Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

341–350 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#341

Post by hutzlibu »

saurik wrote: post #298
hutzlibu wrote: post #218

Earlier quoted context omitted.

Yeah but he explained, that they could not track down the bug, without having the luxory of default user tracking and metrics. So what can you do, when you have a non reproducible bug, but limited ressources(and other problems around)? You wait for the bug to show up again and then have more data to work with.

What you do is you tell everyone about the issue so they can take the appropriate steps to protect themselves, whatever that might be (don't send sensitive photos, don't use Signal to do it, only use Signal on iOS, etc.); they did not seem to do that.

Yes, this is a valid point.

I only referred to the actual bug fixing.

Re: Signal on Android: Images sent to wrong contacts

#342

Post by growse »

lwhi wrote: post #287
h_anna_h wrote: post #284

Earlier quoted context omitted.

This is false https://github.com/signalapp/Signal-Server

So are you telling me I can run my signal server and use it to communicate with others on the signal network?

You can run your signal server and use it to communicate with others on your signal network.

The openness or otherwise of the code has literally nothing to do with the terms of use of any service being run.

Re: Signal on Android: Images sent to wrong contacts

#343

Post by growse »

afroboy wrote: post #225
LurkersWillLurk wrote: post #160

Earlier quoted context omitted.

Could you explain what Signal is doing to discourage contributions?

By not allowing 3rd parties apps to coexist with official signal app. (Using same servers)

Signal placing restrictions on who can use their service has nothing to do with whether or not people can contribute to the codebase.

Re: Signal on Android: Images sent to wrong contacts

#344

Post by agucova »

desine wrote: post #292
gsich wrote: post #266

Earlier quoted context omitted.

No, those are directly correlated.

The reports of it are correlated to the rarity, except in instances where reports are not generated, such as apps that do not collect error telemetry.

Users can make reports manually, and you would even expect them to do so at a high rate in bugs like this. This implies a high correlation between bug reports and rarity.

Re: Signal on Android: Images sent to wrong contacts

#345

Post by webmaven »

NullPrefix wrote: post #262
hutrdvnj wrote: post #209

Earlier quoted context omitted.

I go to bed now and dream of a universe in which NullPrefix is Ross and continues to argue endlessly.

I'll argue with anyone about anything. For free.

> I'll argue with anyone about anything. For free.

No, you won't.

Re: Signal on Android: Images sent to wrong contacts

#346

Post by rvz »

godelski wrote: post #324
rvz wrote: post #313

Earlier quoted context omitted.

> I'm not convinced. The bug is rare and requires a specific set of circumstances that not many people are going to perform. I don't think you would say the exact same thing if this happened to closed-source apps like WhatsApp or Discord and open-source apps like Telegram or Element. All of these apps have funding behind them and lots of resources to urgently address security issues when reported or discovered. The s…

> I don't think you would say the exact same thing if this happened to closed-source apps like WhatsApp or Discord You're right. Because I judge a project backed by a company worth hundreds of billions of dollars and with hundreds of developers differently than I judge a company with a few tens of millions and only a dozen developers. I'm not sure why any sane person would judge these with the same metric. 15 devs ju…

> Because I judge a project backed by a company worth hundreds of billions of dollars and with hundreds of developers differently than I judge a company with a few tens of millions and only a dozen developers.

Any project that can at least afford a string of external audits and proudly advertises on multiple claims of high quality security and privacy should be held to very high standards, especially if they are serious projects in security and privacy and are not toy or pet projects.

Hence this, I would expect all Signal engineers to be the best in their field and qualified in both of these standards to justify the compensation price and uphold these claims for Signal. The same goes for any serious secure messaging platform prioritising security and privacy.

The harsh reality is that serious projects and competitors with bold claims of security and privacy all get treated the same. No exceptions or passes. Otherwise it can't be considered a serious project or even recommended to users if they don't prioritise and fix critical issues urgently.

> I'm not sure why any sane person would judge these with the same metric.

So you're telling me that Telegram or Element are able to prioritise urgent and critical security issues much better than Signal could? Signal is a serious messaging app going with its bold claims of high quality security and privacy isn't it?

Re: Signal on Android: Images sent to wrong contacts

#347

Post by hutzlibu »

tylermenezes wrote: post #280
hutzlibu wrote: post #229

Earlier quoted context omitted.

Well yes, maybe they should have put more people on it, from day one. But even though they have solid funding, doesn't mean they can throw it out the window. And non reproducible bugs can be hard, even when you throw money at them. But your quote was almost a textbook example of selective quoting, because you said, that they said they did a quick fix, when it really took over 6 months. But they did not say this - the…

"But even though they have solid funding, doesn't mean they can throw it out the window." This is a product which is advertised as private, marketed extensively toward people requiring privacy. Knowing they're accidentally sending images to the wrong people is a HUGE, priority 1 problem.

"Knowing they're accidentally sending images to the wrong people is a HUGE, priority 1 problem."

It is. But I have no insight in all the other problems and bugs they have. Do you? There is never a guarantee of total safety. So focusing all the ressources on one problem that happens extremeley rarely and miss out a bigger problem, that affects millions? But I don't know if this was the case here. Might also be neglect or not wanting to spread the image of Signal as being non-secure, while in a path of growth.

Re: Signal on Android: Images sent to wrong contacts

#348

Post by henryaj »

h_anna_h wrote: post #252
maqp wrote: post #205

Earlier quoted context omitted.

>serious alternatives How is Quill Chat that's proprietary and not E2EE a serious alternative? Element's UX is behind Signal but at least the encryption is E2EE by default. Session is a Signal fork with bad metadata protection: There's 60 entities owning Loki nodes, and top three players own 80% of nodes. Delta chat leaks metadata to email providers, and PGP has no forward secrecy or deniability. Element is the only…

> Delta chat leaks metadata to email providers, and PGP has no forward secrecy or deniability. Signal leaks metadata to the signal server. Deniability is useless. Forward secrecy is cool as long as you are not using more than one device.

Signal publishes their response to any subpoenas they receive; they only ever respond with the timestamp of when the user in question signed up and when they were last active - which I guess implies that's all the data they have?

https://signal.org/bigbrother/eastern-virginia-grand-jury/

Re: Signal on Android: Images sent to wrong contacts

#349

Post by gsich »

desine wrote: post #292
gsich wrote: post #266

Earlier quoted context omitted.

No, those are directly correlated.

The reports of it are correlated to the rarity, except in instances where reports are not generated, such as apps that do not collect error telemetry.

Telemetry does not matter in this case. If a bug occures often, then either the issue ticker will get this bug often, or there might even be a "known bugs" section.

Re: Signal on Android: Images sent to wrong contacts

#350

Post by stathibus »

tablespoon wrote: post #326
stathibus wrote: post #316

Earlier quoted context omitted.

Yes, they can.

> Yes, they can. If they do, they're either incompetent, lying, or building something enormously expensive yet completely impractical for most if not all real world uses.

I don't understand this attitude. Where did we go wrong as a discipline where making products that actually work is such an outlandish proposition? No other consumer product industry would talk like this.
Post reply on HN