7 ms·

Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSigna

by ge0rg 10y ago

Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

morsch 10y ago
That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of course the fallout of shutting them out would only grow over time. Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Thirds party clients would be at the mercy of their developers when OWS makes an incompatible change. Caveat emptor, I would say, but again, the problem would only grow. My personal situation is that the only people I talk to via Signal are nerds; the kind of people who jump ship when a sexier alternative comes up -- like we did when TextSecure/Signal offered good e2e crypto. But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal.
- moxie 10y ago
  > Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who communicate with them as well. For example, LibreSignal doesn't support voice calls. When normal Signal users try to call LibreSignal users, it just doesn't work. Most normal Signal users don't care or understand or sympathize with the idea that the person they're trying to call uses some other app which doesn't support voice calls. They'll just think that Signal voice calls are flaky and randomly don't work sometimes. That's one example, but as development progresses, there will inevitably be more. We're concerned about exactly the same set of problems we found with federation. > But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal. Just to be clear, I think that's great. If people don't feel it's necessary to use Signal because Signal Protocol is "the new normal" in the apps they already use, then I think we've succeeded. Hopefully we'll eventually have the chance to push the envelope forward again and restart that cycle.
  - jsingleton 10y ago
    If the code is GPL then shouldn't WhatsApp need to be open source? Or did they get a different license? The only thing listed at https://www.whatsapp.com/android/ https://www.whatsapp.com/android/ are some changes to qcom as per the LGPL.
    - laughinghan 10y ago
      I think they're talking about the protocol like "keep around these keys and exchange this", but implemented with proprietary code that doesn't use any of Moxie's C implementation which is indeed GPL.
      - dlmetcalf 10y ago
        Nope, WhatsApp were given a different license. Unlike ChatSecure, who until this most recent change, were locked out from iOS.
        dlmetcalf 10y ago
        It's good to see.
  - gpvos 10y ago
    > When normal Signal users try to call LibreSignal users, it just doesn't work. Wouldn't it be possible to give better feedback to the caller in this case, such as the name of the client the callee uses? I don't use Signal, so I may be missing something here.
    - moxie 10y ago
      Probably, but most people aren't going to understand that LibreSignal is different from Signal. We could try to make things work differently for users calling LibreSignal, but that sets us on a path of having to constantly account for all the various 3rd party clients and their various stages of development or support, which as a team of two developers we unfortunately don't have the resources for.
- lorenzhs 10y ago
  > My personal situation is that the only people I talk to via Signal are nerds Nerds, and people who were pressured to install Signal by nerds, indeed cover nearly all of my Signal contacts. But that second group is the larger one, so "nerds" is not an entirely fair characterisation of Signal's user base any more.
dlmetcalf 10y ago
Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Signal app itself still can't run on Android Open Source, because it forces centralised metadata collection on the user via Google Play Store and GCM. Installing Google privacy-invading bloatware, is a prerequisite, which also further requires you to destroy your phone's security model because all non-vendor GCM options currently require you to patch a nasty hack into the kernel or otherwise prevent you using a secure, verified bootloader. But like 'blame Apple', 'blame Google', because Signal won't provide or permit a WebSocket fallback (to do exactly the same as desktop client) - the one major thing LibreSignal wanted and were threatened legal action with if they did. Oh, that and using a trustworthy (FDroid), not just trusted, app store that doesn't require bloat, metadata leaks & GSF battery drain. So, if your operating system can't support GCM (for good security reasons), or you just don't want to give up your data (kind of the point of Signal), then you're out in the cold. You may think "It's open source, I'll run my own server". Nope. It's not just that they won't allow others to federate with their servers. Even if you were willing to give up your entire network of Signal contacts (that you've been building because you THOUGHT they were Open as they always painted themselves) - you can't. 'Open' Whisper aren't open sourcing their server. The voice side is locked up. Don't forget, you didn't choose GCM. Signal took the SMS option away after you'd built your network, plus convinced all your friends to drop XMPP alternatives and install Signal. This license is too little, too late. Matrix.org is providing a secure, viable modern, open alternative to IRC and XMPP, that also federates with them. With clients like Vector.IM that'll soon be non-GCM too. It already provides better functionality than Signal app and with Olm protocol (being merged within weeks) is equivalent to Signal encryption anyway. Conversations.IM already works beautifully without Signal (plus is merging with the resources of ChatSecure). They've proven very well that you CAN in fact have an awesome (and secure) user experience based on XMPP. The thing that really annoys me, is that while we spent all these years just backing Signal, singing their praises - thinking they were open (yeah, more fool us) - we were also diverting attention, installs and sentiment/resources from genuinely open protocols & projects for the web. Now those networks are gone, they're hard to get back. The good news is that Matrix is technically good enough to win, so I hope they do. Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release.

