6 ms·

Users are not entitled to a guarantee that this will never happen again, because Signal is free and open source software provided free of charge and without war

by hnarn 5y ago

Users are not entitled to a guarantee that this will never happen again, because Signal is free and open source software provided free of charge and without warranty. The Android app is GPL licensed. The license clearly states: > For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. If you feel let down by open source software, you have many options available to you to make that software more reliable.

ghoward 5y ago
Moxie Marlinspike is famously belligerent against Signal forks, so no, the license does not really help here.
- sneak 5y ago
  It does. You are allowed to fork or reimplement the Signal client, and even distribute it, with the official Signal servers configured, so long as you do not infringe the Signal trademark. They don't like forks using their servers, but it's the users who connect to their servers, not the fork publisher. Those users are permitted to connect via the TOS, which is independent from the GPL.
  - lwhi 5y ago
    They also refuse to open source their server software. This is the problem in my mind. Open source in words, but not spirit.
    - h_anna_h 5y ago
      This is false https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
      - lwhi 5y ago
        So are you telling me I can run my signal server and use it to communicate with others on the signal network?
        h_anna_h 5y ago
        I am telling you that "They also refuse to open source their server software." is false.
        chithanh 5y ago
        Signal typically delay releasing the server source code, so the latest version of the server is not open source. In one case it took them almost a year (no public commits between 20 April 2020 and 6 April 2021). https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-798900367 https://github.com/signalapp/Signal-Android/issues/11101#iss... Among the official reasons given was staying ahead of spammers. In this instance it was also speculated that the payment function which they were building into the server was to remain secret. https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-815400676 https://github.com/signalapp/Signal-Android/issues/11101#iss...
        tablespoon 5y ago
        One of the biggest problems with open source software is enormously entitled users; who don't pay for it, don't work on it, yet feel remarkably offended when some whim of theirs is not catered to. Just saying.
        chithanh 5y ago
        If you call it a "whim" if I point out that the latest version of the Signal server is proprietary software most of the time then so be it. Or maybe you are referring to the other commenters who were entitled to expect that the one critical task of a crypto messenger is ensuring the confidentiality of communication, which has been broken by this bug (and at least one similar bug before it, https://github.com/signalapp/Signal-Android/issues/7909 https://github.com/signalapp/Signal-Android/issues/7909 ). You can both be grateful that Signal is free and at the same time call out shenanigans of its owners. Just saying.
    - sneak 5y ago
      Not only is it false as has already been pointed out, it doesn't matter at all. There is nothing stopping them from silently running a fork.
      - lwhi 5y ago
        As far as I'm aware, I have to use the official server if I wish to communicate via the platform. If this isn't true, I'd be very interested to learn more.

by hnarn 5y ago

ghoward 5y ago

Moxie Marlinspike is famously belligerent against Signal forks, so no, the license does not really help here.

sneak 5y ago
It does. You are allowed to fork or reimplement the Signal client, and even distribute it, with the official Signal servers configured, so long as you do not infringe the Signal trademark. They don't like forks using their servers, but it's the users who connect to their servers, not the fork publisher. Those users are permitted to connect via the TOS, which is independent from the GPL.
- lwhi 5y ago
  They also refuse to open source their server software. This is the problem in my mind. Open source in words, but not spirit.
  - h_anna_h 5y ago
    This is false https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
    - lwhi 5y ago
      So are you telling me I can run my signal server and use it to communicate with others on the signal network?
      - h_anna_h 5y ago
        I am telling you that "They also refuse to open source their server software." is false.
        chithanh 5y ago
        Signal typically delay releasing the server source code, so the latest version of the server is not open source. In one case it took them almost a year (no public commits between 20 April 2020 and 6 April 2021). https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-798900367 https://github.com/signalapp/Signal-Android/issues/11101#iss... Among the official reasons given was staying ahead of spammers. In this instance it was also speculated that the payment function which they were building into the server was to remain secret. https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-815400676 https://github.com/signalapp/Signal-Android/issues/11101#iss...
        tablespoon 5y ago
        One of the biggest problems with open source software is enormously entitled users; who don't pay for it, don't work on it, yet feel remarkably offended when some whim of theirs is not catered to. Just saying.
        chithanh 5y ago
        If you call it a "whim" if I point out that the latest version of the Signal server is proprietary software most of the time then so be it. Or maybe you are referring to the other commenters who were entitled to expect that the one critical task of a crypto messenger is ensuring the confidentiality of communication, which has been broken by this bug (and at least one similar bug before it, https://github.com/signalapp/Signal-Android/issues/7909 https://github.com/signalapp/Signal-Android/issues/7909 ). You can both be grateful that Signal is free and at the same time call out shenanigans of its owners. Just saying.
  - sneak 5y ago
    Not only is it false as has already been pointed out, it doesn't matter at all. There is nothing stopping them from silently running a fork.
    - lwhi 5y ago
      As far as I'm aware, I have to use the official server if I wish to communicate via the platform. If this isn't true, I'd be very interested to learn more.