6 ms·

Thanks for opening the source. You might want to contact the EFF to see if they will add you to their "scorecard" for secure messaging programs: https://www.e

by jcr 11y ago

Thanks for opening the source. You might want to contact the EFF to see if they will add you to their "scorecard" for secure messaging programs: https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard

ex3ndr 11y ago
I want to implement full e2e encryption with Moxie's encryption and I can't because it is GPL( GPL is not comparable with mobile apps at all. Also I think that implementing encryption by ourselves will be mistake. May be some one can contribute?
- nzp 11y ago
  Yet somehow, Open Whisper Systems apps are doing just fine being GPL.
  - ex3ndr 11y ago
    Yes, this is their software and they can do whatever they want. I think Moxie just don't care. In Actor we respect licenses and all other legal stuff. More information about GPL and Mobile Stores: https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement https://www.fsf.org/blogs/licensing/more-about-the-app-store...
    - belorn 11y ago
      You could ask the Moxie for extra permission to publish a non-open source version of Actor with his code on the app-store.
      - ex3ndr 11y ago
        I tried, no luck. And any fork will need this permission again? I believe that crypto implementations need to be in public domain. What if people can't use some software and will stay unsecured?
    - nzp 11y ago
      You could ask for an exemption from OWS for the App Store (and others) distribution. I don't know if OWS contributors retain individual copyright or just transfer it to OWS (ala GNU contributors to FSF). If former, it could be complicated, but it's worth a try.
    - aorth 11y ago
      The reason you aren't allowed to publish applications containing GPL'd source code in the Apple Store isn't because the GPL forbids it, it's because Apple forbids it; they have an unnatural hatred for the GPL. From what I can see the Signal application uses GPLv3'd code. I have no idea how it is still available in the Apple store.
- Rafert 11y ago
  You're free to re-implement the public-domain protocol[1] under your own license. Pond has a 3-clause BSD licensed Golang implementation[2] that Moxie even references in the Axolotl announcement blog post. 1: https://github.com/trevp/axolotl/wiki https://github.com/trevp/axolotl/wiki 2: https://github.com/agl/pond/tree/master/client/ratchet https://github.com/agl/pond/tree/master/client/ratchet
  - ex3ndr 11y ago
    Re-Implementing cryptography is VERY costly operation that we cannot afford now. I already implemented in the past crypto for Telegram, there waere a lot of small mistakes in the implementation part. Even Telegram have many resources, but we haven't.
    - deleted 11y ago
      [deleted]
    - Rafert 11y ago
      Understandable. Other than that the project looks quite interesting -- good luck!
- lmm 11y ago
  You could make a GPLed APK available. Not user friendly but it will allow those who really care to get the most secure possible version.
- aorth 11y ago
  I don't like the way you've framed the debate. As I said below, the reason you aren't allowed to publish applications containing GPL'd source code in the Apple Store isn't because the GPL forbids it, it's because Apple forbids it; they have an unnatural hatred for the GPL. Whether you like copyleft licenses or not is irrelevant. They are the wishes of the person who developed the original code.
  - johncolanduoni 11y ago
    That's not entirely true. They forbid using other people's code licensed under the GPL because it is not possible to meet its conditions[1]. Basically, they don't want to deal with the possible resulting copyright lawsuit. If you own the copyright to all the code used in your app, then there is no issue. [1]: http://apple.stackexchange.com/a/59495/101602 http://apple.stackexchange.com/a/59495/101602
- dllthomas 11y ago
  Incorporate Moxie's encryption as a module. Distribute this version for those who want it (and have jailbroken phones, where relevant), and use it as a reference implementation when you build an alternative that is more generally available. Meanwhile, criticize Apple's anti-gpl policies for making their users less secure.

by jcr 11y ago

ex3ndr 11y ago

I want to implement full e2e encryption with Moxie's encryption and I can't because it is GPL( GPL is not comparable with mobile apps at all. Also I think that implementing encryption by ourselves will be mistake. May be some one can contribute?

nzp 11y ago
Yet somehow, Open Whisper Systems apps are doing just fine being GPL.
- ex3ndr 11y ago
  Yes, this is their software and they can do whatever they want. I think Moxie just don't care. In Actor we respect licenses and all other legal stuff. More information about GPL and Mobile Stores: https://www.fsf.org/blogs/licensing/more-about-the-app-store-gpl-enforcement https://www.fsf.org/blogs/licensing/more-about-the-app-store...
  - belorn 11y ago
    You could ask the Moxie for extra permission to publish a non-open source version of Actor with his code on the app-store.
    - ex3ndr 11y ago
      I tried, no luck. And any fork will need this permission again? I believe that crypto implementations need to be in public domain. What if people can't use some software and will stay unsecured?
  - nzp 11y ago
    You could ask for an exemption from OWS for the App Store (and others) distribution. I don't know if OWS contributors retain individual copyright or just transfer it to OWS (ala GNU contributors to FSF). If former, it could be complicated, but it's worth a try.
  - aorth 11y ago
    The reason you aren't allowed to publish applications containing GPL'd source code in the Apple Store isn't because the GPL forbids it, it's because Apple forbids it; they have an unnatural hatred for the GPL. From what I can see the Signal application uses GPLv3'd code. I have no idea how it is still available in the Apple store.
Rafert 11y ago
You're free to re-implement the public-domain protocol[1] under your own license. Pond has a 3-clause BSD licensed Golang implementation[2] that Moxie even references in the Axolotl announcement blog post. 1: https://github.com/trevp/axolotl/wiki https://github.com/trevp/axolotl/wiki 2: https://github.com/agl/pond/tree/master/client/ratchet https://github.com/agl/pond/tree/master/client/ratchet
- ex3ndr 11y ago
  Re-Implementing cryptography is VERY costly operation that we cannot afford now. I already implemented in the past crypto for Telegram, there waere a lot of small mistakes in the implementation part. Even Telegram have many resources, but we haven't.
  - deleted 11y ago
    [deleted]
  - Rafert 11y ago
    Understandable. Other than that the project looks quite interesting -- good luck!
lmm 11y ago
You could make a GPLed APK available. Not user friendly but it will allow those who really care to get the most secure possible version.
aorth 11y ago
I don't like the way you've framed the debate. As I said below, the reason you aren't allowed to publish applications containing GPL'd source code in the Apple Store isn't because the GPL forbids it, it's because Apple forbids it; they have an unnatural hatred for the GPL. Whether you like copyleft licenses or not is irrelevant. They are the wishes of the person who developed the original code.
- johncolanduoni 11y ago
  That's not entirely true. They forbid using other people's code licensed under the GPL because it is not possible to meet its conditions[1]. Basically, they don't want to deal with the possible resulting copyright lawsuit. If you own the copyright to all the code used in your app, then there is no issue. [1]: http://apple.stackexchange.com/a/59495/101602 http://apple.stackexchange.com/a/59495/101602
dllthomas 11y ago
Incorporate Moxie's encryption as a module. Distribute this version for those who want it (and have jailbroken phones, where relevant), and use it as a reference implementation when you build an alternative that is more generally available. Meanwhile, criticize Apple's anti-gpl policies for making their users less secure.