Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Statement on Recent Events Between Signal and the Anti-Censorship Community

github.com

Post reply on HN
Print view View original

41–50 of 290 posts

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#41

Post by pm90 »

nexthash wrote: post #35
edent wrote: post #31

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerability highlighted by Naomi Wu and others. I remember back when it was TextSecure - I tried to raise some usability and security issues. First I was ignored, then dismissed, then - a few years later - they implemented some of the changes. I still use Signal. Bu…

Maybe, but I think that the way these researchers reacted when their criticism wasn't heard doesn't benefit anybody. By ratcheting up the tension and participating in an internet catfight against the Signal team, a net loss occurs for the anti-censorship community. If the Signal team does indeed have a real problem with taking feedback and criticism, a better approach might've been to gather support and enter into lo…

The owners and maintainers of the product get to decide on how to handle issues like this one. But I’m not convinced that an “internet catfight” is a good enough reason for shutting down the conversation completely as it was done. I am aware that it’s totally unfair that signal owners should have to deal with this kind of behavior and not take strong measure like they did... I don’t really know what a good resolution would have been. But it’s also a fact that if a system is broken in some way then that hard truth remains true even if it’s wrapped in layers of shit. The ultimate losers will be the users.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#42

Post by fmajid »

sneak wrote: post #28
rfoo wrote: post #25

Earlier quoted context omitted.

> Sometimes I really wonder the motives and identities behind the people causing such massive and unnecessary drama In this case, it's pretty boring. They are just a group of "your average power users" or "wannabe programmers" in their highschool or junior years who happened to be born in China so had some exposure to anti-censorship. Being in their overconfident period of life, they pass by various myth they don't r…

I've seen a growing number of anti-Signal posts and activism lately, mostly surrounding the (well-documented) design tradeoffs that Signal makes for usability and privacy (such as opting to use phone numbers for usernames, to avoid having to store contact lists/social graphs on Signal servers), or their famous decision not to federate/interoperate. Perhaps it's just criticism growing in lockstep with Signal's overall…

Did you know Signal, like Tor, was financed by an offshoot of the CIA?

https://www.opentech.fund/results/supported-projects/open-wh...

https://pando.com/2015/03/01/internet-privacy-funded-by-spoo...

Now if I were an Iranian dissident, I would be reasonably confident Signal is designed to withstand the Iranian regime’s interception efforts (but not necessarily traffic analysis). If I were someone on the US government’s shitlist like Edward Snowden or Julian Assange, my calculus would be entirely different. (Yes, I know Snowden has endorsed Signal)

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#43

Post by ComodoHacker »

What interests me more, is Signal's principal stance about censorship. If non-tech people ever come to Signal in numbers, the moderation problem will inevitably arise. Would they censor things that we currently have public consensus about? Like CP, terrorism etc.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#44

Post by pm90 »

yorwba wrote: post #34
La1n wrote: post #27

Earlier quoted context omitted.

>It's overblown, I think. https://freedomhouse.org/country/iran/freedom-net/2019 >Several harsh prison sentences were handed down during the reporting period in retaliation for online activities. Mostafa Abdi, an editor of the news site Majzooban Noor, was sentenced to 26 years in prison and 74 lashes in August 2018. Five other journalists at the outlet received sentences ranging from 7 to 12 years (see C3).

Did they draw the government's attention because they were connecting to banned websites or because they were running a high-profile news outlet? It's seems unlikely to me that the Iranian government would be able to prosecute even a small fraction of instances of the former, whereas there's only a small number of high-profile news outlets at any given time.

Due process is not really a thing in Iran. If the Government wants you in prison, they will throw you in on flimsy pretexts. Which is why journalists need to be extra careful: they don’t just need to hide their activities but need to hide any trace or hints of participating in those activities. Outspoken people will be monitored closely, and even an attempt to access signal (say) could be used by the Government to imprison the user.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#45

Post by konjin »

La1n wrote: post #13
nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

What could have been the more productive way? If their issues are closed (and Signal does not seem interested in discussing this) and they feel like this is actively putting peoples lives in danger I feel they should call this out.

Start their own app that's better.

The fork option is there and always has been.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#46

Post by henearkr »

ComodoHacker wrote: post #43

What interests me more, is Signal's principal stance about censorship. If non-tech people ever come to Signal in numbers, the moderation problem will inevitably arise. Would they censor things that we currently have public consensus about? Like CP, terrorism etc.

I doubt that this will ever be an issue, because Signal is a messaging application, on which censoring/moderation is thus irrelevant. It's not a social network (contrary to e.g. Telegram which has tons of SNS features).

Let's hope it will remain just a messaging/videocall app.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#47

Post by postmodernbrute »

nexthash wrote: post #19
La1n wrote: post #13

Earlier quoted context omitted.

What could have been the more productive way? If their issues are closed (and Signal does not seem interested in discussing this) and they feel like this is actively putting peoples lives in danger I feel they should call this out.

This isn't putting anybody's life in danger - to my rough understanding the only thing detection of a proxy allows for is its takedown. I doubt the Iranian government has the resources or will to trawl their entire net for these proxies and trace their physical locations. What I meant by resolving the situation in a more productive way entails taking a step back and considering the situation outside this Twitter and…

People have been arrested for merely using an anti-censorship proxy in my side of the world. There is a real danger, even if you have never witnessed one.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#48

Post by Gatsky »

Signal seems to get a lot of unfair criticism. I think this is at least partly because they made something a lot of people actually do use. This would otherwise be quite a rarity in cryptography.

This ‘statement’ is quite weird. Is it normal to declare oneself an oppressed minority over a github issue?

I feel like we should be a bit more charitable to people who make things. Otherwise nobody will make anything anymore...

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#49

Post by smeej »

lionkor wrote: post #17
smeej wrote: post #15

Earlier quoted context omitted.

I work in account security, not for GH, but another platform. Account security with 2FA is a long way from foolproof. Accounts get compromised all the time, especially by phishing or malware. That's why my company's internal emails are all PGP encrypted and signed, even with managed accounts and YubiKey authentication. When it really, really matters, you need more than 2FA.

Yes, of course, I agree! Where I disagree is the notion that putting some PGP keys in a github issues comment is going to prevent anything :/ Edit: Like, if I had hacked one of their accounts, what's keeping me from commenting there and just copy-pasting the key they used before, or generating a new one? Are they going to check?

They easily could if they wanted to, which is the point.

If at any point in the future, someone wanted to say, "Well, so-and-so may not really have been the one who posted it," or, on the other hand, one of the signers later wanted to renege and say they didn't really sign it, it's going to be a lot harder for anyone to buy that the account credentials and PGP privkey were stolen and used than just that someone somehow spoofed a post from an account.

It's like the difference between posting a +1 retweet and having a signed document notarized. One of those is a lot harder to claim was faked/unauthorized later.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#50

Post by tylermenezes »

nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

> rather than resolving the issue productively

Unfortunately it's not possible to productively resolve issues with the Signal team, something you can find documented again and again.

(My own experience: I had to justify the the user impact of 30+sec freezes on every sent message, confirmed by multiple people. Bug was closed wontfix.)

This is a known thing with Moxie and the culture he's created at Signal and it's unfortunate that he's still starting drama with everyone instead of doing any self-reflection.

Post reply on HN