7 ms·

1. It's not stolen. It's used. It may not be used efficiently (or, if you're correct, used sensibly at all) but it's not stolen. 2. If deleted data not being p

1. It's not stolen. It's used. It may not be used efficiently (or, if you're correct, used sensibly at all) but it's not stolen. 2. If deleted data not being purged from your iOS device is a "significant security flaw" then you shouldn't be using a device from Apple or Google; your threat model is way beyond the two big players. 3. Hyperbolic comments[1] don't help issues being re-opened. Helpful comments, preferably with steps to reproduce, and a polite note that the issue is still current, will get the issue re-opened in my experience. Getting on your high horse and making silly claims would get you put to the bottom of the pile if it were my job. [1] https://github.com/signalapp/Signal-iOS/issues/4916#issuecomment-1084723087 https://github.com/signalapp/Signal-iOS/issues/4916#issuecom...

ribs 5y ago
Eh, sometimes going hyperbolic does the trick, but yeah, it’s not the most beneficial tactic, overall
- gruez 5y ago
  >Eh, sometimes going hyperbolic does the trick When has it ever worked?
nh2 5y ago
It's not a hyperbolic comment. The Signal stale bot is bad and frustrates anybody contributing. * I've reported NullPointerExceptions with stack traces, stale bot comes to close. * I've reported Signal fatally corrupting its DB and losing all its data [1], stale bot comes to close. Few things are more frustrating than investing your free time, and then finding an automated system pitted against you. [1]: https://news.ycombinator.com/item?id=26841134 https://news.ycombinator.com/item?id=26841134, https://github.com/signalapp/Signal-Android/issues/11160#issuecomment-1022315870 https://github.com/signalapp/Signal-Android/issues/11160#iss...
- danuker 5y ago
  The most prominent red flag about Signal is that, for all its purported commitment to "developing open source privacy technology", a real, working open-source app is not on F-Droid. https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...
  - woodruffw 5y ago
    I don't think availability via any particular distribution mechanism is a reasonable litmus test for "open sourcedness." Such a test would have excluded Linux for most of its development history, prior to migration to git.
    - danuker 5y ago
      This particular distribution (F-Droid) requires that the source be build-able from strictly source files, without bundling binaries.
  - mos_6502 5y ago
    You can download the APK directly from Signal: https://signal.org/android/apk/ https://signal.org/android/apk/ When a new version is released, the Signal app notifies you.
    - danuker 5y ago
      Problem is, the APK is a closed-source binary. What they include there might be completely different from what is in the source.
      - hiq 5y ago
        Not with reproducible builds, no.
  - m-p-3 5y ago
    One more point in favor of Matrix/Element.
- proactivesvcs 5y ago
  I agree it can be frustrating; the bot does seem to need tweaking. The first issue was only closed two days ago and presumably it'll be reopened since it's effectively by design. The second issue you linked was not closed at all, and in fact looks to be been acknowledged. I don't like to nit pick but this just proves that the statement is indeed hyperbole: the Signal devs are paying attention, tickets aren't always closed and when they are closed I almost always see them re-opened.
  - nh2 5y ago
    > The second issue you linked was not closed at all The only reason it's not closed is because I kept replying! Had I not succumbed to the bot, it would have likely been closed before the acknowledgement, and never been looked at again.
sonofhans 5y ago
> Getting on your high horse and making silly claims would get you put to the bottom of the pile if it were my job. I disagree strongly. It’s not up to us — as designers and developers and maintainers of software — to decide how users engage with us. If they engage at all they are doing us a favor. Tone-policing user bug reports is a nasty anti-pattern, a predictable way to make your software more user-hostile. Unless they degenerate into outright abuse, which is obviously unacceptable (and this does not), we should separate tone from content and see if the content is useful. A substantive response to the content, ignoring the tone, is usually the best practice.
chrisshroba 5y ago
I understand the issues you have with the claims, but I would argue that this is still a security flaw, given that Signal and other encrypted chat apps are often used by journalists and activists that may have openly hostile governments. If I were choosing an app to message about something sensitive like protests, etc., I would be pretty uncomfy with the idea that deletion doesn't actually mean deletion, even if it's only local. Especially given recent news about Russian police (reportedly) demanding to search random citizens' phones on the street[1]. [1]: https://www.independent.co.uk/news/world/europe/ukraine-moscow-protests-phones-war-b2030786.html https://www.independent.co.uk/news/world/europe/ukraine-mosc...
rvz 5y ago
Except that these full time engineers are getting in $110K per year to ‘fix’ these issues. There isn’t any excuse left from that $60M in funding to fix these issues is there? Maybe they were too busy integrating a scam private cryptocurrency over fixing these bugs.
- stereoradonc 5y ago
  I agree, and I am curious why your comment was downvoted. They have turned crypto shills :-)
stereoradonc 5y ago
It's unfair to target individuals in this manner. If it were to me, I'd judge your comment as "borderline trolling". The OP has mentioned something specific and brought it to the notice of a larger audience.

