3 ms·
> you can choose not to install it There is a time bomb in there and servers will kick you out regularly unless you have updated. If you get a patched client
by xorcist 6y ago
> you can choose not to install it
There is a time bomb in there and servers will kick you out regularly unless you have updated.
If you get a patched client running you could probably change whatever string is required but some sort of action is required on the client side.
- tga_d 6y agoSure, but that's an unrelated phenomenon to the security implications being discussed. The argument against auto-updates is "it's running code without my permission or ability to audit first"; putting a recency requirement for client-server communication doesn't impact that concern, and I don't see any reason why it would be considered a bad thing.
- lmm 6y ago> The argument against auto-updates is "it's running code without my permission or ability to audit first"; putting a recency requirement for client-server communication doesn't impact that concern It makes it impractical to actually audit the code you're running, because you're forced to re-audit on Signal's schedule. And it makes those audits mostly meaningless: what are you going to do if you decide a given code change is suspicious? You can't keep using the version of the code you were happy with, so you'd better have a plan in place for moving off Signal quickly - but in that case how much can you gain from using it at all?