Category: Telephone

Signal 的「Privacy is Priceless, but Signal is Expensive」這篇 PR 稿裡面提到了各項支出，Hacker News 上的討論在「Privacy is priceless, but Signal is expensive (signal.org)」這邊可以翻到。

裡面可以看到目前的數字 (以 2023 年十一月推算)：

Storage: $1.3 million dollars per year.
Servers: $2.9 million dollars per year.
Registration Fees: $6 million dollars per year.
Total Bandwidth: $2.8 million dollars per year.
Additional Services: $700,000 dollars per year.

Current Infrastructure Costs (as of November 2023): Approximately $14 million dollars per year.

我比較感興趣的有幾塊，一個是標題提到的簡訊，在「Registration Fees」這個段落的說明裡可以看到列了兩個項目，一個是下載 Signal 的費用，另外一個是簡訊 SMS 認證的費用：

Signal incurs expenses when people download Signal and sign up for an account, or when they re-register on a new device. We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account.

這邊有些要確認的，下載軟體的頻寬應該是包括在 Total Bandwidth... 而且推敲起來，金額應該不算大：

• 手機上的應用應該是由 Apple 的 App Store 與 Google 的 Play 平台提供，不需要 Signal 提供頻寬下載。
• 桌面應用端的部分，無論是 Windows、Mac 還是 Linux 的平台，看起來是透過 updates.signal.org 下載，這個名稱目前是指到 Cloudflare 上面，透過 traceroute 看起來不是 premium account (HiNet 用戶是導去美西的 SFO 機房)，也許是 Cloudflare 的贊助帳號？

所以我會先假設這邊 $6m/year 的費用應該都是 SMS，在後面這段看起來也有提出來：

The cost of these registration services for verifying phone numbers when people first install Signal, or when they re-register on a new device, currently averages around $6 million dollars per year.

另外會這麼高也是因為現在 SMS pumping 很流行，也就是攻擊者與電信商合作 (或是同一組人)，透過假造大量的認證需求，讓 app 後面的公司需要付大量的簡訊費用：

另外一個感興趣的是頻寬的部分，裡面有提到有一個比較吃頻寬的項目，是處理不在通訊錄上面的通話或是視訊。這邊 Signal 為了避免 IP address 的洩漏，會避免直接讓兩邊接通，而是透過 relay 接通：

To take one example, Signal always routes end-to-end encrypted calls from people who aren’t in your contacts through a relay server that obscures IP address information.

光這部份大約是 20PB/year 的量，費用約 $1.7m/year (上面有提到整個頻寬費用約 $2.8m/year)：

At current traffic levels, the amount of outbound bandwidth that is required to support Signal voice and video calls is around 20 petabytes per year (that’s 20 million gigabytes) which costs around $1.7 million dollars per year in bandwidth fees just for calling[.]

而最大的費用還是各種人事支出的部分 (i.e. 經濟規模還沒有大到反過來)，佔 $19m/year：

In total, around 50 full-time employees currently work on Signal[.]

To sustain our ongoing development efforts, about half of Signal’s overall operating budget goes towards recruiting, compensating, and retaining the people who build and care for Signal. When benefits, HR services, taxes, recruiting, and salaries are included, this translates to around $19 million dollars per year.

在 Hacker News 上有人貼了「Signal Technology Foundation - Nonprofit Explorer - ProPublica」這個，這邊有申報資料可以翻，比 PR 稿上面細。