18 ms·

Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear thin

Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.

sschueller 4y ago
Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...
- award_ 4y ago
  What are your others? I use signal alot personally and haven't had too many issues.
  - sschueller 4y ago
    - Still need a phone number - They refuse to post the app on f-droid (directly) - No 3rd party clients allowed on their servers. - Crypto thing they attempted - I don't trust Moxie, he rubs me the wrong way.
    - junon 4y ago
      Agreed on all counts, especially the last one.
    - artificialLimbs 4y ago
      - Backups? lol...
    - aeturnum 4y ago
      None of these suggest you shouldn't use signal - or that it's not meeting its goal of secure communication (except the last one I suppose). Signal is not without flaws as you say, but if you have a phone number and can access a binary, there's every reason to believe it will securely and privately transmit your messages. You are also, ofc, free to fork their client and run your own service (as others have done).
      - krageon 4y ago
        There is no reason to believe it is secure, as it doesn't have reproducible builds. What you download has binary blobs embedded.
        aeturnum 4y ago
        Signal has repeatedly been audited[1] so there's more reason to believe the protocol has the capacity to be secure than other options. Obviously if you believe the company is actively subverting their goal, you should use your own fork. Edit: to be clearer - signal both publishes a protocol (that is thought to be secure) and provides a public service (that claims to use the signal protocol). Signal has claimed that the binary blobs they add to their public client (and the other restrictions) are required to run a public service (anti-abuse, etc). You are free to believe them or not - I do. At the protocol level, which you are free to use, none of the problems you or the ancestors have pointed to apply. All of the alternatives people are pointing to here are at the "protocol" level - accessible only if you or someone you trust has setup a node. There's nothing wrong with that - it's a good idea - but it's no reason to attack signal's service for not being a protocol (which they also provide). [1] https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
    - gort19 4y ago
      What do you recommend as an alternative?
      - chpatrick 4y ago
        matrix/element.
      - freedomben 4y ago
        keybase.io has been great, although it's not without its risks either since it was acquired by Zoom. It's still up and seemingly maintained but AFAIK there's no new feature work. I've heard WhatsApp recommended from people I trust, but I have never personally used it so can't speak from experience.
        gort19 4y ago
        WhatsApp seems like a non-starter based on this list of complaints. It’s hard to imagine someone who doesn’t trust Moxie, but does trust Zuck.
        seized 4y ago
        A lot of people moved to Signal because of WhatsApps changes so that advice can thought of as misleading at best. Your suggested alternatives are owned by Zoom and Facebook. I'll stick with Signal.
        happymellon 4y ago
        As a Facebook owned app, I don't trust WhatsApp. All of them being tied to a phone number is bad form.
        calgoo 4y ago
        The legal team at the company I work for are suggesting to remove keybase and treat it as compromised as there is no way of knowing of keys and other data has not been shared with the Chinese government. No proof at all of course, just the world we live in I guess :)
        L3viathan 4y ago
    - ixwt 4y ago
      Moxie stepped down from the CEO of Signal in January of this year [0]. Other than that, yeah. Valid criticisms that their reasons are flimsy at best. [0]:https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps-down-moxie-marlinspike-encryption-cryptocurrency https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps...
      - krageon 4y ago
        Stepped down maybe, but the fostered culture remains.
    - nells 4y ago
      - windexh8er 4y ago
        I see you're new, you might want to review the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - dheera 4y ago
      Yeah the phone number thing is a bad move since it's traceable to your identity one way or another, even if you use a virtual number like I do.
  - ChuckNorris89 4y ago
