9 ms·

Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send

Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...

award_ 4y ago
What are your others? I use signal alot personally and haven't had too many issues.
- sschueller 4y ago
  - Still need a phone number - They refuse to post the app on f-droid (directly) - No 3rd party clients allowed on their servers. - Crypto thing they attempted - I don't trust Moxie, he rubs me the wrong way.
  - junon 4y ago
    Agreed on all counts, especially the last one.
  - artificialLimbs 4y ago
    - Backups? lol...
  - aeturnum 4y ago
    None of these suggest you shouldn't use signal - or that it's not meeting its goal of secure communication (except the last one I suppose). Signal is not without flaws as you say, but if you have a phone number and can access a binary, there's every reason to believe it will securely and privately transmit your messages. You are also, ofc, free to fork their client and run your own service (as others have done).
    - krageon 4y ago
      There is no reason to believe it is secure, as it doesn't have reproducible builds. What you download has binary blobs embedded.
      - aeturnum 4y ago
        Signal has repeatedly been audited[1] so there's more reason to believe the protocol has the capacity to be secure than other options. Obviously if you believe the company is actively subverting their goal, you should use your own fork. Edit: to be clearer - signal both publishes a protocol (that is thought to be secure) and provides a public service (that claims to use the signal protocol). Signal has claimed that the binary blobs they add to their public client (and the other restrictions) are required to run a public service (anti-abuse, etc). You are free to believe them or not - I do. At the protocol level, which you are free to use, none of the problems you or the ancestors have pointed to apply. All of the alternatives people are pointing to here are at the "protocol" level - accessible only if you or someone you trust has setup a node. There's nothing wrong with that - it's a good idea - but it's no reason to attack signal's service for not being a protocol (which they also provide). [1] https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
  - gort19 4y ago
    What do you recommend as an alternative?
    - chpatrick 4y ago
      matrix/element.
    - freedomben 4y ago
      keybase.io has been great, although it's not without its risks either since it was acquired by Zoom. It's still up and seemingly maintained but AFAIK there's no new feature work. I've heard WhatsApp recommended from people I trust, but I have never personally used it so can't speak from experience.
      - gort19 4y ago
        WhatsApp seems like a non-starter based on this list of complaints. It’s hard to imagine someone who doesn’t trust Moxie, but does trust Zuck.
      - seized 4y ago
        A lot of people moved to Signal because of WhatsApps changes so that advice can thought of as misleading at best. Your suggested alternatives are owned by Zoom and Facebook. I'll stick with Signal.
      - happymellon 4y ago
        As a Facebook owned app, I don't trust WhatsApp. All of them being tied to a phone number is bad form.
      - calgoo 4y ago
        The legal team at the company I work for are suggesting to remove keybase and treat it as compromised as there is no way of knowing of keys and other data has not been shared with the Chinese government. No proof at all of course, just the world we live in I guess :)
      - L3viathan 4y ago
  - ixwt 4y ago
    Moxie stepped down from the CEO of Signal in January of this year [0]. Other than that, yeah. Valid criticisms that their reasons are flimsy at best. [0]:https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps-down-moxie-marlinspike-encryption-cryptocurrency https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps...
    - krageon 4y ago
      Stepped down maybe, but the fostered culture remains.
  - nells 4y ago
    - windexh8er 4y ago
      I see you're new, you might want to review the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - dheera 4y ago
    Yeah the phone number thing is a bad move since it's traceable to your identity one way or another, even if you use a virtual number like I do.
- ChuckNorris89 4y ago
  Not GP but I'm a Signal user and here are my gripes: - No easy way to do and restore backups on Android and impossible to do backups on their PC client - Does not support Android tablets at all (my mom loves hers) - Fails to ring on Android when you call someone or someone calls you, later serving you a missed call notification (disabled Doze/battery optimization feature on Android and tested on 3 different phones with no cigar) - No way to share your live location to friends - Using its built in photo snapping and sharing function takes horrible pictures on Android (I suspect they're using the wrong API). If I want to send someone I'm currently texting a good looking picture I need to switch to my phone's camera APP, then back to the chat and use the photo upload function, instead of the in-app photo snapping and sharing function Some of these bugs have been reported 3+ years ago, while these things work flawlessly on WhatsApp since nearly forever, meanwhile Signal is busy implementing crypto payment features. I don't know about iOS, but at least for Android and PC, it still feels like an app in alpha that's not yet released to the public compared to how polished and feature rich WhatsApp and Telegram are.
  - gort19 4y ago
    The only one of these that is a ‘bug’ is the failure to ring on android. The rest are all feature requests. That said, it’s interesting to see what people think are basic requirement for a messaging app these days.
    - thrtythreeforty 4y ago
      If you want to be reductionist, everything is a feature. But if an app is missing something so basic as to impact usability, I might consider it a bug. It's a matter of opinion where the line is, of course. Uncontroversial example: a calculator app that doesn't have a divide key. Technically, yes, it's a separate feature from the multiply key, but it's so basic, so expected, that its absence is a bug. From the above list, I consider "No easy way to do and restore backups on Android and impossible to do backups on their PC client" a bug, or at least a frustrating omission by design.
