6 ms·

> Contains no proprietary blobs, unlike Signal What "proprietary blobs" does Signal have? I'll also just add: it's probably not a good idea to use any modific

by landr0id 11mo ago

> Contains no proprietary blobs, unlike Signal What "proprietary blobs" does Signal have? I'll also just add: it's probably not a good idea to use any modifications to an E2EE messenger unless you are comfortable with those privacy/security guarantees possibly being violated by the 3rd party code. The only exception to this would be if I really trusted the goals of the 3rd party, like Graphene.

anonym29 11mo ago
Firebase, GMS (Google Mobile Services). The Alphabet Corporation is part of many security and privacy conscious users' threat model, and these users aren't generally thrilled about leaking even limited message metadata like timing to their adversary, particularly when that adversary is known to cooperate with global passive adversaries. There are actually two builds of Molly: Molly and Molly-FOSS. IIRC Molly uses regular Firebase, which can be faster and more reliable but comes with the above tradeoffs, while Molly-FOSS uses UnifiedPush. Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code, but given you seem to trust GrapheneOS, it's worth noting that they've formally endorsed Molly: https://xcancel.com/GrapheneOS/status/1769277147569443309 https://xcancel.com/GrapheneOS/status/1769277147569443309
- landr0id 11mo ago
  > Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code Also a great point :) And thank you for the reference.
- t0bia_s 11mo ago
  UnifiedPush not works if you not use Molly exclusively on one device. So of you sync between Signal on Win desktop and Android device, your battery drain faster.
grishka 11mo ago
> What "proprietary blobs" does Signal have? As they say in the Github readme, FCM and Google Maps. FCM doesn't technically require a blob — it's just that Google wants you to think it does. I reverse engineered their library and it turned out to be a criminally over-engineered wrapper around two broadcast receivers. So, the Mastodon app is proudly the first app ever to both support FCM push notifications, and be 100% open-source.
- nicoburns 11mo ago
  Oo, do you have a link for your implementation? I will soon be looking at creating a library to support FCM (android push notifications) in Android apps written in Rust. And having a simpler interface with the OS (esp. if it therefore doesn't require building a non-syste library) would be incredibly helpful.
  - GranPC 11mo ago
    Looks like this is the first commit where it was added: https://github.com/mastodon/mastodon-android/commit/a0cbf0fa31cbed1993daf6fda065739341f51643 https://github.com/mastodon/mastodon-android/commit/a0cbf0fa...
    - nicoburns 11mo ago
      Thanks! It looks like that repo is GPL though, which I respect but isn't going to work for my usage (where I'm trying to build a generic UI toolkit that can be used by all sorts of applications including closed source ones).
      - deleted 11mo ago
        [deleted]
      - cyberax 11mo ago
        If you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23bcc1619f8c5717de5b9d/play-services-core/src/main/java/org/microg/gms/gcm/McsService.java#L556 https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b... It's Apache 2.
TeMPOraL 11mo ago
OTOH it's nice to have an alternative client. If E2EE messenger system is going to lock itself down hard, trying to "protect" itself from the user even harder than third party adversaries, then I personally see no point - might as well use Whatsapp. I miss the times IM software respected, or at least didn't fight hard to defeat, the end-user's freedom to computing on their own device, which includes viewing and sending messages through whatever interface they see fit, including indirectly as part of a script/automation. But that was all before E2EE era, hell, before mobile dominance.
- godelski 11mo ago
  > might as well use Whatsapp. - still scrapes metadata - run by company who's entire objective is to profile you Stop being so ridiculous. You can criticize Signal (and there's plenty to critique) but that's just silly. What, should we also just use telegram where E2EE is off by default? You know signal is open source, right? That's why Molly exists. They can run their own servers too. Now I wish you could do both. Talk in both signal and the decentralized molly servers. I wish signal had a mesh like feature since it's way harder to snoop on conversations if you have to be physically near. I even wish Signal made the signal sticker site accessible from inside the app. There's tons of things they should do but let's not pretend that just because they're not perfect that we should use apps from a company whose motto might as well be "be evil".
  - prmoustache 11mo ago
    > What, should we also just use telegram where E2EE is off by default? There are plenty of others, all with their pros and cons. Ultimately,the network effect is usually the hardest parameter to overcome. Ironically, the only person who mentionned wanting to use signal instead of whatsapp in my network circle is my 71y old mother.
    - zetsurin 11mo ago
      You should listen to your mother. edit: lol, i assumed you were the OP. ignore me

