4 ms·

The server code for Signal is so out of date. The last update publicly was April 2020 and people on their forums say certain features don't even work on it. So

The server code for Signal is so out of date. The last update publicly was April 2020 and people on their forums say certain features don't even work on it. So clearly whats on production is not whats on git publicly. It amazes me that they are being given a pass on this inspite of being so "transparent". If you can trust signal then you can trust telegram or whatsapp Take a look for here https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server Plenty of threads about people asking about updates or not being able to run it https://community.signalusers.org/t/wheres-the-server-source/19019 https://community.signalusers.org/t/wheres-the-server-source... https://community.signalusers.org/t/the-server-sources/10622 https://community.signalusers.org/t/the-server-sources/10622

the_other 6y ago
Even if you “trust” FB/WA, they’re still monetising a model of you and your friends, they expect you to update that model, and don’t share the profile from that model beyond letting you use the tools that update the model.
palebluedot 6y ago
If the Signal clients are using E2E encryption, then trusting the server code is significantly less important; the whole point is you don't need to trust the server. With Telegram, E2E encryption is not enabled in all modes, and is not the default.
- thejellypen 6y ago
  i think the point is if you cant see the code you dont know if its still E2E encrypted and you're just taking them for their word?
xurukefi 6y ago
1. The client is up-to-date on GitHub, which is a much better situation than with WhatsApp or Telegram. An outdated server code just gives you reason to distrust their metadata handling. 2. Trust is a bit more complicated than that. FB sells your data and Telegram is very shady in many more regards. The situation with Signal is completely different. 3. Even if the server code on GitHub was updated, what exactly would give you reason to believe that they run that version in production? Ultimately, you cannot trust the server. This can only be solved with decentralization.
- emptysongglass 6y ago
  This does not deal with the very real fact that Signal's server code is out of date by 9 months. Period. Telegram's closed-source server was used as a weapon against the Telegram community by Signal people for ages. But now that the shoe's on the other foot, let's be apologists. 2. Sources. Because all I see is Telegram protecting protestors in Belarus, Hong Kong, and Russia.
  - xurukefi 6y ago
    Signal is rightfully critiziced by people for their outdated server code. I'm just arguing that a) this does not make them as bad as WhatsApp or Telegram and b) updating the server code does not add as much trust as people tend to think. In fact, it's more of a symbolic act, because it does not give any strong technical guarantees.
- bilal4hmed 6y ago
  telegrams client code is also upto date on GitHub
  - akvadrako 6y ago
    Is it? A lot of people report problems compiling the iOS client without replies. It also has no licence in the repo or on the github page.
    - pdimitar 6y ago
      How is not having a license in the repo an argument against trusting Telegram though? I mean, the code is right there. Not like it's encrypted.
- SpaceRaccoon 6y ago
  All of Telegram's chat clients are open-source and they provide libraries and encourage people to develop new clients if they'd like.
- 6y ago
crossroadsguy 6y ago
For the last few years I have always rooted (or rather I hoped) for Matrix/Riot->Element. So much that for my recreational and token FOSS IM usage (because for mainstream conversation in my country it all has moved to WhatsApp) with select friends I made it a point to request/convince them to use Matrix. But when this WhatsApp T&C thingie happened I had to make a choice and ask all my friends and important IM contacts to move to Signal because let's face it Matrix is simply not usable for the average user as of now and I guess they will take forever to figure out Signal/WhatsApp and Slack/IRC/Zoom are not two different types of animals but are aliens to each other, especially from an end user's UX expectation point of view. So yeah it had to be Signal because no one was going to move to Wire or Threema. Telegram is perfect for casual groups like the ones which form off places like subreddits — e.g. my country's book/lit subreddit. Besides their apps are a couple of hundred kilometres ahead of others including WhatsApp. So as of now I am going to use Signal. Come 6-7 Feb, and I am deleting my WhatsApp account. Because I am pissed and as someone who deleted Fb, Instagram 6-7 years ago, I just don't want to accept that T&C even though I know Fb may get my data or would track me by using other means anyway. It'd be my personal tiny F.Y. to Zuck. Having said that Signal does and have always made me very uncomfortable: — It's headed literally by a benevolent dictator, and boy he does benevolent dictator. — After a while I literally gave up on trying to make sense of their feature/dev priority and delivery. — (As you've pointed out) Dev model of their server code is very much questionable and for an app that is "Signal", this thing has no reason, no excuse — it's either there in the open, regularly, and latest, or it's not. — It's centralized — a catastrophe waiting to happen (oh wait, a technical one just happened). Hell, Telegram and Signal both have open source apps (in fact I can make my own in case of Telegram but in case of Signal — naah!) and they both essentially have closed source servers (even if you discount that for a centralized service you don't know what's on the server). I really wish there was a Telegram like Matrix — esp. the UX — not like Signal/WhatsApp. https://builtformars.com/creating-an-account-with-signal/ https://builtformars.com/creating-an-account-with-signal/ this is good.
