4 ms·

I don't want to sysadmin my phone, I just want to remove Google from my threat model. That means I'd like everyone to be able to buy phones which come pre-inst

I don't want to sysadmin my phone, I just want to remove Google from my threat model. That means I'd like everyone to be able to buy phones which come pre-installed with F-Droid as an alternative app store, so people get the benefit of reproducible builds of free software apps (ideally with binary transparency, and verifiers in multiple jurisdictions). Reliance on Google as a third party is just another example of the blind-spot that Marlinkspike has about the dangers of centralisation. This is seen in his resistance to making Signal work on devices that don't use the proprietary Google Play services[0], and the slowly boiling frog of developers no longer having control of their own keys when publishing in the Google Play store.[1] [0] https://github.com/signalapp/Signal-Android/issues/5450 https://github.com/signalapp/Signal-Android/issues/5450 [1] https://www.theregister.com/2021/07/01/android_app_bundle/ https://www.theregister.com/2021/07/01/android_app_bundle/

hiq 5y ago
This is an issue from 2016, it's 2022 now and Signal works perfectly fine without Google Play Services. The .apk is there if you don't want to use Google Play Store: https://signal.org/android/apk/ https://signal.org/android/apk/ and it prompts for updates when they're available.
- dane-pgp 5y ago
  Thank you for adding that context, which I should have included in my comment. I still think the issue from 2016 is worth reading, as the issue was closed on the basis of being a duplicate, but as a commenter on the issue points out: > Because all the refernced duplicate discussion threads trying to solve this are locked (why?), I'm raising my voice for this here. This is indicative of a project which not only resisted supporting users without Google Play services, but also resisted people questioning their decision. Two days after that plea, without any further explanation: > @signalapp locked and limited conversation to collaborators Of course an issue tracker isn't a discussion forum, but a good project team would have taken an extra couple of seconds to point issue reporters and commenters to an FAQ answer (assuming they had an answer that would withstand scrutiny). Anyway, my point is that despite the supposed merits of centralisation, people had to beg (and be met with silence) before the project deigned to grant this reasonable request. This is not the sort of permissionless innovation that free software is supposed to enable. Similarly, although Signal may have relented and made an .apk file available (perhaps due to pressure from more innovative and user-respecting platforms like Matrix), their stubbornness is still apparently preventing F-Droid from distributing it. Here's a better link to support that claim: https://forum.f-droid.org/t/signal-on-f-droid/13742/4 https://forum.f-droid.org/t/signal-on-f-droid/13742/4
  - hiq 5y ago
    > Of course an issue tracker isn't a discussion forum, but a good project team would have taken an extra couple of seconds to point issue reporters and commenters to an FAQ answer (assuming they had an answer that would withstand scrutiny). I don't know what your experience with FOSS development is. I still have fairly little and only with low-profile projects, and yet I've already been accused of many things and spent (wasted?) quite some time in pointless arguments. This issue is exacerbated in high-profile projects such as Signal, and it's impossible to deal with them as you're suggesting. https://github.com/signalapp/Signal-Android/issues https://github.com/signalapp/Signal-Android/issues currently has close to 10000 issues (most of them closed). Signal does not have that many people to deal with what is mostly noise. There are explanations about their stances regarding F-Droid etc. if you're willing to look for them. In any case these questions belong to the community forum. Most of the duplicates are opened in bad faith, and there are diminishing returns in answering all of them. I recommend you "watch all activity" on one of the Signal client repository and check your GitHub notifications to understand the problem. > Anyway, my point is that despite the supposed merits of centralisation, people had to beg (and be met with silence) before the project deigned to grant this reasonable request. This is not the sort of permissionless innovation that free software is supposed to enable. You're talking about their development model (which is rather closed, a very high bar has to be reached for them to accept community contributions) rather than the fact that they're using a centralized rather than federated network. The article is about the latter, not the former. These issues are orthogonal.
    - dane-pgp 5y ago
      > There are explanations about their stances regarding F-Droid etc. if you're willing to look for them. Source(s): Dude trust me. > These issues are orthogonal. They are distinct issues, but not orthogonal. It wouldn't matter how Signal decided to run their "rather closed" open source software project if they allowed other people's forks to connect to their centralised network. By not allowing that, they have "weaponised" the "rather closed" development model against their own users, and, as a result, invalidated these bold claims made about why centralised networks are better. The benefit of Free Software is that it allows everyone (rather than a self-selected few) to add and remove features as they choose, and let users choose which fork they support. That creates a selective pressure towards genuine (user-centric) innovation, rather than changes that are declared to be innovation by fiat (excuse the pun). It also prevents the sort of stagnation (and potentially security problems) we saw when Internet Explorer had a 90% browser market share. There are very clear links between centralisation of design/control and a culture of closed source software development (with a non-transparent "we know better" attitude).

