Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snap Store administrators removed signal-desktop from Ubuntu Snap

forum.snapcraft.io

Post reply on HN
Print view View original

381–390 of 443 posts

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#381

Post by marginalia_nu »

rosnd wrote: post #374
marginalia_nu wrote: post #373

Earlier quoted context omitted.

I've seen this extremely sketchy variant a few times curl -sfL www.marginalia.nu/install.sh | sudo sh - Even without sudo, this is extremely sketchy.

Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?

The difference is that the stream coming out of curl and entering sh is ephemeral. With this device, there is no checksum or signature (as with apt). If you pipe curl into sh, you also leave no trail of what you've run. A malicious actor can also hinder analysis by serving different payloads per user-agent, per time of day, per subnet; or only serving the malicious payload intermittently.

With .deb-files you're expected to verify the checksum. Maybe you don't, and even if you don't, you can theoretically go back and verify after as part of a forensic process. This checksum is also typically distributed across different mirrors, making bait-and-switch attacks difficult. It means that if you're going to do a supply chain attack, you must do it in the open.

Compiling from sources is a bit sketchy, but it is also the vector that is easiest to analyze, so I think they cancel out.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#382

Post by aeturnum »

krageon wrote: post #159
aeturnum wrote: post #112

Earlier quoted context omitted.

None of these suggest you shouldn't use signal - or that it's not meeting its goal of secure communication (except the last one I suppose). Signal is not without flaws as you say, but if you have a phone number and can access a binary, there's every reason to believe it will securely and privately transmit your messages. You are also, ofc, free to fork their client and run your own service (as others have done).

There is no reason to believe it is secure, as it doesn't have reproducible builds. What you download has binary blobs embedded.

Signal has repeatedly been audited[1] so there's more reason to believe the protocol has the capacity to be secure than other options. Obviously if you believe the company is actively subverting their goal, you should use your own fork.

Edit: to be clearer - signal both publishes a protocol (that is thought to be secure) and provides a public service (that claims to use the signal protocol). Signal has claimed that the binary blobs they add to their public client (and the other restrictions) are required to run a public service (anti-abuse, etc). You are free to believe them or not - I do.

At the protocol level, which you are free to use, none of the problems you or the ancestors have pointed to apply. All of the alternatives people are pointing to here are at the "protocol" level - accessible only if you or someone you trust has setup a node. There's nothing wrong with that - it's a good idea - but it's no reason to attack signal's service for not being a protocol (which they also provide).

[1] https://community.signalusers.org/t/overview-of-third-party-...

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#383

Post by b112 »

einpoklum wrote: post #215
b112 wrote: post #188

Earlier quoted context omitted.

The same was systemd did? The force of a multi-billion dollar company, where profit is far more important than doing it right? Linux and OSS software became what it is, became the stable, secure powerhouse it is, literally dominating every aspect of computing, because profit was originally less important. Look at Debian, which only ships when ready, and never ever to a fixed deadline. Yet today, almost all private co…

So, do you think the adoption of systemd was motivated to a great extent by the influence of commercial companies' interest? Would you say that's true for distributions like Debian, which you gave as an example? I'm not being facetious, it's just that this aspect has not been described to me so far, IIRC.

Systemd was a child of Redhat.

Debian had to support it, mostly because at the time Gnome, another Redhat controlled project, decided to depend upon systemd.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#384

Post by jdiff »

cyberphobe wrote: post #209
kybernetyk wrote: post #201

Earlier quoted context omitted.

Binaries are just condensed source code. So when the source code is AGPL I sure as hell can distribute binaries if I like.

What is GNU IceCat (formerly IceWeasel) then?

Firefox's license did not permit use of trademark. Eventually an exception was made, and now GNU IceCat is mostly a relic.

Signal's license on the other hand, does permit use of trademark. If nothing else this means that using the DMCA for this is wildly inappropriate.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#385

Post by jdiff »

cyberphobe wrote: post #330
jeroenhd wrote: post #315

Earlier quoted context omitted.