anonym29 11mo ago

Firebase, GMS (Google Mobile Services). The Alphabet Corporation is part of many security and privacy conscious users' threat model, and these users aren't generally thrilled about leaking even limited message metadata like timing to their adversary, particularly when that adversary is known to cooperate with global passive adversaries. There are actually two builds of Molly: Molly and Molly-FOSS. IIRC Molly uses regular Firebase, which can be faster and more reliable but comes with the above tradeoffs, while Molly-FOSS uses UnifiedPush. Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code, but given you seem to trust GrapheneOS, it's worth noting that they've formally endorsed Molly: https://xcancel.com/GrapheneOS/status/1769277147569443309 https://xcancel.com/GrapheneOS/status/1769277147569443309

landr0id 11mo ago
> Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code Also a great point :) And thank you for the reference.
t0bia_s 11mo ago
UnifiedPush not works if you not use Molly exclusively on one device. So of you sync between Signal on Win desktop and Android device, your battery drain faster.

grishka 11mo ago

> What "proprietary blobs" does Signal have? As they say in the Github readme, FCM and Google Maps. FCM doesn't technically require a blob — it's just that Google wants you to think it does. I reverse engineered their library and it turned out to be a criminally over-engineered wrapper around two broadcast receivers. So, the Mastodon app is proudly the first app ever to both support FCM push notifications, and be 100% open-source.

nicoburns 11mo ago
Oo, do you have a link for your implementation? I will soon be looking at creating a library to support FCM (android push notifications) in Android apps written in Rust. And having a simpler interface with the OS (esp. if it therefore doesn't require building a non-syste library) would be incredibly helpful.
- GranPC 11mo ago
  Looks like this is the first commit where it was added: https://github.com/mastodon/mastodon-android/commit/a0cbf0fa31cbed1993daf6fda065739341f51643 https://github.com/mastodon/mastodon-android/commit/a0cbf0fa...
  - nicoburns 11mo ago
    Thanks! It looks like that repo is GPL though, which I respect but isn't going to work for my usage (where I'm trying to build a generic UI toolkit that can be used by all sorts of applications including closed source ones).
    - deleted 11mo ago
      [deleted]
    - cyberax 11mo ago
      If you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23bcc1619f8c5717de5b9d/play-services-core/src/main/java/org/microg/gms/gcm/McsService.java#L556 https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b... It's Apache 2.

TeMPOraL 11mo ago

OTOH it's nice to have an alternative client. If E2EE messenger system is going to lock itself down hard, trying to "protect" itself from the user even harder than third party adversaries, then I personally see no point - might as well use Whatsapp. I miss the times IM software respected, or at least didn't fight hard to defeat, the end-user's freedom to computing on their own device, which includes viewing and sending messages through whatever interface they see fit, including indirectly as part of a script/automation. But that was all before E2EE era, hell, before mobile dominance.

godelski 11mo ago
> might as well use Whatsapp. - still scrapes metadata - run by company who's entire objective is to profile you Stop being so ridiculous. You can criticize Signal (and there's plenty to critique) but that's just silly. What, should we also just use telegram where E2EE is off by default? You know signal is open source, right? That's why Molly exists. They can run their own servers too. Now I wish you could do both. Talk in both signal and the decentralized molly servers. I wish signal had a mesh like feature since it's way harder to snoop on conversations if you have to be physically near. I even wish Signal made the signal sticker site accessible from inside the app. There's tons of things they should do but let's not pretend that just because they're not perfect that we should use apps from a company whose motto might as well be "be evil".
- prmoustache 11mo ago
  > What, should we also just use telegram where E2EE is off by default? There are plenty of others, all with their pros and cons. Ultimately,the network effect is usually the hardest parameter to overcome. Ironically, the only person who mentionned wanting to use signal instead of whatsapp in my network circle is my 71y old mother.
  - zetsurin 11mo ago
    You should listen to your mother. edit: lol, i assumed you were the OP. ignore me