12 ms·

The problem with installing Signal on CM is that it's only available from Google Play and requires some Google components. You cannot install it from F-Droid on

by blfr 11y ago

The problem with installing Signal on CM is that it's only available from Google Play and requires some Google components. You cannot install it from F-Droid on a Google-free Android.

Sir_Cmpwn 11y ago
And the maintainer has no interest in fixing this. There was a very long thread on Github where all of his concerns around this were addressed and solutions found, but he doesn't give a shit. I don't think Signal should have any kind of first class support in CM until it can be used without nonfree software.
- sheepdestroyer 11y ago
  Signal does not have any specific support in CM. That's why WhisperPush was great, same technology, directly integrated and no need for Google Play. It's disappearance is bad for Cyanogen users in countries without GPlay. And CM are not transparent as to who and why. If difficulties with specific countries, they should be explicitly named.
  - SEMW 11y ago
    > If difficulties with specific countries, they should be explicitly named. That's easy to say when you aren't the person who'll be subject to criminal liability for violation of a gag order.
    - sheepdestroyer 11y ago
      You do see the big trust issue for the users here? Warrant Canaries, or something similar, become a necessity in today's world. The thing is : in this case we already know there were unspecified issues with anonymous countries. And they are now corrected I guess? And without much more details, that may well be enough of a dead canary for the security minded to turn to something else.
- simoncion 11y ago
  > There was a very long thread on Github where all of his concerns around this were addressed and solutions found, but he doesn't give a shit. I gather that you read the thread, so I won't go point by point and explain the reasonableness of his responses to the issue. I will -however- link to the Github issues that I remember that contain relevant discussion. [0] (Issues 127 and 281 are particularly relevant. 282 is included for the folks who don't understand that Signal for Android is distributed under the terms of the GPLv3.) Moxie cares about providing solid, functional, easy-to-use, as-idiot-proof-as-possible communication encryption software. His target audience is everyone, not just the technically skilled. To that end, he wishes to make it very difficult for non-technical users to get Signal from a source that is substantially less secure than the Google Play App Store. Anyone is free to download the source and build and sign their own binary. If you're technical enough to do this, you're presumed to be technical enough to understand the risks you're taking by doing this. For everyone who is not sufficiently knowledgeable to build from source, any binary package distribution mechanism needs to be at least as secure as Google's, and provide the additional features mentioned in Issue 281. Also notice that Moxie supports the effort to replace use of GCM with Websockets. [1] Google does security well, but Moxie is neither beholden to them, nor is he opposed to equally secure and capable replacements to the services that Google provides. Whisper Systems is carefully doing excellent work with Signal. Software like this is a great benefit to society. [0] https://github.com/WhisperSystems/Signal-Android/issues/127 https://github.com/WhisperSystems/Signal-Android/issues/127 https://github.com/WhisperSystems/Signal-Android/issues/281 https://github.com/WhisperSystems/Signal-Android/issues/281 https://github.com/WhisperSystems/Signal-Android/issues/282 https://github.com/WhisperSystems/Signal-Android/issues/282 [1] https://github.com/WhisperSystems/Signal-Android/issues/1000 https://github.com/WhisperSystems/Signal-Android/issues/1000
  - Sir_Cmpwn 11y ago
    >[...] non-technical users to get Signal from a source that is substantially less secure than the Google Play App Store. F-Droid has signed apps. >[...] Google does security well, but Moxie is neither beholden to them, nor is he opposed to equally secure and capable replacements to the services that Google provides. Google is a known collaborator with three letter agencies (remember that famous "SSL added and removed here :)" diagram?). It's grossly unacceptable for security related software to require Google Play Services (spyware) on the end user's phone.
deleted 11y ago
[deleted]
gothenburg 11y ago
The WhisperPush already existent in CM12 also required the Google Play services to work. So until you installed Gapps, you had no way of using it. Nothing changed really, except that we have one less bloat in the CM rom.

by blfr 11y ago

The problem with installing Signal on CM is that it's only available from Google Play and requires some Google components. You cannot install it from F-Droid on a Google-free Android.

Sir_Cmpwn 11y ago

And the maintainer has no interest in fixing this. There was a very long thread on Github where all of his concerns around this were addressed and solutions found, but he doesn't give a shit. I don't think Signal should have any kind of first class support in CM until it can be used without nonfree software.

sheepdestroyer 11y ago
Signal does not have any specific support in CM. That's why WhisperPush was great, same technology, directly integrated and no need for Google Play. It's disappearance is bad for Cyanogen users in countries without GPlay. And CM are not transparent as to who and why. If difficulties with specific countries, they should be explicitly named.
- SEMW 11y ago
  > If difficulties with specific countries, they should be explicitly named. That's easy to say when you aren't the person who'll be subject to criminal liability for violation of a gag order.
  - sheepdestroyer 11y ago
    You do see the big trust issue for the users here? Warrant Canaries, or something similar, become a necessity in today's world. The thing is : in this case we already know there were unspecified issues with anonymous countries. And they are now corrected I guess? And without much more details, that may well be enough of a dead canary for the security minded to turn to something else.
simoncion 11y ago
> There was a very long thread on Github where all of his concerns around this were addressed and solutions found, but he doesn't give a shit. I gather that you read the thread, so I won't go point by point and explain the reasonableness of his responses to the issue. I will -however- link to the Github issues that I remember that contain relevant discussion. [0] (Issues 127 and 281 are particularly relevant. 282 is included for the folks who don't understand that Signal for Android is distributed under the terms of the GPLv3.) Moxie cares about providing solid, functional, easy-to-use, as-idiot-proof-as-possible communication encryption software. His target audience is everyone, not just the technically skilled. To that end, he wishes to make it very difficult for non-technical users to get Signal from a source that is substantially less secure than the Google Play App Store. Anyone is free to download the source and build and sign their own binary. If you're technical enough to do this, you're presumed to be technical enough to understand the risks you're taking by doing this. For everyone who is not sufficiently knowledgeable to build from source, any binary package distribution mechanism needs to be at least as secure as Google's, and provide the additional features mentioned in Issue 281. Also notice that Moxie supports the effort to replace use of GCM with Websockets. [1] Google does security well, but Moxie is neither beholden to them, nor is he opposed to equally secure and capable replacements to the services that Google provides. Whisper Systems is carefully doing excellent work with Signal. Software like this is a great benefit to society. [0] https://github.com/WhisperSystems/Signal-Android/issues/127 https://github.com/WhisperSystems/Signal-Android/issues/127 https://github.com/WhisperSystems/Signal-Android/issues/281 https://github.com/WhisperSystems/Signal-Android/issues/281 https://github.com/WhisperSystems/Signal-Android/issues/282 https://github.com/WhisperSystems/Signal-Android/issues/282 [1] https://github.com/WhisperSystems/Signal-Android/issues/1000 https://github.com/WhisperSystems/Signal-Android/issues/1000
- Sir_Cmpwn 11y ago
  >[...] non-technical users to get Signal from a source that is substantially less secure than the Google Play App Store. F-Droid has signed apps. >[...] Google does security well, but Moxie is neither beholden to them, nor is he opposed to equally secure and capable replacements to the services that Google provides. Google is a known collaborator with three letter agencies (remember that famous "SSL added and removed here :)" diagram?). It's grossly unacceptable for security related software to require Google Play Services (spyware) on the end user's phone.

deleted 11y ago

[deleted]

gothenburg 11y ago

The WhisperPush already existent in CM12 also required the Google Play services to work. So until you installed Gapps, you had no way of using it. Nothing changed really, except that we have one less bloat in the CM rom.