It's Signal's fault for getting lawyers involved before communicating with the people that put the alternative up. If it's that much of a problem, asking nicely would probably have worked. They could even set up a mechanism to transfer users to the official distribution if they wanted to put in the effort to help their users. As a side note, "Signal" is a generic English word. The logo is a generic speech bubble. Cop…

Signal isn’t saying no one can use the word signal. The problem arises when you use all of their branding together in such a way that could plausibly fool someone into thinking it’s their software, which very much appears to have happened here (see this entire thread full of people who installed this trademark violating build thinking it was legit)

Signal is not saying this, as evidenced by the cofounder saying that this is all a misunderstanding and that they're working to undo what's been done.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#386

Post by mechanical_bear »

drran wrote: post #364
tssva wrote: post #287

Earlier quoted context omitted.

Unfortunately, this is the world Signal lives in. For binary debian packages to be installed securely directly from a vendor requires the installation of gpg keys which is what 2 of the 3 commands are regarding. If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS instead of developing a system where they are gatekeepers and distribute all pack…

> If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS No way. I will never trust your binary.

Lol, like you audit the thousands of lines of code when you compile from source.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#387

Post by dijit »

yummypaint wrote: post #372
dijit wrote: post #252

Earlier quoted context omitted.

To be honest I don’t see a strong reason to trust signal either except better marketing. There are so many scandals that come to mind, like not updating the FOSS code for years. I’m no fan of Meta, and they have incentive to hoover up data. But I don’t have a good reason to trust signal other than that everyone on hackernews seems to love them.

Look at how signal vs meta make their money. Meta's entire business model is built around directly violating people's privacy, and conspiring with other businesses to violate people's privacy. Meta is a publicly traded company. Signal is a 501c3, it's a completely different kind of organization.

I already said that meta has an incentive to snarf up your data.

There is credibility to the notion that signal is designed to ensure that people who are paranoid would prefer it.

The fact that it exists and is convenient prevents more secure messengers from existing as the lions share simply goes to signal, and this is what I mean by marketing. It is conventional wisdom that signal is the bees knees and looking further or scrutinising it is folly.

A lot of funding comes from the government to signal too; and since it’s an American company it must comply to the best of its ability with US law. They tell us that they can only comply in small ways, but given that there is no independent verification of the server (that it even runs the FOSS code) and the hostility in having unofficial clients on the network I am left pondering.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#388

Post by rlpb »

woodruffw wrote: post #370
bostik wrote: post #368

Earlier quoted context omitted.

This threat model was at the heart of Maemo's and later Meego's app store criteria. Both APT and RPM repository trust model is flat: all repositories have the same privileges to make packages available for upload, and can declare any dependencies they choose in their packages. This allows a third party to override any package in the system. Doesn't matter who provides the repository, because ownership can change. Eve…

I think I addressed this in the adjacent reply[1]. Yes, there's a legitimate risk (and accompanying threat model) when trusting package repositories. But I don't understand the specific threat model that involves not trusting Signal's package repository while (1) trusting a random third-party package that (2) just redistributes (in the best case) the official binary. [1]: https://news.ycombinator.com/item?id=33455836

Snaps run sandboxed. It's not perfect, but it's a whole lot better than debs.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#389

Post by hiq »

turminal wrote: post #338
tssva wrote: post #248

Earlier quoted context omitted.

The name for the Signal Desktop package is signal-desktop and Signal provides instructions on their website on how to add their deb repository.

Why doesn't signal have a package in the official debian repo? I don't want to add random deb repositories for software like that.

One potential reason is that their release cycle is too fast for the official Debian repositories, and they don't want to slow it down. Supporting old versions is a cost they don't want to bear.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#390

Post by lcnPylGDnU4H9OF »

fazfq wrote: post #350
brianacton wrote: post #305

Earlier quoted context omitted.

Correct. We spoke to our attorneys and found the breakdown in communication. We are working to rectify and reinstate signal-desktop ASAP. Sorry for the confusion.

Why is Signal, a company that prides itself in being tech-centric, allowing lawyers to send DMCA requests without consulting anybody?

I don't get why Signal being tech-centric (whatever that means) should disallow their lawyers from sending DMCA takedown requests.
Post reply on HN