Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moxie Marlinspike Makes Encryption for Everyone

popsci.com

Post reply on HN
Print view View original

31–40 of 144 posts

Re: Moxie Marlinspike Makes Encryption for Everyone

#31

Post by AstralStorm »

avmich wrote: post #14
sandebert wrote: post #10

Earlier quoted context omitted.

Well, no. You could have a situation where there's a policy in place forbidding installing GPL-licensed products. (I don't have any info about it, but I wouldn't be surprised if that was the case at Microsoft a while ago.) EDIT: I'm getting downvotes and don't understand why. I'm seriously interested, can someone explain the reason?

> You could have a situation where there's a policy in place forbidding installing GPL-licensed products. You might have situation with policies forbidding anything. Like, MS Windows. Or Macs. Or smartphones. Rarely, yes, but I'm surprised GPL looks that unique regarding this matter.

Weird that someone would prohibit installing GPL licenced software. It is a very different case than using GPL licenced code in development. Sounds like a dumb lawyer trying to hard cover his rear against reverse engineering accusations. Which you cannot do in this way anyway.

Re: Moxie Marlinspike Makes Encryption for Everyone

#32

Post by AtticHacker »

feklar wrote: post #26
AtticHacker wrote: post #8

Earlier quoted context omitted.

Huge deal breaker for me, regrettably.

Experiment with a reversed play services framework http://forum.xda-developers.com/android/apps-games/app-micro...

I'm not familiar with this but it looks like an interesting project. My problem however is that I mainly do not like that GPL'd software isn't allowed to be redistributed. I might not be properly informed on this issue (and please correct me if I'm wrong) but from what I've read that seems to be the case.

Re: Moxie Marlinspike Makes Encryption for Everyone

#33

Post by AtticHacker »

Joeboy wrote: post #30
AtticHacker wrote: post #8

Earlier quoted context omitted.

Huge deal breaker for me, regrettably.

What are you going to use instead? Who are you going to talk to with it?

Currently I'm using Telegram with secret chat to talk to my friends and family.

Re: Moxie Marlinspike Makes Encryption for Everyone

#34

Post by Freak_NL »

superkuh wrote: post #25
dbalan wrote: post #9

Earlier quoted context omitted.

Here is moxie's reply in that matter https://news.ycombinator.com/item?id=10665520

He's doing great and useful work, there's no doubt. But requiring a phone number for an internet instant messenger is still a deal breaker even with Chromium as an alternative.

The most useful piece of metadata available to anyone harvesting user profiles for surveillance or profit. Governments must love phone numbers. Getting an anonymous phone number for each separate service you register with is practically infeasible.

I worry about how influential people like Moxie Marlinspike are seemingly turning the modern 'mobile-first' development paradigm into a 'mobile-only' mindset. I don't believe in secure and private computing when you are making it very hard for people to use your tools on (or via) anything but the two dominant mobile operating systems.

Re: Moxie Marlinspike Makes Encryption for Everyone

#35

Post by simoncion »

blablablaat wrote: post #7

Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/

> He only wants distribution via Google...

Untrue. He only wants distribution through channels that provide the same security assurances and deployment features that Google does through the Play Store. [0][1][2]

He's also quite open to replacing use of GCM with WebSockets or some equivalent tech, but if you don't use GCM, the replacement is likely going to significantly reduce battery life of phones on cell networks. [3][4]

> ...and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure.

That's because -in part- the F-droid project managers had (and -AFAIK, but I haven't checked in quite some time- continues to have) very serious issues in regards to their APK signing key handling procedures.

Signal is GPL'd. Anyone can take the code and do what they like with it, as long as it conforms with the license terms. However, it's very clear that Whisper Systems does not want people distributing Signal-branded builds on app distribution platforms that don't provide Whisper Systems the security guarantees and management tools that they need to get their jobs done.

In short, you're free to distribute custom builds of the Signal-Android, Signal-Desktop, TextSecure-Server, and Signal-iOS projects. However, it'd be nice of you to:

* Stand up an instance of the Signal server software on hardware you control, then point your builds of the Signal client software to your server.

* Rename the software that you're redistributing, make up your own logo, and make it abundantly clear that -while your work is based entirely on Signal's code- you're neither operating with the explicit support of Open Whisper Systems nor are you likely to be providing the same security guarantees that they are.

[0] https://github.com/WhisperSystems/Signal-Android/issues/127#...

