13 ms·

Signal Desktop is corrupting its database

257 points by miduil 6y ago

cpach 6y ago
Ouch. That’s one painful bug. Hope it gets sorted soon.
88840-8855 6y ago
As much as I want to move to Signal, I cannot. Their apps feel like a hobby project from the iOS 5 era. Especially the desktop app has a terrible UI. It feels, looks and behaves very bad. And then I am looking at telegram - everything is polished, many smart and useful functionality is included. The design is outstanding, the updates seem to add useful stuff. Can someone explain to me why Signal is so very bad compared to telegram?
- domano 6y ago
  My guess is that the priorization is different - signal implements everything with a privacy first approach in mind, whereas telegram is not even encrypted by default (even Whatsapp does that AFAIK).
  - einpoklum 6y ago
    That's not it. That is, choosing whether conversations are encrypted by default or not has very little to do with whether the client application has polished UI.
  - saddlerustle 6y ago
    WhatsApp is encrypted by default
    - croes 6y ago
      That's what he/she wrote.
  - xvector 6y ago
    Signal requires a telephone number. This makes the privacy bit is a complete joke, even if your chats are E2EE. Your Signal account is bound to a KYC identity.
    - deleted 6y ago
      [deleted]
    - abdullahkhalids 6y ago
      Privacy and anonymity are distinct concepts. Signals provides very high privacy and low anonymity - which is totally acceptable for many people's threat model. Other apps may provide higher anonymity, but none provide privacy guarantees higher than (or even close to) Signal.
      - corty 6y ago
        Privacy and anonymity are distinct, but strongly correlated. Without anonymity, there will always be enough metadata to hang you with. Using Signal as a surveillance-evasion-tool will get you into trouble in a lot of the more unsavoury corners of this planet. So, being "best" at privacy is meaningless unless you are in the very lucky position that your local jurisdiction fits Signal's threat model. There aren't many in the west even...
        blazzy 6y ago
        Meaningless? I value private communication with my friends and family. I don't exactly need anonymity there. In fact I want the opposite. In the absence of phone numbers I would be adding very explicit metadata on my device to distinguish between my friends. Signal has taken measures to limit its ability to know who I'm sending and receiving messages from. Though it's still possible by mapping my IP address to me. So yes there is still a centralized metadata problem, but I'm not letting perfect stand in the way of better.
        upofadown 6y ago
        >Without anonymity, there will always be enough metadata to hang you with. Not in most cases, for most people, most of the time. Everyone knows you communicate with your family, friends and business associates. Very few people communicate out of those groups and even if they do they rarely have to worry about anyone finding out about it.
  - alerighi 6y ago
    To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern. I'm more concerned about every day privacy, and Telegram is far better on them. Do you realized that you sent by mistake some data to the wrong people? In Telegram you can delete or edit every messages you want whenever you want. Don't you want to share your phone number in a group? In Telegram your phone number is hidden by default, meaning that other group members doesn't see you number unless you share it with them. Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client. And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system. You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?)
    - growse 6y ago
      > To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern. For a lot of people, that's exactly the concern. > Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client. There's nothing in open source that requires people running services to allow anyone to connect to it however they like. You still have the freedom to inspect, modify, run and distribute both the server and client, so it's to see what part of that in "not really open". > And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system. I agree, this is annoying. But it depends on your threat model and it seems that most people don't see Google as the threat to protect against. > You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store https://signal.org/android/apk/ https://signal.org/android/apk/ > (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
  - Sebb767 6y ago
    > telegram is not even encrypted by default That's technically not true - it's not end-to-end-encrypted by default. But yes, it is a design choice - telegram puts usability first - see all their innovations with large groups, stickers etc -, even at the expense of some privacy (i.e. no e2e-chats). But that's why you can have Telegram open on every device you own and probably why they are the second largest chat app by now. Signal, on the other hand, values privacy first, everything else second. This is why this bug is open for 6 months - they see your chat log as a convenience feature and mostly a burden. In addition, Signal is a smaller team with less funding, so that their UI is not as polished is partially also due to lacking manpower, but its simply not a priority for them.
  - SignalNotSecure 6y ago
    Whatsapp E2E is a red herring. It's not protecting you from your perceived threat like you think it is. https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15 https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15
    - domano 6y ago
      Sure i agree, just saying that even WhatsApp ticks that box in some way.
- rvz 6y ago
  > Can someone explain to me why Signal is so very bad compared to telegram? The Signal desktop app is Electron, where as Telegram is native. That's why and it's that simple.
  - dewey 6y ago
    There's non-native apps that are not as bad as Signal so that doesn't really explain that.
  - metachris 6y ago
    That's certainly not the reason. There are many really good Electron applications, Visual Studio Code being one of them.
    - fouc 6y ago
      Visual Studio Code is literally the only good Electron application, the rare exception that proves the rule.
      - Griffinsauce 6y ago
        GitKraken, Insomnia, Postman, Mongo Compass, Mingo, Mockoon, Notion (yes it's slow AF to load, but that's not due to electron), LosslessCut, Gitify
  - fauigerzigerk 6y ago
    No, it's not that simple at all. The Signal desktop app is bad in ways that have nothing to do with Electron at all. Most importantly, it's bad at protecting my privacy. You can't show any message to anyone on your screen or have someone look over your shoulder unless you want them to see who you recently communicated with in what order as well as the start of the most recent messages.
    - primeos 6y ago
      > unless you want them to see who you recently communicated with in what order as well as the start of the most recent messages. Thanks for mentioning that. I always wondered why there's no option to at least hide the most recent messages and dates (or temporarily hide the whole sidebar). I guess most people are either fine with it or use their phone instead (and using Signal-Desktop in public / when someone's looking is probably uncommon). It seems like at least Telegram-Desktop has this issue as well (not sure if there's an option for it). Anyway, a slight modification to the UI to hide/minimize the sidebar would be something I'd appreciate for those rare situations.
- chovybizzass 6y ago
  Telegram has a bit better and also has e2e encryption (optional).
