7 ms·

The Signal Server repository has not been updated since April 2020

71 points by ignoramous 6y ago

sodality2 6y ago
Not liking what signal is becoming. I liked element but I didn't like the reliability of the apps. Are there any other alternatives besides XMPP+OMEMO/matrix for federated messages?
- lrvick 6y ago
  Element is my only messaging client and I don't really understand the "reliability" comments. Sure it has momentary downtime with the official matrix.org servers for maybe a minute but this is why we should pursue setting up smaller servers for our social groups in the long run. I can't think of anything as unreliable as the multiple days of downtime Signal had.
  - sodality2 6y ago
    Several months ago (and a few months before that!) nothing would go from my phone to my laptop with separate accounts on different servers. Messages, calls, etc all didn't deliver. I'm definitely gonna try again soon, but those reliability issues put me off from it for a while. Unless it's some sort of internet issue?
    - Arathorn 6y ago
      Weird. we're not aware of a failure mode like that. For what it's worth, most of the VoIP stuff has been rewritten over the last few months and is feeling much better these days.
      - sodality2 6y ago
        I will certainly be retrying it then, thanks! That was honestly my only holdout because everything else about matrix/element excites me (federation, easy integration, multi device with keys, etc).
    - lrvick 6y ago
      There were some significant upgrades that were a bit bumpy between clients of differing versions etc, but today I have 0 problems using Element across several devices seamlessly.
  - Macha 6y ago
    Yeah, reliability is pretty much on par with discord or slack. Neither of them have the same level of reliability as say Whatsapp or iMessage, but it hasn't been a blocker to them, or isn't mentioned every time they're brought up.
    - patcon 6y ago
      From my perspective as someone who uses it every day for work on a community server my coworkers arduously maintain, this is 100% NOT true for us (I'm not leaving Matrix, but it's def not on par with Slack)
      - Arathorn 6y ago
        it sounds like there’s something wrong with the server; it shouldn’t be arduous to maintain. please ping us if you haven’t already.
- banger180 6y ago
  I honestly believe matrix will become the go to for (federated) messaging everywhere. The element client has much improved and matrix is continuing to get better.
  - sodality2 6y ago
    I'll have to try it again, then. On two occasions several months apart, as soon as I tried to use it again it just didn't deliver calls or messages. The only time I tried to use it and it flat out didn't work :/ might see if I can track down the issue through the logs.
    - tormeh 6y ago
      FluffyChat is an alternative client that's also pretty far along
      - unicornporn 6y ago
        Syphon[1] (although open alpha) too. [1] https://syphon.org/ https://syphon.org/
  - patcon 6y ago
    as someone who just yesterday was working around what seemed to be a Matrix netsplit on our office/community server (coworkers saw different things on mobile vs desktop vs other servers), i feel like you're glamourizing Matrix. We're still hosting it and committed to it for work, but Matrix servers have been so finicky for years (with improvements) Signal is still the clear winner rn imho
    - Arathorn 6y ago
      this simply shouldn’t happen; it’s almost unheard of for mobile vs desktop to get out of sync unless the server is super unhealthy. can you file a bug or ping in #synapse:matrix.org so we can try to help?
- Arathorn 6y ago
  I'd love to know what reliability metric you're going by, and which platform (Element Web/Desktop, iOS & Android are entirely different codebases). We're currently working hard on Element's UX, but it's always a bit unclear whether complaints like this refer to crashes, or UX papercuts (e.g. the cross-signing UX on login), or performance, or something else.
  - sodality2 6y ago
    Several months ago (and a few months before that!) nothing would go from my phone to my laptop with separate accounts on different servers. Messages, calls, etc all didn't deliver. Could this be an internet issue? These were the only times I've tried it as well, which leads me to believe it is a network issue. Never had internet issues previously, so I would appreciate some guidance on how to enable logging to see what the problem is.
binarymax 6y ago
The title is the only thing worth reading in this pile of speculation and hand waving. That being said it would be nice to hear why this is the case. It may be a misunderstanding.
- cs702 6y ago
  Agree. To the OP and/or HN mods: please consider changing the link to the Signal server's public repo, which shows the last date on which the repo was updated: https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
mikece 6y ago
Is there any reason to believe that Signal’s encryption has been compromised or that metadata harvesting is going on?
- Tajnymag 6y ago
  No
- lrvick 6y ago
  They control the only allowed client binaries and don't let others compile and distribute them. Those binaries have complete control of your keys. If they wanted to (or were forced to) release an update that bulk decrypted all messages or those of specific people and sent them to a random server somewhere... They totally could, and likely not get caught until well after every target was exposed, if at all. Huge SPOF. End to end encryption where only one party controls the software that controls both ends with no accountability is more marketing than security.
  - op03 6y ago
    What you are really saying is you dont know how to market an alternate approach. So hopefully grandma or someone else shows up and does the work right? I am fine with Signal. They arent Facebook. And they arent Russians. Anyone who has an alternative go spend some cash and energy on marketing cause thats the hard problem not the technical details.
    - anoncake 6y ago
      > And they arent Russians. Any other ethnicities you don't allow?
      - vulcan01 6y ago
        It's not the ethnicity: - If a company is based in the US, they will be under pressure from the US government. - If a company is based in Russia, they will be under pressure from the Russian government. - If a company is based in China, they will be under pressure from the Chinese government.
blueplanet200 6y ago
Signal Server isn't some open source library you drop into a project. It's an application run in production on a shoestring budget. Have a look at the PRs that are have been opened (that have or have not been merged): https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr I don't see much to complain about it. Most if not all are small non-issues that I wouldn't blame the Signal devs for ignoring to focus on what they view as higher value features. Signal is free, it's secure, and its source if freely available online. I don't see much to sharpen my pitchfork over in this case...
gramakri 6y ago
Are there any instruction on how to deploy the server code?
- bilal4hmed 6y ago
  you can find them on the forum, good luck trying to getting up and running https://community.signalusers.org/c/development/server-development/24 https://community.signalusers.org/c/development/server-devel...
  - gramakri 6y ago
    Thanks, I found https://community.signalusers.org/t/wiki-overview-of-unofficial-server-setup-guides/28721 https://community.signalusers.org/t/wiki-overview-of-unoffic... . But not very encouraging that all the docs are 3rd party.
bilal4hmed 6y ago
Im glad this is being discussed further. I had posted about this a lot. People will say the clients are open source, it doesnt matter if the server code is not available because the clients share little meta data etc. do you realize things like reactions etc. dont work with the version of the server on public github ? It would be nice to be able to have feature parity on git vs prod so you can see to a greater extent what the server is doing vs today where its just a black box. People have been asking moxie and the team about this for a while and the minute you bring it up silence. They dont like to talk about it all. Doesnt help with their privacy and transparency message.
hpb42 6y ago
Someone opened a provocative pull request in signal's server source code yesterday about this: https://github.com/signalapp/Signal-Server/pull/124/files https://github.com/signalapp/Signal-Server/pull/124/files
sschueller 6y ago
On a side note. Has anyone gotten the android client reproducible builds to work recently? I have been unsuccessful but have not spent much time figuring out whats broken so far.
0xy 6y ago
Given it's confirmed Signal production servers run features not seen in this repository, we can safely label Signal as a closed source application that happens to have an abandonware repository of old code.

