Follow

The last contribution to 's server software was on April 22, 2020. Due to the sudden commit drop to literally 0 it is no longer possible to seriously call current Signal versions fully open-source.

That has no effect on the messenger's end-to-end encryption or its overall security but it does compromise the trust in the Signal Foundation, especially when considering that they did not give any reason for not disclosing the source code.

🔗 github.com/signalapp/Signal-Se

In light of this change I'd prefer @threemaapp as my main centralized messenger since it does not require a phone number but has no major disadvantages compared to Signal.

Remember that you should probably text via a federated messenger if possible.

@datenschutzratgeber @threemaapp Is it opensource?

It's paid on iOS and I get that but not worth it for most people since they don't care about privacy

@ArneBab

Truly decentralized messengers like Briar are – at least in my opinion – not as user-friendly as federated or centralized ones because they don't allow "asymmetric" communication (both contacts have to be online). Due to the lack of a server message caching is impossible which would annoy most regular users.

@datenschutzratgeber That’s something that should already be solved: Hand the encrypted message to mutual friends who then deliver it for you when the other party goes online.

This is how Freenet enables you to reconnect to Friends after they changed their IP address: they upload their new IP to a key that only their friends know.

@datenschutzratgeber @threemaapp Why would you want to use a centralized messenger?

XMPP, email, or GNU Jami are better (or Matrix, but it promotes reCAPTCHA).

@noisytoot

Centralized messengers are only for people who are not comfortable with decentralized ones (e.g. elderly people, non-techies etc.).

Federated services like the ones you mentioned are great because they are not that complicated and don't need a single central server. They're a good compromise between independence and usability (the only problem is that many of them are bad at avoiding metadata).

@signaleleven @datenschutzratgeber @threemaapp The specification has reCAPTCHA as an authentication method (matrix.org/docs/spec/client_se), and the Synapse README.rst recommends using reCAPTCHA for open-registration servers (github.com/matrix-org/synapse#): "By default, registration of new users via Matrix clients is disabled. To enable it, specify enable_registration: true in homeserver.yaml. (It is then recommended to also set up CAPTCHA - see docs/CAPTCHA_SETUP.md.)".

@signaleleven @datenschutzratgeber @threemaapp It could mean another CAPTCHA, but the only CAPTCHA supported is reCAPTCHA (github.com/matrix-org/synapse/): "The captcha mechanism used is Google's ReCaptcha."

@noisytoot @datenschutzratgeber @threemaapp

It sucks. But it's a remarkably weird hill to die on, for an otherwise good system, isn't it?
Was the issue discussed in the spec meetings?

@datenschutzratgeber I'm also reminded of this Webshit Weekly entry from February
> A chat app based on a protocol that supports federation wants to borrow your computer instead of allowing federation.
http://n-gate.com/hackernews/2021/02/07/0/
@datenschutzratgeber There's something I don't get in this post. In your opinion, the problem for calling Signal's server software open source is
a) the lack of recent commits
or b) their refusal to displose the source code?

@miguel @datenschutzratgeber The issue is that they have had developments on their server (evidenced by features in their client software) after their last commit to the public server repo. Their server has seen development, but their open source repo has not.

@datenschutzratgeber I agree that this is bad, but ... is it really? I mean, after all, even with FLOSS you have little to no chance to know what binaries are actually *running* on servers that carry your communications (and metadata). Maybe we finally should give up on servers being FLOSS as an interesting aspect and rather focus on services and protocols that drastically limit (best: avoid) *any* plain-text server-sided data or metadata trail.

@z428 @datenschutzratgeber Imho, the issue is not about putting trust in servers (we should never trust any infrastructure not under our control). The issue is more about the freedom to run our server if signal turned evil someday.

@fluxx Ok, good point. But maybe we still should focus more on making P2P networks (without dedicated servers) more "feasible" for common day-to-day users. That would solve quite some of these issues.

