6 ms·

What they've not addressed: - Moxie's involvement with MobileCoin (could be as simple as saying: "for the same reasons Signal's interested in MobileCoin, moxie

by Vinnl 6y ago

What they've not addressed: - Moxie's involvement with MobileCoin (could be as simple as saying: "for the same reasons Signal's interested in MobileCoin, moxie is as well"). - The concerns about regulatory risks/attention involved with a cryptocurrency integration. - Why it involved hiding the server source code. The idea of privacy-friendly transactions easily available within an app I'm already using is attractive, but I very much hope the obvious concerns won't play out in practice (which time will tell), and it would be good if they'd also addressed the above.

hiq 6y ago
> - Why it involved hiding the server source code. My guess: to reduce the noise and speculation. Much better to deal with it now that there's something to be gained (feedback from beta testers and actual deployment). There was little to gain before, since the server accepts very few contributions anyway. I wander enough on GH to see how much time big open-source project maintainers spend addressing toxic comments. Open-source is nice when you get relevant contributions and constructive feedback, but it's really not free, you have to deal with all the rest as well.
- mplewis 6y ago
  If you're not willing to be open with your source, don't market your software as open-source.
  - rOOb85 6y ago
    ...there code always has and continues to be open source. Is there some law that states a project must publish X code changes in Y timespan?
    - fastball 6y ago
      Well take it further – is is still open-source if you update the public repo once every 10 years? For the vast majority of people, OSS in 2021 means having a public repo hosted somewhere that all commits are pushed to, or PRs are made to. Periodically updating a public repo with changes made to a private repo is not really what people have in mind.
      - cptskippy 6y ago
        Were they updating the Server during the periods where the public repo wasn't receiving updates? That's like requiring a developer to push their local changes hourly/daily for a task that's been committed to but not completed.
        remram 6y ago
        Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. When you're using a product for which you can't get the source code, the product is not open source. Commits: https://github.com/signalapp/Signal-Server/commits/master https://github.com/signalapp/Signal-Server/commits/master No push between: April 20, 2020 and April 6, 2021.
        cptskippy 6y ago
        > Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they deployed but then say it's an assumption. Either they did or they didn't. If they didn't deploy the code to production prior to the commit then I see no problem with what they did.
        dogecoinbase 6y ago
        I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.
        cptskippy 6y ago
        Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.
    - dogecoinbase 6y ago
      In this case, they not only didn't update with changes, but didn't address specific concerns about known vulnerabilities in their outdated repo: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c...
    - SuchAnonMuchWow 6y ago
      It is not about how often you update your project. To be open source, you need to publish the source of applications you run. It's as simple as that: "we developed this app, and it's running on our servers, and the source can be found here". They kept updating their server app for a year, without publishing their source. This is not open source. Signal server code was not open source for a year.
    - geofft 6y ago
      Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stopped updating the server repository for around a year, but not just implausible but contradicted by evidence that they never changed the server code for about a year?) If so, then the code quite simply is not open source by any possible definition. I agree with you that a project that is dormant, or even receiving internal development that is still under review, can defensibly be called "open source" even if the development isn't happening in the open. (For instance, your favorite begrudgingly-GPL-compliant hardware vendor who releases .zip files every time they release a new product is releasing "open source" code.) But if the source code to the Signal server isn't even published, it can't be open.
  - hiq 6y ago
    I sympathize with this. On the other hand, you have to consider the big picture: - the open-source argument was mostly meant for everyone to look at the sources and draw their conclusions regarding privacy and security - these guarantees are mostly client-side (and you can't check what's running on the server anyway, even with the code) It's fair to say that the server code was proprietary for one year. Most of their code was still open-source during that time, and most of it (now that they push to the server repo as well) is now. I feel they would have taken less flak over this if their server code had never been open-source to begin with, or if they just released it now.
- alpaca128 6y ago
  > My guess: to reduce the noise and speculation. Why do you think more transparency would lead to noise and speculation? Exactly the opposite is the case. They could have gone the open route and maybe even gotten help from the community at implementing their payment feature. But the way they did it they left everyone wondering whether their server is now spyware or what other reasons there could be for them to not update the public repo.
