Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Server code on GitHub is up to date again

github.com

Post reply on HN
Print view View original

41–50 of 206 posts

Re: Signal Server code on GitHub is up to date again

#41

Post by jiveturkey »

ajconway wrote: post #33
jiveturkey wrote: post #25

Earlier quoted context omitted.

I think it's proof that security (and privacy) doesn't matter. So it is very relevant. (As if telegram as competitor isn't enough proof.) The entirety of the signal "stack" depends on the SGX enclave. The fact that no one, in all time, has bothered to notice that the running code is different than the published code, is telling. There's actually a newer SGX exploit, and related mitigation, that came to light at about…

> The fact that no one, in all time, has bothered to notice that the running code is different than the published code It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. > The entirety of the signal "stack" depends on the SGX enclave Only private contact discovery depends on trusting SGX.

> It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source.

If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained about. Without independent audit, there is no verification and we have established that independent parties do not care.

> Only private contact discovery depends on trusting SGX.

uh, no. this is demonstrably and obviously wrong.

Re: Signal Server code on GitHub is up to date again

#42

Post by hvis »

mnd999 wrote: post #38
hu3 wrote: post #35

Earlier quoted context omitted.

It's obviously related. The implication is that they pushed code to Github just to gain public trust that can be leveraged to market their cryptocurrency.

I think you’re part correct. I suspect they didn’t want to go public with the shitcoin until it was done.

That makes a lot of sense, though.

It was probably apparent to them that adding the new crypto payments feature would create at least some kind of community pushback.

Waiting until the feature is reasonably complete and can be judged on its merits is good from a business perspective.

Re: Signal Server code on GitHub is up to date again

#43

Post by yjftsjthsd-h »

tlarkworthy wrote: post #34
mulmen wrote: post #29

Earlier quoted context omitted.

How do you prove the endpoint is running the code to which it links?

Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code. It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells The clever bits that ac…

> Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate.

If I was evil, I wouldn't have a totally separate source tree and binary that I shipped; I'd have my CI process inject a patch file. As a result, everything would work as expected - including getting any changes from the public source code - but the created binaries would be backdoored.

Re: Signal Server code on GitHub is up to date again

#44

Post by ddevault »

nimbius wrote: post #31
newscracker wrote: post #23

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?

better question yet: Did we ever get a full post-mortem of the six day outage the service had? other than hand waving statements about user subscriptions? what fixes were made or lessons learned?

The Signal outage was SIX DAYS?

Re: Signal Server code on GitHub is up to date again

#45

Post by hvis »

olah_1 wrote: post #27
lvs wrote: post #13

I read some speculation that the delay was to keep this objectionable crypto payment development under wraps until they were ready to launch.

The devious aspect to this is that nobody knew the development was happening so we couldn’t invest even if we wanted to. It was kept under wraps for a grade A pump.

OTOH, announcing this development semi-privately on GitHub but not to the public at large (including the current MobileCoin owners) could be considered as "insider trading", and it's a criminal offense in US.

Re: Signal Server code on GitHub is up to date again

#46

Post by yjftsjthsd-h »

yunohn wrote: post #40
prophesi wrote: post #17

Earlier quoted context omitted.

Yep. I posted this on a different Signal HN submission, but the very next commit on April 22nd, 2020 was when they first began working on the integration. https://github.com/signalapp/Signal-Server/commit/95f0ce1816...

Oh wow. That’s incredibly suspicious...

It could just be an arguably-legitimate desire to keep the hot new feature secret until the big announcement; this particular bit is... sub-optimal... but it doesn't seem like it needs to be nefarious.

Re: Signal Server code on GitHub is up to date again

#47

Post by feanaro »

jiveturkey wrote: post #41
ajconway wrote: post #33

Earlier quoted context omitted.

> The fact that no one, in all time, has bothered to notice that the running code is different than the published code It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. > The entirety of the signal "stack" depends on the SGX enclave Only private contact discovery depends on trusting SGX.

> It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained abo…

> uh, no. this is demonstrably and obviously wrong.

Yes? How?

Re: Signal Server code on GitHub is up to date again

#48

Post by amyjess »

newscracker wrote: post #23

So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?

My guess is that the whole public repo thing was just one employee's idea, nobody else at the company cared, and that employee either forgot about it or was too busy to do it for months.

Re: Signal Server code on GitHub is up to date again

#49

Post by olah_1 »

hvis wrote: post #45
olah_1 wrote: post #27

Earlier quoted context omitted.

The devious aspect to this is that nobody knew the development was happening so we couldn’t invest even if we wanted to. It was kept under wraps for a grade A pump.

OTOH, announcing this development semi-privately on GitHub but not to the public at large (including the current MobileCoin owners) could be considered as "insider trading", and it's a criminal offense in US.

Which is probably why they’re avoiding the SEC at all costs.

Re: Signal Server code on GitHub is up to date again

#50

Post by saurik »

ddevault wrote: post #44
nimbius wrote: post #31

Earlier quoted context omitted.

better question yet: Did we ever get a full post-mortem of the six day outage the service had? other than hand waving statements about user subscriptions? what fixes were made or lessons learned?

The Signal outage was SIX DAYS?

(All the news I'm finding is that it was just one day.)
Post reply on HN