9 ms·

The F-Droid argument is the strongest and most evident among all. I don't trust Google, I don't trust Play. The main point is, Moxie could take the wind out of

by lez 8y ago

The F-Droid argument is the strongest and most evident among all. I don't trust Google, I don't trust Play. The main point is, Moxie could take the wind out of the sails of literally all arguments in this page by publishing Signal on F-Droid but he just won't. This alone is enough for me to lose trust in Signal.

s73v3r_ 8y ago
Are you going to pay for him to do that?
- krn 8y ago
  And who is paying for Signal to be on Google Play?
  - jethro_tell 8y ago
    google, facebook, whats app, microsoft. Basically the companies that pay for signal end to end encryption in their chat apps. There are, I'm sure, apps that are better, and that's never been moxie's goal. He's said it over and over that he'd rather have encryption for the masses than the perfect messaging app. It seems disingenuous to assume that he's acting in bad faith when he's clearly doing exactly what he said he wanted to do. If you want to make the prefect, self-hosted, chat eco system, fire up that matrix server and invite your non tech friends to join. I'm sure that will work out incredibly well. In the mean time, Moxie seems to realize that to accomplish his goal and make communication incrementally more secure for average users, he needs to go where the users are. It's crazy to me that people still think that secure communication is a technical problem. We've had GPG for the competent for a long time. The hard problems in secure communication are about using the eco systems that are available to large groups of average users and still being secure.
    - xvector 8y ago
      Pushing an app out to F-Droid is trivial. There is literally no defense for only using Google Play and unsigned binaries on his own website.
      - jethro_tell 8y ago
        I believe that to use the same app, he requires google play? Am i missing something? You can export the app yourself from google play and it doesn't run unless you have google play installed. Am I missing something?
        Vinnl 8y ago
        Does "the same app" refer to Signal? If so, you an run it without having Google Play installed (though it will be more battery-hungry), and download the APK yourself.
      - leshow 8y ago
        Build the code yourself
  - s73v3r_ 8y ago
    Google Play is the default.
- 394549 8y ago
  > Are you going to pay for him to do that? I donated some money to them a while back. How hard could it be to push the binaries out to a second app store?
  - abawany 8y ago
    I published an app on F-Droid once: it is a very light-weight process. One gives them access to the open source repo where the code is with build instructions and they then take care of pulling updates and publishing new versions.
    - barbs 8y ago
      That process can be more complicated than it seems. I tried to publish my open-source game on F-Droid, but the build process involves building native components with a specific third-party version of the NDK toolchain, as well as shell scripts to move files around, so it never made it to the store.
- conradev 8y ago
  The Signal Foundation has 50 million dollars.
dublinben 8y ago
They've already made the APK available directly on their website for over a year now.[0][1] It works just fine (albeit a little heavy on battery usage) without the Google Play Store or Google Play Services. What more do you really want? [0]https://signal.org/android/apk/ https://signal.org/android/apk/ [1]https://whispersystems.discoursehosting.net/t/how-to-get-signal-apks-outside-of-the-google-play-store/808/15 https://whispersystems.discoursehosting.net/t/how-to-get-sig...
- mhkool 8y ago
  The article is clear: download from the Signal site is not secure.
  - vajrabum 8y ago
    Checksummed but not signed.
    - lordlimecat 8y ago
      SSL provides integrity guarantees.
      - zzzcpan 8y ago
        Only a bit of transport level integrity. But it doesn't make your average hosting provider into a high assurance one or its servers, OSes, software stacks, etc. Quite known problem since the cryptocurrency era.
        lordlimecat 8y ago
        Which is maybe why Moxie is encouraging people to rely on Google Play Store. If you are so concerned about state-level actors that play store is untenable to you, signal and android on commodity hardware are probably not the solutions you want anyways.
        UncleMeat 8y ago
dvfjsdhgfv 8y ago
What I don't understand is why he's not doing that in spite of the fact that he could still keep control over Signal easily. One minor modification of the app and a forced upgrade would do the trick and render the F-Droid copies useless. The competition has been forcing users to upgrade in this way for a couple of years now. So I don't understand what he's afraid of.
lordlimecat 8y ago
Maybe Moxie doesnt see it as his problem to address concerns of non-contributing critics. Are there any identified, non-state-level actor threats here, or is this just an ideological rant against proprietary software? If state-level actors are your concern, using android means you have already lost.
- Sir_Cmpwn 8y ago
  Moxie doesn't address the concerns of conctributors, either. Here's one from this very comment thread: https://news.ycombinator.com/item?id=17724893 https://news.ycombinator.com/item?id=17724893 Others have emailed me as well, thanking me for putting to words what they felt afraid to for fear of retribution from "Moxie and his religious following" (direct quote).
  - tptacek 8y ago
    This kind of innuendo is beneath this thread.
    - ddevault 8y ago
      What kind of innuendo? I don't understand.
    - alexnewman 8y ago
      This is a logical fallacy
      - tptacek 8y ago
        Do go on.
geofft 8y ago
This seems more like "I disagree with Moxie," not "I don't trust Moxie," unless there's some allegation that Moxie is in cahoots with Google. I can trust people that I think made incorrect technical decisions, because I can see that they made a decision for technical reasons and have different priorities and reasoned soundly.
leshow 8y ago
It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You have to root your device to run it, allow third party code. Those are all security concerns too. It was posted elsewhere but here's Moxie's take: https://github.com/signalapp/Signal-Android/issues/127#issuecomment-13335689 https://github.com/signalapp/Signal-Android/issues/127#issue...
- abawany 8y ago
  You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.
- BubuIIC 8y ago
  > You have to root your device to run it, allow third party code. Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid. Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.
- Hello71 8y ago
  > You have to root your device to run it wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions. > allow third party code that's called running apps. tl;dr nice FUD.
  - angry_octet 8y ago
    'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.
philipov 8y ago
Nah, people will just accuse him of publishing different binaries, or find something else to be upset about. You can't win against concern trolling by giving in to their demands. They just manufacture new demands, and all you do is waste your own resources. Haters are gonna hate, so you're better off ignoring them and focussing on your own vision.