  - spacemanmatt 6y ago
    Optional E2E means there's a chance that misunderstanding or misusing the GUI results in exposure. For critical purposes, that's unacceptable.
  - frereubu 6y ago
    E2E encryption is only available in one-to-one chats, and those chats are specific to the device. So, like Signal chats effectively.
- waheoo 6y ago
  I've been using signal since release, never had any issues with its level of polish. Updates have been meaningful and minimal. Can't say I'd be happy if it started adding a bunch of features I didn't ask for.
  - primeos 6y ago
    > Updates have been meaningful and minimal. Opinions may differ here. Their sticker packs feature added at least 50 MB (mostly via node_modules): https://github.com/signalapp/Signal-Desktop/issues/3919 https://github.com/signalapp/Signal-Desktop/issues/3919 > Can't say I'd be happy if it started adding a bunch of features I didn't ask for. What features do you mean here? The GitHub issue is a bug report and not a feature request. However, there are two features that could help: Backups (export and import functionality) and syncing older messages from the phone during the initial setup. Both of these features can be fully optional and shouldn't require much code. And they do regularly add new features (that I didn't ask for but I get why) anyway: https://github.com/signalapp/Signal-Desktop/releases https://github.com/signalapp/Signal-Desktop/releases
- henearkr 6y ago
  Not the same purpose: Telegram as a SNS, Signal as a messaging app.
- orbifold 6y ago
  Telegram hires excellent developers and was started by someone that had successfully run a company before. The clients for the different platforms in the case of telegram were developed by very small teams (1-2) of exceptional programmers. - macOS client: https://github.com/overtake/TelegramSwift/graphs/contributors https://github.com/overtake/TelegramSwift/graphs/contributor.... Written almost single handedly by one developer. - Telegram Desktop: https://github.com/telegramdesktop/tdesktop/graphs/contributors https://github.com/telegramdesktop/tdesktop/graphs/contribut.... Written almost single handedly by one developer, who also wrote almost all of the supporting Qt code.
colesantiago 6y ago
Why wasn't this bug caught in the first place and allowed to be rolled out into production? This is very serious for everyone depending on signal, that I could just lose all my secure chat history without warning!
- luto 6y ago
  Signal's inability to sync its history to somewhere else (e.g. their server, encrypted) and its rather inaccessible backup processes[1] are a pain. It makes me use something else for anything serious sometimes. [1]: https://support.signal.org/hc/en-us/articles/360007059752-Backup-and-Restore-Messages https://support.signal.org/hc/en-us/articles/360007059752-Ba...
- LockAndLol 6y ago
  What kind of a question is that? Are you a developer? Do you think developers willingly write bugs into their applications, then simply release them hoping they can mess up somebody's day for the fun of it? "Allowed to roll out into production" as if there's a manager looking at the list of newly created bugs, grinning and going "This bug... I like this bug! Roll it out!"
  - colesantiago 6y ago
    What are you talking about? They clearly didn't test this hard enough otherwise this would be caught early. Was there any tests for this sort of thing? surely if you are storing secure chat history to a database this should be tested to death. Had they tested more of this functionality this serious bug would have been caught, and now that I recommended this to people, I pretty much now regret doing so for secure messaging.
  - cj 6y ago
    “Why wasn't this bug caught in the first place” - this isn’t an attack on whichever developer introduced the bug. It’s a (totally fair) attack on Signal’s lack of QA/testing in their development + release cycle. Do they implement peer reviews on PR? Multiple reviews on changes touching mission critical code (ie. data migrations)? Do their test suites provide adequate test coverage? Do they have a manual Q/A process that involves real people testing new releases? Considering Signal’s funding, I would hope the answer to all of those questions is yes. But if it’s possible to release code that completely corrupts the app with no known fix, I suspect their test coverage and Q/A processes aren’t as robust as they need to be.
eznzt 6y ago
>This issue is so painful. There are journalists on Twitter reporting that they've lost access to their Signal app & sources due to this bug. Oh my God, not the journalists!!!!
- perryizgr8 6y ago
  Won't anybody think of the journalists!!1
- Hammershaft 6y ago
  I mean, if a genuine journalist loses sources, we could lose evidence of corruption / abuse / fraud / government overreach / any # of evils in the world. I think journalists losing sources is a pretty serious problem.
anotherhue 6y ago
A BUG, IN SOFTWARE? Who could have predicted? My ongoing thanks to Signal for the massive net positive their work had produced.
- float4 6y ago
  It's a bug in a messaging app that corrupts your message database, so calling it "a bug" feels like an understatement. It sucks that people (myself included) try to convert friends to Signal when serious bugs happen regularly. Nonetheless, I'm grateful that Signal exists and continues to improve.
  - Zizizizz 6y ago
    Happen regularly?
DangerousPie 6y ago
Looks like this is the bug that made me stop using Signal at some point last year. It just kept "migrating" the database every time I started and never managed to load. I even tried to reinstall it from scratch but when that didn't fix it I just gave up and went back to Hangouts/WhatsApp.
primeos 6y ago
This whole thing is especially painful/annoying since they neither support backing up the database nor syncing/importing old messages from the phone. So if this happens there's no known/reliable way to recover (even though the data is still on the phone). (In theory it should be possible to recover from this and I can still access my sqlcipher database manually but Electron and the stateful Signal protocol make it extremely difficult so I gave up. Multiple backups of the whole ~/.config/Signal directory didn't help either.) (See: https://github.com/signalapp/Signal-Desktop/issues/4513#issuecomment-756830788 https://github.com/signalapp/Signal-Desktop/issues/4513#issu... )
- ancarda 6y ago
  >they neither support backing up the database nor syncing/importing old messages from the phone Why Signal doesn't support this is beyond me. I can basically only use it for scenarios where I don't want any chat history, which just isn't that common.
- satysin 6y ago
  Yes and this has been my biggest complaint for literally years but whenever I say "Signal needs a top tier backup system asap" I get moaned at with responses like "Signal is a messaging app not email, if you want to backup a message just do that one message." or "Why would you want a whole conversation backup?!" as if I am some weirdo for wanting to have a backup. Does my fucking head in. Yes Signal is about security but that doesn't mean it can't have a functional backup feature! Honestly it needs to be priority number one imho. This bug shows just how important backups and importing conversations are. Whenever I setup Signal on a new system I hate when I see the message "For your security, conversation history isn't transferred to new linked devices." Signal doesn't (or at least shouldn't) get to decide what happens here. If I am having to re-register because of a Signal failure my security is not effected by importing the conversation history as it was there two minutes ago before they corrupted the database. At the very least they should make it an option even if it is disabled by default. Apologies for the ranty nature of this comment but I am fed up with this absolutely pathetic denial that backups are important because it is "just a messaging app". AHHH! Edit: See this reply from when I complained about the lack of backup a month ago https://news.ycombinator.com/item?id=25687851 https://news.ycombinator.com/item?id=25687851
