5 ms·
(Comment adapted from one I made under the post itself) Whether or not the server-side code is visible isn't very important. There are two reasons why: 1. (An
by Seirdy 6y ago
(Comment adapted from one I made under the post itself)
Whether or not the server-side code is visible isn't very important. There are two reasons why:
1. (Anti-Signal) Signal is a closed platform; users can't self-host a Signal server and expect to be able to talk to other Signal users. Users must accept whatever code the server runs, no modifications. This is an example of the difference between "free software" and "open-source"; this type of SaaS is open-source but not necessarily free.
2. (Pro-Signal) All three Signal apps (at the time of writing this comment) use E2EE with minimal metadata leakage. The server is unaware of the contents of the messages and cannot connect a sender to a recipient. As long as the apps don't get an update that changes this situation, users don't need to trust a Signal server to protect their privacy.
I wrote about the first reason in a bit more detail in a blog post, posted here previously [0].
A follow-up article [1] covered alternative asynchronous messaging platforms: email, XMPP and Matrix. None of the three is a perfect replacement of Signal due to metadata leakage, but all offer a greater degree of freedom. My main thesis is that when choosing a messaging platform to adopt, it's important to consider implementation and provider diversity to prevent lock-in.
[0]: https://news.ycombinator.com/item?id=25982860 https://news.ycombinator.com/item?id=25982860
[1]: https://seirdy.one/2021/02/23/keeping-platforms-open.html https://seirdy.one/2021/02/23/keeping-platforms-open.html
- captn3m0 6y agoA 12 year old kid in India was able to clone the Signal app, change the branding, publish it on the Play Store, get tens of thousands of users, get news coverage, and yet it took Signal 4+ months to get that application blocked. Signal, afaik, hasn't made a public statement on the clone application and whether the users were impacted in any way. News Report (2020-09-04): https://keralakaumudi.com/en/news/news.php?id=383731&u=a-bold-attempt-to-fill-the-space-left-by-chinese-12-year-old-makes-app-for-chatting-provides-though-competition-to-whatsapp https://keralakaumudi.com/en/news/news.php?id=383731&u=a-bol... Report after which the app was taken down (2021-01-12): https://twitter.com/selfrefute/status/1348994641165631488 https://twitter.com/selfrefute/status/1348994641165631488 Edit: On second reading, realized you meant Federation, and this isn't that (the clone app talks to the Signal servers)
- zajio1am 6y ago> All three Signal apps (at the time of writing this comment) use E2EE with minimal metadata leakage. Three most important metadata of a message is sender, receiver, time. AFAIK all three are available to Signal server (while sender, receiver identified at least by IP address).
- mindslight 6y ago> This is an example of the difference between "free software" and "open-source" Given Signal's insistence that modified apps don't connect to their users' existing accounts, Signal is better characterized as shared source. You're only meant to look, not to touch.