- saurik 6y ago
  As far as Facebook has explicitly stated, the reason for the "changes" to their terms and conditions was to be able to launch a feature where businesses with a Facebook page could use what amounts to a "hosted client" in order to do things like customer service or have chat bots and the such, all with multi-level permissions as you see with other platforms. This feature has been "a long time coming" (in that they have been talking about it publicly on their site for I think two years). You could argue that anyone could already technically (though against the terms of service) build such a service, so "end to end" only applies to a user's selection of their "end", but since Facebook is WhatsApp, a statement that Facebook never has access to X or Y or Z is no longer true, and so they carefully went through everything and adjusted those terms in a way that was confusing, totally forgetting that this is the Internet and no one would understand the nuance. The original big article about this had a statement from a Facebook representative about this that went out of its way to note that nothing was going to change for "non-business chats and account data", but almost no one seems to have even paid attention to what was actually going on or what was changing. I am betting that Facebook saying they are delaying this rollout now is going to include them spending more time on the wording to make it clearer (not that I bet the people who like to get upset about this stuff will read it carefully). > The move, the spokeswoman said, is part of a previously disclosed move to allow businesses to store and manage WhatsApp chats using Facebook's infrastructure. Users won't have to use WhatsApp to interact with the businesses and have the option of blocking the businesses. She said there will be no change in how WhatsApp shares provides data with Facebook for non-business chats and account data. Then, a couple days later, people were going crazy over an update to their security whitepaper that now supposedly claimed that Facebook no longer didn't not (double negative, sorry) have access to a chat's private keys... but the update was actually careful and rather specific to scope it correctly to this new hosted client for businesses feature, having the following paragraph, which seems to still be sufficient and carry the same goal as the removed sentence elsewhere. > All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. As far as I can tell, this change was blown entirely out of proportion into what almost feels like a hit on one of the few secure messenger options we have, and the only one that actually "works well" for all users, including true "end" users who barely understand what they are doing. Hell: WhatsApp is an interesting case of a product that was less secure before Facebook bought it and meddled, as it wasn't originally end-to-end encrypted! Now, I do appreciate the arguments from people who say "you can't trust the WhatsApp client, as it isn't open source". As a reverse engineer, I think people have a bit of a warped perspective of the value of this, as I can both easily show you how to hide a backdoor in an open source project that no one will question you on (just throw in a use after free bug with an info leak in your network stack) and also attest to how "easy" (for someone like me) it is to audit these things to at least surface verify it isn't doing something ridiculous in the general case (for all users, not for you in specific... but again: that is also true of the open source client!). That said, I really really do appreciate the point: this kind of software should be open source with secure reproducible builds, and it should have open protocols and alternative clients (which FWIW, Moxie doesn't believe in--he won't even allow Signal in F-Droid--but that's another argument). If someone wants to never use a program for this that isn't open source, I totally can buy into that belief system (though I am also going to hope they don't use an off-the-shelf closed source operating system, for some consistency). But... none of that changed two weeks ago. If you were happy with WhatsApp before two weeks ago, it seems like you should still be happy now. And if you weren't happy with WhatsApp before two weeks ago, I can't imagine you will ever be happy with WhatsApp. You, FWIW, sound like you might have been in the first category of people, not the second? You also just seem to despite Facebook to the point where it doesn't matter what they do, good or bad :(. Regardless, to the extent to which a subset of the second people tried to capitalize on uncertainty here to essentially misrepresent what was going on as a massive change, I want to say "shame on them", as that feels like dirty politics to me.
tailspin2019 6y ago
I agree with the concern of the server code being out-of-date. I know the consensus seems to be that it’s E2E so you “don’t need to trust the server”, but still as a principle it seems strange to be so out of date. Perhaps more importantly, I believe Signal doesn’t have reproducible builds for their iOS client app[0] * whereas, interestingly, it seems Telegram does [1]. For me, the combination of out of date server code and non-reproducible iOS client binaries mean that for all my support of Signal (I donated during their recent outage) the benefits of this being a fully “open source” message solution are somewhat devalued. Not to be too down on them though, I don’t touch WhatsApp with a barge pole, so they’re still my favoured messaging platform. * Not necessarily entirely Signal’s fault because, of course, Apple doesn’t make this easy. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds https://core.telegram.org/reproducible-builds

the_other 6y ago

Even if you “trust” FB/WA, they’re still monetising a model of you and your friends, they expect you to update that model, and don’t share the profile from that model beyond letting you use the tools that update the model.