GNU_James 6y ago
Why are you all pushing for this Signal crap when Matrix is objectively better and doesn't require phone numbers?
- deleted 6y ago
  [deleted]
- fouc 6y ago
  What's the easiest way to get started with Matrix, in a way that's objectively better than Signal?
- detaro 6y ago
  Because it's not "objectively better", and certainly hasn't been historically (and I say that as someone who has more conversations on Matrix than on Signal, and thinks Signal made the wrong tradeoffs in some places)
- float4 6y ago
  Element on iOS crashes when I try to log in, so there's that. Both Element/Matrix and Signal don't come close to WhatsApp, sadly.
  - rvz 6y ago
    > Both Element/Matrix and Signal don't come close to WhatsApp, sadly. That is the unfortunate reality-hitting hard truth right there. Element and Signal are just not ready yet for serious widespread general use to compete with WhatsApp. Signal is still immature and lacks tons of functionality compared to WhatsApp. Element suffers from usability and onboarding issues which frustrate the user. The fact we have to keep mentioning the protocol 'Matrix' next to the client name 'Element' creates further confusion to the user; leaving them to ignore it altogether. That's before they get confused and lost in the settings page. Telegram on the other hand has a better chance to compete against WhatsApp.
    - mft_ 6y ago
      I'm interested: aside from the phone number/backup issues well documented on every HN thread about Signal, which features do you think that Signal lacks?
StavrosK 6y ago
This is odd, I literally just now got a corrupted database on Android and had to restore from a backup (it's still restoring). Are two platforms impacted?
deleted 6y ago
[deleted]
0x0 6y ago
I thought sqlite was very resilient and have a hard time understanding how an sqlite file can be corrupted. Are they manipulating the sqlite file outside of sqlite APIs? Are they mixing up file descriptors and writing garbage into an sqlite handle?
- dssound 6y ago
  I had issues with corruption during a Xamarin project - its easy to do with bad coding but if proper practices are made then it shouldn't occur much.
- primeos 6y ago
  They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data). I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).
  - RJIb8RBYxzAMX9u 6y ago
    How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme. [0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki https://www.sqlite.org/see/doc/trunk/www/readme.wiki
    - 6y ago
Rygian 6y ago
This story should be tagged [2020], bug report is already 6 months old.
- rvz 6y ago
  Good point actually, but this serious bug is still not fixed after 6 months. They have plenty of time and money to fix this issue quickly before it gets out of hand.
  - meibo 6y ago
    If you have any experience with the Signal GitHub projects, you'd know that you're lucky to even get a reply. They seem to strictly follow their own agenda. If they don't think something is important, it won't be taken care of.
    - growse 6y ago
      Isn't that true of every open source project?
      - remram 6y ago
        No?
say_it_as_it_is 6y ago
I've used signal for so many years with ubuntu, android and macos. I've never gotten a corrupt database error. I'll repeat-- I used it with LINUX without a hitch for MANY YEARS. Most other desktop applications, however, have not performed as well. This isn't worthy of the front page of HN..
- samb1729 6y ago
  This is not the slam dunk comment you appear to think it is. I've lived for many years without a single death, but this fact wouldn't serve to nullify the fact I died when it does happen.
johnchristopher 6y ago
Report suggest there's some beta/stable mismatching going on. While Signal's greatest strength is its privacy features I think that at some point they are going to have to meet their customers/prospects/users' other needs. The biggest one being the availability of chat history anywhere, anytime at their own risk if needed. We won't educate people to use messaging app in the way we want them to (for privacy sensible conversations only) because the vast majority don't use messaging app like that. It's either give up on that idea or heavily advertise that Signal is not a Whatsapp/Telegram/Viber/Messenger/Whatever replacement: it's a tool to use when you want to have private conversations. Maybe it'd be better to leave the Signal messaging app lives its life and allows a third party chat history viewer to emerge. You can already export your encrypted backup to a readable CSV file. https://github.com/xeals/signal-back https://github.com/xeals/signal-back edit: which obviously doesn't work with a corrupted database :p. Signal backup as a service startup ? Point in case: mom complained the other day that Signal Desktop took some time to launch because it was “syncing things”. I told here that this syncing from her phone to the computer is the proof her messages only exist in the application. Desktop or smartphone, that's why it needs to sync, facebook and others don't work like that (I grossly simplified). note: Thread with comments like is how I remember HN is now a site with a huge audience.
- reader_mode 6y ago
  I just use telegram - it has ptivate messages when I need them but it's a great chat app to begin with.
- matsemann 6y ago
  I don't really need my messages persisted across devices in the cloud or when buying a new phone. Search on Facebook messenger for instance is broken so it's not like I can find anything ("what was the code to the gate?"), and I've never felt the need to scroll more than a few days back for other stuff. What I need is just to persist the groups, really. So I easily can continue chatting there and not hope someone else sends a message first.
  - JohnJamesRambo 6y ago
meibo 6y ago
Signal Desktop is a travesty. Their design causes it to be incredibly slow, to miss messages, to have them arrive out of order - and that's not even acknowledging the usability downfalls. They really need to do better. I hope they can figure out some way to shift more resources to it, a good desktop client is essential to modern messengers.
- hashkb 6y ago
  The "standard electron horror" is why I can't really commit to signal. None of the Good Guys have a good desktop messenger yet.
  - meibo 6y ago
    You can make good Electron apps if you care enough. Electron is decidedly not why Signal Desktop is terrible, it's just a contributing factor.
    - pseudalopex 6y ago
      Even Visual Studio Code gets things wrong.
    - EvilEy3 6y ago
      > You can make good Electron apps if you care enough. That defeats purpose of Electron, though.
    - hashkb 6y ago
      Well, nobody cares enough. And that's probably why they find Electron attractive. No need to care, no expectations that you'll ship something good. Hey, look at Slack!
  - MikusR 6y ago
    Telegram has one.
    - Asraelite 6y ago
oefrha 6y ago
SQLite should not be corruptible by power loss unless PRAGMA synchronous is OFF, or OS/fs/storage media don’t honor fsync. https://www.sqlite.org/howtocorrupt.html https://www.sqlite.org/howtocorrupt.html But the thread says SQLCipher is used, so not sure.
