Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Server code on GitHub is up to date again

github.com

Post reply on HN
Print view View original

31–40 of 206 posts

Re: Signal Server code on GitHub is up to date again

#31

Post by nimbius »

newscracker wrote: post #23

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?

better question yet: Did we ever get a full post-mortem of the six day outage the service had? other than hand waving statements about user subscriptions? what fixes were made or lessons learned?

Re: Signal Server code on GitHub is up to date again

#32

Post by dbrgn »

lvs wrote: post #13

I read some speculation that the delay was to keep this objectionable crypto payment development under wraps until they were ready to launch.

This might be a legitimate reason to keep the source code non-public temporarily. However, the communication strategy by Signal about this was horrible (or rather non-existent).

People in the user forum (https://community.signalusers.org/t/where-is-new-signal-serv...) and in other places on the internet were upset for months, because the server wasn't being updated anymore. At the same time, Signal regularly tweetet that "all they do is 100% open source", even at a point in time where no source code was released for almost a year.

Just 2 days ago this was getting picked up by some larger tech news platforms:

https://www.golem.de/news/crypto-messenger-signal-server-nic...

https://www.androidpolice.com/2021/04/06/it-looks-like-signa...

It's normal that Signal ignores its users, but apparently they didn't even reply to press inquiries about the source code. All it would have taken is a clear statement like "we're working on a cool new feature and will release the sources once that's ready, please bear with us". Instead, they left people speculating for months.

This communication strategy, combined with the cryptocurrency announcement, may cause serious harm to Signal's reputation.

Re: Signal Server code on GitHub is up to date again

#33

Post by ajconway »

jiveturkey wrote: post #25
newscracker wrote: post #23

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?

I think it's proof that security (and privacy) doesn't matter. So it is very relevant. (As if telegram as competitor isn't enough proof.) The entirety of the signal "stack" depends on the SGX enclave. The fact that no one, in all time, has bothered to notice that the running code is different than the published code, is telling. There's actually a newer SGX exploit, and related mitigation, that came to light at about…

> The fact that no one, in all time, has bothered to notice that the running code is different than the published code

It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source.

> The entirety of the signal "stack" depends on the SGX enclave

Only private contact discovery depends on trusting SGX.

Re: Signal Server code on GitHub is up to date again

#34

Post by tlarkworthy »

mulmen wrote: post #29
tlarkworthy wrote: post #28

If you have a PhD you might be able to verify from the client-side it does not matter. If you are into blockchain there might be another (but very expensive) way to show a system can be trusted. For normal development, I am advocating an always auditable runtime that runs only public source code by design:- https://observablehq.com/@endpointservices/serverless-cells Before sending data to a URL, you can look up the s…

How do you prove the endpoint is running the code to which it links?

Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate.

Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code.

It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells

The clever bits that actually implement services are all in the notebooks.

Re: Signal Server code on GitHub is up to date again

#35

Post by hu3 »

mtmail wrote: post #30
pmlnr wrote: post #20

"Signal Server code on GitHub is up to date again - now with a freshly added shitcoin!"

The addition of micropayments to Signal is discussed separately at https://news.ycombinator.com/item?id=26724237

It's obviously related. The implication is that they pushed code to Github just to gain public trust that can be leveraged to market their cryptocurrency.

Re: Signal Server code on GitHub is up to date again

#36

Post by mulmen »

tlarkworthy wrote: post #34
mulmen wrote: post #29

Earlier quoted context omitted.

How do you prove the endpoint is running the code to which it links?

Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code. It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells The clever bits that ac…

That doesn't seem to provide any meaningful indication the endpoint runs the code it claims. Can't I just create an evil endpoint that links to legit code?

Re: Signal Server code on GitHub is up to date again

#37

Post by tlarkworthy »

mulmen wrote: post #36
tlarkworthy wrote: post #34

Earlier quoted context omitted.

Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code. It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells The clever bits that ac…

That doesn't seem to provide any meaningful indication the endpoint runs the code it claims. Can't I just create an evil endpoint that links to legit code?

No the endpoint is shared across all customers, the service providers do not self host, generally. The end point is the infra provider. Later I might try to code sign that and open up the cloud console for visibility, but not short term

Re: Signal Server code on GitHub is up to date again

#38

Post by mnd999 »

hu3 wrote: post #35
mtmail wrote: post #30

Earlier quoted context omitted.

The addition of micropayments to Signal is discussed separately at https://news.ycombinator.com/item?id=26724237

It's obviously related. The implication is that they pushed code to Github just to gain public trust that can be leveraged to market their cryptocurrency.

I think you’re part correct. I suspect they didn’t want to go public with the shitcoin until it was done.

Re: Signal Server code on GitHub is up to date again

#40

Post by yunohn »

prophesi wrote: post #17
lvs wrote: post #13

I read some speculation that the delay was to keep this objectionable crypto payment development under wraps until they were ready to launch.

Yep. I posted this on a different Signal HN submission, but the very next commit on April 22nd, 2020 was when they first began working on the integration. https://github.com/signalapp/Signal-Server/commit/95f0ce1816...

Oh wow. That’s incredibly suspicious...
Post reply on HN