palebluedot 6y ago

If the Signal clients are using E2E encryption, then trusting the server code is significantly less important; the whole point is you don't need to trust the server. With Telegram, E2E encryption is not enabled in all modes, and is not the default.

thejellypen 6y ago
i think the point is if you cant see the code you dont know if its still E2E encrypted and you're just taking them for their word?

xurukefi 6y ago

1. The client is up-to-date on GitHub, which is a much better situation than with WhatsApp or Telegram. An outdated server code just gives you reason to distrust their metadata handling. 2. Trust is a bit more complicated than that. FB sells your data and Telegram is very shady in many more regards. The situation with Signal is completely different. 3. Even if the server code on GitHub was updated, what exactly would give you reason to believe that they run that version in production? Ultimately, you cannot trust the server. This can only be solved with decentralization.

emptysongglass 6y ago
This does not deal with the very real fact that Signal's server code is out of date by 9 months. Period. Telegram's closed-source server was used as a weapon against the Telegram community by Signal people for ages. But now that the shoe's on the other foot, let's be apologists. 2. Sources. Because all I see is Telegram protecting protestors in Belarus, Hong Kong, and Russia.
- xurukefi 6y ago
  Signal is rightfully critiziced by people for their outdated server code. I'm just arguing that a) this does not make them as bad as WhatsApp or Telegram and b) updating the server code does not add as much trust as people tend to think. In fact, it's more of a symbolic act, because it does not give any strong technical guarantees.
bilal4hmed 6y ago
telegrams client code is also upto date on GitHub
- akvadrako 6y ago
  Is it? A lot of people report problems compiling the iOS client without replies. It also has no licence in the repo or on the github page.
  - pdimitar 6y ago
    How is not having a license in the repo an argument against trusting Telegram though? I mean, the code is right there. Not like it's encrypted.
SpaceRaccoon 6y ago
All of Telegram's chat clients are open-source and they provide libraries and encourage people to develop new clients if they'd like.
6y ago

crossroadsguy 6y ago

For the last few years I have always rooted (or rather I hoped) for Matrix/Riot->Element. So much that for my recreational and token FOSS IM usage (because for mainstream conversation in my country it all has moved to WhatsApp) with select friends I made it a point to request/convince them to use Matrix. But when this WhatsApp T&C thingie happened I had to make a choice and ask all my friends and important IM contacts to move to Signal because let's face it Matrix is simply not usable for the average user as of now and I guess they will take forever to figure out Signal/WhatsApp and Slack/IRC/Zoom are not two different types of animals but are aliens to each other, especially from an end user's UX expectation point of view. So yeah it had to be Signal because no one was going to move to Wire or Threema. Telegram is perfect for casual groups like the ones which form off places like subreddits — e.g. my country's book/lit subreddit. Besides their apps are a couple of hundred kilometres ahead of others including WhatsApp. So as of now I am going to use Signal. Come 6-7 Feb, and I am deleting my WhatsApp account. Because I am pissed and as someone who deleted Fb, Instagram 6-7 years ago, I just don't want to accept that T&C even though I know Fb may get my data or would track me by using other means anyway. It'd be my personal tiny F.Y. to Zuck. Having said that Signal does and have always made me very uncomfortable: — It's headed literally by a benevolent dictator, and boy he does benevolent dictator. — After a while I literally gave up on trying to make sense of their feature/dev priority and delivery. — (As you've pointed out) Dev model of their server code is very much questionable and for an app that is "Signal", this thing has no reason, no excuse — it's either there in the open, regularly, and latest, or it's not. — It's centralized — a catastrophe waiting to happen (oh wait, a technical one just happened). Hell, Telegram and Signal both have open source apps (in fact I can make my own in case of Telegram but in case of Signal — naah!) and they both essentially have closed source servers (even if you discount that for a centralized service you don't know what's on the server). I really wish there was a Telegram like Matrix — esp. the UX — not like Signal/WhatsApp. https://builtformars.com/creating-an-account-with-signal/ https://builtformars.com/creating-an-account-with-signal/ this is good.