71 points by ignoramous 6y ago

Not liking what signal is becoming. I liked element but I didn't like the reliability of the apps. Are there any other alternatives besides XMPP+OMEMO/matrix for federated messages?

lrvick 6y ago
Element is my only messaging client and I don't really understand the "reliability" comments. Sure it has momentary downtime with the official matrix.org servers for maybe a minute but this is why we should pursue setting up smaller servers for our social groups in the long run. I can't think of anything as unreliable as the multiple days of downtime Signal had.
- sodality2 6y ago
  Several months ago (and a few months before that!) nothing would go from my phone to my laptop with separate accounts on different servers. Messages, calls, etc all didn't deliver. I'm definitely gonna try again soon, but those reliability issues put me off from it for a while. Unless it's some sort of internet issue?
  - Arathorn 6y ago
    Weird. we're not aware of a failure mode like that. For what it's worth, most of the VoIP stuff has been rewritten over the last few months and is feeling much better these days.
    - sodality2 6y ago
      I will certainly be retrying it then, thanks! That was honestly my only holdout because everything else about matrix/element excites me (federation, easy integration, multi device with keys, etc).
  - lrvick 6y ago
    There were some significant upgrades that were a bit bumpy between clients of differing versions etc, but today I have 0 problems using Element across several devices seamlessly.
- Macha 6y ago
  Yeah, reliability is pretty much on par with discord or slack. Neither of them have the same level of reliability as say Whatsapp or iMessage, but it hasn't been a blocker to them, or isn't mentioned every time they're brought up.
  - patcon 6y ago
    From my perspective as someone who uses it every day for work on a community server my coworkers arduously maintain, this is 100% NOT true for us (I'm not leaving Matrix, but it's def not on par with Slack)
    - Arathorn 6y ago
      it sounds like there’s something wrong with the server; it shouldn’t be arduous to maintain. please ping us if you haven’t already.
banger180 6y ago
I honestly believe matrix will become the go to for (federated) messaging everywhere. The element client has much improved and matrix is continuing to get better.
- sodality2 6y ago
  I'll have to try it again, then. On two occasions several months apart, as soon as I tried to use it again it just didn't deliver calls or messages. The only time I tried to use it and it flat out didn't work :/ might see if I can track down the issue through the logs.
  - tormeh 6y ago
    FluffyChat is an alternative client that's also pretty far along
    - unicornporn 6y ago
      Syphon[1] (although open alpha) too. [1] https://syphon.org/ https://syphon.org/
- patcon 6y ago
  as someone who just yesterday was working around what seemed to be a Matrix netsplit on our office/community server (coworkers saw different things on mobile vs desktop vs other servers), i feel like you're glamourizing Matrix. We're still hosting it and committed to it for work, but Matrix servers have been so finicky for years (with improvements) Signal is still the clear winner rn imho
  - Arathorn 6y ago
    this simply shouldn’t happen; it’s almost unheard of for mobile vs desktop to get out of sync unless the server is super unhealthy. can you file a bug or ping in #synapse:matrix.org so we can try to help?
Arathorn 6y ago
I'd love to know what reliability metric you're going by, and which platform (Element Web/Desktop, iOS & Android are entirely different codebases). We're currently working hard on Element's UX, but it's always a bit unclear whether complaints like this refer to crashes, or UX papercuts (e.g. the cross-signing UX on login), or performance, or something else.
- sodality2 6y ago
  Several months ago (and a few months before that!) nothing would go from my phone to my laptop with separate accounts on different servers. Messages, calls, etc all didn't deliver. Could this be an internet issue? These were the only times I've tried it as well, which leads me to believe it is a network issue. Never had internet issues previously, so I would appreciate some guidance on how to enable logging to see what the problem is.

