5 ms·

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?

jiveturkey 6y ago
I think it's proof that security (and privacy) doesn't matter. So it is very relevant. (As if telegram as competitor isn't enough proof.) The entirety of the signal "stack" depends on the SGX enclave. The fact that no one, in all time, has bothered to notice that the running code is different than the published code, is telling. There's actually a newer SGX exploit, and related mitigation, that came to light at about the same time when they released their discovery protocol. Those mitigations were never backported to the base signal functionality. That no one audited and complained about this says quite a lot. I've not looked at this code dump but perhaps the newer fixes finally made their way in. Or have been there all along.
- ajconway 6y ago
  > The fact that no one, in all time, has bothered to notice that the running code is different than the published code It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. > The entirety of the signal "stack" depends on the SGX enclave Only private contact discovery depends on trusting SGX.
  - jiveturkey 6y ago
    > It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained about. Without independent audit, there is no verification and we have established that independent parties do not care. > Only private contact discovery depends on trusting SGX. uh, no. this is demonstrably and obviously wrong.
    - feanaro 6y ago
      > uh, no. this is demonstrably and obviously wrong. Yes? How?
    - tylersmith 6y ago
      Then please demonstrate.
nimbius 6y ago
better question yet: Did we ever get a full post-mortem of the six day outage the service had? other than hand waving statements about user subscriptions? what fixes were made or lessons learned?
- ddevault 6y ago
  The Signal outage was SIX DAYS?
  - saurik 6y ago
    (All the news I'm finding is that it was just one day.)
    - uoaei 6y ago
      As I recall it was 1-2 days, yeah.
  - stjohnswarts 6y ago
    no it wasn't
amyjess 6y ago
My guess is that the whole public repo thing was just one employee's idea, nobody else at the company cared, and that employee either forgot about it or was too busy to do it for months.
Sander_Marechal 6y ago
> Is there an official response as to why they stopped sharing the code for so long Not oficially, but see https://news.ycombinator.com/item?id=26725117 https://news.ycombinator.com/item?id=26725117. They stopped publishing code when they started on the cryptocurrency integration.
est31 6y ago
The first commit that they omitted in April 2020 is related to the payment feature they just announced. So the two events coinciding (server code being published and payment feature being announced) might not have been a coincidence. They apparently didn't want to bother creating a private test server running a private fork of the server code and just pushed their experiments to production, just not releasing the source code to prevent people from seeing the feature before an official announcement. They neccessarily built test client apps because I couldn't find any old commit mentioning payments in the client app git log. https://news.ycombinator.com/item?id=26718134 https://news.ycombinator.com/item?id=26718134
- theptip 6y ago
  This leaves a very bad taste in my mouth. Unclear how much practical damage this caused (how many security analysts are using the Signal server source to look for vulns?) but this is damaging to the project's claims of transparency and trustworthiness. It’s quite clear that this crypto integration provides a perverse incentive for the project that points in the opposite direction of security.
  - ignoramous 6y ago
    It was called out as recently as 4 weeks ago [0] and was voted to the front-page but then weighted-out possibly incorrectly by mods (may be because the top comment is dismissive of concerns raised [1]?) before a discussion could flourish. cc: @dang [0] https://news.ycombinator.com/item?id=26345937 https://news.ycombinator.com/item?id=26345937 [1] The title is the only thing worth reading in this pile of speculation and hand waving.
  - _dibly 6y ago
    Forgive me if this is a stupid question, but how exactly is that the case? It's been damaging to their claims of transparency for almost a year now, if anything this should be the first step in repairing that slight. How is dumping a year's worth of private work into your public repo somehow doing damage to their trustworthiness?
nileshtrivedi 6y ago
Here's a response by MobileCoin folks: > Signal had to verify that MobileCoin worked before exposing their users to the technology. That process took a long time because MobileCoin has lots of complicated moving parts. > With respect to price, no one truly understands the market. It’s impossible to predict future price. - https://twitter.com/mobilecoin/status/1379830618876338179 https://twitter.com/mobilecoin/status/1379830618876338179 Reeks of utter BS. As the reply on this tweet says, features can be developed while being kept switched off with a flag.
- dewey 6y ago
  > features can be developed while being kept switched off with a flag But maybe you don't want everyone to know about all the features / announcements months in advance?
  - vinay427 6y ago
    They already did this development privately. I don't think anyone has a problem with building out a new feature before it's announced. The problem people have, IMO understandably, is that they pushed this code to production servers instead of testing it privately.
mrtweetyhack 6y ago
remove plain text passwords and China's message redirects

jiveturkey 6y ago

I think it's proof that security (and privacy) doesn't matter. So it is very relevant. (As if telegram as competitor isn't enough proof.) The entirety of the signal "stack" depends on the SGX enclave. The fact that no one, in all time, has bothered to notice that the running code is different than the published code, is telling. There's actually a newer SGX exploit, and related mitigation, that came to light at about the same time when they released their discovery protocol. Those mitigations were never backported to the base signal functionality. That no one audited and complained about this says quite a lot. I've not looked at this code dump but perhaps the newer fixes finally made their way in. Or have been there all along.

