6 ms·

There are a lot of people on this thread crapping on Signal for its various flaws and downsides. It's nice to be smarter and more informed than everyone, but fo

There are a lot of people on this thread crapping on Signal for its various flaws and downsides. It's nice to be smarter and more informed than everyone, but for the rest of us we really need advice about what we SHOULD do if we want a baseline amount of privacy from mass surveillance. I'm honestly asking here--I don't have the knowledge that many in this community do about the exact risk of Signal requiring Google Play Services for example. If Signal isn't the answer, what should I and others use who require a usable, reasonably accessible to non-tech-professionals solution?

thatcat 10y ago
MicroG can replace play services if that is your concern. previous discussion: https://news.ycombinator.com/item?id=12864429 https://news.ycombinator.com/item?id=12864429
xjfkekxmmf 10y ago
The Tox project is specifically designed to meet your usability requirements. There were also forks of Signal which fixed the privacy issues, however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist.
- ekidd 10y ago
  however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist Would you be kind enough to provide links? I can't find any information about this claim via Google, and Signal is distributed under the GPLv3, which grants rights to fork and modify it: https://github.com/WhisperSystems/Signal-Android https://github.com/WhisperSystems/Signal-Android
  - xjfkekxmmf 10y ago
    https://github.com/LibreSignal/LibreSignal https://github.com/LibreSignal/LibreSignal
    - ekidd 10y ago
      Thank you! tl;dr: You can fork the Signal code if you want, but if you do, Moxie Marlinspike asks you to change the app name and run your own servers. The server source code appears to be available at https://github.com/WhisperSystems/Signal-Server https://github.com/WhisperSystems/Signal-Server, but I've heard it doesn't include the voice component. So, for example, if you think that Signal ought to support a feature like iMessage's "Invisible Ink" (https://mic.com/articles/146347/i-os-10-s-invisible-ink-feature-is-stealthy-af-here-s-how-to-send-a-hidden-message https://mic.com/articles/146347/i-os-10-s-invisible-ink-feat...), which Moxie has specifically refused to support (https://github.com/WhisperSystems/Signal-Android/issues/5103 https://github.com/WhisperSystems/Signal-Android/issues/5103), then you can't just fork the client, implement it yourself, and use the new client normally, because you'd no longer be able to talk to regular Signal client if I understand correctly. I mean, even if you figured out a way for two clients to tell each other whether or not the feature was available. So Signal is open source, but not in a way that's useful if you want to change something. I don't want to discourage people from using Signal. It's a great app. But I thought this was worth pointing out, assuming the LibreSignal is representative of what will happen if people want to make changes to their client.
      - woah 10y ago
        I didn't realize that open source licenses required the maintainers to run infrastructure for you.
        Jarwain 10y ago
        The big issue with maintenance is if the fork wants to continue using OWS servers and continue being able to communicate with 'normal' Signal users
        bad_user 10y ago
        Open source requires the ability to fork and Signal isn't forkable.
        10y ago
- Forbo 10y ago
  I think it is important to note that Tox is still considered alpha. From their own wiki's FAQ: "Tox is by no means complete. You may encounter bugs ranging from simple visual defects to segfaults on file shares. We cannot guarantee what works today will work tomorrow; Tox is an alpha program and code changes daily. Certain commits may break existing APIs, and we strive to give proper advanced warning to all client developers, etc. when such changes will be made. Additionally, Tox has not yet received a full security audit. While we believe Tox is secure against attackers who want to decrypt your messages, you may wish to use a more established solution if you are in a life-or-death situation." If you're in a life-or-death situation, I think you really ought to be doing some intensive research into secure communications to find the solution that will work best for you.
- Jarwain 10y ago
  My understanding of the issues with the Signal forks was mainly the inclusion of the word 'Signal' in the name, resulting in brand confusion by more casual users.
- Manozco 10y ago
  He did not ordered any cease and desists, he just asked them to use another infrastructure. If you don't like Signal, absolutely nothing prevents you to fork the client AND the server to run something new. I don't expect debian to provide me CI/repo/mailing-list servers if I decide to fork them.
hannob 10y ago
Use Signal. It's the best you can get right now. I understand all the concerns people have about Signal and I share most of them. But these discussions really are for people who want to build something better, not for people who look for something they can use now.

