Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standalone Signal Desktop

signal.org

Post reply on HN
Print view View original

281–290 of 320 posts

Re: Standalone Signal Desktop

#281

Post by Sir_Cmpwn »

terraforming wrote: post #212
unicornporn wrote: post #165

I so wish more people discovered Matrix or https://riot.im . To me it's simpler and works better than Signal while being decentralized and federated. It has excellent clients for all platforms (and these keep measages in sync with each other) and does not require a phone number.

Matrix is fantastic. However, riot desktop sucks in my opinion. Yet again, an electron app. You say that matrix "has excellent clients for all platforms". That is simply not true at this time. For linux, there's pretty much only 1 client that's currently usable, and that is riot (electron app). There's a fantastic one in the works, qmatrixclient (quaternion: https://github.com/QMatrixClient/Quaternion ), but it doesn…

There is a Weechat plugin.

https://github.com/torhve/weechat-matrix-protocol-script

Re: Standalone Signal Desktop

#282

Post by verbify »

acdha wrote: post #277
scott_karana wrote: post #142

Earlier quoted context omitted.

Verbify didn't say that at all. It's ludicrous that you can't download a security-focused app when your browser settings are unusually secure. ;)

> It's ludicrous that you can't download a security-focused app when your browser settings are unusually secure. ;) Security is about threat models: if you don't trust the code they write on their website, you shouldn't trust the code they shipped in the app.

A casual look shows they're also loading JavaScript via bootstrapcdn.com and googleapis.com. Security is also about attack surface reduction.

Re: Standalone Signal Desktop

#283

Post by amedvednikov »

hiimnate wrote: post #250
MarkSweep wrote: post #143

Earlier quoted context omitted.

For what it's worth, it only uses that when adding an account initially to display the login webpage. The CEF is not used in normal operation of the app. It appears the app's GUI is created using OpenGL. That said, I could not get the app to work with Google Hangouts or Facebook Messenger after 5 minutes of fiddling, so I gave up.

Why in the world would they do that? Can't they just launch a normal browser window or something? Downloading 500MB of chrome bloat just to display a login window seems ludicrous.

eul requires cookies for authentication. Initially it was decrypting Chrome cookies, but this was rightfully detected and flagged by antivirus software.

I'll switch to Servo in the future, it's only ~20MB.

Re: Standalone Signal Desktop

#284

Post by lorenzhs »

kuschku wrote: post #219
lorenzhs wrote: post #182

Earlier quoted context omitted.

Oh come on kuschku, stop it with the deliberate misinformation about Signal! You bring nonsense like this up in just about every thread on Signal and it's becoming harder and harder to assume that you operate in good faith. Moxie is most decidedly not against building the code yourself. He doesn't want anyone distributing forks or other clients using the official servers because a) that creates a giant hassle when up…

How the fuck is this misinformation? Moxie has publicly stated that he is against anyone publishing a third-party build of Signal. He has openly and loudly ranted against F-Droid. Of course he's not against users building it for themselves, but he's publicly stated he won't allow F-Droid, or distributions, or anyone else, to build and publish the client, under the name Signal, so that it can connect to his servers. R…

noja said: "Give us a github repo and we can build it ourself" and I pointed out that moxie never opposed it when people build the code themselves. I'm not denying that he doesn't like it when people distribute their own builds (F-Droid) or forks (LibreSignal), and I'm not a fan of that policy either. But I understand why he's acting this way. If you read the issues you so kindly linked, he explains his reasons, and they are valid points to make even if I don't like their consequences. It's a pity that as a result, Signal is controlled by a small group of people in Silicon Valley, just like any other software product these days. I would like to have a good native desktop client just as much as you. But that's not a reason to misrepresent his position, or to inject it into only tangentially related discussions.

Re: Standalone Signal Desktop

#285

Post by 72deluxe »

andrepd wrote: post #267
interfixus wrote: post #251

Earlier quoted context omitted.

Wow! A race to the bottom of the memory pool. Electron is several things which HN guidelines probably won't allow me to describe here. I avoid it whenever I can.

That's all very true, but can you point to an alternative? If you were a small team with few resources, and you wanted to ship a cross-platform desktop app, what would you choose?

