Live data from Hacker News

Standalone Signal Desktop

signal.org

111–120 of 320 posts

Re: Standalone Signal Desktop

#111
post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

Sure, but it doesn't pull HTML or Javascript from servers, it is all packaged along with the native Electron runtime. Exploiting a Javascript vulnerability is an absurd waste of time when you could just add a backdoor or whatever to the native code.

Re: Standalone Signal Desktop

#112
post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

what do you suggest they should they use instead

Re: Standalone Signal Desktop

#113
post #27

Earlier quoted context omitted.

wow, sorry. my bad. So I guess there is a way to use signal without having a phone nowadays! That's a great news! I will try right now.

You can get a google voice number and just activate through that. On iOS you have to type a confirmation code in manually, so there is no need for a debug version there.

If only Google voice existed outside the US.

Re: Standalone Signal Desktop

#114
post #111
post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

Sure, but it doesn't pull HTML or Javascript from servers, it is all packaged along with the native Electron runtime. Exploiting a Javascript vulnerability is an absurd waste of time when you could just add a backdoor or whatever to the native code.

It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.

Re: Standalone Signal Desktop

#115
post #5

Another 205MB Electron App to the collection, at least it's 50MB smaller than Wire.

Genuine question: Why do you care about a few hundred MB of disk space for an app?

I could understand if it was a GB or so, but in this day and age it's USD 9c or less worth of disk space (assuming you use high end SSDs, if it's a HDD then it's under 1c).

Re: Standalone Signal Desktop

#117
post #89

Earlier quoted context omitted.

eul is a light (4 MB) native desktop client for all popular messengers: https://eul.im Signal support is coming later this year. Right now it supports Slack, Skype, Facebook, and Gmail.

does it support relevant slack features...gifs, slackmojis, tags, etc?

Those core, must have features right?

"Oh no I can't use that business chat tool, it doesn't support smiley faces and cat reaction gifs".

Re: Standalone Signal Desktop

#118

Why no web app? Moxie closed https://github.com/WhisperSystems/Signal-Desktop/issues/723 without giving any reasoning. Can someone link me to a blog post that explains why Signal is refusing to release a web version? I cannot run another Electron app on my computer, I simply do not have the RAM left. Signal as a web-app would allow me to put it inside of Franz or Rambox, where all my other chat services live. Right n…

Reasoning!? That's for cryptonerds and free software retards who don't understand "modern growth engines" etc big boy business stuff.

Re: Standalone Signal Desktop

#119
The weird thing that isn't supported is Signal on 2 Android devices. I tried to install in on my tablet, but if I put in my phone number it blocks the app on my phone... bewildering..

Kinda the Wechat model

Re: Standalone Signal Desktop

#120
post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

what do you suggest they should they use instead

They could use NW.js instead, which stays up-to-date with the latest Chromium version, including security updates. They usually release on the same day as Chromium. https://nwjs.io/blog/
Post reply on HN