Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Server code on GitHub is up to date again

github.com

Post reply on HN
Print view View original

91–100 of 206 posts

Re: Signal Server code on GitHub is up to date again

#91

Post by Slartie »

hvis wrote: post #42
mnd999 wrote: post #38

Earlier quoted context omitted.

I think you’re part correct. I suspect they didn’t want to go public with the shitcoin until it was done.

That makes a lot of sense, though. It was probably apparent to them that adding the new crypto payments feature would create at least some kind of community pushback. Waiting until the feature is reasonably complete and can be judged on its merits is good from a business perspective.

It's also good from a very personal business perspective to have the crucial inside information of an obscure coin named "MobileCoin" (sitting on CoinMarketCap Rank #2378) about to be pumped HARD once the news about inclusion into a popular messaging app hits the airwaves.

It's especially good to have this information while said coin is already publicly traded on some (albeit obscure) exchanges. Because that allows you, as an insider, to slowly accumulate a nicely sized position in that coin while it's still cheap. "MobileCoin" wasn't publicly traded until December of last year, there wasn't even a live blockchain until that month, so if it's true that the first commits in the Signal server repo hinting at the crypto payment plans were created shortly after the repo went silent in April 2020, it is obvious that keeping these commits secret until at least December 2020 was crucial to successfully realize these good personal business perspectives - a.k.a. insider trading, but nobody cares about it if it's crypto.

Re: Signal Server code on GitHub is up to date again

#92

Post by dtx1 »

lxgr wrote: post #67
dtx1 wrote: post #53

After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…

> To me this drives home one key issue: the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. Something tells me you've never given tech support to non-technical family members. (And that's being generous – because outright considering everyone non-technical "stupid" would be a pretty sad worldview.)

> or unwilling to invest even the tiniest amount of effort into their privacy.

Re: Signal Server code on GitHub is up to date again

#93

Post by dtx1 »

Vinnl wrote: post #73
jedberg wrote: post #63

Earlier quoted context omitted.

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. Those of us who have worked in security have known this for years. There are countless examples of massive security gains through minor inconvenience, and users rejecting them. Two factor auth is a big one. Yeah, it's a slight hassle. It gives major security improvements. Even security people don't li…

And of course, that's exactly why people were recommending Signal. Of all the practically frictionless apps it provided best encryption.

privacy isn't just encryption. Forcing users to link their phone number as an identifier like signal does is just one of the myriad of questionable choices signal has made. And with their coin based payment they just painted a large bullseye on them.

Re: Signal Server code on GitHub is up to date again

#94

Post by dtx1 »

jedberg wrote: post #63
dtx1 wrote: post #53

After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. Those of us who have worked in security have known this for years. There are countless examples of massive security gains through minor inconvenience, and users rejecting them. Two factor auth is a big one. Yeah, it's a slight hassle. It gives major security improvements. Even security people don't li…

> I saw this at eBay and PayPal a few times, where the user rejected a free security token despite having been scammed multiple times.

People here downvote me for this but this is the issue. Those people cannot be helped and they don't want help. They chose this and have to live with the consequences. There's no right to easy computing.

Re: Signal Server code on GitHub is up to date again

#95

Post by lxgr »

monocasa wrote: post #7
red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

That's basically the same problem as DRM, so no, you can't verify that someone is running only code you want them to run against data you gave them, on hardware they own.

Yet DRM does exist. (Yes, these schemes usually end up getting broken at some point, but so does other software.)

The problem is more generally called trusted computing, with Intel SGX being an implementation (albeit one with a pretty bad track record).

Re: Signal Server code on GitHub is up to date again

#96

Post by woah »

A lot of these comments are just manifestations of the kneejerk HN "crypto bad" reflex. Here's the deal:

- Whether or not Signal's server is open source has nothing to do with security. Signal's security rests on the user's knowledge that the open source client is encrypting messages end to end. With that knowledge, the server code could be anything, and Signal inc. would still not be able to read your messages. In fact, having the server code open source adds absolutely nothing to this security model, because no matter how open source and secure the server code might be, Signal inc. could still be logging messages upstream of it. The security rests only upon the open source client code. The server is completely orthogonal to security.

- Signal's decision to keep early development of the MobileCoin feature set private was valid. Signal is not your weekend node.js module with two stars on Github. When changes get made to the repo, they will be noticed. This might mess up their marketing plan, especially if they weren't even sure whether they were going to end up going live with the feature. Signal is playing in the big leagues, competing with messengers which have billions of dollars in marketing budget, will never ever be even the smallest amount open source, and are selling all your messages to the highest bidder. They can't afford to handicap themselves just to keep some guys on Hacker News happy.

- Signal's decision to keep development to the (private) master branch, instead of splitting the MobileCoin integration into a long-running feature branch is a valid choice. It's a lot of work to keep a feature branch up to date over years, and to split every feature up into the public and non-public components which then get committed to separate branches. This would greatly affect their architecture and slow down shipping for no benefit, given that the open sourceness of the server is orthogonal to security.

Re: Signal Server code on GitHub is up to date again

#97

Post by jedberg »

dtx1 wrote: post #94
jedberg wrote: post #63

Earlier quoted context omitted.

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. Those of us who have worked in security have known this for years. There are countless examples of massive security gains through minor inconvenience, and users rejecting them. Two factor auth is a big one. Yeah, it's a slight hassle. It gives major security improvements. Even security people don't li…

> I saw this at eBay and PayPal a few times, where the user rejected a free security token despite having been scammed multiple times. People here downvote me for this but this is the issue. Those people cannot be helped and they don't want help. They chose this and have to live with the consequences. There's no right to easy computing.

I think you got downvotes for the way you presented your argument, not the content...

Re: Signal Server code on GitHub is up to date again

#98

Post by coolspot »

yjftsjthsd-h wrote: post #46
yunohn wrote: post #40

Earlier quoted context omitted.

Oh wow. That’s incredibly suspicious...

It could just be an arguably-legitimate desire to keep the hot new feature secret until the big announcement; this particular bit is... sub-optimal... but it doesn't seem like it needs to be nefarious.

Next time they will freeze code to keep NSA integration secret.

Re: Signal Server code on GitHub is up to date again

#99

Post by jedberg »

dtx1 wrote: post #80
driverdan wrote: post #72

Earlier quoted context omitted.

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy This is an awful attitude. Not everyone understands computers at a technical level. Not everyone has the knowledge to install and troubleshoot Matrix. Most users are non-technical, full stop. You can't expect them to use something that requires technical knowledge.

Then the reality is that those users cannot expect privacy anymore

This part I disagree with. They can (and should) lobby for laws that protect their privacy. Users don't want to give up convenience, but if the majority are using the services of BigCorp, and we push to force BigCorp to provide privacy through legislation, then society still wins.

Re: Signal Server code on GitHub is up to date again

#100

Post by dtx1 »

jedberg wrote: post #97
dtx1 wrote: post #94

Earlier quoted context omitted.

> I saw this at eBay and PayPal a few times, where the user rejected a free security token despite having been scammed multiple times. People here downvote me for this but this is the issue. Those people cannot be helped and they don't want help. They chose this and have to live with the consequences. There's no right to easy computing.

I think you got downvotes for the way you presented your argument, not the content...

Yeah, i'm tired and hangry. you're right. I'm just happy SOMEONE understood my argument and saw the same issues i did
Post reply on HN