Comment by Drblessing

Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure.

> We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. Simple solution, go distributed.

6M $ for that. Stop doing that. What do dictators control? Mobile phone networks and other infrastructure. And, yes, they really do go after people any way they can.

This "cost" puts people into danger. Coupling identity and operator infrastructure is a critical privacy flaw. And a costly one too apparently. If your #1 goal is to be the most private solution, this cannot be tolerated to continue to be the case. Get rid of it. Your identity should be your cryptographic key.

I'll ask the question you're implying out loud.

Why does an organization with about 50 employees need 4 C-level executives, totalling about 2M compensation per year? Or perhaps it's 7 C-level executives (3 hiding under the "Software developer" title) totalling about 3,7M compensation per year?

I'm absolutely not donating money to such a thing without an answer to this question. As a counterpoint, I am a member of a local (Finnish) non-profit organization, one of whose many services is Matrix. This costs me 40 euros per year and none of that money goes to C-level executives.

Does anyone have an idea why they did not list the combined salaries of all employees? They did seem to list all the other things...

I'm kind of happy to don't see Moxie with such rockstar salary as for instance the CTO one..

Salaries: Pretty abusive salaries for a non profit but that seems to be pretty much the standard nowadays, right?

Bandwidth: I took at quick look and see that chat.signal.org resolves to AWS. If they are paying AWS for a lot of bandwidth, that is very expensive. Let's take a quick look:

   They say they use 20PB per year of bandwidth for voice calls alone, this costs them $1.7M a year.  
   
   According to AWS pricing for great customers (suckers) of over 150TB per month, the cost per GB goes waaaay down to $0.05, yay.  1.6PB per month is 1600000GBs, that's $80K a month and therefore $960K a year.

   Very roughly, a 10Gbp/s link to the Internet, from a Tier-1 provider will be around $800 (eight hundred dollars, you're reading this right) a month in a low-bandwidth-cost country like the US, possibly double that in say Asia.

   A 10Gbps link fully utilized (minus some overheads), translates roughly to 3 Petabytes per month, that's 36 petabytes per year, almost double their advertized amount of bandwidth needed for calls per year.

   So we have ~$10K a year (negotiable) for 36PB which is double their bandwidth needs but let's not forget that AWS graciously (geniously) charges for egess only, this means that their actual bandwidth needs are 40PB per year for whatever they are reporting.  So we have $10K for 36PB a year vs $960K a year for 20PB (actually 40PB) of bandwidth from dear Amazon.

   1. Not sure why they are saying the cost is $1.7M per year.
   2. Even at 960K it's daylight robbery.
   3. AWS makes an absolute killing on bandwidth costs.  Best. Business. Model. Ever.
   4. Don't these guys have a Devops pro at $300K+ a year? weird :)

Servers: I won't get into the numbers here as that's a lot more involved, and impossible without more data, but buying and maintaining your own infra, or possibly easier, renting it, would still be quite a lot cheaper than using AWS.

Takeaways: - Storage is something you should buy and maintain (Thanks B!), you swap out old/dying storage devices. See Backblaze.

   - Bandwidth, compute and storage costs at your favorite CSP are absolutely f'ing *outrageous*

   - If you care about your money, your bottom line, do things differently than the *insane* mainstream way of clickity-click on some UIs to provision services without understanding what's really happening under the hood (not saying Signal doesn't understand that part, I'm sure they do), or caring about the added costs of whatever gets so easily "added" to your "infrastructure". 

   - By having your stuff on a CSP you don't even have "infrastructure", but that's juts me.

Anyway, I do love Signal, what they do and what they represent. Keep up the good work.

Signal, mail me at m aaaat zynk.it if you'd like to talk.