5 ms·

Does it lock me out of the app like signal if I don't update the app every few weeks? I'm looking for an app that never needs to be updated; Oh, I guess that

Does it lock me out of the app like signal if I don't update the app every few weeks? I'm looking for an app that never needs to be updated; Oh, I guess that is email.

some_furry 11mo ago
Enjoy getting pwned by zero-click exploits that have been widely patched elsewhere and disclosed publicly, I guess?
- analogpixel 11mo ago
  weird, I have never been pwned via email which has been updated 0 times in the last 20 years. I guess Signal is just so poorly made it needs to be constantly re-written every 2 weeks.
  - aeturnum 11mo ago
    Email has been updated many times in the last 20 years. All of the major sender authentication protocols (SPF, DKIM, DMARC) were created and deployed over the last 20 years. Email is also famously insecure and lacking a standard way of managing encryption - so the reason you never see updates is because the features signal is changing do not exist in email at all.
    - upofadown 11mo ago
      SPF, DKIM, DMARC are all about server reputation. They don't count as any sort of update to email and don't affect the protocol. These days regular non E2EE email is as secure as any other messaging protocol that relies on trusted servers. Since it is federated over multiple servers it is better than systems with just one server. You can choose who to trust and can even host it yourself. Compare with Signal where there is only one allowed server entity and hardly anyone verifies identities making man in the middle attacks trivial.
      - fylo 11mo ago
        Any reference to the trivial mitm attacks which signal has suffered?
        upofadown 11mo ago
        This is mostly about the usability issues that make such attacks work so well on Signal: https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... This adds some detail about how Signal can do MITM attacks: https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-great-encryption-needs-great-authentication/ https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-gr... Some of the details might of changed since publication. My current understanding is that Signal doesn't even bring up the idea of identity verification if a user has not previously done it. So if anything, things have gotten worse.
    - qmr 11mo ago
      PGP/GNUPG has worked well for me for nearly three decades.
      - deleted 11mo ago
        [deleted]
  - some_furry 11mo ago
    You're running 2005 versions of your mail-daemon in prod?
godelski 11mo ago
Why do you want an app that never gets updated? You want bugs to persist and security issues to persist? AFAIK signal only blocks due to security patches. Which it's on a much longer timeframe than a few weeks.
- elaus 11mo ago
  I think the distinction here is they want an app that never NEEDS to be updated, not one that never DOES get updates (which is fair – I'm happy if things just work and are not changed every 2 weeks).
  - akerl_ 11mo ago
    For a security app, it's pretty rational to need to be updated. One of the most common patterns in basically every technological attack is to take a freshly discovered vulnerability and target devices that haven't been updated yet.
    - Spunkie 11mo ago
      It sounds good in theory but signal updates are beyond excessive, sometimes multiple times a day but almost certainly every few days. Most of the time there is zero explanation for the update. They are just training their users to auto accept updates with no thought about why, which in itself is a security risk. If signal really is pushing these updates for "security" then it must be one of the most insecure apps ever built. I legitimately can't think of another app or program that updates more frequently... Maybe youtube-dl?
      - godelski 11mo ago
        > It sounds good in theory but signal updates are beyond excessive Those are two different arguments. Updating too frequently is not equivalent to "doesn't need to be updated." I can agree that they update a bit too frequently but that's nowhere near the argument about never updating. A program cannot be secure if it does not update. Full stop. > Most of the time there is zero explanation for the update There's always a changelog. If you, unlike most people, are interested it is all open source https://github.com/signalapp https://github.com/signalapp/libsignal/releases https://github.com/signalapp/Signal-Android/releases https://github.com/signalapp/Signal-iOS/releases https://github.com/signalapp/Signal-Desktop/releases I would suggest looking at the actual commits and not just the release notes. Libsignal usually has more info about the security > legitimately can't think of another app or program that updates more frequently Probably because they do so silently.

Does it lock me out of the app like signal if I don't update the app every few weeks? I'm looking for an app that never needs to be updated; Oh, I guess that is email.

some_furry 11mo ago

Enjoy getting pwned by zero-click exploits that have been widely patched elsewhere and disclosed publicly, I guess?

analogpixel 11mo ago
weird, I have never been pwned via email which has been updated 0 times in the last 20 years. I guess Signal is just so poorly made it needs to be constantly re-written every 2 weeks.
- aeturnum 11mo ago
  Email has been updated many times in the last 20 years. All of the major sender authentication protocols (SPF, DKIM, DMARC) were created and deployed over the last 20 years. Email is also famously insecure and lacking a standard way of managing encryption - so the reason you never see updates is because the features signal is changing do not exist in email at all.
  - upofadown 11mo ago
    SPF, DKIM, DMARC are all about server reputation. They don't count as any sort of update to email and don't affect the protocol. These days regular non E2EE email is as secure as any other messaging protocol that relies on trusted servers. Since it is federated over multiple servers it is better than systems with just one server. You can choose who to trust and can even host it yourself. Compare with Signal where there is only one allowed server entity and hardly anyone verifies identities making man in the middle attacks trivial.
    - fylo 11mo ago
      Any reference to the trivial mitm attacks which signal has suffered?
      - upofadown 11mo ago
        This is mostly about the usability issues that make such attacks work so well on Signal: https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... This adds some detail about how Signal can do MITM attacks: https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-great-encryption-needs-great-authentication/ https://sequoia-pgp.org/blog/2021/06/28/202106-hey-signal-gr... Some of the details might of changed since publication. My current understanding is that Signal doesn't even bring up the idea of identity verification if a user has not previously done it. So if anything, things have gotten worse.
  - qmr 11mo ago
    PGP/GNUPG has worked well for me for nearly three decades.
    - deleted 11mo ago
      [deleted]
- some_furry 11mo ago
  You're running 2005 versions of your mail-daemon in prod?

godelski 11mo ago

Why do you want an app that never gets updated? You want bugs to persist and security issues to persist? AFAIK signal only blocks due to security patches. Which it's on a much longer timeframe than a few weeks.

elaus 11mo ago
I think the distinction here is they want an app that never NEEDS to be updated, not one that never DOES get updates (which is fair – I'm happy if things just work and are not changed every 2 weeks).
- akerl_ 11mo ago
  For a security app, it's pretty rational to need to be updated. One of the most common patterns in basically every technological attack is to take a freshly discovered vulnerability and target devices that haven't been updated yet.
  - Spunkie 11mo ago
    It sounds good in theory but signal updates are beyond excessive, sometimes multiple times a day but almost certainly every few days. Most of the time there is zero explanation for the update. They are just training their users to auto accept updates with no thought about why, which in itself is a security risk. If signal really is pushing these updates for "security" then it must be one of the most insecure apps ever built. I legitimately can't think of another app or program that updates more frequently... Maybe youtube-dl?
    - godelski 11mo ago
      > It sounds good in theory but signal updates are beyond excessive Those are two different arguments. Updating too frequently is not equivalent to "doesn't need to be updated." I can agree that they update a bit too frequently but that's nowhere near the argument about never updating. A program cannot be secure if it does not update. Full stop. > Most of the time there is zero explanation for the update There's always a changelog. If you, unlike most people, are interested it is all open source https://github.com/signalapp https://github.com/signalapp/libsignal/releases https://github.com/signalapp/Signal-Android/releases https://github.com/signalapp/Signal-iOS/releases https://github.com/signalapp/Signal-Desktop/releases I would suggest looking at the actual commits and not just the release notes. Libsignal usually has more info about the security > legitimately can't think of another app or program that updates more frequently Probably because they do so silently.