4 ms·

> Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Olm/Megolm is not Signal Pr

by moxie 10y ago

> Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Olm/Megolm is not Signal Protocol. It is an entirely different protocol that has made different choices, and those choices have received less study and scrutiny. It hasn't been deployed anywhere that I know of. It's fine if you want to explore those choices, but I would caution against calling it the same thing. > the one major thing LibreSignal wanted and were threatened legal action with if they did I understand that because we have what you consider to be unpopular opinions, it's easy to believe that we're somehow single-handedly responsible for everything bad in the world. However, you can't just make shit up. Legal action? Could you cite that? The entirety of our exchange is in the top of that issue. They asked for permission, and I said we'd prefer for them to use their own servers and their own name. The same thing we say to everyone. Many people do set up their own servers for their own products, these people chose not to. We didn't threaten anyone with anything, legal or otherwise. > 'Open' Whisper aren't open sourcing their server. The voice side is locked up. https://github.com/whispersystems/textsecure-server https://github.com/whispersystems/textsecure-server https://github.com/whispersystems/pushserver https://github.com/whispersystems/pushserver https://github.com/whispersystems/websocket-resources https://github.com/whispersystems/websocket-resources https://github.com/whispersystems/dropwizard-simpleauth https://github.com/whispersystems/dropwizard-simpleauth By "the voice side," do you mean a TURN server? Plenty of options for you out there. Or are you just more interested in having something to blame us for? And LibreSignal already doesn't support voice, even with our servers, so your complaint doesn't make much sense. > Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release. The conspiracy theories never stop. We haven't changed anything, this has been what we said our policy was all along, but people thought that was some kind of conspiracy. Of course, now that we've made it an explicit license term instead, that's also suspicious somehow. Why would anyone ever want to be involved in this community you think we're not appropriately considering?

dlmetcalf 10y ago
Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it: "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...). You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat. 'LibreSignal' never wanted their own "product" as you choose to call it. No one in that community was trying to compete with you. They just had legitimate security needs, or wanted to use Signal as it was, but without being tied to an advertising company. The App Store risks aren't even theoretical or tin-foil-hat material: https://twitter.com/SwiftOnSecurity/status/723562435601264640 https://twitter.com/SwiftOnSecurity/status/72356243560126464... Having option to run on a reasonably secure endpoint (e.g. the Copperhead's of this world), that users have some hope of securing, seems a pretty reasonable desire. Since increased security is really the only point of using Signal, and a secure channel is useless if the endpoint is not. The name "LibreSignal" was also not the same as "Signal". If they HAD just redistributed as "Signal" (especially if trademarked), or otherwise didn't make clear it was an independent/unofficial build, then sure that's an issue. However the developers agreed immediately to changing the name further when requested. In terms of the voice server, I'm just going on what other developers have stated. I'm not personally aware whether the TURN server is the only missing component or not. The fact is though, if a user wants to run Signal on a straight-forward Android Open Source device, without adding a large attack surface of Google Apps, then Signal app is not an option. Regardless whether open source clones are possible, you know communications utility comes down to the network itself too (Metcalfe's Law) and holding one tin can, with a dangling piece of string and no one on the other end is rather useless. Now Signal has captured the whole user base, there's large costs in changing. Anyway, your code, your call. I think the key thing, is that people were surprised. Closed distribution models and controlled ecosystems, coming from a company purporting itself as being Open (and not meaning to be personal, but by a guy calling himself an anarchist), was not what people thought they'd been promoting. We don't think you're everything bad in the world. We just wish that using Signal was an option.
- dlmetcalf 10y ago
  Regarding entitlement, it's not just an advertising company the 'product' is tied to. Google is of course one of the most aggressive global profit-shifters for tax 'minimisation'. I would prefer to call it avoidance, as I can't see any other reason for it, but I don't have pockets deep enough for the legal defense to use a word like that (or evasion).
  - dlmetcalf 10y ago
    I wonder who voted this down. I didn't know Google tax lawyers hung out on Hacker News. PR bot? http://www.taxjustice.net/tag/google/ http://www.taxjustice.net/tag/google/
- dlmetcalf 10y ago
  It's ironic that WhatsApp runs fine on open source Android, but Signal won't. Are you _sure_ that wasn't part of the deal @moxie? ;)
- laughinghan 10y ago
  "You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat." Wait what? Because what they did was illegal, to ask them to stop is to threaten legal action? A: "Hey, you just hit me, can you stop?" B: "Oh sorry we'll stop." C: "Gosh, you didn't have threaten them with legal action!" A: "What when did I do that" C: "You know full well assault is a criminal offense and the government could prosecute with or without your consent. There's also an open ended civil claim you'd now have against them."
  - dlmetcalf 10y ago
    I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106 https://twitter.com/LauriLoveX/status/733137222539567106 i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms. It's not like LibreSignal were doing anything particularly different to Desktop. LibreSignal would have been thrilled to have just had it upstreamed anyway. How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic. Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected? Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network. Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community. The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.