    Not GP but I'm a Signal user and here are my gripes: - No easy way to do and restore backups on Android and impossible to do backups on their PC client - Does not support Android tablets at all (my mom loves hers) - Fails to ring on Android when you call someone or someone calls you, later serving you a missed call notification (disabled Doze/battery optimization feature on Android and tested on 3 different phones with no cigar) - No way to share your live location to friends - Using its built in photo snapping and sharing function takes horrible pictures on Android (I suspect they're using the wrong API). If I want to send someone I'm currently texting a good looking picture I need to switch to my phone's camera APP, then back to the chat and use the photo upload function, instead of the in-app photo snapping and sharing function Some of these bugs have been reported 3+ years ago, while these things work flawlessly on WhatsApp since nearly forever, meanwhile Signal is busy implementing crypto payment features. I don't know about iOS, but at least for Android and PC, it still feels like an app in alpha that's not yet released to the public compared to how polished and feature rich WhatsApp and Telegram are.
    - gort19 4y ago
      The only one of these that is a ‘bug’ is the failure to ring on android. The rest are all feature requests. That said, it’s interesting to see what people think are basic requirement for a messaging app these days.
      - thrtythreeforty 4y ago
        If you want to be reductionist, everything is a feature. But if an app is missing something so basic as to impact usability, I might consider it a bug. It's a matter of opinion where the line is, of course. Uncontroversial example: a calculator app that doesn't have a divide key. Technically, yes, it's a separate feature from the multiply key, but it's so basic, so expected, that its absence is a bug. From the above list, I consider "No easy way to do and restore backups on Android and impossible to do backups on their PC client" a bug, or at least a frustrating omission by design.
      - happymellon 4y ago
        Taking poor pictures, if it is due to using the wrong API is also a bug.
  - defraxi 4y ago
    Although I use Signal, I actually prefer Threema which you can also use without a phone number. https://threema.ch/en/home https://threema.ch/en/home
- CoastalCoder 4y ago
  > The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Are we sure that Signal didn't contact the maintainer? I haven't seen any statements either way about that.
  - nvrspyx 4y ago
    From galgalesh, the snap package maintainer, in the linked forum post: > I was just linked to this thread from our issue tracker > As a maintainer for this snap package, it’s mind-boggling to me that, even after almost two weeks, the store team did not contact me at all. I had to find this out myself from users reporting it on our bug tracker. > After almost two weeks, the maintainer of the snap has not received any official communication about this, but @roadmr was able to provide this tiny sliver of info in a thread on this forum. From the original comment of this particular thread, also from galgalesh: > Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly.
    - CoastalCoder 4y ago
      > Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly. You could be right, but I think another possibility is that the maintainer did get contacted earlier by Signal, and just didn't mentally connect the dots between that and his Snap package being pulled. Note that I don't know how realistic this is, I'm just trying to be fair in my assumptions.
  - freedomben 4y ago
    Good thinking, but based on what GP said I don't think so: > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Had they contacted the maintainer, then the maintainer would not have been wondering what the deal was.
- nimbius 4y ago
  Moxies always been fairly dictatorial about Signal. no third party clients, no decentralization. im not surprised to see a DMCA at all. So far Signal is a centralized encrypted messaging app that includes its own cryptocurrency and wallet no one asked for, shills me for donations every other release, and begs me to invite new users despite deprecating regular SMS message support. if youre a threat-actor the most malevolent thing you could do at this point is just watch Moxie and the team drive this project into the ground.
  - dheera 4y ago
    > no third party clients Isn't their client open source? If I compiled it myself, is that a third party client? If they don't let me compile it myself, how can I trust their official version is using the source they published?
    - alias_neo 4y ago
      You can build their client and use it yourself, but they don't want you to distribute it and they don't want you using their infra and API from a third party client.
    - maccam94 4y ago
      They don't want people distributing unofficial builds that claim to be Signal due to the risk of supply chain attacks against users.
  - 411111111111111 4y ago
    I thought moxie moved on from Signal? Is he still in the loop?
    - cyberphobe 4y ago
      The anti-signal crowd loves to blame moxie for everything. Just part of their overall commitment to being fact-free
      - 4y ago
- kevin_b_er 4y ago
