7 ms·

Has anyone given this https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 more thought a

• qznc 10y ago
  Moxie replied in this Forbes article: http://www.forbes.com/sites/thomasbrewster/2016/05/11/wire-skype-sued-moxie-marlinspike-extortion/#9dc5acd3ff59 http://www.forbes.com/sites/thomasbrewster/2016/05/11/wire-s...
  • deleted 10y ago
    [deleted]
  • mike_hearn 10y ago
    That isn't quite a reply. It's a second hand account of Moxie denying that he asked for money. This story seems very troubling. The Wire guys made very specific claims (where did they get the >$2M figure from ... and why would they simply invent such a figure). If their implementation is in Rust then it cannot be the same as OWS' code. It would be good if OWS could publicly clarify that reimplementing the Signal Protocol/Axoltl does not trigger any copyright claims by OWS even if doing so involved reading the GPLd version.
    • cm3 10y ago
      So, https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c is GPL3. If I implement haskell-signal and consult documentation and the code to understand the protocol but do not copy code, it's not clean room, but Open Whisper wants to see the protocol spread, so it's in their interest to more clearly state how someone is allowed to reimplement Signal in Common Lisp or FORTH, if one were so inclined, and release it under MIT.
      • tptacek 10y ago
        That's not what happened. Wire didn't consult OWS documentation. They used the code itself, and (apparently) baked it into a closed-source product. How much sympathy am I meant to have for those people?
        • cm3 10y ago
          You kinda repeat yourself here, and it's not really a response to my post here. I found the answer from a sibling post: https://twitter.com/moxie/status/730289041493483520 https://twitter.com/moxie/status/730289041493483520 Moxie should use this incident to prominently make it clear in the protocol documentation that independent implementations are welcome. That's our best bet until there's an IETF RFC based on Axolotol everyone can implement instead.
          • tptacek 10y ago
            Since nobody has provided any evidence that OWS ever suggested that using their documentation was improper, you might just as well suggest Moxie use this "incident" as an opportunity to announce that he's stopped beating his wife.
            • cm3 10y ago
              I don't understand the cultural reference and I'll assume it's irrelevant, but the Oracle vs Google saga made me very very cautious when it comes to clean room reimplementations of public bits, and if I were to earn money with such a library, I'm afraid I'd need more than Moxie's tweet.
              • tptacek 10y ago
                Seriously? Oracle? Maybe this cultural reference will be clearer: https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IEl0Y2h5LAogaGUncyBJcmlzaCE= https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IE... This is FUD.
    • maxerickson 10y ago
      https://twitter.com/moxie/status/730230490653851648 https://twitter.com/moxie/status/730230490653851648 https://twitter.com/moxie/status/730230320553828352 https://twitter.com/moxie/status/730230320553828352 The Wire guys also withdrew the complaint.
    • codelitt 10y ago
      Here's an article including first hand account and quotes from Moxie: http://news.softpedia.com/news/wire-drops-lawsuit-alleging-extortion-from-signal-co-founder-503850.shtml http://news.softpedia.com/news/wire-drops-lawsuit-alleging-e... IMHO, no credence should be given to lawsuits and accusations made without proof and right before OWS integrates with two huge partners. The accuser even filed a voluntary notice of dismissal with prejudice. Accusations without proof are just mudslinging. Moxie has a great track record; the burden of proof is on the accuser, not the defendant.
    • neerdowell 10y ago
      > The Wire guys made very specific claims (where did they get the >$2M figure from ... and why would they simply invent such a figure). Their court filing[0] says the license fee was "unspecified" and the $2 million figure was based on "information and belief" which is legal terminology used to dodge perjury[1]. If they had really been told that, they wouldn't be using terms that mean "I heard that from somewhere second-hand and think it might be true". [0] https://www.scribd.com/doc/311974670/Wire-Swiss-GmbH-v-Quiet-Riddle-Ventures-LLC https://www.scribd.com/doc/311974670/Wire-Swiss-GmbH-v-Quiet... [1] https://www.law.cornell.edu/wex/information_and_belief https://www.law.cornell.edu/wex/information_and_belief
    • rmc 10y ago
      > does not trigger any copyright claims by OWS even if doing so involved reading the GPLd version. I'm pretty sure having GPLed code open, reading it and writing some new software counts as a "derived work", and the GPL would apply. That's what most people who release FLOSS want to happen.