@datenschutzratgeber

@z428 @fluxx @datenschutzratgeber P2P messangers are interesting, but I don't think that they can be so convenient for the non-technical user. Many of them require having a "smart" phone. Also, you can easily lose your chat history, contacts, data, etc. whenever your phone gets broken, stolen... or when you just change phone.
While the client-server model implieas trusting a third party, it is still the best solution for ordinary people, (provided that you can choose server/trust your server admins).

@z428 I wouldn't see it that way because if a service says something like 'Our stuff is the best because you can always check its source code' but does not fulfil their promise then I'd consider it highly intransparent even when we cannot be sure what actually runs on the server. Of course, you are not wrong about that but in my opinion it downplays the importance of software being FOS.

@datenschutzratgeber I agree ... but I wonder whether we are in some situation doing exactly the other thing and over-emphasizing the importance and benefits of software being FLOSS, even in situations in which threats and problems aren't caused by software being proprietary but rather by (proprietary or FLOSS) software being handled and operated in a malicious manner. FLOSS will not change anything about broken business models, shady admins, ...

@datenschutzratgeber ... poor server maintenance. Zero-knowledge servers and privacy-preserving protocols will. 😉

@datenschutzratgeber the whole point of E2EE is that you don’t have to trust the server. Btw Threema‘s Server code is closed source too. Maybe signal is working on some new censorship circumvention that they can’t show now, as they did in the past. I think they have a lot of work atm because of many new users and there’s pressure for new features.

@Lu @datenschutzratgeber Couldn't they have used a private branch for that instead of freezing further commits to the whole open source repo for almost a year now? Not even security updates, apparently. That's definitely suspicious AF.

@avalos @datenschutzratgeber they du use a private repository for development. Only major releases that are ready for release and fully working get in the public repository. People forget thar signal is an open source product and not an open source project. They work on it by themselfs and don’t want the Community to „help“.

@Lu @avalos That's not an excuse for me. Other services like Tutanota are also just open-source products but they don't behave so strangely. And it doesn't explain why there are no updates at all, not even major ones.

@datenschutzratgeber @avalos Tutanona is also just a simple encrypted mail service. Signal is a complex messenger with many complicated functions to avoid all types of data and has to deal with country locks, which it must always be one step ahead of. Because of WhatsApp they have to Deal with tons of new users atm and I think infrastructure and new features to keep them is priority number one now.

@datenschutzratgeber oh nonono xD it already was difficult to get people to signal ^^

No to mega podważa całość... jakoś mi tam gdzieś coś nie pasowało...

@petros @kuba IMO... Matrix jest trochę źle zaprojektowany, ale jego federacja jest super.

Mattermost z OpenSource jest moim bezwględnym faworytem jeśli chodzi o UI/UX ... ale brak federacji jest na minus :/

Wiec jak dla mnie, nie powstało jeszcze nic idealnego... no może Jabber... ale jakoś się nie przebił :/

@petros @kuba zapomniałem dodać że jakoś Signal mnie nigdy nie przekonał i nie używam go w ogóle... mimo że jestem fanem OTR, a oni go jeszcze poprawili

@piotrsikora @kuba

A czy i jak można sfederować Mattermosta? I jak tam z e2ee?
Bo przyznaję, że matrix bywa upierdliwy.

@petros federacji nie ma, ale jest coś podobnego i nazywa się to matterbridge i można łączyć różne kanały (w tym nawet matrixa).

e2e nie ma... z zalozenia to masz self hosted i to jest zaufane miejsce gdzie jest historia i szybka wyszukiwarka (mega fajnie działa).

Ogólnie na MM patrz bardziej jako narzędzie do pracy grupowej... alternatywa dla Slack.

@piotrsikora
Zaufanie jest dobre, ale kontrole jeszcze lepsza.
To ja na razie zostanę przy matrixie.

@petros jeśli chodzi o bezpieczeństwo i prywatność... IMO najlepszy jest teraz albo właśnie Matrix, albo XMPP z klientem wspierającym OTR.

@petros @piotrsikora Myślę że warto mieć dostęp do obu tych platform i po prostu obserwować, która będzie radziła sobie lepiej. Na obu z nich są ciekawe społeczności, więc ja sam regularnie korzystam z obu.

