7 ms·
> Moxie forbids you from distributing branded builds of the Signal app ... Having multiple branded builds to choose from would be a terrible thing and would ea
by move-on-by 8y ago
> Moxie forbids you from distributing branded builds of the Signal app ...
Having multiple branded builds to choose from would be a terrible thing and would easily allow fake apps to gain traction.
> ... and if you rebrand he forbids you from using the official Open Whisper servers.
This seems pretty fair to me. Not only could you abuse their resources, it would greatly hinder their ability to make changes and respond to protocol-level security threats. They aren't in the API business, controlling their ecosystem allows them to make forward progress without concern for 3rd parties that they have no control over. And still there is the issue of 3rd parties abusing their server resources.
- hutzlibu 8y ago"Having multiple branded builds to choose from would be a terrible thing and would easily allow fake apps to gain traction" In this particular case, not likely. People who are into more secure communication do not randomly click on anything. They know what they are doing, or get it installed from people they trust. And if they don't - their fault. Not Signals. And Signal can continue to work and introduce breaking changes whenever they want. They simply only support the official build of Signal. Any person using anything different, cannot complain, if things stop working. (they will anyway, sure) And the ressouce-abuse. Can this really be a thing? I don't know in detail how the protocol works, but what can I do with the servers, I can't do with Signal anyway? Sending (encrypted) data from A to B. I can allready abuse that today, if I want.
- move-on-by 8y ago> People who are into more secure communication do not randomly click on anything I think you overestimate people. I told my wife to install Signal because she needed a password for something and it was way to complicated for her to remember. I know what the signal app is and could likely avoid fakes - she would not. I think it is often the case that only one party of the conversation is security minded, while the others just trust that person. > And the ressouce-abuse. Can this really be a thing? You know NTP, the protocol for sharing what time it is? That gets abused badly [1]. If you have an open service, there are ways it can be abused. This would without a doubt lead to DDoS-like resource abuse where lazy clients don't cache things properly and just hog server resources. There are ways to limit things like that- but they aren't always simple. Also, like I said before, Signal isn't in the API business. [1] https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse
- hutzlibu 8y agoPeople who do click on the wrong "Signal" probably clicked on many other wrong things, too. Their Security is not existent anyway, even if they accidently use the official Signal build.
- zaarn 8y agoSo because a user clicked on a wrong thing we should completely abandon them and ignore all their security and privacy needs?
- hutzlibu 8y agoNope, but we should not limit the freedom of other users, who know what they are doing, because of some, who do not.
- zaarn 8y agoI heavily disagree. If we want to protect as much people as possible we will have to limit the freedom of some users to do as they want because other users will accidentally or intentionally abuse the freedoms given. Not limiting freedom of the user because they know what they are doing at the expense of others is maximizing the protection and freedom of a small group, not society as a whole.
- s73v3r_ 8y ago" People who are into more secure communication do not randomly click on anything." That's not the sole market of people who would try Signal, though.
- acdha 8y ago> People who are into more secure communication do not randomly click on anything Even if that wasn't wrong, it would be a fatal limitation for a social app which relies on network effects. Even if you were actually super-humanly capable of not making mistakes you'd end up using the apps that everyone else you know is actually on.
- lez 8y agoThe F-Droid argument is the strongest and most evident among all. I don't trust Google, I don't trust Play. The main point is, Moxie could take the wind out of the sails of literally all arguments in this page by publishing Signal on F-Droid but he just won't. This alone is enough for me to lose trust in Signal.
- s73v3r_ 8y agoAre you going to pay for him to do that?
- krn 8y agoAnd who is paying for Signal to be on Google Play?
- jethro_tell 8y agogoogle, facebook, whats app, microsoft. Basically the companies that pay for signal end to end encryption in their chat apps. There are, I'm sure, apps that are better, and that's never been moxie's goal. He's said it over and over that he'd rather have encryption for the masses than the perfect messaging app. It seems disingenuous to assume that he's acting in bad faith when he's clearly doing exactly what he said he wanted to do. If you want to make the prefect, self-hosted, chat eco system, fire up that matrix server and invite your non tech friends to join. I'm sure that will work out incredibly well. In the mean time, Moxie seems to realize that to accomplish his goal and make communication incrementally more secure for average users, he needs to go where the users are. It's crazy to me that people still think that secure communication is a technical problem. We've had GPG for the competent for a long time. The hard problems in secure communication are about using the eco systems that are available to large groups of average users and still being secure.
- xvector 8y agoPushing an app out to F-Droid is trivial. There is literally no defense for only using Google Play and unsigned binaries on his own website.