GNU_James 6y ago
Why not use encrypted Jabber like Russian Mob? If they are safe with XMPP, I feel safe too.
eptcyka 6y ago
Exporting message history, easily selecting multiple messages to forward, allowing for group chat history to be maintained and transferred between devices, synchronizing video rotation in video calls, scheduled messages. Some of these features might be harder to implement than others, but I am constantly reminded of their absence whenever I use signal. I used to only use telegram, and it just works that much better as long as you don't care about privacy. It'd be easier for me to continue using Signal if it was more grandmother friendly. Even my partner is having issues with this, and they are usually capable of using tech.
- pure_simplicity 6y ago
  These are sensible suggestions. What do you mean by "synchronizing video rotation in video calls" and how do you note the presence / absence of this feature in practice? Do you have any idea how we could practically make Signal a better app in the future?
  - eptcyka 6y ago
    As brash as this might sound, reworking the user interface to more match the likes of the competition would go a long way to make the app more usable. My partner has trouble finding functionality that is there. The video call issue is that if I rotate my phone from portrait to landscape, the recipient will still receive a portrait video stream from me. I'd expect the recipient to receive a landscape aspect ratio stream instead. I must add that I am incredibly thankful for the effort you guys have put into Signal. If users like me come across as a bit sour, at least in my case, I am that way because there seem to be a lot of low hanging fruit that users willing to use the app seem to hit on the head. I'd love for signal to be more successful.
sagivo 6y ago
I feel like Signal missed the opportunity they had after the WhatsApp fiasco. Every person I've tried to convert to Signal opt out after a day or two due to lack of usability. Most of them either went back to WhatsApp or moved to Telegram. While the tech is great and the privacy is good, if they won't invest in usability and UI they will not win the masses. EDIT - if you downvote, please explain why. If you disagree it's not a reason to downvote.
- krastanov 6y ago
  My personal anecdote is the opposite of yours: it was easy for me to convert people to Signal. Concerning your edit: I thought it was a pretty established part of the etiquette on HN that a downvote is used also for simple disagreement. It means "I do not agree", not "you are wrong and should be shamed".
  - sagivo 6y ago
    I may be wrong, but comments are meant for that. Ideally when there's a disagreement, people can openly discuss it. I thought downvoting is to flag unproductive comments.
    - hansvm 6y ago
      I had that impression too, but I just read the guidelines and can't find anything to that effect. They do say that we shouldn't be commenting about the voting though ;).
  - vengefulduck 6y ago
    Maybe on Reddit, but on HN downvoting is supposed to be a moderation tool. That’s why you need a certain amount of karma to access it. It should be used to flag content that breaks the rules or is unproductive in some way. Please don’t use it like you do on Reddit.
    - krastanov 6y ago
      You are making a couple too many assumptions. For starters, I do not use reddit. I wrote my message above with the caveat that I am unsure ("I thought"), but you are presenting a front of certainty without backing it up with evidence (and evidence rarely exists when talking about common culture).
mittaus 6y ago
Caveat Emptor.
Daniel_sk 6y ago
Unfortunately the overall code quality doesn't seem to good - I looked at the Android code and the network layer / retry logic seems to be quite chaotic with weird exception handling. The UI layer would also need a refresh, a lot of logic is placed in the Fragments directly, no MVVM (e.g. Architecture Components ViewModel) or any other pattern. The sync issues keep coming back. For example you use the Signal desktop app and then at the end of the day you pick up the phone, open Signal and a stream of notifications will start flowing in (even though you read everything on desktop). Also the PC desktop app doesn't sync with iPhone, you need to download an old version, pair the phone and then update to latest to fix it - https://community.signalusers.org/t/my-messages-in-desktop-app-not-showing-in-ios-app/22329 https://community.signalusers.org/t/my-messages-in-desktop-a....
- GuB-42 6y ago
  I also too a look at the code and wasn't impressed. Signal used to have a feature that allows you to import SMS. It had a few problems but it mostly did the job. But lately, they disabled it with the latest onboarding update, without mentioning anything in the change log. I had to look at the git history to see that, I also found a "won't fix" ticket about the problem. I think they are ignoring an very important feature but anyways, make a decision. Either you officially disable the feature, write it in the changelog and remove the dead code. Or you keep it and hopefully fix it. The way they are doing it is sloppy. I didn't look too much into it but dead code is definitely a code smell and your experience seems to match mine. It is not terrible, but a bit underwhelming considered it is a highly regarded, security sensitive app.
- pure_simplicity 6y ago
  That's unfortunate. I wonder why Signal suffers from these issues, but I hope it's something we can fix. I think Signal has such great potential. Society needs a successful privacy respecting open source chat app like Signal. Do you have any clue how to make things better?
batterylow 6y ago
I've been using the iOS version on my M1 MacBook Air... it seems to use less memory, which is a benefit on my 8GB (base) model. I haven't done any tests though!
reidrac 6y ago
A few years ago I gave up on my own XMPP server and moved to Telegram because Signal wasn't ready. Recently I have moved to Signal because, after the WhatsApp opportunity, I had to move my non-tech savvy family members to something better, and I suspect Telegram isn't it (I can't understand how it is funded, it is too "magic"). But it is rough, specially compared to Telegram. For example: there's no way I'll share my phone number to chat with strangers, whilst on Telegram I have an anonymous username I can use. But even forgetting about that, it is the small things, like it can't record and send a video (you can record it out of the app, and then send it from Signal; at least on Android), or the atrocious desktop app. I'm happy it exists and I'll stick with it because they're supposed to be "the good guys", but I'm hopping it improves before I have to admit it was a mistake and I should have trusted Telegram.
prophesi 6y ago
https://github.com/signalapp/Signal-Desktop/issues/4513#issuecomment-787429886 https://github.com/signalapp/Signal-Desktop/issues/4513#issu... Is there a citation for this claim? I tried searching on Twitter for tweets regarding Signal errors, and I didn't see anything except for retweets of the link to this HN post. It's also just the local database, so the phone that their desktop app is linked to will still have their chat history, thus these alleged journalists would not have lost their sources.
- miduil 6y ago
  I didn't link it on GitHub for purpose. Somehow it turned out not to be related to that issue (so after few days it's just unlinked but contacts/history thankfully still there) https://twitter.com/moltke/status/1364231860528836608 https://twitter.com/moltke/status/1364231860528836608
Havoc 6y ago
Signal has been rather flakey the last 24hrs in general