by lez 8y ago

s73v3r_ 8y ago

Are you going to pay for him to do that?

krn 8y ago
And who is paying for Signal to be on Google Play?
- jethro_tell 8y ago
  google, facebook, whats app, microsoft. Basically the companies that pay for signal end to end encryption in their chat apps. There are, I'm sure, apps that are better, and that's never been moxie's goal. He's said it over and over that he'd rather have encryption for the masses than the perfect messaging app. It seems disingenuous to assume that he's acting in bad faith when he's clearly doing exactly what he said he wanted to do. If you want to make the prefect, self-hosted, chat eco system, fire up that matrix server and invite your non tech friends to join. I'm sure that will work out incredibly well. In the mean time, Moxie seems to realize that to accomplish his goal and make communication incrementally more secure for average users, he needs to go where the users are. It's crazy to me that people still think that secure communication is a technical problem. We've had GPG for the competent for a long time. The hard problems in secure communication are about using the eco systems that are available to large groups of average users and still being secure.
  - xvector 8y ago
    Pushing an app out to F-Droid is trivial. There is literally no defense for only using Google Play and unsigned binaries on his own website.
    - jethro_tell 8y ago
      I believe that to use the same app, he requires google play? Am i missing something? You can export the app yourself from google play and it doesn't run unless you have google play installed. Am I missing something?
      - Vinnl 8y ago
        Does "the same app" refer to Signal? If so, you an run it without having Google Play installed (though it will be more battery-hungry), and download the APK yourself.
    - leshow 8y ago
      Build the code yourself
- s73v3r_ 8y ago
  Google Play is the default.
394549 8y ago
> Are you going to pay for him to do that? I donated some money to them a while back. How hard could it be to push the binaries out to a second app store?
- abawany 8y ago
  I published an app on F-Droid once: it is a very light-weight process. One gives them access to the open source repo where the code is with build instructions and they then take care of pulling updates and publishing new versions.
  - barbs 8y ago
    That process can be more complicated than it seems. I tried to publish my open-source game on F-Droid, but the build process involves building native components with a specific third-party version of the NDK toolchain, as well as shell scripts to move files around, so it never made it to the store.
conradev 8y ago
The Signal Foundation has 50 million dollars.