thatcat 10y ago

MicroG can replace play services if that is your concern. previous discussion: https://news.ycombinator.com/item?id=12864429 https://news.ycombinator.com/item?id=12864429

xjfkekxmmf 10y ago

The Tox project is specifically designed to meet your usability requirements. There were also forks of Signal which fixed the privacy issues, however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist.

ekidd 10y ago
however Moxie Marlinspike (the founder of Open Whisper Systems) ordered them to cease and desist Would you be kind enough to provide links? I can't find any information about this claim via Google, and Signal is distributed under the GPLv3, which grants rights to fork and modify it: https://github.com/WhisperSystems/Signal-Android https://github.com/WhisperSystems/Signal-Android
- xjfkekxmmf 10y ago
  https://github.com/LibreSignal/LibreSignal https://github.com/LibreSignal/LibreSignal
  - ekidd 10y ago
    Thank you! tl;dr: You can fork the Signal code if you want, but if you do, Moxie Marlinspike asks you to change the app name and run your own servers. The server source code appears to be available at https://github.com/WhisperSystems/Signal-Server https://github.com/WhisperSystems/Signal-Server, but I've heard it doesn't include the voice component. So, for example, if you think that Signal ought to support a feature like iMessage's "Invisible Ink" (https://mic.com/articles/146347/i-os-10-s-invisible-ink-feature-is-stealthy-af-here-s-how-to-send-a-hidden-message https://mic.com/articles/146347/i-os-10-s-invisible-ink-feat...), which Moxie has specifically refused to support (https://github.com/WhisperSystems/Signal-Android/issues/5103 https://github.com/WhisperSystems/Signal-Android/issues/5103), then you can't just fork the client, implement it yourself, and use the new client normally, because you'd no longer be able to talk to regular Signal client if I understand correctly. I mean, even if you figured out a way for two clients to tell each other whether or not the feature was available. So Signal is open source, but not in a way that's useful if you want to change something. I don't want to discourage people from using Signal. It's a great app. But I thought this was worth pointing out, assuming the LibreSignal is representative of what will happen if people want to make changes to their client.
    - woah 10y ago
      I didn't realize that open source licenses required the maintainers to run infrastructure for you.
      - Jarwain 10y ago
        The big issue with maintenance is if the fork wants to continue using OWS servers and continue being able to communicate with 'normal' Signal users
      - bad_user 10y ago
        Open source requires the ability to fork and Signal isn't forkable.
        10y ago
Forbo 10y ago
I think it is important to note that Tox is still considered alpha. From their own wiki's FAQ: "Tox is by no means complete. You may encounter bugs ranging from simple visual defects to segfaults on file shares. We cannot guarantee what works today will work tomorrow; Tox is an alpha program and code changes daily. Certain commits may break existing APIs, and we strive to give proper advanced warning to all client developers, etc. when such changes will be made. Additionally, Tox has not yet received a full security audit. While we believe Tox is secure against attackers who want to decrypt your messages, you may wish to use a more established solution if you are in a life-or-death situation." If you're in a life-or-death situation, I think you really ought to be doing some intensive research into secure communications to find the solution that will work best for you.
Jarwain 10y ago
My understanding of the issues with the Signal forks was mainly the inclusion of the word 'Signal' in the name, resulting in brand confusion by more casual users.
Manozco 10y ago
He did not ordered any cease and desists, he just asked them to use another infrastructure. If you don't like Signal, absolutely nothing prevents you to fork the client AND the server to run something new. I don't expect debian to provide me CI/repo/mailing-list servers if I decide to fork them.

hannob 10y ago

Use Signal. It's the best you can get right now. I understand all the concerns people have about Signal and I share most of them. But these discussions really are for people who want to build something better, not for people who look for something they can use now.