  What this is is also another reason not to use Snap. This is a multi-level failure. 1. Signal-Desktop is AGPLv3: https://github.com/signalapp/Signal-Desktop https://github.com/signalapp/Signal-Desktop 2. The snap package metadata is AGPLv3: https://github.com/snapcrafters/signal-desktop https://github.com/snapcrafters/signal-desktop So, this looks like a fraudulent DMCA claim by Signal, as the snap package maintainers and Canonicial have an open source license! This shows malice by Signal. 3. No-one from Canonical contacted the package maintainer(s) about the DMCA, so they have no opportunity to counterclaim or defend. This is an open sign Snap should not be used. Because utterly unjustified DMCA claims will result in the removal of a package without any way to contest. This is compounded by Canoncial's controlling methodology with Snap where it is ostensibly open-source but Canonical controls what is permitted with snap through a closed-source server.
  - cyberphobe 4y ago
    AGPLv3 does not somehow permit trademark violations. Signal has taken issue with third parties building binaries and calling them Signal, and I can’t really blame them. This is the same reason Signal isn’t in F-Droid
    - kevin_b_er 4y ago
      And the DMCA is about copyright. Where's trademark mentioned?
      - tingletech 4y ago
        Violating trademark triggers AGPLv3 license to be invalid, thus the copyright claim.
        Murrawhip 4y ago
        No, AGPLv3 allows for adding an additional term regarding trademark. Signal-desktop is using the default APGLv3 without such a term.
    - 4y ago
- cyberphobe 4y ago
  Signal offers an official deb. The correct behavior would have been for third parties to not distribute trademark-infringing binaries and call them Signal
  - kybernetyk 4y ago
    Binaries are just condensed source code. So when the source code is AGPL I sure as hell can distribute binaries if I like.
    - cyberphobe 4y ago
      What is GNU IceCat (formerly IceWeasel) then?
      - jdiff 4y ago
        Firefox's license did not permit use of trademark. Eventually an exception was made, and now GNU IceCat is mostly a relic. Signal's license on the other hand, does permit use of trademark. If nothing else this means that using the DMCA for this is wildly inappropriate.
    - MrsPeaches 4y ago
      I think the point is that you can't call it Signal. Is that correct?
      - cyberphobe 4y ago
        Yup, also can’t really prove it came from the same source code.
    - bheadmaster 4y ago
      > I sure as hell can distribute binaries if I like As far as I understood the argument, you're free to distribute binaries, you just can't call them "Signal", since it's a trademarked name (?).
- deleted 4y ago
  [deleted]
googlryas 4y ago
So you're saying signal requested their own program be removed from the snap store? Sorry, I'm a little confused on terms. When you say snap maintainer, are you saying you are the maintainer of the signal snap package, or that you're a maintainer of snap itself?
- aero-glide2 4y ago
  This snap is unofficial.
- SSLy 4y ago
  > are you saying you are the maintainer of the signal snap package They are, yes. Well, former maintainer.
- galgalesh 4y ago
  I'm the maintainer of this unofficial snap package.
- deleted 4y ago
  [deleted]
- cyberphobe 4y ago
  Wasn’t their own program. They have a binary they distribute, this was some other binary calling itself Signal without their approval.
  - teraflop 4y ago
    If that's the issue, it's (at most) a trademark violation instead of a copyright violation, which means the DMCA complaint was filed under false premises.
    - crumpled 4y ago
      A trademark violation is a copyright violation, because a trademark is copyrighted at first inception, before anyone adds the '™'. A company is also compelled to take actions like this to maintain the rights to thier own trademarks. That's my understanding; IANAL.
ElijahLynn 4y ago
Thanks for the explanation Galgalesh! Can you post this update on the Snapcraft (https://forum.snapcraft.io/t/what-happened-to-signal-desktop/32119/11 https://forum.snapcraft.io/t/what-happened-to-signal-desktop...) and GitHub threads (https://github.com/snapcrafters/signal-desktop/issues/70 https://github.com/snapcrafters/signal-desktop/issues/70) too? I was going to just now and cross link back here to your comment and figured it would be better coming from you directly!
- SSLy 4y ago
  They just did comment on that discourse thread.
  - ElijahLynn 4y ago
    Thanks, I see it here now in both places > https://forum.snapcraft.io/t/what-happened-to-signal-desktop/32119/15 https://forum.snapcraft.io/t/what-happened-to-signal-desktop... & https://github.com/snapcrafters/signal-desktop/issues/70#issuecomment-1302299328 https://github.com/snapcrafters/signal-desktop/issues/70#iss....
nottorp 4y ago
This deserves a lot of publicity. Why send a DMCA takedown instead of contact the people involved? Will they do the same if some vulnerability is found in Signal? Lawyer up instead of fix the problem?
- hyperhopper 4y ago
  Exactly, using lawyers first is a very bad sign. I don't know why often people say "oh it was just the lawyers" like that makes it okay. No, those lawyers are paid for by and directed by signal. Signal is responsible.
  - dheera 4y ago
