de53ac41a5
The database is the source of truth; the site is a view over it.
- packages/core/db/schema.sql: vendors, products, categories, the 8-dimension
instrument, assessments, scores, evidence, findings, off-ramp, plus the
derived v_product_score view the game reads.
- packages/core/db/build.mjs: rebuilds bigtech.db, absorbs the legacy 43-product
roster as unassessed, applies seeds, then verifies the instrument's own rules
(weights sum to 100, totals recompute, grades match bands, every score has a
rationale, no tier-4 evidence on a scored dimension, reproducible-build caps
actually enforced).
- packages/core/db/seed/0001-signal.sql: Signal Desktop 8.36.0-alpha.1 on linux,
75.9/100 grade B, weakest dimension local_data_exposure. Evidence points at
the re-runnable audit artifacts in the Servetus vault.
- packages/core/src/data/generated/catalog.{ts,json}: generated export.
Verified: 44 products, 1 assessed, all checks pass.
135 lines
9.8 KiB
SQL
135 lines
9.8 KiB
SQL
-- =====================================================================
|
|
-- Assessment 0001 — Signal Desktop, Linux x86_64
|
|
-- Assessed 2026-10-29 by CLU. Source commit 5dad34a (v8.36.0-alpha.1).
|
|
-- Evidence artifacts: Servetus vault
|
|
-- 00-Artifacts/2026/10-Oct/29/clu-big-tech-report/
|
|
-- Narrative report: 04-Projects/big-tech-report/2026-10-29-signal-desktop-assessment.md
|
|
-- =====================================================================
|
|
|
|
INSERT OR REPLACE INTO vendor
|
|
(id, name, legal_entity, entity_type, jurisdiction, business_model, founded, notes)
|
|
VALUES
|
|
('signal-foundation', 'Signal', 'Signal Technology Foundation / Signal Messenger LLC',
|
|
'nonprofit', 'US', 'none', '2018',
|
|
'US 501(c)(3), EIN 82-4506840. Operated by Signal Messenger LLC. No ad model, no data sale. US jurisdiction means US legal process reaches it, but there is almost nothing to reach.');
|
|
|
|
-- ------------------------------------------------------------------ dimension set v0.1
|
|
INSERT OR REPLACE INTO dimension (id, label, weight, anchor_10, anchor_0) VALUES
|
|
('telemetry_egress', 'Telemetry and egress', 25,
|
|
'Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.',
|
|
'Covert collection, or egress that cannot be enumerated.'),
|
|
('verifiability', 'Verifiability', 20,
|
|
'Reproducible build verified on the scored platform.',
|
|
'Closed source, or no way to prove the binary matches the source.'),
|
|
('server_retention', 'Server-side retention', 15,
|
|
'Subpoena answer is two timestamps or an empty set.',
|
|
'Content readable by the vendor.'),
|
|
('ownership_jurisdiction', 'Ownership, jurisdiction, business model', 12,
|
|
'Nonprofit or cooperative, no ad model, strong process protections.',
|
|
'State-controlled.'),
|
|
('local_data_exposure', 'Local data exposure', 10,
|
|
'All artifacts encrypted at rest under a user-presence key.',
|
|
'Everything plaintext on disk.'),
|
|
('dependency_surface', 'Dependency surface', 8,
|
|
'Small audited dependency tree, signed and pinned update channel.',
|
|
'Huge unaudited tree, unsigned updates.'),
|
|
('user_control_exit', 'User control and exit', 5,
|
|
'Usable export, real deletion, no identity hostage-taking.',
|
|
'No export, deletion that does not delete.'),
|
|
('incident_record', 'Incident record', 5,
|
|
'Flaws found, disclosed honestly, fixed fast.',
|
|
'Unblemished only because nobody is allowed to test it.');
|
|
|
|
-- ------------------------------------------------------------------ the product
|
|
INSERT OR REPLACE INTO product
|
|
(id, vendor_id, name, category_id, platform, source_url, license, sovereign, boss, art_slot, monthly_cost, notes)
|
|
VALUES
|
|
('signal-desktop', 'signal-foundation', 'Signal Desktop', 'messaging', 'linux-x86_64',
|
|
'https://github.com/signalapp/Signal-Desktop', 'AGPL-3.0', 0, 0, 'outlaw_signal', 0,
|
|
'Linked-device client. Requires a phone to pair. Electron 45.0.0.');
|
|
|
|
-- ------------------------------------------------------------------ the assessment
|
|
INSERT OR REPLACE INTO assessment
|
|
(id, product_id, version, source_commit, assessed_on, method_version,
|
|
reproducible_build, weighted_total, grade, weakest_dimension, headline, not_tested)
|
|
VALUES
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'signal-desktop', '8.36.0-alpha.1',
|
|
'5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d', '2026-10-29', 'btr-0.1',
