Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Tell Us a Secret

nytimes.com

Post reply on HN
Print view View original

111–120 of 120 posts

Re: How to Tell Us a Secret

#111

Post by balladeer »

CiPHPerCoder wrote: post #51
ac4tw wrote: post #43

Earlier quoted context omitted.

myth_buster, lisper, & newscracker make interesting points. In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." ( https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-…

You can reverse engineer any Android app in very little time. Professionals use frameworks like Lobotomy, but you can get by with dex2jar and JD-GUI for most of it. It not being open source is a political argument, not a technical one. EDIT: I ended up doing just that. It took roughly 5 minutes (most of that was making sure I had my PATH for Java set up correctly on this machine) to get decompiled Java code ready to…

I know Telegram isn't something truly "open" either (and just to mention, neither is Signal) but I don't need to reverse engineer Telegram app. I actually had its repo cloned and synced and had built and tested it couple of times. Though at the time I ended up not using the Telegram as among my contacts few were using it.

My point is open sourced code is much more readable and hence more accessible and you can build it yourself and use it most of the times.

Re: How to Tell Us a Secret

#112

Post by balladeer »

fcarraldo wrote: post #20
lisper wrote: post #13

Earlier quoted context omitted.

In general you cannot be certain of anything in today's world with regards to security. You have to trust someone. Actually, you have to trust a lot of people: hardware vendors, compiler vendors, OS vendors, and application software vendors. Any one of these could, if they chose to, easily introduce a back-door into your "secure" system. The only way to be absolutely certain that no one has done this is to build your…

I believe Signal and Wire are both clearly superior alternatives when it comes to privacy and trust. Both are easy to use for non-technical people.

Signal's iOS app is really nothing to write home about (imho) and its desktop app is often downright unusable.

I have not used Wire beyond a test install but it indeed looked promising. In a sense it's even better than Telegram that allows you to just use usernames but you have to add a phone number anyway (also if the other Telegram user by any chance has your phone number in their contacts then your identity is revealed anyway).

But I'd say that Telegram's apps (mobile and desktop both) are superior too all the major IM apps around. I wish they could be more forthcoming about openness.

Re: How to Tell Us a Secret

#113

Post by balladeer »

idlewords wrote: post #65
ac4tw wrote: post #43

Earlier quoted context omitted.

myth_buster, lisper, & newscracker make interesting points. In researching WhatsApp a while ago, I came across this in a Quora post "But one more point I want to stress here is that, though whatsapp is allowing end to end communication , it does not necessarily mean they can not analyse the encrypted data. in cryptography we call it Searchable Encryption." ( https://www.quora.com/Now-that-WhatsApp-can-no-longer-read-…

Whether or not it's open source is irrelevant to the trust issue. You would still have to look at the binary to check whether its behavior matches that of the putative source code. Either way, you end up examining the behavior of the compiled code.

So, something like Matrix/Riot?

Build it yourself and host/use your own app builds and server instances. But then I'll have trust the company I bought my VPS from to host my Matrix instance, isn't it?

Re: How to Tell Us a Secret

#116

Post by dredmorbius »

ssalka wrote: post #77
dredmorbius wrote: post #67

Earlier quoted context omitted.

HN could fix this trivially. It's been requested numerous times. They refuse. For years. Sigh.

It's not HN's job to inspect every code block to determine if it's _actually_ code. If you use the code syntax, it's code. That's the assumption that every markdown renderer makes, and I wouldn't expect anyone to assume otherwise. Format your posts appropriately - that's the sole burden of the writer, no one else's.

If a design leads to a decade or more of frequent misuse to the point of derailing dicussions, it's a bad design.

Don't blame the user.

Re: How to Tell Us a Secret

#117

Post by reificator »

dredmorbius wrote: post #87
reificator wrote: post #68

Earlier quoted context omitted.

True, it would probably be a small change, and it'd be nice to have code blocks readable on mobile. However, the generally accepted quote syntax on HN does not use code blocks in the first place. > *Quote goes here*

And that's how I write extended quote blocks generally. Some users don't, there is no one unambiguously correct method, and the 2nd- most common variant I see has several obvious detriments. The fact that the "show us your code" feature seems to be predominantly used for blockquotes, on a generally technological site, strongly suggests a failure to correctly match user expectations and needs. Though as metacommentary…

I think you're reading too much into it.

Seems more likely that it's a lack of instruction on the comment page. Discord manages to fit all of its formatting into the whitespace under the chat input....

Re: How to Tell Us a Secret

#118

Post by dredmorbius »

reificator wrote: post #117
dredmorbius wrote: post #87

Earlier quoted context omitted.

And that's how I write extended quote blocks generally. Some users don't, there is no one unambiguously correct method, and the 2nd- most common variant I see has several obvious detriments. The fact that the "show us your code" feature seems to be predominantly used for blockquotes, on a generally technological site, strongly suggests a failure to correctly match user expectations and needs. Though as metacommentary…

I think you're reading too much into it. Seems more likely that it's a lack of instruction on the comment page. Discord manages to fit all of its formatting into the whitespace under the chat input....

That would help. Many sites now offer formatting tools or a "help" link or expando. HN elects not to. Some of this may be part of its intentional asthetic. But more proximate hep might, er, help.

Re: How to Tell Us a Secret

#119

Post by tptacek »

TheForumTroll wrote: post #82
idlewords wrote: post #65

Earlier quoted context omitted.

Whether or not it's open source is irrelevant to the trust issue. You would still have to look at the binary to check whether its behavior matches that of the putative source code. Either way, you end up examining the behavior of the compiled code.

It is not irrelevant. If you can't build the binary from code yourself you have no way to know if it is trustworthy. Step one in finding out if it is is to look at the source and then compile it. After that you can look if it does strange things because of something you missed in the code but without step one you might as well not start at all. It will always be at most guesswork.

Virtually no one who uses software compiles it themselves, so this is not a very interesting rebuttal.

Meanwhile, it's not 1994 anymore, and people who know how to look for bugs can (I know this is hard for some people to wrap their heads around) look inside of binaries and draw conclusions about how programs work. There's a name for it; it's a kind of engineering.

Re: How to Tell Us a Secret

#120

Post by Angostura »

eggsome wrote: post #97
Angostura wrote: post #84

Earlier quoted context omitted.

WhatsApp requires you send the server the entirety of your contact list. No thanks.

Not true. I use WhatsApp without doing that (on iOS), but it does require other people to contact you first before you can have a conversation.

Really? So you don’t simply get this? :

https://share.icloud.com/photos/0xU-mTEbBSDtCRSgVUGGhp8Kw

Post reply on HN