[1] https://github.com/WhisperSystems/Signal-Android/issues/281#...

[2] https://github.com/WhisperSystems/Signal-Android/issues/127#...

[3] https://github.com/WhisperSystems/Signal-Android/issues/1000...

[4] (see the reply to) https://github.com/WhisperSystems/Signal-Android/issues/127#...

Re: Moxie Marlinspike Makes Encryption for Everyone

#36

Post by uola »

Freak_NL wrote: post #34
superkuh wrote: post #25

Earlier quoted context omitted.

He's doing great and useful work, there's no doubt. But requiring a phone number for an internet instant messenger is still a deal breaker even with Chromium as an alternative.

The most useful piece of metadata available to anyone harvesting user profiles for surveillance or profit. Governments must love phone numbers. Getting an anonymous phone number for each separate service you register with is practically infeasible. I worry about how influential people like Moxie Marlinspike are seemingly turning the modern 'mobile-first' development paradigm into a 'mobile-only' mindset. I don't beli…

Yes, phone numbers are public enough that they are shared everywhere, but unique enough to lead to a single person not to speak of that persons movements. And "just use twilio" isn't a motivation for using phone numbers in the first place.

If he had said "the benefits of finding friends are greater than the privacy implications" or something like that there would at least been a case for a discussion, but now he's seemingly saying "oh, if you really care about privacy you could/should use a fake phone number".

Re: Moxie Marlinspike Makes Encryption for Everyone

#37

Post by simoncion »

AtticHacker wrote: post #32
feklar wrote: post #26

Earlier quoted context omitted.

Experiment with a reversed play services framework http://forum.xda-developers.com/android/apps-games/app-micro...

I'm not familiar with this but it looks like an interesting project. My problem however is that I mainly do not like that GPL'd software isn't allowed to be redistributed. I might not be properly informed on this issue (and please correct me if I'm wrong) but from what I've read that seems to be the case.

> I might not be properly informed on this issue.

You're not. Here's an okay starting point into the discussion: https://github.com/WhisperSystems/Signal-Android/issues/282

Another thing to remember is that (IIRC) -for approximately forever- Red Hat Enterprise Linux has been a Linux distro that's composed almost entirely of Open Source software, but prohibits folks who receive the binaries from redistributing them.

Re: Moxie Marlinspike Makes Encryption for Everyone

#38

Post by simoncion »

sandebert wrote: post #10
wtbob wrote: post #6

Earlier quoted context omitted.

> Not for everyone, their crypto is GPL only and GPL can't be deployed everywhere. GPL code can be used anywhere; GPL code cannot be made proprietary.

Well, no. You could have a situation where there's a policy in place forbidding installing GPL-licensed products. (I don't have any info about it, but I wouldn't be surprised if that was the case at Microsoft a while ago.) EDIT: I'm getting downvotes and don't understand why. I'm seriously interested, can someone explain the reason?

> I'm getting downvotes and don't understand why. I'm seriously interested, can someone explain the reason?

Probably because your comment is of the form "Well, here's a ridiculously unlikely (as well as patently ridiculous) thing that I'm going to use as a counter to your argument."

Preemptive downvoter shield attempt: I'm deliberately taking a very uncharitable view of sandebert's comment in order to answer his question.

Re: Moxie Marlinspike Makes Encryption for Everyone

#39

Post by nurmara »

indlebe wrote: post #2

Moxie's been a huge inspiration for me in tech, i first discovered him through his blog post Career Advice: https://moxie.org/blog/career-advice/

I've read this blog post multiple times over the past few months and I wish I knew about it before I went to college. His career advice has so much clarity that I can't find elsewhere (so far).

Thanks for sharing the link. I'm about to do a career switch and reading this again is certainly reassuring. He is right. We are what we do for a living.

I find his work very inspirational and I hope I'll be able to personally thank him one day for all the work he has done.

Re: Moxie Marlinspike Makes Encryption for Everyone

#40

Post by jalami »

AtticHacker wrote: post #8
blablablaat wrote: post #7

Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/

Huge deal breaker for me, regrettably.

Yeah me too, I'm using Conversations[0] on Android and it's pretty awesome actually. Pretty actively developed with a smooth UI and no Play services or phone number requirement.

Running a really light prosody[1] instance on my server to host my own XMPP connection, although since it's all E2E, I could have used a public one.

[0] https://f-droid.org/repository/browse/?fdid=eu.siacs.convers... [1] https://prosody.im/

Post reply on HN