257 points by miduil 6y ago

Ouch. That’s one painful bug. Hope it gets sorted soon.

As much as I want to move to Signal, I cannot. Their apps feel like a hobby project from the iOS 5 era. Especially the desktop app has a terrible UI. It feels, looks and behaves very bad. And then I am looking at telegram - everything is polished, many smart and useful functionality is included. The design is outstanding, the updates seem to add useful stuff. Can someone explain to me why Signal is so very bad compared to telegram?

domano 6y ago
My guess is that the priorization is different - signal implements everything with a privacy first approach in mind, whereas telegram is not even encrypted by default (even Whatsapp does that AFAIK).
- einpoklum 6y ago
  That's not it. That is, choosing whether conversations are encrypted by default or not has very little to do with whether the client application has polished UI.
- saddlerustle 6y ago
  WhatsApp is encrypted by default
  - croes 6y ago
    That's what he/she wrote.
- xvector 6y ago
  Signal requires a telephone number. This makes the privacy bit is a complete joke, even if your chats are E2EE. Your Signal account is bound to a KYC identity.
  - deleted 6y ago
    [deleted]
  - abdullahkhalids 6y ago
    Privacy and anonymity are distinct concepts. Signals provides very high privacy and low anonymity - which is totally acceptable for many people's threat model. Other apps may provide higher anonymity, but none provide privacy guarantees higher than (or even close to) Signal.
    - corty 6y ago
      Privacy and anonymity are distinct, but strongly correlated. Without anonymity, there will always be enough metadata to hang you with. Using Signal as a surveillance-evasion-tool will get you into trouble in a lot of the more unsavoury corners of this planet. So, being "best" at privacy is meaningless unless you are in the very lucky position that your local jurisdiction fits Signal's threat model. There aren't many in the west even...
      - blazzy 6y ago
        Meaningless? I value private communication with my friends and family. I don't exactly need anonymity there. In fact I want the opposite. In the absence of phone numbers I would be adding very explicit metadata on my device to distinguish between my friends. Signal has taken measures to limit its ability to know who I'm sending and receiving messages from. Though it's still possible by mapping my IP address to me. So yes there is still a centralized metadata problem, but I'm not letting perfect stand in the way of better.
      - upofadown 6y ago
        >Without anonymity, there will always be enough metadata to hang you with. Not in most cases, for most people, most of the time. Everyone knows you communicate with your family, friends and business associates. Very few people communicate out of those groups and even if they do they rarely have to worry about anyone finding out about it.
- alerighi 6y ago
  To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern. I'm more concerned about every day privacy, and Telegram is far better on them. Do you realized that you sent by mistake some data to the wrong people? In Telegram you can delete or edit every messages you want whenever you want. Don't you want to share your phone number in a group? In Telegram your phone number is hidden by default, meaning that other group members doesn't see you number unless you share it with them. Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client. And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system. You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?)
  - growse 6y ago
    > To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern. For a lot of people, that's exactly the concern. > Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client. There's nothing in open source that requires people running services to allow anyone to connect to it however they like. You still have the freedom to inspect, modify, run and distribute both the server and client, so it's to see what part of that in "not really open". > And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system. I agree, this is annoying. But it depends on your threat model and it seems that most people don't see Google as the threat to protect against. > You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store https://signal.org/android/apk/ https://signal.org/android/apk/ > (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
- Sebb767 6y ago
  > telegram is not even encrypted by default That's technically not true - it's not end-to-end-encrypted by default. But yes, it is a design choice - telegram puts usability first - see all their innovations with large groups, stickers etc -, even at the expense of some privacy (i.e. no e2e-chats). But that's why you can have Telegram open on every device you own and probably why they are the second largest chat app by now. Signal, on the other hand, values privacy first, everything else second. This is why this bug is open for 6 months - they see your chat log as a convenience feature and mostly a burden. In addition, Signal is a smaller team with less funding, so that their UI is not as polished is partially also due to lacking manpower, but its simply not a priority for them.
- SignalNotSecure 6y ago
  Whatsapp E2E is a red herring. It's not protecting you from your perceived threat like you think it is. https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15 https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15
  - domano 6y ago
    Sure i agree, just saying that even WhatsApp ticks that box in some way.
rvz 6y ago
> Can someone explain to me why Signal is so very bad compared to telegram? The Signal desktop app is Electron, where as Telegram is native. That's why and it's that simple.
- dewey 6y ago
  There's non-native apps that are not as bad as Signal so that doesn't really explain that.
- metachris 6y ago
  That's certainly not the reason. There are many really good Electron applications, Visual Studio Code being one of them.
  - fouc 6y ago
    Visual Studio Code is literally the only good Electron application, the rare exception that proves the rule.
    - Griffinsauce 6y ago
      GitKraken, Insomnia, Postman, Mongo Compass, Mingo, Mockoon, Notion (yes it's slow AF to load, but that's not due to electron), LosslessCut, Gitify
- fauigerzigerk 6y ago
  No, it's not that simple at all. The Signal desktop app is bad in ways that have nothing to do with Electron at all. Most importantly, it's bad at protecting my privacy. You can't show any message to anyone on your screen or have someone look over your shoulder unless you want them to see who you recently communicated with in what order as well as the start of the most recent messages.
  - primeos 6y ago
    > unless you want them to see who you recently communicated with in what order as well as the start of the most recent messages. Thanks for mentioning that. I always wondered why there's no option to at least hide the most recent messages and dates (or temporarily hide the whole sidebar). I guess most people are either fine with it or use their phone instead (and using Signal-Desktop in public / when someone's looking is probably uncommon). It seems like at least Telegram-Desktop has this issue as well (not sure if there's an option for it). Anyway, a slight modification to the UI to hide/minimize the sidebar would be something I'd appreciate for those rare situations.
chovybizzass 6y ago
Telegram has a bit better and also has e2e encryption (optional).
- spacemanmatt 6y ago
  Optional E2E means there's a chance that misunderstanding or misusing the GUI results in exposure. For critical purposes, that's unacceptable.
- frereubu 6y ago
  E2E encryption is only available in one-to-one chats, and those chats are specific to the device. So, like Signal chats effectively.
waheoo 6y ago
I've been using signal since release, never had any issues with its level of polish. Updates have been meaningful and minimal. Can't say I'd be happy if it started adding a bunch of features I didn't ask for.
- primeos 6y ago
  > Updates have been meaningful and minimal. Opinions may differ here. Their sticker packs feature added at least 50 MB (mostly via node_modules): https://github.com/signalapp/Signal-Desktop/issues/3919 https://github.com/signalapp/Signal-Desktop/issues/3919 > Can't say I'd be happy if it started adding a bunch of features I didn't ask for. What features do you mean here? The GitHub issue is a bug report and not a feature request. However, there are two features that could help: Backups (export and import functionality) and syncing older messages from the phone during the initial setup. Both of these features can be fully optional and shouldn't require much code. And they do regularly add new features (that I didn't ask for but I get why) anyway: https://github.com/signalapp/Signal-Desktop/releases https://github.com/signalapp/Signal-Desktop/releases
henearkr 6y ago
Not the same purpose: Telegram as a SNS, Signal as a messaging app.
orbifold 6y ago
Telegram hires excellent developers and was started by someone that had successfully run a company before. The clients for the different platforms in the case of telegram were developed by very small teams (1-2) of exceptional programmers. - macOS client: https://github.com/overtake/TelegramSwift/graphs/contributors https://github.com/overtake/TelegramSwift/graphs/contributor.... Written almost single handedly by one developer. - Telegram Desktop: https://github.com/telegramdesktop/tdesktop/graphs/contributors https://github.com/telegramdesktop/tdesktop/graphs/contribut.... Written almost single handedly by one developer, who also wrote almost all of the supporting Qt code.