    Hey signal, maybe fix this $ sudo apt-get install signal Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package signal and we don't need to resort to unofficial snap packages
    - nsxwolf 4y ago
      Oh, snap!
    - tssva 4y ago
      The name for the Signal Desktop package is signal-desktop and Signal provides instructions on their website on how to add their deb repository.
      - dheera 4y ago
        Too difficult. Their install instructions are also too complicated and involve reading about 5 lines of comments and 4 shell commands. It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. This is 2022, not 1995. It's faster to just search for "signal" in the snap store and hit "Install".
        4y ago
ddevault 4y ago
Typical behavior from Signal. They have a track record of hostility that we as a community should really not be tolerating. I do not use Signal and I tell my friends not to, either. Play nice or don't play at all.
- enriquto 4y ago
  Problem is, I already moved my friends and family to Signal and removed Whatsapp from my phone. It was an uphill battle that I don't want to fight again. What do I do, now? As much as there's a lot of questionable stuff on Signal, that's nothing compared to whatsapp. Do you suggest a Signal alternative that is significantly better?
  - goodpoint 4y ago
    Support a new, well managed fork of Signal
  - ddevault 4y ago
    I don't have an answer which is likely to satisfy you. I'm still a grumpy old IRC user. I communicate with non-technical friends and family via email, SMS, and Jitsi Meet. I allowed myself to be persuaded to try Matrix earlier this year and so far I've regret it. goodpoint's answer is probably the best longer term answer: someone needs to fork Signal and manage it properly. But it's not as simple as just rebranding the software, it needs lots of difficult technical work to fix its many problems.
    - forgotpwd16 4y ago
      >try Matrix earlier this year and so far I've regret it Why is that?
      - ddevault 4y ago
        Very bloated and unreliable.
forgotpwd16 4y ago
>this is because of a DMCA takedown request from lawyers representing Signal Whoa. That's unexpected.
brianacton 4y ago
Correct. We spoke to our attorneys and found the breakdown in communication. We are working to rectify and reinstate signal-desktop ASAP. Sorry for the confusion.
- deleted 4y ago
  [deleted]
- cyberphobe 4y ago
  Will a similar line of communication be established with other open source distribution platforms (such as F-Droid) that would also like to distribute binaries and call them Signal?
- fazfq 4y ago
  Why is Signal, a company that prides itself in being tech-centric, allowing lawyers to send DMCA requests without consulting anybody?
  - deleted 4y ago
    [deleted]
  - lcnPylGDnU4H9OF 4y ago
    I don't get why Signal being tech-centric (whatever that means) should disallow their lawyers from sending DMCA takedown requests.
    - jdiff 4y ago
      Because it means their lawyers are firing off in random, uninformed directions. There's no copyright issue, as the maintainers of the Snap have a copyright license (the AGPLv3) to do what they are doing. You could argue that it's a trademark issue, except that if it was, this makes a DMCA request illegal as it's not a tool to enforce trademark issues. And in addition, while the AGPLv3 has allowances for trademark carve-outs, Signal makes none. It's not a good look for the lawyers to be completely in the dark on an issue so core to their company's business.
spullara 4y ago
You didn't realize what you were doing was against the license?
- ohbtvz 4y ago
  How terrible of them, packaging open source software for their distribution like so many package managers do.
  - caeril 4y ago
    I'm the last person to defend lawyers, DMCA takedowns, etc. But Signal has very strict build processes in place to ensure (to the best of their ability, anyway) that the official binaries are devoid of side-channel attack vulnerabilities. Putting my tinfoil hat on, all it takes is one unofficial Snap maintainer to be approached by one Glow-In-The-Dark with an offer they can't refuse to infect a hundred thousand users with key material compromise. I hate to say it, but Signal is doing the right thing, here.
- jdiff 4y ago
  It wasn't against the license. It's AGPL v3, about as open as it gets.
  - spullara 4y ago
    You don't get the license without respecting the trademark. e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
    - jdiff 4y ago
      Read the full context of that rule. The entire section allows those provisions to be applied, it does not make those provisions. The APGLv3 disallows any further restrictions beyond the license to be applied, except for a handful of exceptions. That's one of them. And if such an exception is made, further instructions are provided to inform downstream users of them. Signal did not follow those instructions and didn't make any of the permitted exceptions.
xtat 4y ago
idk not a great look for signal

