
"name": "Nextcloud Passwords",
|
||||
"platform": "web",
|
||||
"category_id": "passwords",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nitrokey-app2",
|
||||
"name": "Nitrokey App2",
|
||||
|
|
@ -2282,6 +2524,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-photos",
|
||||
"name": "Nextcloud Photos",
|
||||
"platform": "web",
|
||||
"category_id": "photos",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "photocollage",
|
||||
"name": "PhotoCollage",
|
||||
|
|
@ -2480,6 +2744,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-office",
|
||||
"name": "Nextcloud Office",
|
||||
"platform": "web",
|
||||
"category_id": "productivity",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "asana",
|
||||
"name": "Asana",
|
||||
|
|
@ -2502,6 +2788,28 @@
|
|||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "nextcloud-deck",
|
||||
"name": "Nextcloud Deck",
|
||||
"platform": "web",
|
||||
"category_id": "project",
|
||||
"vendor_id": "nextcloud-gmbh",
|
||||
"sovereign": 1,
|
||||
"boss": 0,
|
||||
"art_slot": null,
|
||||
"monthly_cost": 0,
|
||||
"vendor": "Nextcloud GmbH",
|
||||
"entity_type": "private",
|
||||
"jurisdiction": "DE",
|
||||
"business_model": "subscription",
|
||||
"weighted_total": null,
|
||||
"grade": null,
|
||||
"policy": null,
|
||||
"infra": null,
|
||||
"weakest_dimension": null,
|
||||
"headline": null,
|
||||
"assessed_on": null
|
||||
},
|
||||
{
|
||||
"id": "trello",
|
||||
"name": "Trello",
|
||||
|
|
@ -2851,7 +3159,7 @@
|
|||
],
|
||||
"evidence": [
|
||||
{
|
||||
"id": 44,
|
||||
"id": 55,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "local_data_exposure",
|
||||
"claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.",
|
||||
|
|
@ -2862,7 +3170,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 45,
|
||||
"id": 56,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.",
|
||||
|
|
@ -2873,7 +3181,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 46,
|
||||
"id": 57,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.",
|
||||
|
|
@ -2884,7 +3192,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 47,
|
||||
"id": 58,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "telemetry_egress",
|
||||
"claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.",
|
||||
|
|
@ -2895,7 +3203,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 48,
|
||||
"id": 59,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "verifiability",
|
||||
"claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.",
|
||||
|
|
@ -2906,7 +3214,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 49,
|
||||
"id": 60,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "server_retention",
|
||||
"claim": "Grand jury subpoena response returned two timestamps and nothing else.",
|
||||
|
|
@ -2917,7 +3225,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 50,
|
||||
"id": 61,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.",
|
||||
|
|
@ -2928,7 +3236,7 @@
|
|||
"observed_at": "2026-10-29T13:13:56-05:00"
|
||||
},
|
||||
{
|
||||
"id": 51,
|
||||
"id": 62,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.",
|
||||
|
|
@ -2939,7 +3247,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 52,
|
||||
"id": 63,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "incident_record",
|
||||
"claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.",
|
||||
|
|
@ -2950,7 +3258,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 53,
|
||||
"id": 64,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "ownership_jurisdiction",
|
||||
"claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.",
|
||||
|
|
@ -2961,7 +3269,7 @@
|
|||
"observed_at": "2026-10-29T15:26:00-05:00"
|
||||
},
|
||||
{
|
||||
"id": 54,
|
||||
"id": 65,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"dimension_id": "user_control_exit",
|
||||
"claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.",
|
||||
|
|
@ -2974,7 +3282,7 @@
|
|||
],
|
||||
"findings": [
|
||||
{
|
||||
"id": 21,
|
||||
"id": 25,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "high",
|
||||
"title": "Received attachments are stored unencrypted on disk",
|
||||
|
|
@ -2983,7 +3291,7 @@
|
|||
"cve": "CVE-2023-24069"
|
||||
},
|
||||
{
|
||||
"id": 22,
|
||||
"id": 26,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "No verified reproducible build for the Linux package",
|
||||
|
|
@ -2992,7 +3300,7 @@
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 23,
|
||||
"id": 27,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "medium",
|
||||
"title": "Local database key is held in the OS keyring",
|
||||
|
|
@ -3001,7 +3309,7 @@
|
|||
"cve": null
|
||||
},
|
||||
{
|
||||
"id": 24,
|
||||
"id": 28,
|
||||
"assessment_id": "A-2026-10-29-SIGNAL-DESKTOP",
|
||||
"severity": "low",
|
||||
"title": "Registration requires a phone number",
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
{
|
||||
"digest": "fcc6032021e38bef4c5d2122c640a82cd5d066b3a8e9b7b378b0f31f2133e51c",
|
||||
"digest": "1993b8de020ef8807e3e7499d9d45b429df9963b90182823ddc6e02b0ccd031c",
|
||||
"algorithm": "sha256",
|
||||
"file": "catalog.json",
|
||||
"byte_length": 82952,
|
||||
"rebuilt_at": "2026-10-29T21:22:40.576Z",
|
||||
"byte_length": 91034,
|
||||
"rebuilt_at": "2026-10-29T22:18:53.103Z",
|
||||
"method_version": "btr-0.1",
|
||||
"products": 123,
|
||||
"products": 137,
|
||||
"assessed": 1
|
||||
}
|
||||
Loading…
Reference in a new issue