    - happymellon 4y ago
      Taking poor pictures, if it is due to using the wrong API is also a bug.
- defraxi 4y ago
  Although I use Signal, I actually prefer Threema which you can also use without a phone number. https://threema.ch/en/home https://threema.ch/en/home
CoastalCoder 4y ago
> The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Are we sure that Signal didn't contact the maintainer? I haven't seen any statements either way about that.
- nvrspyx 4y ago
  From galgalesh, the snap package maintainer, in the linked forum post: > I was just linked to this thread from our issue tracker > As a maintainer for this snap package, it’s mind-boggling to me that, even after almost two weeks, the store team did not contact me at all. I had to find this out myself from users reporting it on our bug tracker. > After almost two weeks, the maintainer of the snap has not received any official communication about this, but @roadmr was able to provide this tiny sliver of info in a thread on this forum. From the original comment of this particular thread, also from galgalesh: > Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly.
  - CoastalCoder 4y ago
    > Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly. You could be right, but I think another possibility is that the maintainer did get contacted earlier by Signal, and just didn't mentally connect the dots between that and his Snap package being pulled. Note that I don't know how realistic this is, I'm just trying to be fair in my assumptions.
- freedomben 4y ago
  Good thinking, but based on what GP said I don't think so: > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Had they contacted the maintainer, then the maintainer would not have been wondering what the deal was.
nimbius 4y ago
Moxies always been fairly dictatorial about Signal. no third party clients, no decentralization. im not surprised to see a DMCA at all. So far Signal is a centralized encrypted messaging app that includes its own cryptocurrency and wallet no one asked for, shills me for donations every other release, and begs me to invite new users despite deprecating regular SMS message support. if youre a threat-actor the most malevolent thing you could do at this point is just watch Moxie and the team drive this project into the ground.
- dheera 4y ago
  > no third party clients Isn't their client open source? If I compiled it myself, is that a third party client? If they don't let me compile it myself, how can I trust their official version is using the source they published?
  - alias_neo 4y ago
    You can build their client and use it yourself, but they don't want you to distribute it and they don't want you using their infra and API from a third party client.
  - maccam94 4y ago
    They don't want people distributing unofficial builds that claim to be Signal due to the risk of supply chain attacks against users.
- 411111111111111 4y ago
  I thought moxie moved on from Signal? Is he still in the loop?
  - cyberphobe 4y ago
    The anti-signal crowd loves to blame moxie for everything. Just part of their overall commitment to being fact-free
    - 4y ago
kevin_b_er 4y ago
What this is is also another reason not to use Snap. This is a multi-level failure. 1. Signal-Desktop is AGPLv3: https://github.com/signalapp/Signal-Desktop https://github.com/signalapp/Signal-Desktop 2. The snap package metadata is AGPLv3: https://github.com/snapcrafters/signal-desktop https://github.com/snapcrafters/signal-desktop So, this looks like a fraudulent DMCA claim by Signal, as the snap package maintainers and Canonicial have an open source license! This shows malice by Signal. 3. No-one from Canonical contacted the package maintainer(s) about the DMCA, so they have no opportunity to counterclaim or defend. This is an open sign Snap should not be used. Because utterly unjustified DMCA claims will result in the removal of a package without any way to contest. This is compounded by Canoncial's controlling methodology with Snap where it is ostensibly open-source but Canonical controls what is permitted with snap through a closed-source server.
- cyberphobe 4y ago
  AGPLv3 does not somehow permit trademark violations. Signal has taken issue with third parties building binaries and calling them Signal, and I can’t really blame them. This is the same reason Signal isn’t in F-Droid
  - kevin_b_er 4y ago
    And the DMCA is about copyright. Where's trademark mentioned?
    - tingletech 4y ago
      Violating trademark triggers AGPLv3 license to be invalid, thus the copyright claim.
      - Murrawhip 4y ago
        No, AGPLv3 allows for adding an additional term regarding trademark. Signal-desktop is using the default APGLv3 without such a term.
  - 4y ago
cyberphobe 4y ago
Signal offers an official deb. The correct behavior would have been for third parties to not distribute trademark-infringing binaries and call them Signal
- kybernetyk 4y ago
  Binaries are just condensed source code. So when the source code is AGPL I sure as hell can distribute binaries if I like.
  - cyberphobe 4y ago
    What is GNU IceCat (formerly IceWeasel) then?
    - jdiff 4y ago
      Firefox's license did not permit use of trademark. Eventually an exception was made, and now GNU IceCat is mostly a relic. Signal's license on the other hand, does permit use of trademark. If nothing else this means that using the DMCA for this is wildly inappropriate.
  - MrsPeaches 4y ago
    I think the point is that you can't call it Signal. Is that correct?
    - cyberphobe 4y ago
      Yup, also can’t really prove it came from the same source code.
  - bheadmaster 4y ago
    > I sure as hell can distribute binaries if I like As far as I understood the argument, you're free to distribute binaries, you just can't call them "Signal", since it's a trademarked name (?).
deleted 4y ago
[deleted]

Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...

award_ 4y ago

What are your others? I use signal alot personally and haven't had too many issues.

sschueller 4y ago
- Still need a phone number - They refuse to post the app on f-droid (directly) - No 3rd party clients allowed on their servers. - Crypto thing they attempted - I don't trust Moxie, he rubs me the wrong way.
- junon 4y ago
  Agreed on all counts, especially the last one.
- artificialLimbs 4y ago
  - Backups? lol...
- aeturnum 4y ago
  None of these suggest you shouldn't use signal - or that it's not meeting its goal of secure communication (except the last one I suppose). Signal is not without flaws as you say, but if you have a phone number and can access a binary, there's every reason to believe it will securely and privately transmit your messages. You are also, ofc, free to fork their client and run your own service (as others have done).
  - krageon 4y ago
    There is no reason to believe it is secure, as it doesn't have reproducible builds. What you download has binary blobs embedded.
    - aeturnum 4y ago
      Signal has repeatedly been audited[1] so there's more reason to believe the protocol has the capacity to be secure than other options. Obviously if you believe the company is actively subverting their goal, you should use your own fork. Edit: to be clearer - signal both publishes a protocol (that is thought to be secure) and provides a public service (that claims to use the signal protocol). Signal has claimed that the binary blobs they add to their public client (and the other restrictions) are required to run a public service (anti-abuse, etc). You are free to believe them or not - I do. At the protocol level, which you are free to use, none of the problems you or the ancestors have pointed to apply. All of the alternatives people are pointing to here are at the "protocol" level - accessible only if you or someone you trust has setup a node. There's nothing wrong with that - it's a good idea - but it's no reason to attack signal's service for not being a protocol (which they also provide). [1] https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
- gort19 4y ago
  What do you recommend as an alternative?
  - chpatrick 4y ago
    matrix/element.
  - freedomben 4y ago
    keybase.io has been great, although it's not without its risks either since it was acquired by Zoom. It's still up and seemingly maintained but AFAIK there's no new feature work. I've heard WhatsApp recommended from people I trust, but I have never personally used it so can't speak from experience.
    - gort19 4y ago
      WhatsApp seems like a non-starter based on this list of complaints. It’s hard to imagine someone who doesn’t trust Moxie, but does trust Zuck.
    - seized 4y ago
      A lot of people moved to Signal because of WhatsApps changes so that advice can thought of as misleading at best. Your suggested alternatives are owned by Zoom and Facebook. I'll stick with Signal.
    - happymellon 4y ago
      As a Facebook owned app, I don't trust WhatsApp. All of them being tied to a phone number is bad form.
    - calgoo 4y ago
      The legal team at the company I work for are suggesting to remove keybase and treat it as compromised as there is no way of knowing of keys and other data has not been shared with the Chinese government. No proof at all of course, just the world we live in I guess :)
    - L3viathan 4y ago
- ixwt 4y ago
  Moxie stepped down from the CEO of Signal in January of this year [0]. Other than that, yeah. Valid criticisms that their reasons are flimsy at best. [0]:https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps-down-moxie-marlinspike-encryption-cryptocurrency https://www.theverge.com/2022/1/10/22876891/signal-ceo-steps...
  - krageon 4y ago
    Stepped down maybe, but the fostered culture remains.
- nells 4y ago
  - windexh8er 4y ago
    I see you're new, you might want to review the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dheera 4y ago