ribs 5y ago

Eh, sometimes going hyperbolic does the trick, but yeah, it’s not the most beneficial tactic, overall

gruez 5y ago
>Eh, sometimes going hyperbolic does the trick When has it ever worked?

nh2 5y ago

It's not a hyperbolic comment. The Signal stale bot is bad and frustrates anybody contributing. * I've reported NullPointerExceptions with stack traces, stale bot comes to close. * I've reported Signal fatally corrupting its DB and losing all its data [1], stale bot comes to close. Few things are more frustrating than investing your free time, and then finding an automated system pitted against you. [1]: https://news.ycombinator.com/item?id=26841134 https://news.ycombinator.com/item?id=26841134, https://github.com/signalapp/Signal-Android/issues/11160#issuecomment-1022315870 https://github.com/signalapp/Signal-Android/issues/11160#iss...

danuker 5y ago
The most prominent red flag about Signal is that, for all its purported commitment to "developing open source privacy technology", a real, working open-source app is not on F-Droid. https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...
- woodruffw 5y ago
  I don't think availability via any particular distribution mechanism is a reasonable litmus test for "open sourcedness." Such a test would have excluded Linux for most of its development history, prior to migration to git.
  - danuker 5y ago
    This particular distribution (F-Droid) requires that the source be build-able from strictly source files, without bundling binaries.
- mos_6502 5y ago
  You can download the APK directly from Signal: https://signal.org/android/apk/ https://signal.org/android/apk/ When a new version is released, the Signal app notifies you.
  - danuker 5y ago
    Problem is, the APK is a closed-source binary. What they include there might be completely different from what is in the source.
    - hiq 5y ago
      Not with reproducible builds, no.
- m-p-3 5y ago
  One more point in favor of Matrix/Element.
proactivesvcs 5y ago
I agree it can be frustrating; the bot does seem to need tweaking. The first issue was only closed two days ago and presumably it'll be reopened since it's effectively by design. The second issue you linked was not closed at all, and in fact looks to be been acknowledged. I don't like to nit pick but this just proves that the statement is indeed hyperbole: the Signal devs are paying attention, tickets aren't always closed and when they are closed I almost always see them re-opened.
- nh2 5y ago
  > The second issue you linked was not closed at all The only reason it's not closed is because I kept replying! Had I not succumbed to the bot, it would have likely been closed before the acknowledgement, and never been looked at again.

sonofhans 5y ago

> Getting on your high horse and making silly claims would get you put to the bottom of the pile if it were my job. I disagree strongly. It’s not up to us — as designers and developers and maintainers of software — to decide how users engage with us. If they engage at all they are doing us a favor. Tone-policing user bug reports is a nasty anti-pattern, a predictable way to make your software more user-hostile. Unless they degenerate into outright abuse, which is obviously unacceptable (and this does not), we should separate tone from content and see if the content is useful. A substantive response to the content, ignoring the tone, is usually the best practice.

chrisshroba 5y ago

I understand the issues you have with the claims, but I would argue that this is still a security flaw, given that Signal and other encrypted chat apps are often used by journalists and activists that may have openly hostile governments. If I were choosing an app to message about something sensitive like protests, etc., I would be pretty uncomfy with the idea that deletion doesn't actually mean deletion, even if it's only local. Especially given recent news about Russian police (reportedly) demanding to search random citizens' phones on the street[1]. [1]: https://www.independent.co.uk/news/world/europe/ukraine-moscow-protests-phones-war-b2030786.html https://www.independent.co.uk/news/world/europe/ukraine-mosc...

rvz 5y ago

Except that these full time engineers are getting in $110K per year to ‘fix’ these issues. There isn’t any excuse left from that $60M in funding to fix these issues is there? Maybe they were too busy integrating a scam private cryptocurrency over fixing these bugs.

stereoradonc 5y ago
I agree, and I am curious why your comment was downvoted. They have turned crypto shills :-)

stereoradonc 5y ago

It's unfair to target individuals in this manner. If it were to me, I'd judge your comment as "borderline trolling". The OP has mentioned something specific and brought it to the notice of a larger audience.