61–70 of 178 posts
Does anyone know if they are planning to add a way to change home server. If they take your domain (With your Matrix server on it), you have no way of communicating with other people over riot anymore.
Earlier quoted context omitted.
The developers have feature justifications for every permission requested: https://support.whispersystems.org/hc/en-us/articles/2125358... Edit: Reading your link now, as I didn't see it before I made my comment. Was that added in as an edit?
These are the justifications of developers who are unfamiliar with the Intent system. Were I unaware of Intent, I would make the same design decisions.
https://developer.android.com/training/contacts-provider/mod...
https://developer.android.com/guide/topics/providers/calenda...
and so on and so forth for almost any permission the Signal app needs on Android.
Earlier quoted context omitted.
It can also affect security depending on what jurisdiction the servers fall under. Federation means that while it may be illegal to run the service in, say, China, it can be run elsewhere without those concerns. This is becoming more apparent with the widespread use of National Security Letters.
Sorry, am I missing something? It's my understanding that Signal is ETE encrypted. All an NSL would get you is ciphertext and metadata.
I have the impression that Signal by now has such a great brand name that mere technical objections won't affect its growth for a very long time.
I wonder if the name of Riot will be a hindrance for widespread adoption. Most people don't like riots.
Earlier quoted context omitted.
GCM is merely one minor component. The existence of the microg project proves that you can implement one without the other.
MicroG does not implement GCM.
> The most important concern is that Signal is a silo [...] you have to connect to OpenWhisperSystems servers to communicate with other users. You can run your own private Signal service with OpenWhisperSystems' tools [1]. It's also worth noting that Signal - as a protocol - could easily be federated. (As others have mentioned, Moxie has chimed in on why the app is centralized [2]). If confederated messaging is impor…
> You can run your own private Signal service A distinction without a difference. I use Signal because people use Signal. People do not use 'the Signal service'. They use OWS's app and OWS's servers and moxie has explained he will not federate. The fact that OWS goes to all the effort of creating this excellent protocol, and then insists on only deploying it to insecure devices (with direct-memory-access baseband rad…
I have the impression that Signal by now has such a great brand name that mere technical objections won't affect its growth for a very long time.
I wonder if the name of Riot will be a hindrance for widespread adoption. Most people don't like riots.
Earlier quoted context omitted.
Technically? There's nothing stopping them. For that matter, there's no stopping Google from doing the same. There's also no stopping Apple from patching LLVM so that only patched versions of OpenSSL are ever compiled against. The question is how paranoid are you and what is your threat model? We have to trust someone, eventually. This is especially true for the 99% of the population who doesn't have the skill to com…
Just in case nobody has gotten to enjoy this gem: http://wiki.c2.com/?TheKenThompsonHack Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of e…