  - hiq 6y ago
    > Why do you think more transparency would lead to noise and speculation? Because of the current situation: people argue about whether Moxie lost it, if Signal is still the right solution, etc. If the feature had been implemented in the open, this debate would have taken place since the beginning, again with little benefit. > maybe even gotten help from the community at implementing their payment feature. Signal does not have an open development model. They're a small team, and most things beyond bug fixes are done by them. You can debate whether that's the most efficient approach, I'll just say it's an open question, and that's the model right now. So contributions to this brand new feature by the community would not have been possible. > But the way they did it they left everyone wondering whether their server is now spyware If people misunderstand that most of the security guarantees come from the clients, there's little an up-to-date repository on GitHub can do. I think the noise and complaining that has been happening for one year about the closed-source server is still negligible to what's happening now. I would have preferred if they had kept it open, but I can definitely understand why they thought it was a better course of action.
SuchAnonMuchWow 6y ago
Also: why Mobilecoin, which is as far from "an alternative payments infrastructure" as most other cash-grab cryptocurrency ? It isn't known how much of it was premined, and from an early version of their whitepaper, the founders might have as much as 80% of the total supply of the coin. This isn't fine for a cryptocurrency which aims to be "an alternative payments infrastructure", and it isn't fine for Signal to try to promote them as such.
- qqii 6y ago
  To play Signal's advocate, MobileCoin is one of the only cryptocurrencies that meets their requirements. The only other cryptocurrency that I know of that might come close is Grin. The details of the distribution are lacking but as a beta it meets the experience they're going for - it's not as if they'd choose something that doesn't meet their requirements for the beta.
  - godelski 6y ago
    To clarify the only coins that meet their privacy requirements are ZCash, Monero, and MOB. The only subset of that that meets their transactional speed requirements is MOB. At least AFAIK. There's a ton of alt coins so I might have missed something.
    - nullc 6y ago
      This seems extremely misleading to me. Their "privacy" is strongly based on the confidentiality of SGX. If you're willing to trust SGX for your confidentiality and security, as they have, they could use any cryptocurrency in a highly private and instant manner. E.g. via an implementation of the moneypot server in SGX: https://bitcointalk.org/index.php?topic=5302025.0 https://bitcointalk.org/index.php?topic=5302025.0 MOB is transparently a scheme to generate a windfall from shoving a pre-mined coin into a mass-market application. One could debate the ethics of that with a straight face, I suppose, but to argue that it is anything but is just dishonest.
      - 6y ago
frombody 6y ago
To your first point: https://www.coindesk.com/signal-founder-may-have-been-more-than-tech-adviser-mobilecoin https://www.coindesk.com/signal-founder-may-have-been-more-t... The thing that gets me the most though is not what they are doing, it's the way they are going about it. The leader of a privacy focused app is now hiding secrets from everyone about the technology he convinced people was safe. I've had to write off signal for this reason alone. I mean the only reason I ever used the app was trust.
- deleted 6y ago
  [deleted]
godelski 6y ago
> Moxie's involvement with MobileCoin At best we know that he (claims to) have no coins. But that he was an advisor for them and focused on what he saw as a problem with crypto payments: speed. But yeah, there are still a lot of open questions here. > The concerns about regulatory risks/attention involved with a cryptocurrency integration. They addressed this before and the code reflects it. They whitelist country codes that allow it. > Why it involved hiding the server source code. This was weird and I'd like it addressed but probably not relevant to this particular topic/post. > The idea of privacy-friendly transactions easily available within an app I'm already using is attractive, Same. I mean it is a core element of the cyperpunk manifesto[0]. But I don't want to use a payment system that is volatile. If I have to choose to be beholden to services that collect my data or use a currency that is volatile, I'm going with the former every time. This is the question that I would have liked to be further addressed. [0]https://www.activism.net/cypherpunk/manifesto.html https://www.activism.net/cypherpunk/manifesto.html
- ascorbic 6y ago
  Even if he has no coins personally, that's a very narrow claim. Far more likely is that he has an interest in the company which happens to have pre-minted and owns most of the coins.
- Vinnl 6y ago
  I mean, regardless of whether they addressed it before, to me this blog posts reads like their attempt to address all concerns raised in a single place, and these are all concerns I've seen raised. Thus, it seems to be like it would be very relevant to address them in this post, and would help restore some of the trust that some people already lost, and that others are at risk of losing.