colesantiago 6y ago

Why wasn't this bug caught in the first place and allowed to be rolled out into production? This is very serious for everyone depending on signal, that I could just lose all my secure chat history without warning!

luto 6y ago
Signal's inability to sync its history to somewhere else (e.g. their server, encrypted) and its rather inaccessible backup processes[1] are a pain. It makes me use something else for anything serious sometimes. [1]: https://support.signal.org/hc/en-us/articles/360007059752-Backup-and-Restore-Messages https://support.signal.org/hc/en-us/articles/360007059752-Ba...
LockAndLol 6y ago
What kind of a question is that? Are you a developer? Do you think developers willingly write bugs into their applications, then simply release them hoping they can mess up somebody's day for the fun of it? "Allowed to roll out into production" as if there's a manager looking at the list of newly created bugs, grinning and going "This bug... I like this bug! Roll it out!"
- colesantiago 6y ago
  What are you talking about? They clearly didn't test this hard enough otherwise this would be caught early. Was there any tests for this sort of thing? surely if you are storing secure chat history to a database this should be tested to death. Had they tested more of this functionality this serious bug would have been caught, and now that I recommended this to people, I pretty much now regret doing so for secure messaging.
- cj 6y ago
  “Why wasn't this bug caught in the first place” - this isn’t an attack on whichever developer introduced the bug. It’s a (totally fair) attack on Signal’s lack of QA/testing in their development + release cycle. Do they implement peer reviews on PR? Multiple reviews on changes touching mission critical code (ie. data migrations)? Do their test suites provide adequate test coverage? Do they have a manual Q/A process that involves real people testing new releases? Considering Signal’s funding, I would hope the answer to all of those questions is yes. But if it’s possible to release code that completely corrupts the app with no known fix, I suspect their test coverage and Q/A processes aren’t as robust as they need to be.

eznzt 6y ago

>This issue is so painful. There are journalists on Twitter reporting that they've lost access to their Signal app & sources due to this bug. Oh my God, not the journalists!!!!

perryizgr8 6y ago
Won't anybody think of the journalists!!1
Hammershaft 6y ago
I mean, if a genuine journalist loses sources, we could lose evidence of corruption / abuse / fraud / government overreach / any # of evils in the world. I think journalists losing sources is a pretty serious problem.

anotherhue 6y ago

A BUG, IN SOFTWARE? Who could have predicted? My ongoing thanks to Signal for the massive net positive their work had produced.

float4 6y ago
It's a bug in a messaging app that corrupts your message database, so calling it "a bug" feels like an understatement. It sucks that people (myself included) try to convert friends to Signal when serious bugs happen regularly. Nonetheless, I'm grateful that Signal exists and continues to improve.
- Zizizizz 6y ago
  Happen regularly?

DangerousPie 6y ago

Looks like this is the bug that made me stop using Signal at some point last year. It just kept "migrating" the database every time I started and never managed to load. I even tried to reinstall it from scratch but when that didn't fix it I just gave up and went back to Hangouts/WhatsApp.

primeos 6y ago

This whole thing is especially painful/annoying since they neither support backing up the database nor syncing/importing old messages from the phone. So if this happens there's no known/reliable way to recover (even though the data is still on the phone). (In theory it should be possible to recover from this and I can still access my sqlcipher database manually but Electron and the stateful Signal protocol make it extremely difficult so I gave up. Multiple backups of the whole ~/.config/Signal directory didn't help either.) (See: https://github.com/signalapp/Signal-Desktop/issues/4513#issuecomment-756830788 https://github.com/signalapp/Signal-Desktop/issues/4513#issu... )

ancarda 6y ago
>they neither support backing up the database nor syncing/importing old messages from the phone Why Signal doesn't support this is beyond me. I can basically only use it for scenarios where I don't want any chat history, which just isn't that common.
satysin 6y ago
Yes and this has been my biggest complaint for literally years but whenever I say "Signal needs a top tier backup system asap" I get moaned at with responses like "Signal is a messaging app not email, if you want to backup a message just do that one message." or "Why would you want a whole conversation backup?!" as if I am some weirdo for wanting to have a backup. Does my fucking head in. Yes Signal is about security but that doesn't mean it can't have a functional backup feature! Honestly it needs to be priority number one imho. This bug shows just how important backups and importing conversations are. Whenever I setup Signal on a new system I hate when I see the message "For your security, conversation history isn't transferred to new linked devices." Signal doesn't (or at least shouldn't) get to decide what happens here. If I am having to re-register because of a Signal failure my security is not effected by importing the conversation history as it was there two minutes ago before they corrupted the database. At the very least they should make it an option even if it is disabled by default. Apologies for the ranty nature of this comment but I am fed up with this absolutely pathetic denial that backups are important because it is "just a messaging app". AHHH! Edit: See this reply from when I complained about the lack of backup a month ago https://news.ycombinator.com/item?id=25687851 https://news.ycombinator.com/item?id=25687851

