Signal on Android: Images sent to wrong contacts

Post by tablespoon » Mon, Jul 26, 2021, 12:56 AM UTC

chithanh wrote: post #294

h_anna_h wrote: post #289

Earlier quoted context omitted.

I am telling you that "They also refuse to open source their server software." is false.

Signal typically delay releasing the server source code, so the latest version of the server is not open source. In one case it took them almost a year (no public commits between 20 April 2020 and 6 April 2021). https://github.com/signalapp/Signal-Android/issues/11101#iss... Among the official reasons given was staying ahead of spammers. In this instance it was also speculated that the payment function which they wer…

Post by [deleted] » Mon, Jul 26, 2021, 12:59 AM UTC

maqp wrote: post #205

colesantiago wrote: post #18

Signal is becoming a joke that we should reconsider using, and now has dangerous bugs that is at the edge of compromising people's privacy. Has this app/service really been audited properly? We now need to consider serious alternatives that we should get behind like Element [0] or Session [1] but I am open to user friendly alternatives other than Signal (at worst even Quill [2] or Delta Chat [3]). [0] https://element…

>serious alternatives How is Quill Chat that's proprietary and not E2EE a serious alternative? Element's UX is behind Signal but at least the encryption is E2EE by default. Session is a Signal fork with bad metadata protection: There's 60 entities owning Loki nodes, and top three players own 80% of nodes. Delta chat leaks metadata to email providers, and PGP has no forward secrecy or deniability. Element is the only…

Post by rattray » Mon, Jul 26, 2021, 1:25 AM UTC

hackinthebochs wrote: post #272

tomudding wrote: post #124

Earlier quoted context omitted.

> Can you provide a link to the commit that fixes it? If I understand the issue [0] correctly, these two commits should be the fix: https://github.com/signalapp/Signal-Android/commit/e90fa05d6... https://github.com/signalapp/Signal-Android/commit/b9657208f... The former updates how recipients (or really threads, I suppose) are merged (the issue occurred when trimming threads) and the latter changes the way how thread…

Using incrementing ids as your source of ownership is just asking for trouble. This just means a programming error can have a high probability of ids lining up and leaking resources. Guids make this practically impossible.

Post by kaba0 » Mon, Jul 26, 2021, 1:40 AM UTC

andrewguenther wrote: post #96

greysonp wrote: post #78

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. Without telemetry, can you actually back up the claim that this issue was extremely rare?

Post by mdaniel » Mon, Jul 26, 2021, 1:49 AM UTC

GuB-42 wrote: post #119

Rd6n6 wrote: post #24

Earlier quoted context omitted.

It’s not enough for signal to work for tech people. You have to be able to convince your family and friends to use it, it’s a network effects problem. They are adding features so that ordinary people can have private communications

If that's the case, why did they remove SMS import? It used to be "just install that, you will be more secure and won't notice the difference". To "you will lose all your messages".