• deleted 10y ago
  [deleted]
• tptacek 10y ago
  You have this story backwards and you should correct your post. Moxie and OWS didn't threaten to sue Wire. Wire sued Open Whisper Systems. That suit made, but did not substantiate, a claim that OWS asked for money. OWS denies that. I believe OWS, and not Wire. The genesis of this claim comes from Wire having used GPL'd OWS code, apparently for the Signal protocol, without complying with the GPL. OWS demanded that Wire comply with the GPL. Apparently, upon being told that they would be required to comply with the GPL, they inquired instead about dual-licensing. That's standard practice when a company adopts GPL code for their own product but doesn't want to comply with the GPL: they instead have to pay for a private license. Instead of paying for a private license, Wire has apparently chosen to comply with the GPL instead, and withdrawn their complaint. I think that was the right choice. The knives are definitely out for Signal now that its importance is being recognized by a wider audience. Complaints about Signal are, unsurprisingly, getting dumber and more venomous. For instance, last week, Nadim Kobeissi (the author of Cryptocat, a competing secure messaging system that I think you should avoid) was on Twitter talking about how impossible a GPL violation could have been given that Wire's Signal implementation is in Rust.
  • cm3 10y ago
    Thanks, amended my post.
  • nkobeissi 10y ago
    > Complaints about Signal are, unsurprisingly, getting dumber and more venomous. For instance, last week, Nadim Kobeissi (the author of Cryptocat, a competing secure messaging system that I think you should avoid) was on Twitter talking about how impossible a GPL violation could have been given that Wire's Signal implementation is in Rust. Given that I'm mentioned by name (and tied to a bunch of exaggerated claims), I'd like to clarify a few points. 1. I never claimed that a GPL violation was impossible because of different programming languages. I merely questioned whether this was the case with Wire's Rust codebase [0], given that its data structures, namespacing etc. are substantially different from the OWS Java code [1]. To me, different code organization + different implementation style + different programming language don't exactly amount to a line-by-line conversion from Java to Rust as OWS seems to be claiming. 2. Cryptocat does not compete with Signal: it's a desktop XMPP client that focuses on synchronous messaging (that I write in my free time and with no funding or business plan, to boot), and does not at all target the mobile space. I was very happy to adopt a variant of Signal Protocol into Cryptocat and consider Signal's contributions to the field of secure messaging to be highly valuable. I'm not sure why tptacek brings up Cryptocat (completely unrelated to this discussion) but by all means, don't avoid it! The recent rewrite is pretty good, actually. Overall, this situation just struck me as very ugly. Moxie seemed at some point to be reticent to allow fully independent implementations of the protocol, and Wire's lawsuit was pretty aggressive. Both parties locked in a catfight and then (apparently?) realized their approaches were counterproductive and gave it up. The best resolution here, in my view, would have been for Moxie to publish a public-domain reference specification document of Signal Protocol that's independent of the code, and for Wire to be allowed to write a Rust implementation of it without any party causing drama. [0] https://github.com/wireapp/proteus https://github.com/wireapp/proteus [1] https://github.com/WhisperSystems/libsignal-protocol-java https://github.com/WhisperSystems/libsignal-protocol-java
• cm3 10y ago
  According to https://twitter.com/moxie/status/730289041493483520 https://twitter.com/moxie/status/730289041493483520 Moxie is fine with reimplementations.
  • cm3 10y ago
    Unfortunately, if I read https://news.ycombinator.com/item?id=11727870 https://news.ycombinator.com/item?id=11727870 right, Moxie formulated that more clearly by saying they would only approve of copyleft reimplementations. Unless I'm misreading things, this confirms the concerns and turns it more into something like the Java conformance testing case which the Apache folks ran into. I do get why they want protocol conformance, but expecting everyone to publish their implementation as copyleft is unreasonable and unrealistic. The only acceptable solution, if they want to see widespread use of the protocol, is to have a shared, no strings attached testing framework everyone can use to check their protocol implementation doesn't deviate. We have such things for web standards, why not for a secure chat solution? Their aim is good, but the solution is unacceptable for an industry standard to be. Quoting If you'd like to do the work of developing a strong copyleft version of the GPL that you feel is appropriate for use in the app store, and get it OSI approved, we'd certainly look at using that. We'd like to get this better documented [...] It's a priority [...] hopefully we'll have more to publish this year. We haven't patented any of the concepts here, and we've done a lot to explain and popularize them. We're happy for people to use these concepts to build their own implementations of similar protocols, but we don't want people slapping things together and calling that Signal Protocol.
  • akerro 10y ago
    But he's not happy with recompilation of Signal? https://fdroid.eutopia.cz/ https://fdroid.eutopia.cz/ > Any other distribution channel we be treated as malware
    • Arnt 10y ago
      He isn't fine with anyone distributing unsigned or resigned Signal. What he says is more or less "my app, my signature". The fdroid people could recompile, check that the binary matches the one Moxie signed, and distribute the one with Moxie's signature.
• libeclipse 10y ago
  Wire doesn't even encrypt chats and images, only calls.
  • Siimteller 10y ago
    That was true when Wire launched in December 2014 but not any more. On March 10, 2016 Wire rolled out end-to-end encryption and from that on everything (chat, photos, files, video messages, all calls) are end-to-end encrypted. More + security whitepaper at wire.com/privacy