by ge0rg 10y ago

morsch 10y ago

That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of course the fallout of shutting them out would only grow over time. Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Thirds party clients would be at the mercy of their developers when OWS makes an incompatible change. Caveat emptor, I would say, but again, the problem would only grow. My personal situation is that the only people I talk to via Signal are nerds; the kind of people who jump ship when a sexier alternative comes up -- like we did when TextSecure/Signal offered good e2e crypto. But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal.

moxie 10y ago
> Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who communicate with them as well. For example, LibreSignal doesn't support voice calls. When normal Signal users try to call LibreSignal users, it just doesn't work. Most normal Signal users don't care or understand or sympathize with the idea that the person they're trying to call uses some other app which doesn't support voice calls. They'll just think that Signal voice calls are flaky and randomly don't work sometimes. That's one example, but as development progresses, there will inevitably be more. We're concerned about exactly the same set of problems we found with federation. > But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal. Just to be clear, I think that's great. If people don't feel it's necessary to use Signal because Signal Protocol is "the new normal" in the apps they already use, then I think we've succeeded. Hopefully we'll eventually have the chance to push the envelope forward again and restart that cycle.
- jsingleton 10y ago
  If the code is GPL then shouldn't WhatsApp need to be open source? Or did they get a different license? The only thing listed at https://www.whatsapp.com/android/ https://www.whatsapp.com/android/ are some changes to qcom as per the LGPL.
  - laughinghan 10y ago
    I think they're talking about the protocol like "keep around these keys and exchange this", but implemented with proprietary code that doesn't use any of Moxie's C implementation which is indeed GPL.
    - dlmetcalf 10y ago
      Nope, WhatsApp were given a different license. Unlike ChatSecure, who until this most recent change, were locked out from iOS.
      - dlmetcalf 10y ago
        It's good to see.
- gpvos 10y ago
  > When normal Signal users try to call LibreSignal users, it just doesn't work. Wouldn't it be possible to give better feedback to the caller in this case, such as the name of the client the callee uses? I don't use Signal, so I may be missing something here.
  - moxie 10y ago
    Probably, but most people aren't going to understand that LibreSignal is different from Signal. We could try to make things work differently for users calling LibreSignal, but that sets us on a path of having to constantly account for all the various 3rd party clients and their various stages of development or support, which as a team of two developers we unfortunately don't have the resources for.
lorenzhs 10y ago
> My personal situation is that the only people I talk to via Signal are nerds Nerds, and people who were pressured to install Signal by nerds, indeed cover nearly all of my Signal contacts. But that second group is the larger one, so "nerds" is not an entirely fair characterisation of Signal's user base any more.

dlmetcalf 10y ago

Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Signal app itself still can't run on Android Open Source, because it forces centralised metadata collection on the user via Google Play Store and GCM. Installing Google privacy-invading bloatware, is a prerequisite, which also further requires you to destroy your phone's security model because all non-vendor GCM options currently require you to patch a nasty hack into the kernel or otherwise prevent you using a secure, verified bootloader. But like 'blame Apple', 'blame Google', because Signal won't provide or permit a WebSocket fallback (to do exactly the same as desktop client) - the one major thing LibreSignal wanted and were threatened legal action with if they did. Oh, that and using a trustworthy (FDroid), not just trusted, app store that doesn't require bloat, metadata leaks & GSF battery drain. So, if your operating system can't support GCM (for good security reasons), or you just don't want to give up your data (kind of the point of Signal), then you're out in the cold. You may think "It's open source, I'll run my own server". Nope. It's not just that they won't allow others to federate with their servers. Even if you were willing to give up your entire network of Signal contacts (that you've been building because you THOUGHT they were Open as they always painted themselves) - you can't. 'Open' Whisper aren't open sourcing their server. The voice side is locked up. Don't forget, you didn't choose GCM. Signal took the SMS option away after you'd built your network, plus convinced all your friends to drop XMPP alternatives and install Signal. This license is too little, too late. Matrix.org is providing a secure, viable modern, open alternative to IRC and XMPP, that also federates with them. With clients like Vector.IM that'll soon be non-GCM too. It already provides better functionality than Signal app and with Olm protocol (being merged within weeks) is equivalent to Signal encryption anyway. Conversations.IM already works beautifully without Signal (plus is merging with the resources of ChatSecure). They've proven very well that you CAN in fact have an awesome (and secure) user experience based on XMPP. The thing that really annoys me, is that while we spent all these years just backing Signal, singing their praises - thinking they were open (yeah, more fool us) - we were also diverting attention, installs and sentiment/resources from genuinely open protocols & projects for the web. Now those networks are gone, they're hard to get back. The good news is that Matrix is technically good enough to win, so I hope they do. Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release.