Comment by moxie | Hacker News Reader

Comment by moxie | Hacker News Reader

Parent Full thread

> Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many.

Olm/Megolm is not Signal Protocol. It is an entirely different protocol that has made different choices, and those choices have received less study and scrutiny. It hasn't been deployed anywhere that I know of. It's fine if you want to explore those choices, but I would caution against calling it the same thing.

> the one major thing LibreSignal wanted and were threatened legal action with if they did

I understand that because we have what you consider to be unpopular opinions, it's easy to believe that we're somehow single-handedly responsible for everything bad in the world. However, you can't just make shit up. Legal action? Could you cite that?

The entirety of our exchange is in the top of that issue. They asked for permission, and I said we'd prefer for them to use their own servers and their own name. The same thing we say to everyone. Many people do set up their own servers for their own products, these people chose not to. We didn't threaten anyone with anything, legal or otherwise.

> 'Open' Whisper aren't open sourcing their server. The voice side is locked up.

https://github.com/whispersystems/textsecure-server https://github.com/whispersystems/pushserver https://github.com/whispersystems/websocket-resources https://github.com/whispersystems/dropwizard-simpleauth

By "the voice side," do you mean a TURN server? Plenty of options for you out there. Or are you just more interested in having something to blame us for?

And LibreSignal already doesn't support voice, even with our servers, so your complaint doesn't make much sense.

> Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release.

The conspiracy theories never stop. We haven't changed anything, this has been what we said our policy was all along, but people thought that was some kind of conspiracy. Of course, now that we've made it an explicit license term instead, that's also suspicious somehow. Why would anyone ever want to be involved in this community you think we're not appropriately considering?

Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it:

"I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." (https://github.com/LibreSignal/LibreSignal/issues/37#issueco...).

You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat.

'LibreSignal' never wanted their own "product" as you choose to call it. No one in that community was trying to compete with you. They just had legitimate security needs, or wanted to use Signal as it was, but without being tied to an advertising company. The App Store risks aren't even theoretical or tin-foil-hat material: https://twitter.com/SwiftOnSecurity/status/72356243560126464...

Having option to run on a reasonably secure endpoint (e.g. the Copperhead's of this world), that users have some hope of securing, seems a pretty reasonable desire. Since increased security is really the only point of using Signal, and a secure channel is useless if the endpoint is not.

The name "LibreSignal" was also not the same as "Signal". If they HAD just redistributed as "Signal" (especially if trademarked), or otherwise didn't make clear it was an independent/unofficial build, then sure that's an issue. However the developers agreed immediately to changing the name further when requested.

In terms of the voice server, I'm just going on what other developers have stated. I'm not personally aware whether the TURN server is the only missing component or not.

The fact is though, if a user wants to run Signal on a straight-forward Android Open Source device, without adding a large attack surface of Google Apps, then Signal app is not an option. Regardless whether open source clones are possible, you know communications utility comes down to the network itself too (Metcalfe's Law) and holding one tin can, with a dangling piece of string and no one on the other end is rather useless. Now Signal has captured the whole user base, there's large costs in changing.

Anyway, your code, your call. I think the key thing, is that people were surprised. Closed distribution models and controlled ecosystems, coming from a company purporting itself as being Open (and not meaning to be personal, but by a guy calling himself an anarchist), was not what people thought they'd been promoting.

We don't think you're everything bad in the world. We just wish that using Signal was an option.

Regarding entitlement, it's not just an advertising company the 'product' is tied to. Google is of course one of the most aggressive global profit-shifters for tax 'minimisation'. I would prefer to call it avoidance, as I can't see any other reason for it, but I don't have pockets deep enough for the legal defense to use a word like that (or evasion).

I wonder who voted this down. I didn't know Google tax lawyers hung out on Hacker News. PR bot?

http://www.taxjustice.net/tag/google/

It's ironic that WhatsApp runs fine on open source Android, but Signal won't.

Are you _sure_ that wasn't part of the deal @moxie? ;)

"You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat."

Wait what? Because what they did was illegal, to ask them to stop is to threaten legal action?

A: "Hey, you just hit me, can you stop?"

B: "Oh sorry we'll stop."

C: "Gosh, you didn't have threaten them with legal action!"

A: "What when did I do that"

C: "You know full well assault is a criminal offense and the government could prosecute with or without your consent. There's also an open ended civil claim you'd now have against them."

I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106

i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms. It's not like LibreSignal were doing anything particularly different to Desktop. LibreSignal would have been thrilled to have just had it upstreamed anyway.

How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic.

Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected?

Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network.

Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community.

The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.