  Yeah the phone number thing is a bad move since it's traceable to your identity one way or another, even if you use a virtual number like I do.
ChuckNorris89 4y ago
Not GP but I'm a Signal user and here are my gripes: - No easy way to do and restore backups on Android and impossible to do backups on their PC client - Does not support Android tablets at all (my mom loves hers) - Fails to ring on Android when you call someone or someone calls you, later serving you a missed call notification (disabled Doze/battery optimization feature on Android and tested on 3 different phones with no cigar) - No way to share your live location to friends - Using its built in photo snapping and sharing function takes horrible pictures on Android (I suspect they're using the wrong API). If I want to send someone I'm currently texting a good looking picture I need to switch to my phone's camera APP, then back to the chat and use the photo upload function, instead of the in-app photo snapping and sharing function Some of these bugs have been reported 3+ years ago, while these things work flawlessly on WhatsApp since nearly forever, meanwhile Signal is busy implementing crypto payment features. I don't know about iOS, but at least for Android and PC, it still feels like an app in alpha that's not yet released to the public compared to how polished and feature rich WhatsApp and Telegram are.
- gort19 4y ago
  The only one of these that is a ‘bug’ is the failure to ring on android. The rest are all feature requests. That said, it’s interesting to see what people think are basic requirement for a messaging app these days.
  - thrtythreeforty 4y ago
    If you want to be reductionist, everything is a feature. But if an app is missing something so basic as to impact usability, I might consider it a bug. It's a matter of opinion where the line is, of course. Uncontroversial example: a calculator app that doesn't have a divide key. Technically, yes, it's a separate feature from the multiply key, but it's so basic, so expected, that its absence is a bug. From the above list, I consider "No easy way to do and restore backups on Android and impossible to do backups on their PC client" a bug, or at least a frustrating omission by design.
  - happymellon 4y ago
    Taking poor pictures, if it is due to using the wrong API is also a bug.
defraxi 4y ago
Although I use Signal, I actually prefer Threema which you can also use without a phone number. https://threema.ch/en/home https://threema.ch/en/home

CoastalCoder 4y ago

> The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Are we sure that Signal didn't contact the maintainer? I haven't seen any statements either way about that.

nvrspyx 4y ago
From galgalesh, the snap package maintainer, in the linked forum post: > I was just linked to this thread from our issue tracker > As a maintainer for this snap package, it’s mind-boggling to me that, even after almost two weeks, the store team did not contact me at all. I had to find this out myself from users reporting it on our bug tracker. > After almost two weeks, the maintainer of the snap has not received any official communication about this, but @roadmr was able to provide this tiny sliver of info in a thread on this forum. From the original comment of this particular thread, also from galgalesh: > Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly.
- CoastalCoder 4y ago
  > Seems pretty clear that he was neither aware of it being taken down nor the reason, so I think it's safe to assume that Signal didn't contact the maintainer directly. You could be right, but I think another possibility is that the maintainer did get contacted earlier by Signal, and just didn't mentally connect the dots between that and his Snap package being pulled. Note that I don't know how realistic this is, I'm just trying to be fair in my assumptions.
freedomben 4y ago
Good thinking, but based on what GP said I don't think so: > Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again. Had they contacted the maintainer, then the maintainer would not have been wondering what the deal was.