ajconway 6y ago
> The fact that no one, in all time, has bothered to notice that the running code is different than the published code It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. > The entirety of the signal "stack" depends on the SGX enclave Only private contact discovery depends on trusting SGX.
- jiveturkey 6y ago
  > It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained about. Without independent audit, there is no verification and we have established that independent parties do not care. > Only private contact discovery depends on trusting SGX. uh, no. this is demonstrably and obviously wrong.
  - feanaro 6y ago
    > uh, no. this is demonstrably and obviously wrong. Yes? How?
  - tylersmith 6y ago
    Then please demonstrate.

nimbius 6y ago

better question yet: Did we ever get a full post-mortem of the six day outage the service had? other than hand waving statements about user subscriptions? what fixes were made or lessons learned?

ddevault 6y ago
The Signal outage was SIX DAYS?
- saurik 6y ago
  (All the news I'm finding is that it was just one day.)
  - uoaei 6y ago
    As I recall it was 1-2 days, yeah.
- stjohnswarts 6y ago
  no it wasn't

amyjess 6y ago

My guess is that the whole public repo thing was just one employee's idea, nobody else at the company cared, and that employee either forgot about it or was too busy to do it for months.

Sander_Marechal 6y ago

> Is there an official response as to why they stopped sharing the code for so long Not oficially, but see https://news.ycombinator.com/item?id=26725117 https://news.ycombinator.com/item?id=26725117. They stopped publishing code when they started on the cryptocurrency integration.

est31 6y ago

The first commit that they omitted in April 2020 is related to the payment feature they just announced. So the two events coinciding (server code being published and payment feature being announced) might not have been a coincidence. They apparently didn't want to bother creating a private test server running a private fork of the server code and just pushed their experiments to production, just not releasing the source code to prevent people from seeing the feature before an official announcement. They neccessarily built test client apps because I couldn't find any old commit mentioning payments in the client app git log. https://news.ycombinator.com/item?id=26718134 https://news.ycombinator.com/item?id=26718134

theptip 6y ago
This leaves a very bad taste in my mouth. Unclear how much practical damage this caused (how many security analysts are using the Signal server source to look for vulns?) but this is damaging to the project's claims of transparency and trustworthiness. It’s quite clear that this crypto integration provides a perverse incentive for the project that points in the opposite direction of security.
- ignoramous 6y ago
  It was called out as recently as 4 weeks ago [0] and was voted to the front-page but then weighted-out possibly incorrectly by mods (may be because the top comment is dismissive of concerns raised [1]?) before a discussion could flourish. cc: @dang [0] https://news.ycombinator.com/item?id=26345937 https://news.ycombinator.com/item?id=26345937 [1] The title is the only thing worth reading in this pile of speculation and hand waving.
- _dibly 6y ago
  Forgive me if this is a stupid question, but how exactly is that the case? It's been damaging to their claims of transparency for almost a year now, if anything this should be the first step in repairing that slight. How is dumping a year's worth of private work into your public repo somehow doing damage to their trustworthiness?

nileshtrivedi 6y ago

Here's a response by MobileCoin folks: > Signal had to verify that MobileCoin worked before exposing their users to the technology. That process took a long time because MobileCoin has lots of complicated moving parts. > With respect to price, no one truly understands the market. It’s impossible to predict future price. - https://twitter.com/mobilecoin/status/1379830618876338179 https://twitter.com/mobilecoin/status/1379830618876338179 Reeks of utter BS. As the reply on this tweet says, features can be developed while being kept switched off with a flag.

dewey 6y ago
> features can be developed while being kept switched off with a flag But maybe you don't want everyone to know about all the features / announcements months in advance?
- vinay427 6y ago
  They already did this development privately. I don't think anyone has a problem with building out a new feature before it's announced. The problem people have, IMO understandably, is that they pushed this code to production servers instead of testing it privately.

mrtweetyhack 6y ago

remove plain text passwords and China's message redirects