sschueller 4y ago

Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...

award_ 4y ago
What are your others? I use signal alot personally and haven't had too many issues.
- sschueller 4y ago
  - Still need a phone number - They refuse to post the app on f-droid (directly) - No 3rd party clients allowed on their servers. - Crypto thing they attempted - I don't trust Moxie, he rubs me the wrong way.
  - junon 4y ago
    Agreed on all counts, especially the last one.
  - artificialLimbs 4y ago
    - Backups? lol...
  - aeturnum 4y ago
    None of these suggest you shouldn't use signal - or that it's not meeting its goal of secure communication (except the last one I suppose). Signal is not without flaws as you say, but if you have a phone number and can access a binary, there's every reason to believe it will securely and privately transmit your messages. You are also, ofc, free to fork their client and run your own service (as others have done).
    - krageon 4y ago
      There is no reason to believe it is secure, as it doesn't have reproducible builds. What you download has binary blobs embedded.
      - aeturnum 4y ago
        Signal has repeatedly been audited[1] so there's more reason to believe the protocol has the capacity to be secure than other options. Obviously if you believe the company is actively subverting their goal, you should use your own fork. Edit: to be clearer - signal both publishes a protocol (that is thought to be secure) and provides a public service (that claims to use the signal protocol). Signal has claimed that the binary blobs they add to their public client (and the other restrictions) are required to run a public service (anti-abuse, etc). You are free to believe them or not - I do. At the protocol level, which you are free to use, none of the problems you or the ancestors have pointed to apply. All of the alternatives people are pointing to here are at the "protocol" level - accessible only if you or someone you trust has setup a node. There's nothing wrong with that - it's a good idea - but it's no reason to attack signal's service for not being a protocol (which they also provide). [1] https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
  - gort19 4y ago
    What do you recommend as an alternative?
    - chpatrick 4y ago
      matrix/element.
    - freedomben 4y ago
      keybase.io has been great, although it's not without its risks either since it was acquired by Zoom. It's still up and seemingly maintained but AFAIK there's no new feature work. I've heard WhatsApp recommended from people I trust, but I have never personally used it so can't speak from experience.
      - gort19 4y ago
        WhatsApp seems like a non-starter based on this list of complaints. It’s hard to imagine someone who doesn’t trust Moxie, but does trust Zuck.
      - seized 4y ago
        A lot of people moved to Signal because of WhatsApps changes so that advice can thought of as misleading at best. Your suggested alternatives are owned by Zoom and Facebook. I'll stick with Signal.
      - happymellon 4y ago
        As a Facebook owned app, I don't trust WhatsApp. All of them being tied to a phone number is bad form.
      - calgoo 4y ago
        The legal team at the company I work for are suggesting to remove keybase and treat it as compromised as there is no way of knowing of keys and other data has not been shared with the Chinese government. No proof at all of course, just the world we live in I guess :)
      - L3viathan 4y ago
  - ixwt 4y ago
    Moxie stepped down from the CEO of Signal in January of this year [0]. Other than that, yeah. Valid criticisms that their reasons are flimsy at best. [0]:https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps-down-moxie-marlinspike-encryption-cryptocurrency https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps...
    - krageon 4y ago
      Stepped down maybe, but the fostered culture remains.
  - nells 4y ago
    - windexh8er 4y ago
      I see you're new, you might want to review the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - dheera 4y ago
    Yeah the phone number thing is a bad move since it's traceable to your identity one way or another, even if you use a virtual number like I do.
- ChuckNorris89 4y ago
  Not GP but I'm a Signal user and here are my gripes: - No easy way to do and restore backups on Android and impossible to do backups on their PC client - Does not support Android tablets at all (my mom loves hers) - Fails to ring on Android when you call someone or someone calls you, later serving you a missed call notification (disabled Doze/battery optimization feature on Android and tested on 3 different phones with no cigar) - No way to share your live location to friends - Using its built in photo snapping and sharing function takes horrible pictures on Android (I suspect they're using the wrong API). If I want to send someone I'm currently texting a good looking picture I need to switch to my phone's camera APP, then back to the chat and use the photo upload function, instead of the in-app photo snapping and sharing function Some of these bugs have been reported 3+ years ago, while these things work flawlessly on WhatsApp since nearly forever, meanwhile Signal is busy implementing crypto payment features. I don't know about iOS, but at least for Android and PC, it still feels like an app in alpha that's not yet released to the public compared to how polished and feature rich WhatsApp and Telegram are.
  - gort19 4y ago
    The only one of these that is a ‘bug’ is the failure to ring on android. The rest are all feature requests. That said, it’s interesting to see what people think are basic requirement for a messaging app these days.
    - thrtythreeforty 4y ago
      If you want to be reductionist, everything is a feature. But if an app is missing something so basic as to impact usability, I might consider it a bug. It's a matter of opinion where the line is, of course. Uncontroversial example: a calculator app that doesn't have a divide key. Technically, yes, it's a separate feature from the multiply key, but it's so basic, so expected, that its absence is a bug. From the above list, I consider "No easy way to do and restore backups on Android and impossible to do backups on their PC client" a bug, or at least a frustrating omission by design.