GNU_James 6y ago

Why are you all pushing for this Signal crap when Matrix is objectively better and doesn't require phone numbers?

deleted 6y ago
[deleted]
fouc 6y ago
What's the easiest way to get started with Matrix, in a way that's objectively better than Signal?
detaro 6y ago
Because it's not "objectively better", and certainly hasn't been historically (and I say that as someone who has more conversations on Matrix than on Signal, and thinks Signal made the wrong tradeoffs in some places)
float4 6y ago
Element on iOS crashes when I try to log in, so there's that. Both Element/Matrix and Signal don't come close to WhatsApp, sadly.
- rvz 6y ago
  > Both Element/Matrix and Signal don't come close to WhatsApp, sadly. That is the unfortunate reality-hitting hard truth right there. Element and Signal are just not ready yet for serious widespread general use to compete with WhatsApp. Signal is still immature and lacks tons of functionality compared to WhatsApp. Element suffers from usability and onboarding issues which frustrate the user. The fact we have to keep mentioning the protocol 'Matrix' next to the client name 'Element' creates further confusion to the user; leaving them to ignore it altogether. That's before they get confused and lost in the settings page. Telegram on the other hand has a better chance to compete against WhatsApp.
  - mft_ 6y ago
    I'm interested: aside from the phone number/backup issues well documented on every HN thread about Signal, which features do you think that Signal lacks?

StavrosK 6y ago

This is odd, I literally just now got a corrupted database on Android and had to restore from a backup (it's still restoring). Are two platforms impacted?

deleted 6y ago

[deleted]

0x0 6y ago

I thought sqlite was very resilient and have a hard time understanding how an sqlite file can be corrupted. Are they manipulating the sqlite file outside of sqlite APIs? Are they mixing up file descriptors and writing garbage into an sqlite handle?

dssound 6y ago
I had issues with corruption during a Xamarin project - its easy to do with bad coding but if proper practices are made then it shouldn't occur much.
primeos 6y ago
They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher https://github.com/sqlcipher/sqlcipher Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data). I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).
- RJIb8RBYxzAMX9u 6y ago
  How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme. [0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki https://www.sqlite.org/see/doc/trunk/www/readme.wiki
  - 6y ago

Rygian 6y ago

This story should be tagged [2020], bug report is already 6 months old.

rvz 6y ago
Good point actually, but this serious bug is still not fixed after 6 months. They have plenty of time and money to fix this issue quickly before it gets out of hand.
- meibo 6y ago
  If you have any experience with the Signal GitHub projects, you'd know that you're lucky to even get a reply. They seem to strictly follow their own agenda. If they don't think something is important, it won't be taken care of.
  - growse 6y ago
    Isn't that true of every open source project?
    - remram 6y ago
      No?

say_it_as_it_is 6y ago

I've used signal for so many years with ubuntu, android and macos. I've never gotten a corrupt database error. I'll repeat-- I used it with LINUX without a hitch for MANY YEARS. Most other desktop applications, however, have not performed as well. This isn't worthy of the front page of HN..

samb1729 6y ago
This is not the slam dunk comment you appear to think it is. I've lived for many years without a single death, but this fact wouldn't serve to nullify the fact I died when it does happen.

johnchristopher 6y ago

Report suggest there's some beta/stable mismatching going on. While Signal's greatest strength is its privacy features I think that at some point they are going to have to meet their customers/prospects/users' other needs. The biggest one being the availability of chat history anywhere, anytime at their own risk if needed. We won't educate people to use messaging app in the way we want them to (for privacy sensible conversations only) because the vast majority don't use messaging app like that. It's either give up on that idea or heavily advertise that Signal is not a Whatsapp/Telegram/Viber/Messenger/Whatever replacement: it's a tool to use when you want to have private conversations. Maybe it'd be better to leave the Signal messaging app lives its life and allows a third party chat history viewer to emerge. You can already export your encrypted backup to a readable CSV file. https://github.com/xeals/signal-back https://github.com/xeals/signal-back edit: which obviously doesn't work with a corrupted database :p. Signal backup as a service startup ? Point in case: mom complained the other day that Signal Desktop took some time to launch because it was “syncing things”. I told here that this syncing from her phone to the computer is the proof her messages only exist in the application. Desktop or smartphone, that's why it needs to sync, facebook and others don't work like that (I grossly simplified). note: Thread with comments like is how I remember HN is now a site with a huge audience.

reader_mode 6y ago
I just use telegram - it has ptivate messages when I need them but it's a great chat app to begin with.
matsemann 6y ago
I don't really need my messages persisted across devices in the cloud or when buying a new phone. Search on Facebook messenger for instance is broken so it's not like I can find anything ("what was the code to the gate?"), and I've never felt the need to scroll more than a few days back for other stuff. What I need is just to persist the groups, really. So I easily can continue chatting there and not hope someone else sends a message first.
- JohnJamesRambo 6y ago

meibo 6y ago

Signal Desktop is a travesty. Their design causes it to be incredibly slow, to miss messages, to have them arrive out of order - and that's not even acknowledging the usability downfalls. They really need to do better. I hope they can figure out some way to shift more resources to it, a good desktop client is essential to modern messengers.

hashkb 6y ago
The "standard electron horror" is why I can't really commit to signal. None of the Good Guys have a good desktop messenger yet.
- meibo 6y ago
  You can make good Electron apps if you care enough. Electron is decidedly not why Signal Desktop is terrible, it's just a contributing factor.
  - pseudalopex 6y ago
    Even Visual Studio Code gets things wrong.
  - EvilEy3 6y ago
    > You can make good Electron apps if you care enough. That defeats purpose of Electron, though.
  - hashkb 6y ago
    Well, nobody cares enough. And that's probably why they find Electron attractive. No need to care, no expectations that you'll ship something good. Hey, look at Slack!
- MikusR 6y ago
  Telegram has one.
  - Asraelite 6y ago

oefrha 6y ago

SQLite should not be corruptible by power loss unless PRAGMA synchronous is OFF, or OS/fs/storage media don’t honor fsync. https://www.sqlite.org/howtocorrupt.html https://www.sqlite.org/howtocorrupt.html But the thread says SQLCipher is used, so not sure.