saurik 6y ago
As far as Facebook has explicitly stated, the reason for the "changes" to their terms and conditions was to be able to launch a feature where businesses with a Facebook page could use what amounts to a "hosted client" in order to do things like customer service or have chat bots and the such, all with multi-level permissions as you see with other platforms. This feature has been "a long time coming" (in that they have been talking about it publicly on their site for I think two years). You could argue that anyone could already technically (though against the terms of service) build such a service, so "end to end" only applies to a user's selection of their "end", but since Facebook is WhatsApp, a statement that Facebook never has access to X or Y or Z is no longer true, and so they carefully went through everything and adjusted those terms in a way that was confusing, totally forgetting that this is the Internet and no one would understand the nuance. The original big article about this had a statement from a Facebook representative about this that went out of its way to note that nothing was going to change for "non-business chats and account data", but almost no one seems to have even paid attention to what was actually going on or what was changing. I am betting that Facebook saying they are delaying this rollout now is going to include them spending more time on the wording to make it clearer (not that I bet the people who like to get upset about this stuff will read it carefully). > The move, the spokeswoman said, is part of a previously disclosed move to allow businesses to store and manage WhatsApp chats using Facebook's infrastructure. Users won't have to use WhatsApp to interact with the businesses and have the option of blocking the businesses. She said there will be no change in how WhatsApp shares provides data with Facebook for non-business chats and account data. Then, a couple days later, people were going crazy over an update to their security whitepaper that now supposedly claimed that Facebook no longer didn't not (double negative, sorry) have access to a chat's private keys... but the update was actually careful and rather specific to scope it correctly to this new hosted client for businesses feature, having the following paragraph, which seems to still be sufficient and carry the same goal as the removed sentence elsewhere. > All chats use the same Signal protocol outlined in this whitepaper, regardless of their end-to-end encryption status. The WhatsApp server has no access to the client’s private keys, though if a business user delegates operation of their Business API client to a vendor, that vendor will have access to their private keys - including if that vendor is Facebook. As far as I can tell, this change was blown entirely out of proportion into what almost feels like a hit on one of the few secure messenger options we have, and the only one that actually "works well" for all users, including true "end" users who barely understand what they are doing. Hell: WhatsApp is an interesting case of a product that was less secure before Facebook bought it and meddled, as it wasn't originally end-to-end encrypted! Now, I do appreciate the arguments from people who say "you can't trust the WhatsApp client, as it isn't open source". As a reverse engineer, I think people have a bit of a warped perspective of the value of this, as I can both easily show you how to hide a backdoor in an open source project that no one will question you on (just throw in a use after free bug with an info leak in your network stack) and also attest to how "easy" (for someone like me) it is to audit these things to at least surface verify it isn't doing something ridiculous in the general case (for all users, not for you in specific... but again: that is also true of the open source client!). That said, I really really do appreciate the point: this kind of software should be open source with secure reproducible builds, and it should have open protocols and alternative clients (which FWIW, Moxie doesn't believe in--he won't even allow Signal in F-Droid--but that's another argument). If someone wants to never use a program for this that isn't open source, I totally can buy into that belief system (though I am also going to hope they don't use an off-the-shelf closed source operating system, for some consistency). But... none of that changed two weeks ago. If you were happy with WhatsApp before two weeks ago, it seems like you should still be happy now. And if you weren't happy with WhatsApp before two weeks ago, I can't imagine you will ever be happy with WhatsApp. You, FWIW, sound like you might have been in the first category of people, not the second? You also just seem to despite Facebook to the point where it doesn't matter what they do, good or bad :(. Regardless, to the extent to which a subset of the second people tried to capitalize on uncertainty here to essentially misrepresent what was going on as a massive change, I want to say "shame on them", as that feels like dirty politics to me.

tailspin2019 6y ago

I agree with the concern of the server code being out-of-date. I know the consensus seems to be that it’s E2E so you “don’t need to trust the server”, but still as a principle it seems strange to be so out of date. Perhaps more importantly, I believe Signal doesn’t have reproducible builds for their iOS client app[0] * whereas, interestingly, it seems Telegram does [1]. For me, the combination of out of date server code and non-reproducible iOS client binaries mean that for all my support of Signal (I donated during their recent outage) the benefits of this being a fully “open source” message solution are somewhat devalued. Not to be too down on them though, I don’t touch WhatsApp with a barge pole, so they’re still my favoured messaging platform. * Not necessarily entirely Signal’s fault because, of course, Apple doesn’t make this easy. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds https://core.telegram.org/reproducible-builds