by Vinnl 6y ago

hiq 6y ago

> - Why it involved hiding the server source code. My guess: to reduce the noise and speculation. Much better to deal with it now that there's something to be gained (feedback from beta testers and actual deployment). There was little to gain before, since the server accepts very few contributions anyway. I wander enough on GH to see how much time big open-source project maintainers spend addressing toxic comments. Open-source is nice when you get relevant contributions and constructive feedback, but it's really not free, you have to deal with all the rest as well.

mplewis 6y ago
If you're not willing to be open with your source, don't market your software as open-source.
- rOOb85 6y ago
  ...there code always has and continues to be open source. Is there some law that states a project must publish X code changes in Y timespan?
  - fastball 6y ago
    Well take it further – is is still open-source if you update the public repo once every 10 years? For the vast majority of people, OSS in 2021 means having a public repo hosted somewhere that all commits are pushed to, or PRs are made to. Periodically updating a public repo with changes made to a private repo is not really what people have in mind.
    - cptskippy 6y ago
      Were they updating the Server during the periods where the public repo wasn't receiving updates? That's like requiring a developer to push their local changes hourly/daily for a task that's been committed to but not completed.
      - remram 6y ago
        Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. When you're using a product for which you can't get the source code, the product is not open source. Commits: https://github.com/signalapp/Signal-Server/commits/master https://github.com/signalapp/Signal-Server/commits/master No push between: April 20, 2020 and April 6, 2021.
        cptskippy 6y ago
        > Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they deployed but then say it's an assumption. Either they did or they didn't. If they didn't deploy the code to production prior to the commit then I see no problem with what they did.
        dogecoinbase 6y ago
        I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.
        cptskippy 6y ago
        Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.
  - dogecoinbase 6y ago
    In this case, they not only didn't update with changes, but didn't address specific concerns about known vulnerabilities in their outdated repo: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c...
  - SuchAnonMuchWow 6y ago
    It is not about how often you update your project. To be open source, you need to publish the source of applications you run. It's as simple as that: "we developed this app, and it's running on our servers, and the source can be found here". They kept updating their server app for a year, without publishing their source. This is not open source. Signal server code was not open source for a year.
  - geofft 6y ago
    Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stopped updating the server repository for around a year, but not just implausible but contradicted by evidence that they never changed the server code for about a year?) If so, then the code quite simply is not open source by any possible definition. I agree with you that a project that is dormant, or even receiving internal development that is still under review, can defensibly be called "open source" even if the development isn't happening in the open. (For instance, your favorite begrudgingly-GPL-compliant hardware vendor who releases .zip files every time they release a new product is releasing "open source" code.) But if the source code to the Signal server isn't even published, it can't be open.
- hiq 6y ago
  I sympathize with this. On the other hand, you have to consider the big picture: - the open-source argument was mostly meant for everyone to look at the sources and draw their conclusions regarding privacy and security - these guarantees are mostly client-side (and you can't check what's running on the server anyway, even with the code) It's fair to say that the server code was proprietary for one year. Most of their code was still open-source during that time, and most of it (now that they push to the server repo as well) is now. I feel they would have taken less flak over this if their server code had never been open-source to begin with, or if they just released it now.
alpaca128 6y ago
> My guess: to reduce the noise and speculation. Why do you think more transparency would lead to noise and speculation? Exactly the opposite is the case. They could have gone the open route and maybe even gotten help from the community at implementing their payment feature. But the way they did it they left everyone wondering whether their server is now spyware or what other reasons there could be for them to not update the public repo.
- hiq 6y ago
  > Why do you think more transparency would lead to noise and speculation? Because of the current situation: people argue about whether Moxie lost it, if Signal is still the right solution, etc. If the feature had been implemented in the open, this debate would have taken place since the beginning, again with little benefit. > maybe even gotten help from the community at implementing their payment feature. Signal does not have an open development model. They're a small team, and most things beyond bug fixes are done by them. You can debate whether that's the most efficient approach, I'll just say it's an open question, and that's the model right now. So contributions to this brand new feature by the community would not have been possible. > But the way they did it they left everyone wondering whether their server is now spyware If people misunderstand that most of the security guarantees come from the clients, there's little an up-to-date repository on GitHub can do. I think the noise and complaining that has been happening for one year about the closed-source server is still negligible to what's happening now. I would have preferred if they had kept it open, but I can definitely understand why they thought it was a better course of action.