    - happymellon 4y ago
      Taking poor pictures, if it is due to using the wrong API is also a bug.
- defraxi 4y ago
  Although I use Signal, I actually prefer Threema which you can also use without a phone number. https://threema.ch/en/home https://threema.ch/en/home
CoastalCoder 4y ago
> The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Are we sure that Signal didn't contact the maintainer? I haven't seen any statements either way about that.
- nvrspyx 4y ago
  From galgalesh, the snap package maintainer, in the linked forum post: > I was just linked to this thread from our issue tracker > As a maintainer for this snap package, it’s mind-boggling to me that, even after almost two weeks, the store team did not contact me at all. I had to find this out myself from users reporting it on our bug tracker. > After almost two weeks, the maintainer of the snap has not received any official communication about this, but @roadmr was able to provide this tiny sliver of info in a thread on this forum. From the original comment of this particular thread, also from galgalesh: > Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly.
  - CoastalCoder 4y ago
    > Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly. You could be right, but I think another possibility is that the maintainer did get contacted earlier by Signal, and just didn't mentally connect the dots between that and his Snap package being pulled. Note that I don't know how realistic this is, I'm just trying to be fair in my assumptions.
- freedomben 4y ago
  Good thinking, but based on what GP said I don't think so: > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Had they contacted the maintainer, then the maintainer would not have been wondering what the deal was.
nimbius 4y ago
Moxies always been fairly dictatorial about Signal. no third party clients, no decentralization. im not surprised to see a DMCA at all. So far Signal is a centralized encrypted messaging app that includes its own cryptocurrency and wallet no one asked for, shills me for donations every other release, and begs me to invite new users despite deprecating regular SMS message support. if youre a threat-actor the most malevolent thing you could do at this point is just watch Moxie and the team drive this project into the ground.
- dheera 4y ago
  > no third party clients Isn't their client open source? If I compiled it myself, is that a third party client? If they don't let me compile it myself, how can I trust their official version is using the source they published?
  - alias_neo 4y ago
    You can build their client and use it yourself, but they don't want you to distribute it and they don't want you using their infra and API from a third party client.
  - maccam94 4y ago
    They don't want people distributing unofficial builds that claim to be Signal due to the risk of supply chain attacks against users.
- 411111111111111 4y ago
  I thought moxie moved on from Signal? Is he still in the loop?
  - cyberphobe 4y ago
    The anti-signal crowd loves to blame moxie for everything. Just part of their overall commitment to being fact-free
    - 4y ago
kevin_b_er 4y ago
What this is is also another reason not to use Snap. This is a multi-level failure. 1. Signal-Desktop is AGPLv3: https://github.com/signalapp/Signal-Desktop https://github.com/signalapp/Signal-Desktop 2. The snap package metadata is AGPLv3: https://github.com/snapcrafters/signal-desktop https://github.com/snapcrafters/signal-desktop So, this looks like a fraudulent DMCA claim by Signal, as the snap package maintainers and Canonicial have an open source license! This shows malice by Signal. 3. No-one from Canonical contacted the package maintainer(s) about the DMCA, so they have no opportunity to counterclaim or defend. This is an open sign Snap should not be used. Because utterly unjustified DMCA claims will result in the removal of a package without any way to contest. This is compounded by Canoncial's controlling methodology with Snap where it is ostensibly open-source but Canonical controls what is permitted with snap through a closed-source server.
- cyberphobe 4y ago
  AGPLv3 does not somehow permit trademark violations. Signal has taken issue with third parties building binaries and calling them Signal, and I can’t really blame them. This is the same reason Signal isn’t in F-Droid
  - kevin_b_er 4y ago
    And the DMCA is about copyright. Where's trademark mentioned?
    - tingletech 4y ago
      Violating trademark triggers AGPLv3 license to be invalid, thus the copyright claim.
      - Murrawhip 4y ago
        No, AGPLv3 allows for adding an additional term regarding trademark. Signal-desktop is using the default APGLv3 without such a term.
  - 4y ago
cyberphobe 4y ago
Signal offers an official deb. The correct behavior would have been for third parties to not distribute trademark-infringing binaries and call them Signal
- kybernetyk 4y ago
  Binaries are just condensed source code. So when the source code is AGPL I sure as hell can distribute binaries if I like.
  - cyberphobe 4y ago
    What is GNU IceCat (formerly IceWeasel) then?
    - jdiff 4y ago
      Firefox's license did not permit use of trademark. Eventually an exception was made, and now GNU IceCat is mostly a relic. Signal's license on the other hand, does permit use of trademark. If nothing else this means that using the DMCA for this is wildly inappropriate.
  - MrsPeaches 4y ago
    I think the point is that you can't call it Signal. Is that correct?
    - cyberphobe 4y ago
      Yup, also can’t really prove it came from the same source code.
  - bheadmaster 4y ago
    > I sure as hell can distribute binaries if I like As far as I understood the argument, you're free to distribute binaries, you just can't call them "Signal", since it's a trademarked name (?).
deleted 4y ago
[deleted]

