Technology

The NSA already has your social map from Apple, Google, Facebook/whatsapp, plus a hundred other sources you've given access to your contacts in the past decade.

Even if you've never used any of those, or given any app access to your contacts, 99% of your contacts have.

I'm way more concerned about the privacy of what I say than who I say it to.

That they do, but your contacts doesn't have to get it anymore.
A self-hosted matrix stack built from source with matrix clients built from source with e2ee implemented that you yourself have the competence to verify the encryption and safety of would be the only secure communication I know of if you don't want to trust a third party.

Why would you use iOS if you care about privacy?

Because it’s far better for privacy than any Google-Play-Services-ridden version of Android, and sometimes in life you don’t want to have to deal with custom ROMs anymore.

But also that’s an exceptionally dumb question, because the implication is that privacy can’t matter to people who don’t go to the same precise lengths someone else does.

Is it? I still get regular updates. Yes there are a few, i use Morph

https://www.ubuntu-touch.io/

1. Not just that, but also it's small in description. If you read their papers, they are very easy to understand. I suppose that's intentional, clarity and simplicity are among the main criteria of anything intended for security.

2. "A lot of eyes" is overvalued. There are a lot of eyes on every nation-state in history too, you tell me how that works.

3. It doesn't matter because of protocol design. They've solved very complex problems and have not stopped doing that. E2EE is the wrong buzzword, zero-knowledge is the right one. No, I'm not remotely qualified enough to explain what that is.

4. Still supply chain attack on clients is the most probable, but not much they can do with it. It's similar to fearing trojans on user devices. Yes, 3-letter agencies and such most likely will do that, not bother with pressuring Signal developers. And no, there's not much you can do to defend against a targeted attack, if it's targeted, then you've already bothered people you shouldn't have.

5. Well, it's not as if one could avoid that. It all lies in the area of smart contracts and distributed computing then, and see point 1, right now Signal's protocol can be in general strokes understood by someone like me. If they make something like that, it won't be. Everything is a compromise.

There’s functionally less “trust” here than any messaging application on the planet.

I think Wire and maybe Session use slightly modified Signal protocol. But Signal itself is the thing, made by people with clear vision of the whole architecture, model, which is not limited to protocols, but also to sociology, human psychology, politics. And they've explained literally every architectural decision of theirs in articles.