binarymax 6y ago

The title is the only thing worth reading in this pile of speculation and hand waving. That being said it would be nice to hear why this is the case. It may be a misunderstanding.

cs702 6y ago
Agree. To the OP and/or HN mods: please consider changing the link to the Signal server's public repo, which shows the last date on which the repo was updated: https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server

mikece 6y ago

Is there any reason to believe that Signal’s encryption has been compromised or that metadata harvesting is going on?

Tajnymag 6y ago
No
lrvick 6y ago
They control the only allowed client binaries and don't let others compile and distribute them. Those binaries have complete control of your keys. If they wanted to (or were forced to) release an update that bulk decrypted all messages or those of specific people and sent them to a random server somewhere... They totally could, and likely not get caught until well after every target was exposed, if at all. Huge SPOF. End to end encryption where only one party controls the software that controls both ends with no accountability is more marketing than security.
- op03 6y ago
  What you are really saying is you dont know how to market an alternate approach. So hopefully grandma or someone else shows up and does the work right? I am fine with Signal. They arent Facebook. And they arent Russians. Anyone who has an alternative go spend some cash and energy on marketing cause thats the hard problem not the technical details.
  - anoncake 6y ago
    > And they arent Russians. Any other ethnicities you don't allow?
    - vulcan01 6y ago
      It's not the ethnicity: - If a company is based in the US, they will be under pressure from the US government. - If a company is based in Russia, they will be under pressure from the Russian government. - If a company is based in China, they will be under pressure from the Chinese government.

blueplanet200 6y ago

Signal Server isn't some open source library you drop into a project. It's an application run in production on a shoestring budget. Have a look at the PRs that are have been opened (that have or have not been merged): https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr I don't see much to complain about it. Most if not all are small non-issues that I wouldn't blame the Signal devs for ignoring to focus on what they view as higher value features. Signal is free, it's secure, and its source if freely available online. I don't see much to sharpen my pitchfork over in this case...

gramakri 6y ago

Are there any instruction on how to deploy the server code?

bilal4hmed 6y ago
you can find them on the forum, good luck trying to getting up and running https://community.signalusers.org/c/development/server-development/24 https://community.signalusers.org/c/development/server-devel...
- gramakri 6y ago
  Thanks, I found https://community.signalusers.org/t/wiki-overview-of-unofficial-server-setup-guides/28721 https://community.signalusers.org/t/wiki-overview-of-unoffic... . But not very encouraging that all the docs are 3rd party.

bilal4hmed 6y ago

Im glad this is being discussed further. I had posted about this a lot. People will say the clients are open source, it doesnt matter if the server code is not available because the clients share little meta data etc. do you realize things like reactions etc. dont work with the version of the server on public github ? It would be nice to be able to have feature parity on git vs prod so you can see to a greater extent what the server is doing vs today where its just a black box. People have been asking moxie and the team about this for a while and the minute you bring it up silence. They dont like to talk about it all. Doesnt help with their privacy and transparency message.

hpb42 6y ago

Someone opened a provocative pull request in signal's server source code yesterday about this: https://github.com/signalapp/Signal-Server/pull/124/files https://github.com/signalapp/Signal-Server/pull/124/files

sschueller 6y ago

On a side note. Has anyone gotten the android client reproducible builds to work recently? I have been unsuccessful but have not spent much time figuring out whats broken so far.

0xy 6y ago

Given it's confirmed Signal production servers run features not seen in this repository, we can safely label Signal as a closed source application that happens to have an abandonware repository of old code.