Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

331–340 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#331

Post by remirk »

ViViDboarder wrote: post #259
kitsunesoba wrote: post #20

Earlier quoted context omitted.

This underscores why it’s important to allow third party clients to connect. When only the first-party client is allowed, the failings of its UI drag down the core, too — it doesn’t matter how good the core is if it’s permanently mated to a half-baked UI.

With this party clients, you don’t avoid this. The failings of a third party client will still reflect on the whole of the core product as well. Articles would still talk about a bug like this breathing a Signal issue, even if limited to a third party app. Additionally, I find it quite a stretch to call the app “half-baked”. I think it’s pretty great.

I don't see this happening. As long as the app that's buggy doesn't have more than 33% market share I doubt the media would write it down as the system as a whole having the bug. Thought I am disappointed by lazy tech articles by otherwise good media regularly.

Re: Signal on Android: Images sent to wrong contacts

#333

Post by fulafel »

hackinthebochs wrote: post #272
tomudding wrote: post #124

Earlier quoted context omitted.

> Can you provide a link to the commit that fixes it? If I understand the issue [0] correctly, these two commits should be the fix: https://github.com/signalapp/Signal-Android/commit/e90fa05d6... https://github.com/signalapp/Signal-Android/commit/b9657208f... The former updates how recipients (or really threads, I suppose) are merged (the issue occurred when trimming threads) and the latter changes the way how thread…

Using incrementing ids as your source of ownership is just asking for trouble. This just means a programming error can have a high probability of ids lining up and leaking resources. Guids make this practically impossible.

I wonder if there's any widely implemented programming pattern that would catch this better, eg consisting of concatenated type code and id. Using GUIDs here would still hide the bug, not flag an error.

Re: Signal on Android: Images sent to wrong contacts

#334

Post by lwhi »

asdfasgasdgasdg wrote: post #204
lwhi wrote: post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with…

If you are unclear, perhaps it would be useful to ask yourself what you would personally need from a product to consider it 'secure'.

Re: Signal on Android: Images sent to wrong contacts

#336

Post by lwhi »

tablespoon wrote: post #301
chithanh wrote: post #294

Earlier quoted context omitted.

Signal typically delay releasing the server source code, so the latest version of the server is not open source. In one case it took them almost a year (no public commits between 20 April 2020 and 6 April 2021). https://github.com/signalapp/Signal-Android/issues/11101#iss... Among the official reasons given was staying ahead of spammers. In this instance it was also speculated that the payment function which they wer…

One of the biggest problems with open source software is enormously entitled users; who don't pay for it, don't work on it, yet feel remarkably offended when some whim of theirs is not catered to. Just saying.

No, you are utterly incorrect.

If you produce a product that people depend on — and through which, you either intentionally or inadvertently cause damage to your user base — they have every reason to be upset.

If the product is open source, the user base luckily has the option to fix the problem.

This isn't true with Signal's model.

Re: Signal on Android: Images sent to wrong contacts

#338

Post by tablespoon »

remirk wrote: post #329
tablespoon wrote: post #325

Earlier quoted context omitted.

> If you call it a "whim" if I point out that the latest version of the Signal server is proprietary software most of the time then so be it. For whimsical definitions of "proprietary." > Or maybe you are referring to the other commenters who were entitled to expect... Anyone who feels entitled to bug free software is going to be disappointed, and rightly so. > You can both be grateful that Signal is free and at the…

What a buzz kill. If I understand you correctly we shouldn't have expectations or constructive criticism on stuff we don't directly pay money for. I think that's nonsense. Does this only apply to certain opinions? You are not paying money for Signal. But by using it, and getting others to use it, you are definitely improving their position on the market by helping them become a monopoly. Money isn't everything.

> What a buzz kill. If I understand you correctly we shouldn't have expectations or constructive criticism on stuff we don't directly pay money for. I think that's nonsense. Does this only apply to certain opinions?

You can have constructive criticisms, but they have to actually be reasonable and constructive. It's not reasonable or constructive to expect their software to never have bugs (i.e. be outraged when they have one); to rag on them because they didn't fix some bug more quickly than they may have been able to; to throw around labels like "proprietary" just because they don't release something on your schedule; to be bitter that their vision is not your vision (e.g. they won't implement some client or server feature you want), etc. All of that is in this thread.

Signal, for whatever reason, seems to attract a lot of entitled complaints like the ones I enumerated. I don't know exactly why, but it probably involves some combination of contrarianism, being in popular software category, and people who want to feel better for having picked a different team.

Signal isn't perfect software for me: I really wish they had an unencrypted message export feature, for instance. But I understand that doesn't fit into their vision, and instead of bitching about it, I just have it on my todo list to write my own (and have done some preliminary work on it).

> You are not paying money for Signal. But by using it, and getting others to use it, you are definitely improving their position on the market by helping them become a monopoly. Money isn't everything.

What now? Signal is nowhere near being monopoly, and even if they were, they're a non-profit, which makes the idea far less threatening.

Re: Signal on Android: Images sent to wrong contacts

#339

Post by RedComet »

aadjklskljads wrote: post #129
godelski wrote: post #61

Earlier quoted context omitted.

I don't think Signal has many devs[0] and if you look at the contributors[1] you can see that Grayson is pretty much the only dev for the Android app. So seeing a second dev get involved is probably them freaking out. [0] Personally I believe this is a big bump in the road for Signal and is why a lot of people are frustrated. About promises about things like usernames (it is no longer early 2021), channels, and every…

No, Signal does not get to play the limited resources card when they so firmly discourage 3rd parties from working on their project.

Nor when they've received millions in grant money.

Re: Signal on Android: Images sent to wrong contacts

#340

Post by [deleted] »

hn8788 wrote: post #56
mdoms wrote: post #47

Earlier quoted context omitted.

Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.

Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.

[deleted]
Post reply on HN