4 ms·

Moxie was against people publishing the official Signal app (rebuilt) on F-Droid specifically because he was against the idea that ordinary users would be expos

by cyphar 8y ago

Moxie was against people publishing the official Signal app (rebuilt) on F-Droid specifically because he was against the idea that ordinary users would be exposed to a minor fork of Signal (which would then require them to co-ordinate changes between the two forks). I would be very shocked if he would be any nicer about someone writing an entirely new app from scratch that uses their protocol and inter-operates with their servers. Because then Signal on F-Droid wouldn't have been an issue.

tialaramex 8y ago
Right. You're entirely welcome to use Signal's excellent protocol to go build your own thing. "Simias Comms One Thousand" or whatever. You can have that connected to IRC, or interoperate with ICQ, or whatever other nonsense you want. In doing so obviously you destroy most of the upsides of the Signal design, but whatever - your choice. However you can't label this "Better Signal" (they own a trademark on the Signal name) or connect it to Signal's network.
- cyphar 8y ago
  > However you can't [...] connect it to Signal's network. Which is precisely what this thread is talking about.
- simias 8y ago
  >You can have that connected to IRC, or interoperate with ICQ, or whatever other nonsense you want. In doing so obviously you destroy most of the upsides of the Signal design, but whatever - your choice. What I had in mind was to make a gateway that would act as an IRC server, not client. Basically I'd run it alongside my usual IRC client and use it to access Signal discussions using the same interface that I already use to browse IRC. The IRC connection would be local and completely trusted so as far as I understand it nothing would be "destroyed". Alternatively I could just write an irssi plugin that would directly connect to Signal for instance. Basically what I want is to use Signal as it is today but with a different UI. I don't want to tweak the protocol or anything like that and I'm perfectly happy using a Signal-sanctioned implementation of the protocol. I suppose they could forbid non-official clients to connect to the network (although I'm not sure why they would care) but then since as far as I know the server-side software is not available in any form it's not like I can rehost it anyway.
  - tialaramex 8y ago
    I agree that your local server IRC doesn't obviously make the security story much worse (although it does throw an entire IRC client into the mix which isn't good news security wise). In practice I suspect that if you just build this and use it, that will actually work. If you make a big song and dance, I suspect Moxie will tell you this is not allowed.
    - simias 8y ago
      >I agree that your local server IRC doesn't obviously make the security story much worse (although it does throw an entire IRC client into the mix which isn't good news security wise). Irssi's codebase is probably a tiny, tiny fraction of the electron framework and it's super stable these days. Meanwhile didn't Signal suffer an HTML tag injection vulnerability a while ago? But anyway, that's besides the point. >In practice I suspect that if you just build this and use it, that will actually work. If you make a big song and dance, I suspect Moxie will tell you this is not allowed. Okay I see. I hope eventually they'll open the door a little so that we'll be able to build around the application in broad daylight. But hey, that's their project and they give it out for free so who am I to complain? Maybe one day I'll seriously consider implementing Simias Comms 1000 (tm). Thank you for the feedback.

by cyphar 8y ago

tialaramex 8y ago

Right. You're entirely welcome to use Signal's excellent protocol to go build your own thing. "Simias Comms One Thousand" or whatever. You can have that connected to IRC, or interoperate with ICQ, or whatever other nonsense you want. In doing so obviously you destroy most of the upsides of the Signal design, but whatever - your choice. However you can't label this "Better Signal" (they own a trademark on the Signal name) or connect it to Signal's network.

cyphar 8y ago
> However you can't [...] connect it to Signal's network. Which is precisely what this thread is talking about.
simias 8y ago
>You can have that connected to IRC, or interoperate with ICQ, or whatever other nonsense you want. In doing so obviously you destroy most of the upsides of the Signal design, but whatever - your choice. What I had in mind was to make a gateway that would act as an IRC server, not client. Basically I'd run it alongside my usual IRC client and use it to access Signal discussions using the same interface that I already use to browse IRC. The IRC connection would be local and completely trusted so as far as I understand it nothing would be "destroyed". Alternatively I could just write an irssi plugin that would directly connect to Signal for instance. Basically what I want is to use Signal as it is today but with a different UI. I don't want to tweak the protocol or anything like that and I'm perfectly happy using a Signal-sanctioned implementation of the protocol. I suppose they could forbid non-official clients to connect to the network (although I'm not sure why they would care) but then since as far as I know the server-side software is not available in any form it's not like I can rehost it anyway.
- tialaramex 8y ago
  I agree that your local server IRC doesn't obviously make the security story much worse (although it does throw an entire IRC client into the mix which isn't good news security wise). In practice I suspect that if you just build this and use it, that will actually work. If you make a big song and dance, I suspect Moxie will tell you this is not allowed.
  - simias 8y ago
    >I agree that your local server IRC doesn't obviously make the security story much worse (although it does throw an entire IRC client into the mix which isn't good news security wise). Irssi's codebase is probably a tiny, tiny fraction of the electron framework and it's super stable these days. Meanwhile didn't Signal suffer an HTML tag injection vulnerability a while ago? But anyway, that's besides the point. >In practice I suspect that if you just build this and use it, that will actually work. If you make a big song and dance, I suspect Moxie will tell you this is not allowed. Okay I see. I hope eventually they'll open the door a little so that we'll be able to build around the application in broad daylight. But hey, that's their project and they give it out for free so who am I to complain? Maybe one day I'll seriously consider implementing Simias Comms 1000 (tm). Thank you for the feedback.