5 ms·

libsignal-client – a Signal protocol implementation in Rust

57 points by mcp_ 6y ago

potiuper 6y ago
AGPL: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. This seems like a takedown vector - note the cryptographic country restrictions. https://en.wikipedia.org/wiki/Restrictions_on_the_import_of_cryptography https://en.wikipedia.org/wiki/Restrictions_on_the_import_of_... implies that if one were to host a program using this, the modified source would have to available within yellow or red countries as unlicensed individuals legally are not able to download the source from a server outside their country?
- monocasa 6y ago
  Hell yeah.
- kadoban 6y ago
  Pointing people to your github should satisfy the license.
justinsaccount 6y ago
Would this be of any use for writing bots?
- StavrosK 6y ago
  You can use signald and pysignald for bots, though the former is a bit of a moving target, making the latter hard to maintain.
- z77dj3kl 6y ago
  Yes, once this is more mature, it should make it easier to write Signal bots. You can already do quite a lot with this awesome project: https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli. It doesn't support everything though.
  - GekkePrutser 6y ago
    But moxie hates third-party software using his servers. Isn't this bound to die? Unless sometime sets up a truly open signal server infrastructure.
    - z77dj3kl 6y ago
      > But moxie hates third-party software using his servers. Does he? I doubt he really cares if some devs build a few projects around these kind of tools e.g. hobby projects. Either way, this project has existed for quite some time and the author has maintained it for quite some time now. It seems to be going strong.
      - GekkePrutser 6y ago
        He does, check this: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... He's very much opposed to other projects using either the name Signal or the servers they provide. LibreSignal abandoned their project because of his comment. No legal action was taken and I think this is why libsignal-client is still running. Open Whisper Systems never bothered to sue them, probably because it's only a fringe phenomenon right now. His opinion is clear though and it leaves it open to legal action in the future. I agree it is his perogative but I wish there was an actual open network. I don't like moving from one vendor-lock-in (whatsapp) to another (signal). I want something where I can do with my conversations what I want, like Matrix. For this reason I don't advocate Signal to my friends as an alternative for Whatsapp.
    - shezi 6y ago
      It is on the official Signal GitHub organisation, so it must have __some__ amount of blessing.
      - GekkePrutser 6y ago
        Oh ok I wasn't aware of that. I wonder why bridges like matrix-puppet-signal don't use it then. Because they currently run the full signal desktop app which is extremely wasteful if you're trying to run several bridges on your computer. From what I understood from the LibreSignal discussion: Open Whisper Systems provides the source for transparency only, not to enable others to make clients for their service. They're free to build their own servers (which obviously will be unable to communicate with official Signal users!) but not connect to Signal itself. The reason I keep pointing this out is that I'd really love for them to change their stance on this or at least allow federation from third-party Signal servers. It would really make it an open network. I don't want to move to something that is as locked-in as whatsapp as it is similarly dependent on their choices.
throwawa3495 6y ago
this encryption notice is beta af
zer0-c00l 6y ago
Thanks for writing it in Rust, otherwise it wouldn't have reached the HN frontpage and we wouldn't have known about it!

57 points by mcp_ 6y ago

AGPL: if you run a modified program on a server and let other users communicate with it there, your server must also allow them to download the source code corresponding to the modified version running there. This seems like a takedown vector - note the cryptographic country restrictions. https://en.wikipedia.org/wiki/Restrictions_on_the_import_of_cryptography https://en.wikipedia.org/wiki/Restrictions_on_the_import_of_... implies that if one were to host a program using this, the modified source would have to available within yellow or red countries as unlicensed individuals legally are not able to download the source from a server outside their country?

monocasa 6y ago
Hell yeah.
kadoban 6y ago
Pointing people to your github should satisfy the license.

justinsaccount 6y ago

Would this be of any use for writing bots?

StavrosK 6y ago
You can use signald and pysignald for bots, though the former is a bit of a moving target, making the latter hard to maintain.
z77dj3kl 6y ago
Yes, once this is more mature, it should make it easier to write Signal bots. You can already do quite a lot with this awesome project: https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli. It doesn't support everything though.
- GekkePrutser 6y ago
  But moxie hates third-party software using his servers. Isn't this bound to die? Unless sometime sets up a truly open signal server infrastructure.
  - z77dj3kl 6y ago
    > But moxie hates third-party software using his servers. Does he? I doubt he really cares if some devs build a few projects around these kind of tools e.g. hobby projects. Either way, this project has existed for quite some time and the author has maintained it for quite some time now. It seems to be going strong.
    - GekkePrutser 6y ago
      He does, check this: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... He's very much opposed to other projects using either the name Signal or the servers they provide. LibreSignal abandoned their project because of his comment. No legal action was taken and I think this is why libsignal-client is still running. Open Whisper Systems never bothered to sue them, probably because it's only a fringe phenomenon right now. His opinion is clear though and it leaves it open to legal action in the future. I agree it is his perogative but I wish there was an actual open network. I don't like moving from one vendor-lock-in (whatsapp) to another (signal). I want something where I can do with my conversations what I want, like Matrix. For this reason I don't advocate Signal to my friends as an alternative for Whatsapp.
  - shezi 6y ago
    It is on the official Signal GitHub organisation, so it must have __some__ amount of blessing.
    - GekkePrutser 6y ago
      Oh ok I wasn't aware of that. I wonder why bridges like matrix-puppet-signal don't use it then. Because they currently run the full signal desktop app which is extremely wasteful if you're trying to run several bridges on your computer. From what I understood from the LibreSignal discussion: Open Whisper Systems provides the source for transparency only, not to enable others to make clients for their service. They're free to build their own servers (which obviously will be unable to communicate with official Signal users!) but not connect to Signal itself. The reason I keep pointing this out is that I'd really love for them to change their stance on this or at least allow federation from third-party Signal servers. It would really make it an open network. I don't want to move to something that is as locked-in as whatsapp as it is similarly dependent on their choices.

throwawa3495 6y ago

this encryption notice is beta af

zer0-c00l 6y ago

Thanks for writing it in Rust, otherwise it wouldn't have reached the HN frontpage and we wouldn't have known about it!