3 ms·

Signal's code quality is not conducive to security. They had an extremely bad state management bug that resulted in photos being sent to random contacts in your

by 0xy 6mo ago

Signal's code quality is not conducive to security. They had an extremely bad state management bug that resulted in photos being sent to random contacts in your list (potentially life ruining implications if you're sending private photos). For this reason, it's hard to trust them. The encryption quality is irrelevant if the slop coded client is blasting random photos to random contacts.

alance 6mo ago
Source?
- 0xy 6mo ago
  It would've taken you less time to Google, but sure: https://www.bleepingcomputer.com/news/security/signal-fixes-bug-that-sent-random-images-to-wrong-contacts/ https://www.bleepingcomputer.com/news/security/signal-fixes-... Send a GIF to Contact A, Contact B receives random private images? Absolutely inexcusable slop code project. This class of state management bugs should not be possible with a well-architected client, period. Signal's E2E encryption is more like End 2 Random End.
  - alance 6mo ago
    Or why not include the source of your claim up front? From GitHub comments: https://github.com/signalapp/Signal-Android/issues/10247 https://github.com/signalapp/Signal-Android/issues/10247 Greyson: > Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21) They had a difficult to reproduce problem reported in late December 2020, and got the fix rolled out seven months later. Not sure your criticism "absolutely inexcusable slop code" is well considered.
    - 0xy 6mo ago
      So 7 months of their users getting rinsed by an extremely serious issue exposing your private photos to random contacts. Seems like slop code to me. Those kinds of state management bugs should not be possible. It indicates code divorced from best practice state management. Knowing that bug COULD exist, means that you cannot be sure that messages you send in Signal will make it to the recipient you intend given the poor quality. This means the E2E encryption is fundamentally broken, by the way. Because the client is lying to you about the true state of who it's about to send to. The recipient text has fundamentally zero relationship to the true recipient of the message given that bug. Having the UI and message sending code reference two different versions of state is incredible incompetence.

by 0xy 6mo ago

alance 6mo ago

Source?

0xy 6mo ago
It would've taken you less time to Google, but sure: https://www.bleepingcomputer.com/news/security/signal-fixes-bug-that-sent-random-images-to-wrong-contacts/ https://www.bleepingcomputer.com/news/security/signal-fixes-... Send a GIF to Contact A, Contact B receives random private images? Absolutely inexcusable slop code project. This class of state management bugs should not be possible with a well-architected client, period. Signal's E2E encryption is more like End 2 Random End.
- alance 6mo ago
  Or why not include the source of your claim up front? From GitHub comments: https://github.com/signalapp/Signal-Android/issues/10247 https://github.com/signalapp/Signal-Android/issues/10247 Greyson: > Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21) They had a difficult to reproduce problem reported in late December 2020, and got the fix rolled out seven months later. Not sure your criticism "absolutely inexcusable slop code" is well considered.
  - 0xy 6mo ago
    So 7 months of their users getting rinsed by an extremely serious issue exposing your private photos to random contacts. Seems like slop code to me. Those kinds of state management bugs should not be possible. It indicates code divorced from best practice state management. Knowing that bug COULD exist, means that you cannot be sure that messages you send in Signal will make it to the recipient you intend given the poor quality. This means the E2E encryption is fundamentally broken, by the way. Because the client is lying to you about the true state of who it's about to send to. The recipient text has fundamentally zero relationship to the true recipient of the message given that bug. Having the UI and message sending code reference two different versions of state is incredible incompetence.