|
|
1, 75.9, 'B', 'local_data_exposure',
|
|
'The strongest transport on the internet, sitting behind the weakest desktop client we have scored.',
|
|
'No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild.');
|
|
|
|
INSERT OR REPLACE INTO score (assessment_id, dimension_id, value, rationale) VALUES
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress', 9,
|
|
'Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'verifiability', 6,
|
|
'Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'server_retention', 10,
|
|
'The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction', 8,
|
|
'501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'local_data_exposure', 5,
|
|
'Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'dependency_surface', 6,
|
|
'224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'user_control_exit', 7,
|
|
'Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record', 7,
|
|
'Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.');
|
|
|
|
-- ------------------------------------------------------------------ evidence (T1/T2 only)
|
|
INSERT INTO evidence (assessment_id, dimension_id, claim, tier, kind, artifact, sha256, observed_at) VALUES
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'local_data_exposure',
|
|
'Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.',
|
|
1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt',
|
|
NULL, '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
|
|
'Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.',
|
|
1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt',
|
|
'0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2', '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
|
|
'Zero analytics, tracker or crash-upload dependencies across 224 packages.',
|
|
1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt',
|
|
NULL, '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'telemetry_egress',
|
|
'Only two audio capture call sites exist and both are reachable only from an explicit UI action.',
|
|
1, 'source', '00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt',
|
|
NULL, '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'verifiability',
|
|
'Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.',
|
|
2, 'record', 'https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md',
|
|
NULL, '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'server_retention',
|
|
'Grand jury subpoena response returned two timestamps and nothing else.',
|
|
2, 'filing', 'https://signal.org/bigbrother/cd-california-grand-jury/',
|
|
NULL, '2026-10-29T13:13:56-05:00'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction',
|
|
'Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.',
|
|
2, 'record', 'https://projects.propublica.org/nonprofits/organizations/824506840',
|
|
NULL, '2026-10-29T13:13:56-05:00');
|
|
|
|
-- ------------------------------------------------------------------ findings
|
|
INSERT INTO finding (assessment_id, severity, title, detail, status, cve) VALUES
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'high',
|
|
'Received attachments are stored unencrypted on disk',
|
|
'Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.',
|
|
'by_design', 'CVE-2023-24069'),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'medium',
|
|
'No verified reproducible build for the Linux package',
|
|
'The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.',
|
|
'open', NULL),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'medium',
|
|
'Local database key is held in the OS keyring',
|
|
'Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.',
|
|
'accepted', NULL),
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'low',
|
|
'Registration requires a phone number',
|
|
'Mitigated by usernames and phone-number privacy, but the account root remains a phone number.',
|
|
'accepted', NULL);
|
|
|
|
-- ------------------------------------------------------------------ off-ramp
|
|
INSERT OR REPLACE INTO offramp (product_id, replacement, nextcloud, notes) VALUES
|
|
('signal-desktop', 'Signal (keep it)', NULL,
|
|
'Signal is not a thing to migrate off. It is the recommended landing place for SMS and WhatsApp, with the local-attachment caveat stated plainly.'),
|
|
('signal-desktop', 'Nextcloud Talk', 'Talk',
|
|
'For household and business groups where the admin wants the contact graph to stay on ranch hardware.');
|