Signal Server code on GitHub is up to date again • Hacker News Board

Re: Signal Server code on GitHub is up to date again

#81

Post by Someone1234 » Wed, Apr 07, 2021, 4:55 PM UTC

madars wrote: post #8

Someone1234 wrote: post #4

Earlier quoted context omitted.

How would that work? You'd be layering trust on trust, wherein if they're willing to lie about one thing they're willing to lie about confirmation of that same thing (or not). Unless you're going to hire some independent auditor (that you still have to trust) it seems logically problematic.

SGX enclaves can attest to the code they are running, so you don't exactly need to take Signal's word on faith.

That isn't a solution to the problem being discussed (a provider's server code being verifiable by end users). I'm quite confused by the suggestion that it could be/is.

Re: Signal Server code on GitHub is up to date again

#82

Post by Vinnl » Wed, Apr 07, 2021, 4:57 PM UTC

BTCOG wrote: post #76

You can't even use MobileCoin in the US (Not that I'm a Signal user) but are they either planning on focusing on foreign markets, or planning on getting audited heavily by all the US financial agencies?

I think they're anticipating support for other coins, which might work in the US, judging by their blog post [0]:

> The first payments protocol we’ve added support for is a privacy focused payments network called MobileCoin, which has its own currency, MOB.

(Emphasis mine.)

[0] https://signal.org/blog/help-us-test-payments-in-signal/

Re: Signal Server code on GitHub is up to date again

#83

Post by random5634 » Wed, Apr 07, 2021, 4:58 PM UTC

The crapcoin thing is REDICULOUS!

THIS is what we setup nonprofits to support - some private entity and their crapcoin?

How is this legal?

How is this not a conflict of interest?

How is this not private inurment?

The crapcoin is totally opaque to. With premined coins.

Re: Signal Server code on GitHub is up to date again

#84

Post by theptip » Wed, Apr 07, 2021, 5:00 PM UTC

_dibly wrote: post #74

theptip wrote: post #61

Earlier quoted context omitted.

This leaves a very bad taste in my mouth. Unclear how much practical damage this caused (how many security analysts are using the Signal server source to look for vulns?) but this is damaging to the project's claims of transparency and trustworthiness. It’s quite clear that this crypto integration provides a perverse incentive for the project that points in the opposite direction of security.

Forgive me if this is a stupid question, but how exactly is that the case? It's been damaging to their claims of transparency for almost a year now, if anything this should be the first step in repairing that slight. How is dumping a year's worth of private work into your public repo somehow doing damage to their trustworthiness?

You're right that the damage to trustworthiness was always there. (I.e. they did the damage when they stopped publishing their source code, and they compounded that damage the longer they declined to publish their code). My point was more that the damage now seems to be directly attributable to the new payments integration.

Prior to seeing this post, I was already concerned that adding a crypto/payments integration would damage the Signal project, and this appears to be an immediate example of the kind of harms/perverse incentives I was concerned about.

(A counterargument to my theory here would perhaps be "Signal was always doing stuff like declining to publish their server code even prior to the payments integration", I'm not familiar enough with the history of the project to know the details there.)

Re: Signal Server code on GitHub is up to date again

#85

Post by vinay427 » Wed, Apr 07, 2021, 5:03 PM UTC

dewey wrote: post #69

nileshtrivedi wrote: post #62

Earlier quoted context omitted.

Here's a response by MobileCoin folks: > Signal had to verify that MobileCoin worked before exposing their users to the technology. That process took a long time because MobileCoin has lots of complicated moving parts. > With respect to price, no one truly understands the market. It’s impossible to predict future price. - https://twitter.com/mobilecoin/status/1379830618876338179 Reeks of utter BS. As the reply on thi…

> features can be developed while being kept switched off with a flag But maybe you don't want everyone to know about all the features / announcements months in advance?

They already did this development privately. I don't think anyone has a problem with building out a new feature before it's announced. The problem people have, IMO understandably, is that they pushed this code to production servers instead of testing it privately.

Re: Signal Server code on GitHub is up to date again

#86

Post by dtx1 » Wed, Apr 07, 2021, 5:03 PM UTC

subsubsub wrote: post #70

Given that you have said... "the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy." I don't feel the need to pull my punches. This is the most deluded, idiotic response I've seen on hacker news in a long time. It seems unlikely that the average person (or even a non-techie person of above average intelligence - e.g. a doctor) will be able to set up matrix…

the average person doesn't use signal they use phones, whatsapp and facebook. You can use the public matrix node and i can use my own node and we can talk. No setup needed. If they care they can buy a hosted matrix service package like this https://element.io/pricing with their own instance run by people who probably know what they are doing.