GNU_James 6y ago

Why not use encrypted Jabber like Russian Mob? If they are safe with XMPP, I feel safe too.

eptcyka 6y ago

Exporting message history, easily selecting multiple messages to forward, allowing for group chat history to be maintained and transferred between devices, synchronizing video rotation in video calls, scheduled messages. Some of these features might be harder to implement than others, but I am constantly reminded of their absence whenever I use signal. I used to only use telegram, and it just works that much better as long as you don't care about privacy. It'd be easier for me to continue using Signal if it was more grandmother friendly. Even my partner is having issues with this, and they are usually capable of using tech.

pure_simplicity 6y ago
These are sensible suggestions. What do you mean by "synchronizing video rotation in video calls" and how do you note the presence / absence of this feature in practice? Do you have any idea how we could practically make Signal a better app in the future?
- eptcyka 6y ago
  As brash as this might sound, reworking the user interface to more match the likes of the competition would go a long way to make the app more usable. My partner has trouble finding functionality that is there. The video call issue is that if I rotate my phone from portrait to landscape, the recipient will still receive a portrait video stream from me. I'd expect the recipient to receive a landscape aspect ratio stream instead. I must add that I am incredibly thankful for the effort you guys have put into Signal. If users like me come across as a bit sour, at least in my case, I am that way because there seem to be a lot of low hanging fruit that users willing to use the app seem to hit on the head. I'd love for signal to be more successful.

sagivo 6y ago

I feel like Signal missed the opportunity they had after the WhatsApp fiasco. Every person I've tried to convert to Signal opt out after a day or two due to lack of usability. Most of them either went back to WhatsApp or moved to Telegram. While the tech is great and the privacy is good, if they won't invest in usability and UI they will not win the masses. EDIT - if you downvote, please explain why. If you disagree it's not a reason to downvote.

krastanov 6y ago
My personal anecdote is the opposite of yours: it was easy for me to convert people to Signal. Concerning your edit: I thought it was a pretty established part of the etiquette on HN that a downvote is used also for simple disagreement. It means "I do not agree", not "you are wrong and should be shamed".
- sagivo 6y ago
  I may be wrong, but comments are meant for that. Ideally when there's a disagreement, people can openly discuss it. I thought downvoting is to flag unproductive comments.
  - hansvm 6y ago
    I had that impression too, but I just read the guidelines and can't find anything to that effect. They do say that we shouldn't be commenting about the voting though ;).
- vengefulduck 6y ago
  Maybe on Reddit, but on HN downvoting is supposed to be a moderation tool. That’s why you need a certain amount of karma to access it. It should be used to flag content that breaks the rules or is unproductive in some way. Please don’t use it like you do on Reddit.
  - krastanov 6y ago
    You are making a couple too many assumptions. For starters, I do not use reddit. I wrote my message above with the caveat that I am unsure ("I thought"), but you are presenting a front of certainty without backing it up with evidence (and evidence rarely exists when talking about common culture).

mittaus 6y ago

Caveat Emptor.

Daniel_sk 6y ago

Unfortunately the overall code quality doesn't seem to good - I looked at the Android code and the network layer / retry logic seems to be quite chaotic with weird exception handling. The UI layer would also need a refresh, a lot of logic is placed in the Fragments directly, no MVVM (e.g. Architecture Components ViewModel) or any other pattern. The sync issues keep coming back. For example you use the Signal desktop app and then at the end of the day you pick up the phone, open Signal and a stream of notifications will start flowing in (even though you read everything on desktop). Also the PC desktop app doesn't sync with iPhone, you need to download an old version, pair the phone and then update to latest to fix it - https://community.signalusers.org/t/my-messages-in-desktop-app-not-showing-in-ios-app/22329 https://community.signalusers.org/t/my-messages-in-desktop-a....

GuB-42 6y ago
I also too a look at the code and wasn't impressed. Signal used to have a feature that allows you to import SMS. It had a few problems but it mostly did the job. But lately, they disabled it with the latest onboarding update, without mentioning anything in the change log. I had to look at the git history to see that, I also found a "won't fix" ticket about the problem. I think they are ignoring an very important feature but anyways, make a decision. Either you officially disable the feature, write it in the changelog and remove the dead code. Or you keep it and hopefully fix it. The way they are doing it is sloppy. I didn't look too much into it but dead code is definitely a code smell and your experience seems to match mine. It is not terrible, but a bit underwhelming considered it is a highly regarded, security sensitive app.
pure_simplicity 6y ago
That's unfortunate. I wonder why Signal suffers from these issues, but I hope it's something we can fix. I think Signal has such great potential. Society needs a successful privacy respecting open source chat app like Signal. Do you have any clue how to make things better?

batterylow 6y ago

I've been using the iOS version on my M1 MacBook Air... it seems to use less memory, which is a benefit on my 8GB (base) model. I haven't done any tests though!

reidrac 6y ago

A few years ago I gave up on my own XMPP server and moved to Telegram because Signal wasn't ready. Recently I have moved to Signal because, after the WhatsApp opportunity, I had to move my non-tech savvy family members to something better, and I suspect Telegram isn't it (I can't understand how it is funded, it is too "magic"). But it is rough, specially compared to Telegram. For example: there's no way I'll share my phone number to chat with strangers, whilst on Telegram I have an anonymous username I can use. But even forgetting about that, it is the small things, like it can't record and send a video (you can record it out of the app, and then send it from Signal; at least on Android), or the atrocious desktop app. I'm happy it exists and I'll stick with it because they're supposed to be "the good guys", but I'm hopping it improves before I have to admit it was a mistake and I should have trusted Telegram.

prophesi 6y ago

https://github.com/signalapp/Signal-Desktop/issues/4513#issuecomment-787429886 https://github.com/signalapp/Signal-Desktop/issues/4513#issu... Is there a citation for this claim? I tried searching on Twitter for tweets regarding Signal errors, and I didn't see anything except for retweets of the link to this HN post. It's also just the local database, so the phone that their desktop app is linked to will still have their chat history, thus these alleged journalists would not have lost their sources.

miduil 6y ago
I didn't link it on GitHub for purpose. Somehow it turned out not to be related to that issue (so after few days it's just unlinked but contacts/history thankfully still there) https://twitter.com/moltke/status/1364231860528836608 https://twitter.com/moltke/status/1364231860528836608

Havoc 6y ago

Signal has been rather flakey the last 24hrs in general