hiq 5y ago

This is an issue from 2016, it's 2022 now and Signal works perfectly fine without Google Play Services. The .apk is there if you don't want to use Google Play Store: https://signal.org/android/apk/ https://signal.org/android/apk/ and it prompts for updates when they're available.

dane-pgp 5y ago
Thank you for adding that context, which I should have included in my comment. I still think the issue from 2016 is worth reading, as the issue was closed on the basis of being a duplicate, but as a commenter on the issue points out: > Because all the refernced duplicate discussion threads trying to solve this are locked (why?), I'm raising my voice for this here. This is indicative of a project which not only resisted supporting users without Google Play services, but also resisted people questioning their decision. Two days after that plea, without any further explanation: > @signalapp locked and limited conversation to collaborators Of course an issue tracker isn't a discussion forum, but a good project team would have taken an extra couple of seconds to point issue reporters and commenters to an FAQ answer (assuming they had an answer that would withstand scrutiny). Anyway, my point is that despite the supposed merits of centralisation, people had to beg (and be met with silence) before the project deigned to grant this reasonable request. This is not the sort of permissionless innovation that free software is supposed to enable. Similarly, although Signal may have relented and made an .apk file available (perhaps due to pressure from more innovative and user-respecting platforms like Matrix), their stubbornness is still apparently preventing F-Droid from distributing it. Here's a better link to support that claim: https://forum.f-droid.org/t/signal-on-f-droid/13742/4 https://forum.f-droid.org/t/signal-on-f-droid/13742/4
- hiq 5y ago
  > Of course an issue tracker isn't a discussion forum, but a good project team would have taken an extra couple of seconds to point issue reporters and commenters to an FAQ answer (assuming they had an answer that would withstand scrutiny). I don't know what your experience with FOSS development is. I still have fairly little and only with low-profile projects, and yet I've already been accused of many things and spent (wasted?) quite some time in pointless arguments. This issue is exacerbated in high-profile projects such as Signal, and it's impossible to deal with them as you're suggesting. https://github.com/signalapp/Signal-Android/issues https://github.com/signalapp/Signal-Android/issues currently has close to 10000 issues (most of them closed). Signal does not have that many people to deal with what is mostly noise. There are explanations about their stances regarding F-Droid etc. if you're willing to look for them. In any case these questions belong to the community forum. Most of the duplicates are opened in bad faith, and there are diminishing returns in answering all of them. I recommend you "watch all activity" on one of the Signal client repository and check your GitHub notifications to understand the problem. > Anyway, my point is that despite the supposed merits of centralisation, people had to beg (and be met with silence) before the project deigned to grant this reasonable request. This is not the sort of permissionless innovation that free software is supposed to enable. You're talking about their development model (which is rather closed, a very high bar has to be reached for them to accept community contributions) rather than the fact that they're using a centralized rather than federated network. The article is about the latter, not the former. These issues are orthogonal.
  - dane-pgp 5y ago
    > There are explanations about their stances regarding F-Droid etc. if you're willing to look for them. Source(s): Dude trust me. > These issues are orthogonal. They are distinct issues, but not orthogonal. It wouldn't matter how Signal decided to run their "rather closed" open source software project if they allowed other people's forks to connect to their centralised network. By not allowing that, they have "weaponised" the "rather closed" development model against their own users, and, as a result, invalidated these bold claims made about why centralised networks are better. The benefit of Free Software is that it allows everyone (rather than a self-selected few) to add and remove features as they choose, and let users choose which fork they support. That creates a selective pressure towards genuine (user-centric) innovation, rather than changes that are declared to be innovation by fiat (excuse the pun). It also prevents the sort of stagnation (and potentially security problems) we saw when Internet Explorer had a 90% browser market share. There are very clear links between centralisation of design/control and a culture of closed source software development (with a non-transparent "we know better" attitude).