2 ms·

Did you read my comment (and the followup in the subthread)? It kinda sounds like you didn't. If you didn't, please go back and read them, and the first ten or

Did you read my comment (and the followup in the subthread)? It kinda sounds like you didn't. If you didn't, please go back and read them, and the first ten or so comments of each bug I link to. The "reservations" about F-Droid have to do with its unsuitability for securely distributing software, and have nothing to do with a desire to prevent distribution of Signal through non-Google App Stores.

nextos 11y ago
I had read the whole discussion when it was posted originally. And while I understand moxie's concerns about fdroid, and I would like fdroid to fix these, I'm not sure if he is making the correct compromise. Getting access to Google Play throughout the regular route implies getting closed stuff from Google into your phone...
- simoncion 11y ago
  > Getting access to Google Play throughout the regular route implies getting closed stuff from Google into your phone... IIRC, getting access to software through the F-Droid marketplace explicitly required (at the time the big discussion was made (~3 years ago)) users to expose themselves to the risk that a compromise of F-Droid's online signing key (that -IIRC- wasn't even contained in an HSM(!)) would open them up to silent replacement of any and all software installed through F-Droid by the attacker. Note that "the attacker" could also be "anyone associated with F-Droid". Despite what one might think about their for-profit datamining, Google has a really good track record with regards to the nitty-gritty of computer security. When Moxie looked at what F-Droid provided, it was entirely inadequate to securely distribute software to TextSecure's target audience. Because TS/Signal is not currently officially distributed on the F-Droid market, I have to assume that it still cannot provide what is required to securely distribute Signal. And, to top it all off, the F-Droid folks are so lazy that they write things like this: "The latest version of the application is 0.6.2, and the security flaw has now been fixed. However, the author has not published any source code corresponding to the binary he released of this version, and far from wishing to help anyone stuck with his previous disastrous mistake, he actually asked for the application to be removed from our repository as he wants to distribute it via Google Play only." [0] TS's source has been distributed via GitHub for ages. The version that the F-Droid guy says didn't have publicly available source at the time of his post appears to have been published for two weeks prior to his post. [1] If the guy who wrote that blog post is still in a position of responsibility at F-Droid, I don't trust the organization to pay sufficiently close attention to detail to package any security-critical software. [0] https://f-droid.org/posts/security-notice-textsecure/ https://f-droid.org/posts/security-notice-textsecure/ [1] https://github.com/WhisperSystems/Signal-Android/commit/f6660dbef51ec061f6e4f449e6238014d55fcda0 https://github.com/WhisperSystems/Signal-Android/commit/f666... [2] [2] And the initial import date on the GH repo jives with the date on the notice that TS had been released as OSS. [3] [3] https://web.archive.org/web/20111225144326/http://www.whispersys.com/updates.html https://web.archive.org/web/20111225144326/http://www.whispe...

nextos 11y ago

I had read the whole discussion when it was posted originally. And while I understand moxie's concerns about fdroid, and I would like fdroid to fix these, I'm not sure if he is making the correct compromise. Getting access to Google Play throughout the regular route implies getting closed stuff from Google into your phone...

simoncion 11y ago
> Getting access to Google Play throughout the regular route implies getting closed stuff from Google into your phone... IIRC, getting access to software through the F-Droid marketplace explicitly required (at the time the big discussion was made (~3 years ago)) users to expose themselves to the risk that a compromise of F-Droid's online signing key (that -IIRC- wasn't even contained in an HSM(!)) would open them up to silent replacement of any and all software installed through F-Droid by the attacker. Note that "the attacker" could also be "anyone associated with F-Droid". Despite what one might think about their for-profit datamining, Google has a really good track record with regards to the nitty-gritty of computer security. When Moxie looked at what F-Droid provided, it was entirely inadequate to securely distribute software to TextSecure's target audience. Because TS/Signal is not currently officially distributed on the F-Droid market, I have to assume that it still cannot provide what is required to securely distribute Signal. And, to top it all off, the F-Droid folks are so lazy that they write things like this: "The latest version of the application is 0.6.2, and the security flaw has now been fixed. However, the author has not published any source code corresponding to the binary he released of this version, and far from wishing to help anyone stuck with his previous disastrous mistake, he actually asked for the application to be removed from our repository as he wants to distribute it via Google Play only." [0] TS's source has been distributed via GitHub for ages. The version that the F-Droid guy says didn't have publicly available source at the time of his post appears to have been published for two weeks prior to his post. [1] If the guy who wrote that blog post is still in a position of responsibility at F-Droid, I don't trust the organization to pay sufficiently close attention to detail to package any security-critical software. [0] https://f-droid.org/posts/security-notice-textsecure/ https://f-droid.org/posts/security-notice-textsecure/ [1] https://github.com/WhisperSystems/Signal-Android/commit/f6660dbef51ec061f6e4f449e6238014d55fcda0 https://github.com/WhisperSystems/Signal-Android/commit/f666... [2] [2] And the initial import date on the GH repo jives with the date on the notice that TS had been released as OSS. [3] [3] https://web.archive.org/web/20111225144326/http://www.whispersys.com/updates.html https://web.archive.org/web/20111225144326/http://www.whispe...