by moxie 10y ago

dlmetcalf 10y ago

Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it: "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...). You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat. 'LibreSignal' never wanted their own "product" as you choose to call it. No one in that community was trying to compete with you. They just had legitimate security needs, or wanted to use Signal as it was, but without being tied to an advertising company. The App Store risks aren't even theoretical or tin-foil-hat material: https://twitter.com/SwiftOnSecurity/status/723562435601264640 https://twitter.com/SwiftOnSecurity/status/72356243560126464... Having option to run on a reasonably secure endpoint (e.g. the Copperhead's of this world), that users have some hope of securing, seems a pretty reasonable desire. Since increased security is really the only point of using Signal, and a secure channel is useless if the endpoint is not. The name "LibreSignal" was also not the same as "Signal". If they HAD just redistributed as "Signal" (especially if trademarked), or otherwise didn't make clear it was an independent/unofficial build, then sure that's an issue. However the developers agreed immediately to changing the name further when requested. In terms of the voice server, I'm just going on what other developers have stated. I'm not personally aware whether the TURN server is the only missing component or not. The fact is though, if a user wants to run Signal on a straight-forward Android Open Source device, without adding a large attack surface of Google Apps, then Signal app is not an option. Regardless whether open source clones are possible, you know communications utility comes down to the network itself too (Metcalfe's Law) and holding one tin can, with a dangling piece of string and no one on the other end is rather useless. Now Signal has captured the whole user base, there's large costs in changing. Anyway, your code, your call. I think the key thing, is that people were surprised. Closed distribution models and controlled ecosystems, coming from a company purporting itself as being Open (and not meaning to be personal, but by a guy calling himself an anarchist), was not what people thought they'd been promoting. We don't think you're everything bad in the world. We just wish that using Signal was an option.

dlmetcalf 10y ago
Regarding entitlement, it's not just an advertising company the 'product' is tied to. Google is of course one of the most aggressive global profit-shifters for tax 'minimisation'. I would prefer to call it avoidance, as I can't see any other reason for it, but I don't have pockets deep enough for the legal defense to use a word like that (or evasion).
- dlmetcalf 10y ago
  I wonder who voted this down. I didn't know Google tax lawyers hung out on Hacker News. PR bot? http://www.taxjustice.net/tag/google/ http://www.taxjustice.net/tag/google/
dlmetcalf 10y ago
It's ironic that WhatsApp runs fine on open source Android, but Signal won't. Are you _sure_ that wasn't part of the deal @moxie? ;)
laughinghan 10y ago
"You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat." Wait what? Because what they did was illegal, to ask them to stop is to threaten legal action? A: "Hey, you just hit me, can you stop?" B: "Oh sorry we'll stop." C: "Gosh, you didn't have threaten them with legal action!" A: "What when did I do that" C: "You know full well assault is a criminal offense and the government could prosecute with or without your consent. There's also an open ended civil claim you'd now have against them."
- dlmetcalf 10y ago
  I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106 https://twitter.com/LauriLoveX/status/733137222539567106 i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms. It's not like LibreSignal were doing anything particularly different to Desktop. LibreSignal would have been thrilled to have just had it upstreamed anyway. How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic. Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected? Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network. Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community. The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.