dublinben 8y ago

They've already made the APK available directly on their website for over a year now.[0][1] It works just fine (albeit a little heavy on battery usage) without the Google Play Store or Google Play Services. What more do you really want? [0]https://signal.org/android/apk/ https://signal.org/android/apk/ [1]https://whispersystems.discoursehosting.net/t/how-to-get-signal-apks-outside-of-the-google-play-store/808/15 https://whispersystems.discoursehosting.net/t/how-to-get-sig...

mhkool 8y ago
The article is clear: download from the Signal site is not secure.
- vajrabum 8y ago
  Checksummed but not signed.
  - lordlimecat 8y ago
    SSL provides integrity guarantees.
    - zzzcpan 8y ago
      Only a bit of transport level integrity. But it doesn't make your average hosting provider into a high assurance one or its servers, OSes, software stacks, etc. Quite known problem since the cryptocurrency era.
      - lordlimecat 8y ago
        Which is maybe why Moxie is encouraging people to rely on Google Play Store. If you are so concerned about state-level actors that play store is untenable to you, signal and android on commodity hardware are probably not the solutions you want anyways.
      - UncleMeat 8y ago

dvfjsdhgfv 8y ago

What I don't understand is why he's not doing that in spite of the fact that he could still keep control over Signal easily. One minor modification of the app and a forced upgrade would do the trick and render the F-Droid copies useless. The competition has been forcing users to upgrade in this way for a couple of years now. So I don't understand what he's afraid of.

lordlimecat 8y ago

Maybe Moxie doesnt see it as his problem to address concerns of non-contributing critics. Are there any identified, non-state-level actor threats here, or is this just an ideological rant against proprietary software? If state-level actors are your concern, using android means you have already lost.

Sir_Cmpwn 8y ago
Moxie doesn't address the concerns of conctributors, either. Here's one from this very comment thread: https://news.ycombinator.com/item?id=17724893 https://news.ycombinator.com/item?id=17724893 Others have emailed me as well, thanking me for putting to words what they felt afraid to for fear of retribution from "Moxie and his religious following" (direct quote).
- tptacek 8y ago
  This kind of innuendo is beneath this thread.
  - ddevault 8y ago
    What kind of innuendo? I don't understand.
  - alexnewman 8y ago
    This is a logical fallacy
    - tptacek 8y ago
      Do go on.

geofft 8y ago

This seems more like "I disagree with Moxie," not "I don't trust Moxie," unless there's some allegation that Moxie is in cahoots with Google. I can trust people that I think made incorrect technical decisions, because I can see that they made a decision for technical reasons and have different priorities and reasoned soundly.

leshow 8y ago

It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You have to root your device to run it, allow third party code. Those are all security concerns too. It was posted elsewhere but here's Moxie's take: https://github.com/signalapp/Signal-Android/issues/127#issuecomment-13335689 https://github.com/signalapp/Signal-Android/issues/127#issue...

abawany 8y ago
You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.
BubuIIC 8y ago
> You have to root your device to run it, allow third party code. Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid. Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.
Hello71 8y ago
> You have to root your device to run it wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions. > allow third party code that's called running apps. tl;dr nice FUD.
- angry_octet 8y ago
  'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.

philipov 8y ago

Nah, people will just accuse him of publishing different binaries, or find something else to be upset about. You can't win against concern trolling by giving in to their demands. They just manufacture new demands, and all you do is waste your own resources. Haters are gonna hate, so you're better off ignoring them and focussing on your own vision.