I would choose wxWidgets personally. Easy to build the libraries, plenty of samples.

Some bugs here and there but paired with a tool to layout UIs (like wxFormBuilder), you can get a lot done.

Re: Standalone Signal Desktop

#286

Post by kuschku »

lorenzhs wrote: post #284
kuschku wrote: post #219

Earlier quoted context omitted.

How the fuck is this misinformation? Moxie has publicly stated that he is against anyone publishing a third-party build of Signal. He has openly and loudly ranted against F-Droid. Of course he's not against users building it for themselves, but he's publicly stated he won't allow F-Droid, or distributions, or anyone else, to build and publish the client, under the name Signal, so that it can connect to his servers. R…

noja said: "Give us a github repo and we can build it ourself" and I pointed out that moxie never opposed it when people build the code themselves. I'm not denying that he doesn't like it when people distribute their own builds (F-Droid) or forks (LibreSignal), and I'm not a fan of that policy either. But I understand why he's acting this way. If you read the issues you so kindly linked, he explains his reasons, and…

I’m interpreting it in the way that noja is writing it from the perspective of distributions. As in, just link us a repo, and we (Fedora) can include it. That interpretation might be wrong, and I might have misinterpreted it because I’ve been working with distro maintainers on getting some of my software into distributions recently.

But with that interpretation (and the context around that, where users asked about including it in distros), my arguments are certainly relevant.

> If you read the issues you so kindly linked, he explains his reasons, and they are valid points to make even if I don't like their consequences.

His points are basically irrelevant if compared to the risks that the centralization causes.

Users of distributions have to trust their distro anyway, for many other packages (including the kernel build) already, trusting them for Signal, too, actually reduces the number of parties you have to trust.

Re: Standalone Signal Desktop

#287

Post by bilkow »

Vinnl wrote: post #252
bilkow wrote: post #245

Earlier quoted context omitted.

It may now support working on devices without Play Services, but being the same apk, Google's libraries are still inside the app. This way it's not entirely free and doesn't fit F-Droid's inclusion policy. ( https://f-droid.org/en/docs/Inclusion_Policy/ )

Ah, I did not know that - thanks for clarifying. Does that mean that library code is still executed, or is it just "there"? (Oh, and worth noting: it has an integrated update checker, so not being in F-Droid is less of a problem.)

I'm not sure, maybe it is worth checking the source code.

An update checker is nice though! I wish firefox had one, but at least there's FFUpdater.

Re: Standalone Signal Desktop

#288

Post by frabbit »

mfwoods wrote: post #28
verbify wrote: post #14

It's ludicrous that you need javascript enabled to download a secure messaging app.

For those that don't want to enable Javascript, these are the hidden Linux instructions: $ curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add - $ echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | sudo tee -a /etc/apt/sources.list.d/signal-xenial.list $ sudo apt update && sudo apt install signal-desktop

How are we supposed to verify keys.asc?

(To be a bit more explicit: searching for either the pub (57F6FB06) or sub(0E46390F) keys on hkps.pool.sks-keyservers.net returns no result)

Re: Standalone Signal Desktop

#290

Post by nikisweeting »

kijiki wrote: post #110
nikisweeting wrote: post #55

Why no web app? Moxie closed https://github.com/WhisperSystems/Signal-Desktop/issues/723 without giving any reasoning. Can someone link me to a blog post that explains why Signal is refusing to release a web version? I cannot run another Electron app on my computer, I simply do not have the RAM left. Signal as a web-app would allow me to put it inside of Franz or Rambox, where all my other chat services live. Right n…

In-browser e2e encryption is vulnerable to targeted attacks on specific individuals. The service (either intentionally or by virtue of being hacked) can serve up Javascript crypto code that either uploads plaintext, or subtly backdoors the crypto so it can be decrypted. And they can do this to just a single user, so unless you audit the Javascript every single time you load the page, you'd never know. A signed app is…

That doesn't fit my personal threat model (dragnet surveillance), so I'd be happy to accept slightly lower security and use a web app. imo they should offer the option of both, but notify users on web that the Electron app is preferred because it's more secure.
Post reply on HN