Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

351–360 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#351

Post by stathibus »

asdfasgasdgasdg wrote: post #318
stathibus wrote: post #315

Earlier quoted context omitted.

Yes, Signal is a messaging app whose whole reason for existing is privacy, but it does not actually guarantee any privacy features; it just tries its best. Despite this "who cares if it works" premise, they have raised tens of millions of dollars. I dream of a world where commercial software is held to the same standards as even the lowest quality commercial hardware.

Concretely, what would you like to see done? Should the foundation be hit with a fine or a lawsuit for this bug? Would that improve the overall security stance of the public at large?

I would like to see the foundation put their enormous investment into making a product that works correctly.

If that's too much to ask, then they really ought to be more public and forthcoming about the fact that Signal is not actually private or secure.

Re: Signal on Android: Images sent to wrong contacts

#352

Post by johnisgood »

gsich wrote: post #266
johnisgood wrote: post #253

Earlier quoted context omitted.

The rarity of a bug is independent from reports of it.

No, those are directly correlated.

I would like to think so. I used a program that is full of bugs, yet those are not reported[1], nor have they been fixed. :(

Edit:

[1] I did report one (or two?, it has been some time ago) after some time (could have been months, because I could do without it as a compromise for that time being). They did not respond nor did they fix it (so I did not report any other bugs I have found). I recently re-installed it to give it another go, and the easy-to-fix bug still occurs. They just do not give a damn. Their website has been rebranded and everything, but this bug has not been fixed for over a year.

Edit #2:

Wow, I was way off with the "over a year". I checked the bug report of the one I remember reporting. It does seem like some other people have reported it too. Well, it is a bug from 2018, after all. Still open, no word from a developer. :D It is a bug of a crucial feature.

In any case, if for some reason I had to use this software again, I would never report any bugs because it is pretty much futile. They do not answer, they do not categorize bugs, they do not seem to check the bug reports at all. It would be a waste of time.

Re: Signal on Android: Images sent to wrong contacts

#353

Post by M2Ys4U »

renewiltord wrote: post #166
ikiris wrote: post #92

Earlier quoted context omitted.

ordinary people don't give a flying f** about being able to send someone crypto currency via their messaging app.

But everyone wants to send money or money-equivalents. I use Venmo almost every other day.

But why roll that in to a chat app? Why not use your bank's app (or if you live in a country with a 19th century banking system like the USA, something like Venmo)?

Re: Signal on Android: Images sent to wrong contacts

#355

Post by gsich »

johnisgood wrote: post #352
gsich wrote: post #266

Earlier quoted context omitted.

No, those are directly correlated.

I would like to think so. I used a program that is full of bugs, yet those are not reported[1], nor have they been fixed. :( Edit: [1] I did report one (or two?, it has been some time ago) after some time (could have been months, because I could do without it as a compromise for that time being). They did not respond nor did they fix it (so I did not report any other bugs I have found). I recently re-installed it to…

Then why not report them?

Re: Signal on Android: Images sent to wrong contacts

#357

Post by [deleted] »

gsich wrote: post #355
johnisgood wrote: post #352

Earlier quoted context omitted.

I would like to think so. I used a program that is full of bugs, yet those are not reported[1], nor have they been fixed. :( Edit: [1] I did report one (or two?, it has been some time ago) after some time (could have been months, because I could do without it as a compromise for that time being). They did not respond nor did they fix it (so I did not report any other bugs I have found). I recently re-installed it to…

Then why not report them?

[deleted]

Re: Signal on Android: Images sent to wrong contacts

#358

Post by zimpenfish »

gsich wrote: post #355
johnisgood wrote: post #352

Earlier quoted context omitted.

I would like to think so. I used a program that is full of bugs, yet those are not reported[1], nor have they been fixed. :( Edit: [1] I did report one (or two?, it has been some time ago) after some time (could have been months, because I could do without it as a compromise for that time being). They did not respond nor did they fix it (so I did not report any other bugs I have found). I recently re-installed it to…

Then why not report them?

Because the bug happens when you're trying to get something done and you don't have 5 spare minutes to interrupt your flow in order to file a bug. You might make a mental note to report it later and then forget. Or, if the bug is annoying enough, you might just never use that program again and you don't care if it gets fixed. Or your wifi glitched at the same time the bug happened and you've no idea if it is a bug or the glitchy wifi. Or you don't know it's a bug until later and by that time you've no idea what you were doing to trigger it.

There's a million and one valid reasons people don't report bugs.

Re: Signal on Android: Images sent to wrong contacts

#359

Post by NateEag »

lwhi wrote: post #43
retrac wrote: post #38

Earlier quoted context omitted.

And Microsoft could in principle choose to do a hard break with all backwards compatibility in the next version of Windows. But they won't. Eventually, the third-party base may be so large and varied, that it becomes quite painful to actually make such a change even if the letter of the law says you can.

In which world does Microsoft conform to open standards or protocols? Your point simply doesn't make sense.

Microsoft's Windows APIs are, in some sense, an "open platform".

They don't accept third party contributions, but they are thoroughly documented and their whole purpose is to support third party developers.

Because that's their goal, they won't ever break that backwards compatibility.

That, I think, is what the GP was getting at - the Signal team does not want to wind up being constrained in the ways that MS is by supporting third-party developers.

Making their protocol an open standard would have that effect, because they could no longer unilaterally change the protocol as they see fit. They would be constrained by the need to support and think about all the other stakeholders who rely on the standard.

If you control the client, the server, and the internal-only standard, in really bad situations, you can just push out an update that fixes the apocalypse in a backwards-incompatible way and drop support for all previous clients.

This is not hypothetical - see the KRACK attack from 2017 for an example where an open standard was found to have a security flaw (https://www.krackattacks.com/).

We all got very lucky that the flaw could be mitigated in a backwards-compatible way.

Re: Signal on Android: Images sent to wrong contacts

#360

Post by NateEag »

mdoms wrote: post #58
johnchristopher wrote: post #7

While I suppose the protocol is not at fault and it's a UI and client bug it's still a huge problem. Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. Why even keep the old button in the old place ? And it led me to thinking "what else co…

This is the same app that only 6 months ago had an outage lasting more than a full day[0] - an outage that to my knowledge remains unexplained. The protocol is one thing but these clowns are obviously not careful or reliable engineers. [0] https://www.theverge.com/2021/1/17/22235707/signal-back-app-...

Have you ever experienced millions of new users starting on your service in the space of a few days?

Predicting the future is hard.

Calling a team "clowns" because they didn't make the right guesses when they did capacity planning and had a day with downtime as a result of meteoric growth seems unfair to me.

Post reply on HN