In before "but it's not free as in no cost". That's why big corps will always fuck over the normies. As it stands, one cannot use the internet without either giving away their privacy or learning a lot about computers and how they work and how to use them.

The majority chose the "i don't care, give me shiny app" route. and they fucked us all over by doing so. There's no right to easy privacy friendly computing. There's only the harsh reality that behind friendly blue and rainbow colored companies sit people that will sell a digital recreation of yourself to anyone who cares to pay and give you a few gigs of free e-mail space and a shiny app for it.

Re: Signal Server code on GitHub is up to date again

#87

Post by dtx1 » Wed, Apr 07, 2021, 5:05 PM UTC

dtx1 wrote: post #86

subsubsub wrote: post #70

Given that you have said... "the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy." I don't feel the need to pull my punches. This is the most deluded, idiotic response I've seen on hacker news in a long time. It seems unlikely that the average person (or even a non-techie person of above average intelligence - e.g. a doctor) will be able to set up matrix…

the average person doesn't use signal they use phones, whatsapp and facebook. You can use the public matrix node and i can use my own node and we can talk. No setup needed. If they care they can buy a hosted matrix service package like this https://element.io/pricing with their own instance run by people who probably know what they are doing. In before "but it's not free as in no cost". That's why big corps will alwa…

to prove a point here, use a browser without adblocking and other extensions like chrome for a week and look at how they are targeting you. That's what they do to anyone without the willingness to fight it with technical knowledge. And that sadly is the majority.

Re: Signal Server code on GitHub is up to date again

#88

Post by _dibly » Wed, Apr 07, 2021, 5:17 PM UTC

theptip wrote: post #84

_dibly wrote: post #74

Earlier quoted context omitted.

Forgive me if this is a stupid question, but how exactly is that the case? It's been damaging to their claims of transparency for almost a year now, if anything this should be the first step in repairing that slight. How is dumping a year's worth of private work into your public repo somehow doing damage to their trustworthiness?

You're right that the damage to trustworthiness was always there. (I.e. they did the damage when they stopped publishing their source code, and they compounded that damage the longer they declined to publish their code). My point was more that the damage now seems to be directly attributable to the new payments integration. Prior to seeing this post, I was already concerned that adding a crypto/payments integration w…

Reading the other article on HN definitely helped me understand more. I think really it comes down to me not understanding why they had so much trustworthiness to begin with.

They've been obscuring their code for about a year and even then, it's not like Signal has always come out and said "we love the passion our fellow developers have for our commitment to privacy and security". They just let people sell their relatives on that promise and waited until they had a massive userbase to start monetizing their platform.

Thanks for your reply, I just wonder where all this trustworthiness has been coming from for the last 12 months while they've been quietly working on the platform without publishing any changes. It feels like a beta tester for a game being mad that there were lootboxes in the full release of the game when they weren't in the beta. Even if you didn't know they were coming, you had to assume something like it was inevitable given enough traction.

Re: Signal Server code on GitHub is up to date again

#89

Post by omnimus » Wed, Apr 07, 2021, 5:20 PM UTC

dtx1 wrote: post #59

grumpyautist wrote: post #58

Earlier quoted context omitted.

Matrix is still broken though. I find XMPP to be sufficient at least until matrix fixes their group encryption

Got a source for matrix group encryption issues? EDIT: From their [FAQ]( https://matrix.org/faq/ ) > End-to-End Encryption is fully supported in Matrix. New rooms have encryption enabled by default, and all existing rooms can optionally have End-to-End Encryption turned on. What exactly do you think is broken here?

ux is seriously broken. i run my own instance and even i cant verify my encrypted sessions. Like i already have some three security codes that i have no idea when to use and verification of my own devices often randomly fails.

its just mess and i think it works properly maybe on main instance.

its nowhere near encryption on signal

Re: Signal Server code on GitHub is up to date again

#90

Post by cortesoft » Wed, Apr 07, 2021, 5:22 PM UTC

danpalmer wrote: post #9

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

I think the argument would be that with end-to-end encryption this is unnecessary, which is good because it's impossible. There's a counter-argument that there is still useful metadata a server can glean from its users, but it's certainly minimised with a good protocol... like the Signal protocol.

Wait, how would end-to-end encryption help this problem at all? I agree that it is impossible (currently), but not sure how E2E helps anything?

E2E encryption only helps you verify WHO you are connecting to, not what they are doing with your connection once it is established.