nimbius 4y ago

Moxies always been fairly dictatorial about Signal. no third party clients, no decentralization. im not surprised to see a DMCA at all. So far Signal is a centralized encrypted messaging app that includes its own cryptocurrency and wallet no one asked for, shills me for donations every other release, and begs me to invite new users despite deprecating regular SMS message support. if youre a threat-actor the most malevolent thing you could do at this point is just watch Moxie and the team drive this project into the ground.

dheera 4y ago
> no third party clients Isn't their client open source? If I compiled it myself, is that a third party client? If they don't let me compile it myself, how can I trust their official version is using the source they published?
- alias_neo 4y ago
  You can build their client and use it yourself, but they don't want you to distribute it and they don't want you using their infra and API from a third party client.
- maccam94 4y ago
  They don't want people distributing unofficial builds that claim to be Signal due to the risk of supply chain attacks against users.
411111111111111 4y ago
I thought moxie moved on from Signal? Is he still in the loop?
- cyberphobe 4y ago
  The anti-signal crowd loves to blame moxie for everything. Just part of their overall commitment to being fact-free
  - 4y ago

kevin_b_er 4y ago

What this is is also another reason not to use Snap. This is a multi-level failure. 1. Signal-Desktop is AGPLv3: https://github.com/signalapp/Signal-Desktop https://github.com/signalapp/Signal-Desktop 2. The snap package metadata is AGPLv3: https://github.com/snapcrafters/signal-desktop https://github.com/snapcrafters/signal-desktop So, this looks like a fraudulent DMCA claim by Signal, as the snap package maintainers and Canonicial have an open source license! This shows malice by Signal. 3. No-one from Canonical contacted the package maintainer(s) about the DMCA, so they have no opportunity to counterclaim or defend. This is an open sign Snap should not be used. Because utterly unjustified DMCA claims will result in the removal of a package without any way to contest. This is compounded by Canoncial's controlling methodology with Snap where it is ostensibly open-source but Canonical controls what is permitted with snap through a closed-source server.

cyberphobe 4y ago
AGPLv3 does not somehow permit trademark violations. Signal has taken issue with third parties building binaries and calling them Signal, and I can’t really blame them. This is the same reason Signal isn’t in F-Droid
- kevin_b_er 4y ago
  And the DMCA is about copyright. Where's trademark mentioned?
  - tingletech 4y ago
    Violating trademark triggers AGPLv3 license to be invalid, thus the copyright claim.
    - Murrawhip 4y ago
      No, AGPLv3 allows for adding an additional term regarding trademark. Signal-desktop is using the default APGLv3 without such a term.
- 4y ago

cyberphobe 4y ago

Signal offers an official deb. The correct behavior would have been for third parties to not distribute trademark-infringing binaries and call them Signal

kybernetyk 4y ago
Binaries are just condensed source code. So when the source code is AGPL I sure as hell can distribute binaries if I like.
- cyberphobe 4y ago
  What is GNU IceCat (formerly IceWeasel) then?
  - jdiff 4y ago
    Firefox's license did not permit use of trademark. Eventually an exception was made, and now GNU IceCat is mostly a relic. Signal's license on the other hand, does permit use of trademark. If nothing else this means that using the DMCA for this is wildly inappropriate.
- MrsPeaches 4y ago
  I think the point is that you can't call it Signal. Is that correct?
  - cyberphobe 4y ago
    Yup, also can’t really prove it came from the same source code.
- bheadmaster 4y ago
  > I sure as hell can distribute binaries if I like As far as I understood the argument, you're free to distribute binaries, you just can't call them "Signal", since it's a trademarked name (?).

deleted 4y ago

[deleted]