googlryas 4y ago

So you're saying signal requested their own program be removed from the snap store? Sorry, I'm a little confused on terms. When you say snap maintainer, are you saying you are the maintainer of the signal snap package, or that you're a maintainer of snap itself?

aero-glide2 4y ago
This snap is unofficial.
SSLy 4y ago
> are you saying you are the maintainer of the signal snap package They are, yes. Well, former maintainer.
galgalesh 4y ago
I'm the maintainer of this unofficial snap package.
deleted 4y ago
[deleted]
cyberphobe 4y ago
Wasn’t their own program. They have a binary they distribute, this was some other binary calling itself Signal without their approval.
- teraflop 4y ago
  If that's the issue, it's (at most) a trademark violation instead of a copyright violation, which means the DMCA complaint was filed under false premises.
  - crumpled 4y ago
    A trademark violation is a copyright violation, because a trademark is copyrighted at first inception, before anyone adds the '™'. A company is also compelled to take actions like this to maintain the rights to thier own trademarks. That's my understanding; IANAL.

ElijahLynn 4y ago

Thanks for the explanation Galgalesh! Can you post this update on the Snapcraft (https://forum.snapcraft.io/t/what-happened-to-signal-desktop/32119/11 https://forum.snapcraft.io/t/what-happened-to-signal-desktop...) and GitHub threads (https://github.com/snapcrafters/signal-desktop/issues/70 https://github.com/snapcrafters/signal-desktop/issues/70) too? I was going to just now and cross link back here to your comment and figured it would be better coming from you directly!

SSLy 4y ago
They just did comment on that discourse thread.
- ElijahLynn 4y ago
  Thanks, I see it here now in both places > https://forum.snapcraft.io/t/what-happened-to-signal-desktop/32119/15 https://forum.snapcraft.io/t/what-happened-to-signal-desktop... & https://github.com/snapcrafters/signal-desktop/issues/70#issuecomment-1302299328 https://github.com/snapcrafters/signal-desktop/issues/70#iss....

nottorp 4y ago

This deserves a lot of publicity. Why send a DMCA takedown instead of contact the people involved? Will they do the same if some vulnerability is found in Signal? Lawyer up instead of fix the problem?

