Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Statement on Recent Events Between Signal and the Anti-Censorship Community

github.com

Post reply on HN
Print view View original

171–180 of 290 posts

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#171

Post by ashtonkem »

h_anna_h wrote: post #168
ashtonkem wrote: post #160

Earlier quoted context omitted.

People respond poorly to abuse. This is basic human nature, trying to fight against this is a fool’s errand.

I agree, it is a chain of poor responses to abuse, these people probably considered the original response that they got (along with having their pull request deleted) as an abuse which is why they responded in that way.

I don't really have any particular opinion on Moxie or Signal; I've never interacted with either the product, the community, or the person. But I will say in the abstract that many founders drastically underestimate how much extra headache poor community management will cause them in the long run.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#172

Post by shame_of_cndev »

h_anna_h wrote: post #169
shame_of_cndev wrote: post #157

A group of security researchers who: * Publish the exploit before vendor know it * Publish the exploit before vendor delivered the patch * Send their own opinion to every media possible (including ycombinator) without mentioning the full event, and using new account to looks more neutral * Disrespect other people * And also have their own "secure" software (v2fly, v2ray, ...) Okay, looks like we need to have a new de…

> * Publish the exploit before vendor know it > * Publish the exploit before vendor delivered the patch It's called full disclosure and it is the only ethical way to handle it.

"Full disclosure is the only ethical way to handle it".

haha

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#174

Post by j-james »

alexpetralia wrote: post #64
Gatsky wrote: post #48

Signal seems to get a lot of unfair criticism. I think this is at least partly because they made something a lot of people actually do use. This would otherwise be quite a rarity in cryptography. This ‘statement’ is quite weird. Is it normal to declare oneself an oppressed minority over a github issue? I feel like we should be a bit more charitable to people who make things. Otherwise nobody will make anything anymor…

I agree. If you don't like it, create a fork? It is open source.

Signal discourages third-party clients.

https://community.signalusers.org/t/how-to-get-signal-apks-o...

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#175

Post by avereveard »

gclawes wrote: post #71
UncleMeat wrote: post #53

Earlier quoted context omitted.

Tone can often be more important than facts. At one point in my career I had a somewhat public facing role. I made a tough decision that aggravated a user, who decided to send me several death threats. Suddenly that tough decision wasn’t so tough anymore. Any possible resolution was gone. These situations involve people. We aren’t fact machines.

> Tone can often be more important than facts. Exactly: https://www.edge.org/response-detail/27181

brilliantly explored in 'yes prime minister': https://www.youtube.com/watch?v=G0ZZJXw4MTA

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#176

Post by stale2002 »

ralfn wrote: post #21
nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

It's more important how we all feel about each other and our drama than the fact there isn't a currently easily available obvious way to have private secure conversations. Your "they are not being constructive enough" is actually very unconstructive, because it drags the conversation into more drama. The tone is not more important than the facts. It never is. Im not suggesting you have some alternative motive to defl…

> The tone is not more important than the facts

Of course it can be. If your tone is so bad, that nobody listens to you or implements things that you want, then it doesn't matter how right you are on anything.

Getting stuff done and solving problems relies on way more things than just being right.

> Im not suggesting you have some alternative motive to deflect the facts.

Ok but by making these comments you are also deflecting from real problems that having a bad tone causes.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#177

Post by FDSGSG »

h_anna_h wrote: post #163
FDSGSG wrote: post #146

Earlier quoted context omitted.

You don't see why making such a pull request would be inappropriate? Do you understand what pull requests are for? Does this look like an attempt at productive contribution to you? https://github.com/signalapp/Signal-TLS-Proxy/pull/15 Is this a good patch? It just drops a random file into the repo. https://github.com/signalapp/Signal-TLS-Proxy/commit/40f4d9d... These people decided to abuse the pull request system af…

This has nothing to do with my post.

Of course it does, unless you were replying to the wrong comment in the first place.

What was it you did not see any evidence of?

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#178

Post by detaro »

ryanlol wrote: post #167
detaro wrote: post #159

Earlier quoted context omitted.

It can be acted on: you can realize that you probably shouldn't talk about everything using Signal despite the person urging you to install it swearing that it's secure. (which was the exact event that was given as a reason to add this: some journalist telling Chinese students(?) to use Signal to talk to them freely)

Should Signal then come with a blanket warning “Do not trust Signal!”?

A brief explanation of the threat model (i.e. what it aims to protect against and what it doesn't) would probably be more useful. "Do not trust people that tell you Signal is perfectly secure" is true but probably doesn't lead to the right user behavior. I'm not claiming communicating these things well is easy.

(and obviously a bunch of the blame lies with people that do uncritically push Signal, if you are journalist not misleading your "sources" is important, but again they need to be educated too and it's not surprising that's not happening perfectly - efforts in that would also have been a reasonable response IMHO. And of course this is based on the assumption that the events have been presented somewhat accurately)

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#179

Post by jstanley »

ralfn wrote: post #21
nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

It's more important how we all feel about each other and our drama than the fact there isn't a currently easily available obvious way to have private secure conversations. Your "they are not being constructive enough" is actually very unconstructive, because it drags the conversation into more drama. The tone is not more important than the facts. It never is. Im not suggesting you have some alternative motive to defl…

> there isn't a currently easily available obvious way to have private secure conversations.

Ricochet[1] works really well. It uses Tor hidden services to communicate. Your Ricochet ID is your onion address. To add a contact, you input their Ricochet ID and a short message, and Ricochet connects to their onion address and sends a contact request. If the contact request is accepted then you'll each show up as a contact on each other's client and can chat whenever you want.

Tor is really perfect for this, you can't get more private or censorship-resistant than Tor.

The UI is currently not great, but that's not a protocol problem.

The biggest problem with Ricochet is that hardly anyone is using it.

Private secure conversations: yes.

Easily available: yes.

Obvious: sadly not, for most people :(.

[1] https://ricochet.im/

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#180

Post by ryanlol »

superkuh wrote: post #138
KingOfCoders wrote: post #68

"Who we are [...] V2Fly maintains V2Ray, a proxy and routing tool that helps people behind China's GFW and Iran's Internet firewall stay connected to the internet."

Yes, that's some of them. I was more impressed that some of the shadowsocks team signed the statement. That's great software I use every day. And it's software other people use in life threatening circumstances.

> some of the shadowsocks team signed the statement

And hilariously enough also demonstrated that they don’t know how to use PGP.

Post reply on HN