3 ms·

Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you sh

by opmac 8y ago

Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.

seba_dos1 8y ago
> (you should be!) I don't see how going from one IM silo to another just because it's encrypted is going to help with anything. Especially one that's hostile towards alternative clients. I'm using XMPP with OMEMO, as I should be :P
- bcaa7f3a8bbc 8y ago
  As soon as I saw the Signal client was a web browser disguised as a desktop application, I have expected the discovery of similar issues. But as I only use Signal as an upgraded version of Plain Old Telephone for secure communication of the common people (I guess this is why the OP said "you should", not as an attack to other chats, because it serves a purpose), only talk to those people who knew my personal phone number, I didn't worry it too much. For other communications, I use PGP+E-mail, OTR/OMEMO+XMPP, IRC, Matrix, etc.
- opmac 8y ago
  OMEMO actually implemented the double-ratchet algorithm developed as part of the Signal Protocol. Signal, in my eyes, is still the benchmark for balance between usability and security. That's fine if you prefer XMPP w/ OMEMO, and it's arguably just as secure. ...but it's unfair to call Signal another IM silo that's "hostile" towards other clients. Signal is 100% open source, along with the Signal Protocol which powers it all. It is community supported and wholly dedicated to brining cryptography to everybody. The latest implementation of OMEMO as it exists today would not be what it is without Signal.
  - seba_dos1 8y ago
    Sure, Signal contributed back to the whole IM scene some very useful things, I'm grateful for that. That still won't make me use or recommend their network, as they actively request alternative clients to stop using their servers and are just yet another, centralized network that can just go away at any moment. In Poland I don't see many people using Signal yet. I'm recommending Conversations to anyone who asks, which doesn't seem far away in terms of usability. On desktop it's a bit worse (I mean, I'm very comfy with my Psi, but wouldn't recommend it to a random person on the street), however Dino looks very promising and might fill that niche soon.
    - sicco 8y ago
      A relevant blogpost by Moxie about why the Signal app uses a centralized model (and thus doesn't allow other apps to connect to their servers): https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ Still all code is open source and Signal's code does support federation. Moxie stated before that you can take the code and start a federated version of Signal if you want.
      - seba_dos1 8y ago
        Of course you can. That won't be Signal though, just an another network using its code, and there's already XMPP, so there's no need for that. > (and thus doesn't allow other apps to connect to their servers) "thus"? You can easily use centralized model and allow the client ecosystem to thrive. You don't have to do much, just don't actively prohibit them. And I know the blog post, it isn't very convincing.
- BostonEnginerd 8y ago
  I agree with you that OMEMO + XMPP is much preferred, however the on boarding process for that is significantly more challenging compared to Signal (Download App, Start Messaging). I've managed to get a fair amount of my friends and family to go the Signal route. It's a compromise, but one that I'll live with for now. Encrypted Open Source Messaging > Non-encrypted messaging
AnaniasAnanas 8y ago
> (you should be!) Too bad, I don't have a phone. I never understood why Moxie thought that only allowing phone users would be a good idea. Also, considering how Moxie is against other clients (see the libresignal case) and at the same time considering that Signal is centralised (and Moxie refuses to federate) I would argue that you should not be using it.

by opmac 8y ago

Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.

seba_dos1 8y ago

> (you should be!) I don't see how going from one IM silo to another just because it's encrypted is going to help with anything. Especially one that's hostile towards alternative clients. I'm using XMPP with OMEMO, as I should be :P

bcaa7f3a8bbc 8y ago
As soon as I saw the Signal client was a web browser disguised as a desktop application, I have expected the discovery of similar issues. But as I only use Signal as an upgraded version of Plain Old Telephone for secure communication of the common people (I guess this is why the OP said "you should", not as an attack to other chats, because it serves a purpose), only talk to those people who knew my personal phone number, I didn't worry it too much. For other communications, I use PGP+E-mail, OTR/OMEMO+XMPP, IRC, Matrix, etc.
opmac 8y ago
OMEMO actually implemented the double-ratchet algorithm developed as part of the Signal Protocol. Signal, in my eyes, is still the benchmark for balance between usability and security. That's fine if you prefer XMPP w/ OMEMO, and it's arguably just as secure. ...but it's unfair to call Signal another IM silo that's "hostile" towards other clients. Signal is 100% open source, along with the Signal Protocol which powers it all. It is community supported and wholly dedicated to brining cryptography to everybody. The latest implementation of OMEMO as it exists today would not be what it is without Signal.
- seba_dos1 8y ago
  Sure, Signal contributed back to the whole IM scene some very useful things, I'm grateful for that. That still won't make me use or recommend their network, as they actively request alternative clients to stop using their servers and are just yet another, centralized network that can just go away at any moment. In Poland I don't see many people using Signal yet. I'm recommending Conversations to anyone who asks, which doesn't seem far away in terms of usability. On desktop it's a bit worse (I mean, I'm very comfy with my Psi, but wouldn't recommend it to a random person on the street), however Dino looks very promising and might fill that niche soon.
  - sicco 8y ago
    A relevant blogpost by Moxie about why the Signal app uses a centralized model (and thus doesn't allow other apps to connect to their servers): https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ Still all code is open source and Signal's code does support federation. Moxie stated before that you can take the code and start a federated version of Signal if you want.
    - seba_dos1 8y ago
      Of course you can. That won't be Signal though, just an another network using its code, and there's already XMPP, so there's no need for that. > (and thus doesn't allow other apps to connect to their servers) "thus"? You can easily use centralized model and allow the client ecosystem to thrive. You don't have to do much, just don't actively prohibit them. And I know the blog post, it isn't very convincing.
BostonEnginerd 8y ago
I agree with you that OMEMO + XMPP is much preferred, however the on boarding process for that is significantly more challenging compared to Signal (Download App, Start Messaging). I've managed to get a fair amount of my friends and family to go the Signal route. It's a compromise, but one that I'll live with for now. Encrypted Open Source Messaging > Non-encrypted messaging

AnaniasAnanas 8y ago

> (you should be!) Too bad, I don't have a phone. I never understood why Moxie thought that only allowing phone users would be a good idea. Also, considering how Moxie is against other clients (see the libresignal case) and at the same time considering that Signal is centralised (and Moxie refuses to federate) I would argue that you should not be using it.