hyperhopper 4y ago
Exactly, using lawyers first is a very bad sign. I don't know why often people say "oh it was just the lawyers" like that makes it okay. No, those lawyers are paid for by and directed by signal. Signal is responsible.
- dheera 4y ago
  Hey signal, maybe fix this $ sudo apt-get install signal Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package signal and we don't need to resort to unofficial snap packages
  - nsxwolf 4y ago
    Oh, snap!
  - tssva 4y ago
    The name for the Signal Desktop package is signal-desktop and Signal provides instructions on their website on how to add their deb repository.
    - dheera 4y ago
      Too difficult. Their install instructions are also too complicated and involve reading about 5 lines of comments and 4 shell commands. It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. This is 2022, not 1995. It's faster to just search for "signal" in the snap store and hit "Install".
      - 4y ago

ddevault 4y ago

Typical behavior from Signal. They have a track record of hostility that we as a community should really not be tolerating. I do not use Signal and I tell my friends not to, either. Play nice or don't play at all.

enriquto 4y ago
Problem is, I already moved my friends and family to Signal and removed Whatsapp from my phone. It was an uphill battle that I don't want to fight again. What do I do, now? As much as there's a lot of questionable stuff on Signal, that's nothing compared to whatsapp. Do you suggest a Signal alternative that is significantly better?
- goodpoint 4y ago
  Support a new, well managed fork of Signal
- ddevault 4y ago
  I don't have an answer which is likely to satisfy you. I'm still a grumpy old IRC user. I communicate with non-technical friends and family via email, SMS, and Jitsi Meet. I allowed myself to be persuaded to try Matrix earlier this year and so far I've regret it. goodpoint's answer is probably the best longer term answer: someone needs to fork Signal and manage it properly. But it's not as simple as just rebranding the software, it needs lots of difficult technical work to fix its many problems.
  - forgotpwd16 4y ago
    >try Matrix earlier this year and so far I've regret it Why is that?
    - ddevault 4y ago
      Very bloated and unreliable.

forgotpwd16 4y ago

>this is because of a DMCA takedown request from lawyers representing Signal Whoa. That's unexpected.

brianacton 4y ago

Correct. We spoke to our attorneys and found the breakdown in communication. We are working to rectify and reinstate signal-desktop ASAP. Sorry for the confusion.

deleted 4y ago
[deleted]
cyberphobe 4y ago
Will a similar line of communication be established with other open source distribution platforms (such as F-Droid) that would also like to distribute binaries and call them Signal?
fazfq 4y ago
Why is Signal, a company that prides itself in being tech-centric, allowing lawyers to send DMCA requests without consulting anybody?
- deleted 4y ago
  [deleted]
- lcnPylGDnU4H9OF 4y ago
  I don't get why Signal being tech-centric (whatever that means) should disallow their lawyers from sending DMCA takedown requests.
  - jdiff 4y ago
    Because it means their lawyers are firing off in random, uninformed directions. There's no copyright issue, as the maintainers of the Snap have a copyright license (the AGPLv3) to do what they are doing. You could argue that it's a trademark issue, except that if it was, this makes a DMCA request illegal as it's not a tool to enforce trademark issues. And in addition, while the AGPLv3 has allowances for trademark carve-outs, Signal makes none. It's not a good look for the lawyers to be completely in the dark on an issue so core to their company's business.

spullara 4y ago

You didn't realize what you were doing was against the license?

ohbtvz 4y ago
How terrible of them, packaging open source software for their distribution like so many package managers do.
- caeril 4y ago
  I'm the last person to defend lawyers, DMCA takedowns, etc. But Signal has very strict build processes in place to ensure (to the best of their ability, anyway) that the official binaries are devoid of side-channel attack vulnerabilities. Putting my tinfoil hat on, all it takes is one unofficial Snap maintainer to be approached by one Glow-In-The-Dark with an offer they can't refuse to infect a hundred thousand users with key material compromise. I hate to say it, but Signal is doing the right thing, here.
jdiff 4y ago
It wasn't against the license. It's AGPL v3, about as open as it gets.
- spullara 4y ago
  You don't get the license without respecting the trademark. e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
  - jdiff 4y ago
    Read the full context of that rule. The entire section allows those provisions to be applied, it does not make those provisions. The APGLv3 disallows any further restrictions beyond the license to be applied, except for a handful of exceptions. That's one of them. And if such an exception is made, further instructions are provided to inform downstream users of them. Signal did not follow those instructions and didn't make any of the permitted exceptions.

xtat 4y ago

idk not a great look for signal