7 ms·

So, https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c is GPL3. If I implement haskell-signal and co

by cm3 10y ago

So, https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c is GPL3. If I implement haskell-signal and consult documentation and the code to understand the protocol but do not copy code, it's not clean room, but Open Whisper wants to see the protocol spread, so it's in their interest to more clearly state how someone is allowed to reimplement Signal in Common Lisp or FORTH, if one were so inclined, and release it under MIT.

tptacek 10y ago
That's not what happened. Wire didn't consult OWS documentation. They used the code itself, and (apparently) baked it into a closed-source product. How much sympathy am I meant to have for those people?
- cm3 10y ago
  You kinda repeat yourself here, and it's not really a response to my post here. I found the answer from a sibling post: https://twitter.com/moxie/status/730289041493483520 https://twitter.com/moxie/status/730289041493483520 Moxie should use this incident to prominently make it clear in the protocol documentation that independent implementations are welcome. That's our best bet until there's an IETF RFC based on Axolotol everyone can implement instead.
  - tptacek 10y ago
    Since nobody has provided any evidence that OWS ever suggested that using their documentation was improper, you might just as well suggest Moxie use this "incident" as an opportunity to announce that he's stopped beating his wife.
    - cm3 10y ago
      I don't understand the cultural reference and I'll assume it's irrelevant, but the Oracle vs Google saga made me very very cautious when it comes to clean room reimplementations of public bits, and if I were to earn money with such a library, I'm afraid I'd need more than Moxie's tweet.
      - tptacek 10y ago
        Seriously? Oracle? Maybe this cultural reference will be clearer: https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IEl0Y2h5LAogaGUncyBJcmlzaCE= https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IE... This is FUD.
        cm3 10y ago
        This cultural reference I get even less than the first one, but I'll just ignore the references. I'm not sure if you're missing the context. This branch of the thread forked off me asking the same thing as another poster, namely the likelihood of being bothered by IP or Copyright claims for a real, proper clean room implementation of the protocol, zero code copied, assuming there is sufficient documentation available. Oracle vs Google is relevant, but it seems we're talking past each other and maybe I'm missing a point you're making.
        tptacek 10y ago
        Sorry, I'm just eager to deploy Frinkiac. I simply disagree with you that Moxie Marlinspike is in any way accountable for what Oracle does with Java. I also take exception to the argument that Open Whisper Systems needs to do something to mitigate your false impression that they've disallowed developers from using their documentation. They have not, nobody has credibly claimed otherwise, even the Wire people, and so I don't think it's proper to suggest that OWS take this "opportunity" to address a fictitious concern.
        cm3 10y ago
        > accountable for what Oracle does with Java Maybe my English is imprecise, but that's not what I tried to express. We may have to disagree that the OracleVsGoogle fallout is relevant in the hypothetical case of Axolotl IP, but as we're both not lawyers, it's moot to continue that debate. > I don't think it's proper to suggest It wouldn't cost Moxie anything to clear such concerns, even if it's just a handful of HN reader (including me), in light of this public event and would increase the positive profile of the protocol. You make it seem like by documenting that clearly Moxie would admit to doing something, but that's wrong and a curious way to look at things, especially as you're confident of there being no problem like that.
    - chrisballinger 10y ago
      I've been pretty quiet about this, but over the last couple of months I have been trying to negotiate with Moxie a way to distribute the GPL licensed AxolotlKit on the iOS App Store in ChatSecure (which is open source). After being denied a license, I was told by Moxie that I would be unable to write a non-GPL AxolotlV3 implementation because there is not publicly available documentation, and that any re-implementation will necessarily be a derivative work because the source code must be consulted. You may notice the AxolotlV2 documentation has been removed... and there was never documentation for AxolotlV3. The only public spec is the original double ratchet, and a few blog posts, which don't include things like signed prekeys and 4-way DH.
      - moxie 10y ago
        Hey Chris, as you know, we have no problem with you distributing our GPL software through the app store. Most of your communication has centered around asking us to change the license on our source base to something other than the GPL. We like the GPL for the quality control that it provides. If someone publicly says that they're using our software, we want to see if they've made any changes, and whether they're using it correctly. You don't like the GPL because you feel that it is incompatible with the Apple App Store, despite our feelings to the contrary. If you'd like to do the work of developing a strong copyleft version of the GPL that you feel is appropriate for use in the app store, and get it OSI approved, we'd certainly look at using that. As for documentation, there has never been a protocol called AxolotlV2. There was TextSecure, the crypto layer of which has evolved into Signal Protocol. We'd like to get this better documented so that people without crypto expertise can integrate it without having to talk to us, but that's a pretty heavy task that comes with a massive amount of responsibility, and some parts of this are still evolving. It's a priority, but we are taking the time to do it right, and hopefully we'll have more to publish this year. We haven't patented any of the concepts here, and we've done a lot to explain and popularize them. We're happy for people to use these concepts to build their own implementations of similar protocols, but we don't want people slapping things together and calling that Signal Protocol.
        deleted 10y ago
        [deleted]

by cm3 10y ago

tptacek 10y ago

That's not what happened. Wire didn't consult OWS documentation. They used the code itself, and (apparently) baked it into a closed-source product. How much sympathy am I meant to have for those people?