Według mnie ważne jest to, że mamy wybór: Matrix, XMPP lub oba (ponieważ można je połączyć).

Mattermost używam i według mnie jest o wiele lepszy od Slacka (choćby dlatego, że markdown jest prawdziwy a nie jakaś atrapa), ale nie wybrałbym go jako “coś zamiast Signala” bo nie jest wystarczająco powszechny. Mam kontakty z różnych serwerów XMPP, ale nawet gdybym miał na różnych serwerach Mattermosta znajomych, nie pozakładałbym na każdym z nich kont żeby z nimi pisać. Moim zdaniem to jest dobre do pracy grupowej, ale nie jako komunikator ogólnego zastosowania.

Moja subiektywna opinia jest taka, że XMPP ma największy potencjał i jedyne co trzeba w jego przypadku zrobić, to opracować udogodnienia dla osób nie-technicznych, żeby łatwiej im było odnaleźć się w zdecentralizowanym świecie.

@datenschutzratgeber
I'm trying to find out whether there is any evidence to back this claim.
Asking for data on Fedi did not lead to answer...
floss.social/@silmathoron/1058
Do you have actual evidence to back it? (This is a real question: I am genuinely interested in finding out what the situation is)

@silmathoron @datenschutzratgeber I have no evidence, I just heard about it from this thread. But if Signal aims to remain secure, it should be at least providing some security updates or at least updating the dependencies. It's been almost a year now.

@datenschutzratgeber > "the whole point of E2EE is that you don’t have to trust the server".

Well... that may work for the content of messages, but even with E2EE there still a lot of metadata that goes through servers and can be collected, exploited and used for the worst. Even with E2EE, I do care about the server. A lot.

@miguel @datenschutzratgeber Why not delta chat and briar? those two app dont have any server and the cost are free lol

@datenschutzratgeber @projectmirai39 Yes, they seem good options to me in general.
If we get into the details... Well, the apps, as for themselves, don't have servers. No app has a server, by definition. However, they are linked to servers. DeltaChat is linked to a third party server (your email server) and Briar makes your phone work as your server.
As for the costs, many apps are cost free (and that includes Whatsapp, Telegram...), but that's not the problem nor the solution. If we talk about the costs of data transfer and storage, DeltaChat's costs will be on our email server company and Briar's costs will be on ourselves and our interlocutor.

@datenschutzratgeber

Empty Free Software Promises #3:

No problem, there will be forks...

wait... sorry, just forgot that you nowadays love to bind to walled gardens.

Yeah, well, I never understood for a second why of all things Signal was the one that should become the new WhatsApp. Always puzzled me.

I tried it for a few days, years ago, then found a thread why it's not in fdroid. There is no reason to expect anything good from them. You will be the useful idiot for them, not more.

@datenschutzratgeber 2020.4.22 the last ever plausibly secure open source message system that everyone uses, rip

@datenschutzratgeber it's broken now. it's known insecure by someone. no more help is coming. use this at extreme peril to oneself & one's userbase.

@datenschutzratgeber I can understand this, still just becoming inactive alone is no reason to distrust the encryption safety. So did they release binary downloads (any OS) after or before the last commit? If afterwards, then there might be some non-disclosed code in it.

You still have an option to review and build it yourself.
@datenschutzratgeber signal was never ""secure"". It autoupdated and Signal or Google corporation could change the code any time they want for even specific users.
@datenschutzratgeber Just an update with recent events I'm found. Not only what I said before but Signal is now hosted on Microsoft's servers and requires Google Recaptcha. Both of those corporations are confirmed members of the NSA's PRISM mass surveillance program.

$ host api.directory.signal.org
api.directory.signal.org is an alias for api.az.infra.directory.signal.org.
api.az.infra.directory.signal.org has address 20.62.208.25
$ whois 20.62.208.25 | grep "OrgName"
OrgName: Microsoft Corporation
$
Sign in to participate in the conversation
Mastodon

Server run by the main developers of the project 🐘 It is not focused on any particular niche interest - everyone is welcome as long as you follow our code of conduct!