SuchAnonMuchWow 6y ago

Also: why Mobilecoin, which is as far from "an alternative payments infrastructure" as most other cash-grab cryptocurrency ? It isn't known how much of it was premined, and from an early version of their whitepaper, the founders might have as much as 80% of the total supply of the coin. This isn't fine for a cryptocurrency which aims to be "an alternative payments infrastructure", and it isn't fine for Signal to try to promote them as such.

qqii 6y ago
To play Signal's advocate, MobileCoin is one of the only cryptocurrencies that meets their requirements. The only other cryptocurrency that I know of that might come close is Grin. The details of the distribution are lacking but as a beta it meets the experience they're going for - it's not as if they'd choose something that doesn't meet their requirements for the beta.
- godelski 6y ago
  To clarify the only coins that meet their privacy requirements are ZCash, Monero, and MOB. The only subset of that that meets their transactional speed requirements is MOB. At least AFAIK. There's a ton of alt coins so I might have missed something.
  - nullc 6y ago
    This seems extremely misleading to me. Their "privacy" is strongly based on the confidentiality of SGX. If you're willing to trust SGX for your confidentiality and security, as they have, they could use any cryptocurrency in a highly private and instant manner. E.g. via an implementation of the moneypot server in SGX: https://bitcointalk.org/index.php?topic=5302025.0 https://bitcointalk.org/index.php?topic=5302025.0 MOB is transparently a scheme to generate a windfall from shoving a pre-mined coin into a mass-market application. One could debate the ethics of that with a straight face, I suppose, but to argue that it is anything but is just dishonest.
    - 6y ago

frombody 6y ago

To your first point: https://www.coindesk.com/signal-founder-may-have-been-more-than-tech-adviser-mobilecoin https://www.coindesk.com/signal-founder-may-have-been-more-t... The thing that gets me the most though is not what they are doing, it's the way they are going about it. The leader of a privacy focused app is now hiding secrets from everyone about the technology he convinced people was safe. I've had to write off signal for this reason alone. I mean the only reason I ever used the app was trust.

deleted 6y ago
[deleted]

godelski 6y ago

> Moxie's involvement with MobileCoin At best we know that he (claims to) have no coins. But that he was an advisor for them and focused on what he saw as a problem with crypto payments: speed. But yeah, there are still a lot of open questions here. > The concerns about regulatory risks/attention involved with a cryptocurrency integration. They addressed this before and the code reflects it. They whitelist country codes that allow it. > Why it involved hiding the server source code. This was weird and I'd like it addressed but probably not relevant to this particular topic/post. > The idea of privacy-friendly transactions easily available within an app I'm already using is attractive, Same. I mean it is a core element of the cyperpunk manifesto[0]. But I don't want to use a payment system that is volatile. If I have to choose to be beholden to services that collect my data or use a currency that is volatile, I'm going with the former every time. This is the question that I would have liked to be further addressed. [0]https://www.activism.net/cypherpunk/manifesto.html https://www.activism.net/cypherpunk/manifesto.html

ascorbic 6y ago
Even if he has no coins personally, that's a very narrow claim. Far more likely is that he has an interest in the company which happens to have pre-minted and owns most of the coins.
Vinnl 6y ago
I mean, regardless of whether they addressed it before, to me this blog posts reads like their attempt to address all concerns raised in a single place, and these are all concerns I've seen raised. Thus, it seems to be like it would be very relevant to address them in this post, and would help restore some of the trust that some people already lost, and that others are at risk of losing.