cm3 10y ago
You kinda repeat yourself here, and it's not really a response to my post here. I found the answer from a sibling post: https://twitter.com/moxie/status/730289041493483520 https://twitter.com/moxie/status/730289041493483520 Moxie should use this incident to prominently make it clear in the protocol documentation that independent implementations are welcome. That's our best bet until there's an IETF RFC based on Axolotol everyone can implement instead.
- tptacek 10y ago
  Since nobody has provided any evidence that OWS ever suggested that using their documentation was improper, you might just as well suggest Moxie use this "incident" as an opportunity to announce that he's stopped beating his wife.
  - cm3 10y ago
    I don't understand the cultural reference and I'll assume it's irrelevant, but the Oracle vs Google saga made me very very cautious when it comes to clean room reimplementations of public bits, and if I were to earn money with such a library, I'm afraid I'd need more than Moxie's tweet.
    - tptacek 10y ago
      Seriously? Oracle? Maybe this cultural reference will be clearer: https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IEl0Y2h5LAogaGUncyBJcmlzaCE= https://frinkiac.com/gif/S07E18/362795/366966/IExvb2sgb3V0IE... This is FUD.
      - cm3 10y ago
        This cultural reference I get even less than the first one, but I'll just ignore the references. I'm not sure if you're missing the context. This branch of the thread forked off me asking the same thing as another poster, namely the likelihood of being bothered by IP or Copyright claims for a real, proper clean room implementation of the protocol, zero code copied, assuming there is sufficient documentation available. Oracle vs Google is relevant, but it seems we're talking past each other and maybe I'm missing a point you're making.
        tptacek 10y ago
        Sorry, I'm just eager to deploy Frinkiac. I simply disagree with you that Moxie Marlinspike is in any way accountable for what Oracle does with Java. I also take exception to the argument that Open Whisper Systems needs to do something to mitigate your false impression that they've disallowed developers from using their documentation. They have not, nobody has credibly claimed otherwise, even the Wire people, and so I don't think it's proper to suggest that OWS take this "opportunity" to address a fictitious concern.
        cm3 10y ago
        > accountable for what Oracle does with Java Maybe my English is imprecise, but that's not what I tried to express. We may have to disagree that the OracleVsGoogle fallout is relevant in the hypothetical case of Axolotl IP, but as we're both not lawyers, it's moot to continue that debate. > I don't think it's proper to suggest It wouldn't cost Moxie anything to clear such concerns, even if it's just a handful of HN reader (including me), in light of this public event and would increase the positive profile of the protocol. You make it seem like by documenting that clearly Moxie would admit to doing something, but that's wrong and a curious way to look at things, especially as you're confident of there being no problem like that.
  - chrisballinger 10y ago
    I've been pretty quiet about this, but over the last couple of months I have been trying to negotiate with Moxie a way to distribute the GPL licensed AxolotlKit on the iOS App Store in ChatSecure (which is open source). After being denied a license, I was told by Moxie that I would be unable to write a non-GPL AxolotlV3 implementation because there is not publicly available documentation, and that any re-implementation will necessarily be a derivative work because the source code must be consulted. You may notice the AxolotlV2 documentation has been removed... and there was never documentation for AxolotlV3. The only public spec is the original double ratchet, and a few blog posts, which don't include things like signed prekeys and 4-way DH.
    - moxie 10y ago
      Hey Chris, as you know, we have no problem with you distributing our GPL software through the app store. Most of your communication has centered around asking us to change the license on our source base to something other than the GPL. We like the GPL for the quality control that it provides. If someone publicly says that they're using our software, we want to see if they've made any changes, and whether they're using it correctly. You don't like the GPL because you feel that it is incompatible with the Apple App Store, despite our feelings to the contrary. If you'd like to do the work of developing a strong copyleft version of the GPL that you feel is appropriate for use in the app store, and get it OSI approved, we'd certainly look at using that. As for documentation, there has never been a protocol called AxolotlV2. There was TextSecure, the crypto layer of which has evolved into Signal Protocol. We'd like to get this better documented so that people without crypto expertise can integrate it without having to talk to us, but that's a pretty heavy task that comes with a massive amount of responsibility, and some parts of this are still evolving. It's a priority, but we are taking the time to do it right, and hopefully we'll have more to publish this year. We haven't patented any of the concepts here, and we've done a lot to explain and popularize them. We're happy for people to use these concepts to build their own implementations of similar protocols, but we don't want people slapping things together and calling that Signal Protocol.
      - deleted 10y ago
        [deleted]