Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standalone Signal Desktop

signal.org

Post reply on HN
Print view View original

121–130 of 320 posts

Re: Standalone Signal Desktop

#121

Post by smcleod »

Other than the memory usage - these are problems I've encountered thus far:

  - It said it was 'Importing contacts and messages' when I signed in without first prompting me if that was OK.
  - Importing contacts and messages failed.
  - Manually importing contacts fails.
  - Conversations show up, but each message just shows as an error.
  - Deleting a conversation doesn't delete it, it just makes it as read.
  - Messages marked as read randomly reappear as unread.
  - Incorrect unread message count next to conversations list.
  - Messages often don't arrive at all, seems at random.
  - The application loses it's 'link' to your account seemingly at random upon launch and needs to be relinked.
  - Appears to use an outdated version of electron with published security vulnerabilities.

Re: Standalone Signal Desktop

#122

Post by krrrh »

kome wrote: post #19

Signal Desktop is not really standalone, because you still need to pair it with your phone. And the phone should be turned on. I am very privacy conscious, and I don't use a smartphone, at all, because it's basically a spying device in your pocket. Why Signal is all about privacy and then it forces me to pair it with a telephone? Telegram desktop is really standalone. They require a telephone number too (and that's v…

Wire seems to have better security, and it’s desktop app doesn’t require a phone number and supports multiple logins. Client and server are open source.

It’s got a pretty bad case of kitchen-sink flat ui, but is otherwise not bad.

Re: Standalone Signal Desktop

#123

Post by nv-vn »

will_hughes wrote: post #115
tmikaeld wrote: post #5

Another 205MB Electron App to the collection, at least it's 50MB smaller than Wire.

Genuine question: Why do you care about a few hundred MB of disk space for an app? I could understand if it was a GB or so, but in this day and age it's USD 9c or less worth of disk space (assuming you use high end SSDs, if it's a HDD then it's under 1c).

This question has already been answered a bazillion times. - Longer downloads (especially with updates) -> Discord update times are ridiculous, I can't imagine dealing with that for every app - Slower to launch - Can't keep the entire program in RAM - It's Electron so it will use a ton of RAM anyways

Re: Standalone Signal Desktop

#124

Post by halayli »

jsnar wrote: post #114
kijiki wrote: post #111

Earlier quoted context omitted.

Sure, but it doesn't pull HTML or Javascript from servers, it is all packaged along with the native Electron runtime. Exploiting a Javascript vulnerability is an absurd waste of time when you could just add a backdoor or whatever to the native code.

It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.

same logic can be applied to a native app that is using libpng and an attacker exploits the lib in one way or another.

Re: Standalone Signal Desktop

#125

Post by halayli »

jsnar wrote: post #108
jsnar wrote: post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

See here for the security issues published in Chrome stable releases in those versions: https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googleblog.com/2017/09/stable-channel... https://chromereleases.googleblog.com/2017/10/stable-channel...

browser security vulnerabilities are expensive and heavily scrutinized. Just because they are on top of it for reporting vulnerabilities and fixes so that you become aware of it doesn’t make the alternatives more secure. You just wouldn’t be aware of them which is more dangerous.

Re: Standalone Signal Desktop

#126

Post by Nition »

ezekg wrote: post #94
woolvalley wrote: post #88

Earlier quoted context omitted.

They are a small non-profit dev group, and resource wise it's probably not worth it for them. You could indirectly solve this problem by making some sort of electron multiplexer that could take multiple electron apps and make them share the same electron host browser, achieving the same thing you have now. I personally just use a bluetooth keyboard and my phone. I get a native app, keyboard typing and nothing hogging…

The issue with doing that though is that most Electron apps don’t use the same version of Electron. I have apps I’ve built that are still running pre-v1 because updating has been too much of a headache.

Like DLL Hell all over again.

Re: Standalone Signal Desktop

#127

Post by ktta »

amedvednikov wrote: post #53
tmikaeld wrote: post #5

Another 205MB Electron App to the collection, at least it's 50MB smaller than Wire.

eul is a light (4 MB) native desktop client for all popular messengers: https://eul.im Signal support is coming later this year. Right now it supports Slack, Skype, Facebook, and Gmail.

Calling it 4MB is a bit ludicrous. On first run (on linux) it downloads half a GB worth (508 MB to be exact) of 'browser content'. On first run.

So this isn't light or native. It uses the same Chromium codebase, but atleast twice the size of Electron apps.

https://hardbin.com/ipfs/QmNttGPf65DZ3eeuNCCWemrxyNzaHxLhpAZ...

If the rest of you are wondering where the bulk of it came from, check libcef.so (466 MB)- which is Chromium Embedded Framework.

https://en.wikipedia.org/wiki/Chromium_Embedded_Framework

Re: Standalone Signal Desktop

#128

Post by axaxs »

stephenr wrote: post #117
axaxs wrote: post #89

Earlier quoted context omitted.

does it support relevant slack features...gifs, slackmojis, tags, etc?

Those core, must have features right? "Oh no I can't use that business chat tool, it doesn't support smiley faces and cat reaction gifs".

Maybe relevant wasn't the right word. But it's what makes slack slack, over say, irc.

Re: Standalone Signal Desktop

#129

Post by munin »

halayli wrote: post #124
jsnar wrote: post #114

Earlier quoted context omitted.

It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.

same logic can be applied to a native app that is using libpng and an attacker exploits the lib in one way or another.

things you can do in the native app to mitigate this risk:

* run rendering in a sandbox

* closely monitor your deps for vulnerabilities and ship patches as quickly as possible

* choose deps with a better security track record, when possible

* independently scan, test, and validate the deps you bring in

things you can do in an electron app:

* pray

Re: Standalone Signal Desktop

#130

Post by lewisl9029 »

Any reason why there's not more support for the Progressive Web Apps standard on desktop browsers [1]?

It seems to me that many Electron apps these days are super-thin wrappers around a web app that don't actually need the full desktop access offered by Electron (things like local filesystem access, multi-process execution, multi-window management, arbitrary node APIs, etc).

They just need a way for users to "install" the app so that it 1) has a separate shortcut and appears in a separate window from the browser, 2) can send notifications through the native notifications stack, and use a fallback on systems where one isn't available, 3) is available for use offline.

The Progressive Web Apps spec has answers to all of these problems, and it would vastly improve the resource usage model compared to Electron because each PWA would share the same browser runtime as the user's browser of choice, which is more likely than not running 24/7 anyways.

Security-minded apps like Signal might need more guarantees such as asset verification and version pinning on install, but surely those could be added to the spec, as they would be beneficial for other Progressive Web Apps as well.

I know PWA was designed with mobile apps in mind originally, but it'd be a shame to limit it to that use case, as there is clearly a lot of demand for building desktop apps with web technologies, and PWA sounds like an excellent alternative to the current status quo that's dominated by Electron.

[1] https://developer.mozilla.org/en-US/Apps/Progressive

Post reply on HN