5 ms·
Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Signal app itself still can't
by dlmetcalf 10y ago
Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many.
Signal app itself still can't run on Android Open Source, because it forces centralised metadata collection on the user via Google Play Store and GCM. Installing Google privacy-invading bloatware, is a prerequisite, which also further requires you to destroy your phone's security model because all non-vendor GCM options currently require you to patch a nasty hack into the kernel or otherwise prevent you using a secure, verified bootloader.
But like 'blame Apple', 'blame Google', because Signal won't provide or permit a WebSocket fallback (to do exactly the same as desktop client) - the one major thing LibreSignal wanted and were threatened legal action with if they did. Oh, that and using a trustworthy (FDroid), not just trusted, app store that doesn't require bloat, metadata leaks & GSF battery drain.
So, if your operating system can't support GCM (for good security reasons), or you just don't want to give up your data (kind of the point of Signal), then you're out in the cold.
You may think "It's open source, I'll run my own server". Nope. It's not just that they won't allow others to federate with their servers. Even if you were willing to give up your entire network of Signal contacts (that you've been building because you THOUGHT they were Open as they always painted themselves) - you can't. 'Open' Whisper aren't open sourcing their server. The voice side is locked up. Don't forget, you didn't choose GCM. Signal took the SMS option away after you'd built your network, plus convinced all your friends to drop XMPP alternatives and install Signal.
This license is too little, too late.
Matrix.org is providing a secure, viable modern, open alternative to IRC and XMPP, that also federates with them. With clients like Vector.IM that'll soon be non-GCM too. It already provides better functionality than Signal app and with Olm protocol (being merged within weeks) is equivalent to Signal encryption anyway.
Conversations.IM already works beautifully without Signal (plus is merging with the resources of ChatSecure). They've proven very well that you CAN in fact have an awesome (and secure) user experience based on XMPP.
The thing that really annoys me, is that while we spent all these years just backing Signal, singing their praises - thinking they were open (yeah, more fool us) - we were also diverting attention, installs and sentiment/resources from genuinely open protocols & projects for the web. Now those networks are gone, they're hard to get back.
The good news is that Matrix is technically good enough to win, so I hope they do.
Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release.
- Arathorn 10y agoJust a few clarifications: * Olm isn't a replacement for 'Signal protocol' - it's just an independent (Apache license) implementation of the same 'double ratchet' cryptographic ratchet that Signal protocol uses under the hood for generating message keys. * Megolm provides the higher layer semantics for using Olm for group conversations in Matrix, and diverges significantly from Signal Protocol as far as I know. * There's already an experimental FDroid ready build of Vector Android (following the HN discussion on Friday) at https://matrix.org/jenkins/job/VectorAndroidDevelop/lastSuccessfulBuild/artifact/vector/build/outputs/apk/vector-appFDroid-debug.apk https://matrix.org/jenkins/job/VectorAndroidDevelop/lastSucc... - feedback welcome on just how badly the polling-based push mechanism performs on your hardware & network. We're looking at alternative push mechanisms like microG - or just using a more efficient push transport for Matrix to provide notifs.
- dlmetcalf 10y agoThanks @Arathorn. That's great to hear an FDroid candidate's available. Great turn around! The only device I'd have to test it on right at the moment, unfortunately doesn't take 3rd party APKs (FDroid's been signed, but I'm reluctant to otherwise open that particular device). Will see what else I can pull together. I could sign the APK with my own OS build, but then I'd miss OTA updates (so a different security risk). MicroG sounds a good option. As for Copperhead specifically, I don't think MicroG will be on the table for a while though. Another push would be ideal I suppose (but I know you need to balance priorities).
- dlmetcalf 10y agoHi @Arathorn, the battery drain of that experimental build is certainly noticeable, but not disastrous. In 18 hours on a new Nexus 6p, it's drained the battery 30%. Conversations.IM by comparison had only drained 1%. The next biggest battery drain on that device to Vector, had only taken 3%. I think it's still viable enough for an early release to FDroid for the time being, but with a warning. The fact that you can also turn its background sync on or off, means it's quite fine for the casual reading use case, without notifications one.
- 10y ago