> i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms.

What in the world do you think our motivation is, then? We're not a business, it's not like we're doing all of this to capture revenue. We could all be making orders of magnitude more working elsewhere. We're doing this because we believe it's the most effective way to make private communication ubiquitous, and it's working.

> How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic.

What code contributions? If this is something you want to see in Signal, sure, submit a clean well-written PR and stick around to maintain it. The only contributions we've seen from this particular community haven't even begun to pass code review.

> Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected?

Exactly, we make our code available under the GPL. That entitles you to use the code for whatever you would like under the terms of the license. It does not entitle you to use our service for your product, or to use our name for your product.

> Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network.

I think I've been pretty consistent in my position from the beginning. I've been saying the same things over and over at least since #127, which was early 2013. It's true that we wanted to pursue federation, and we did. But when we tried it with Cyanogen, it was a total nightmare that probably set us back a year in development time. So we've learned from our mistakes, which I think is a good thing. We'd all be better off if projects like XMPP had also learned from their mistakes.

> Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community.

I don't know what you consider "the FOSS community," but I think of them as being the same people who have been sending me a torrent of verbal abuse, legal threats, and even death threats pretty much non-stop over the past three years. At no point have I wanted any part of that.

> The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.

Plenty of people have used the Signal source to build their own projects (some even in "the FOSS community" like SMSSecure), so I don't know how you can say it's closed. Plenty of other people have also come to our project with an understanding of our development goals, and have helped to contribute to making Signal something better. A very small vocal minority of FOSS moralists have decided that we should have to do whatever they want if they scream loudly enough, and have contributed very little of anything but verbal abuse.

> What in the world do you think our motivation is, then?

I didn't have much doubt before. But once you double-down on technical strategies that entrench concentrated power of Google, Apple, etc and leave users without open source options, I have to start to wonder.

> What code contributions?

I guess we'll never know. I think more could have been done to bring them back in though. There was obviously significant interest in LibreSignal for a reason and the community sure looked big enough to curate a PR between them. I'm pretty sure that the only reason they'd have given a different name to the fork (which might have evolved into a solid PR), was that they'd been told blanket that FDroid was never going to happen and hard Google dependencies would continue to be baked in.

> It does not entitle you to use our service for your product, or to use our name for your product.

Mate, you've been spending too much time with corporate lawyers. Take a breath. It's not a "product". In the days that GPL was written, operating as a closed service wasn't something the founders had even contemplated. It just wasn't the done thing.

> We'd all be better off if projects like XMPP had also learned from their mistakes.

The core issue with XMPP was that MSN Messenger, ICQ, etc. had deeper pockets. It wasn't fundamental technical flaws in open protocols. Sure, protocols don't always get it right the first time. I don't think HTTP would be better today though if we had to use 10 different browsers from 10 different vendors with pages that won't link together. Yes, XMPP had some issues (chief of which for mobile, was battery drain resolved by push). Let's hope Matrix gets traction.

> I don't know what you consider "the FOSS community," but I think of them as being the same people who have been sending me a torrent of verbal abuse, legal threats, and even death threats pretty much non-stop over the past three years. At no point have I wanted any part of that.

Well that's pretty sad. The BSD kernel of your iPhone, the Linux kernel of your Google devices and the GNU user space you enjoy on Linux are what the FOSS community have built. It just sounds like you're painting the whole community as abusive now.

Death threats etc should be reported to police. Likewise the community shouldn't be tolerating abuse. My condolences that you've had to go through that @moxie. It's bullshit and behaviours like that help no one.

No doubt, it's been traumatic and stressful, so I want to cut you a lot of slack. This in no way excuses their behaviour and I've never seen you engage in abuse, but mate (and recognising we're all human), your tone hasn't always come across as encouraging either.

> Plenty of people have used the Signal source to build their own projects (some even in "the FOSS community" like SMSSecure), so I don't know how you can say it's closed. Plenty of other people have also come to our project with an understanding of our development goals, and have helped to contribute to making Signal something better. A very small vocal minority of FOSS moralists have decided that we should have to do whatever they want if they scream loudly enough, and have contributed very little of anything but verbal abuse.

It sounds like it's always just going to be a protocol issue. Signal is a closed service and a closed network, unless you're using Signal's App. The GPL for the app in that context seems fairly meaningless in practical terms.

To anyone looking on, from the outside, it looks like OWS has taken a giant flip from their previous position: https://twitter.com/lyon01_david/status/733096322304249856. Maybe you need to work on your PR. When people see companies like Facebook given rights, but open source are not, it naturally raises eyebrows. Good on you for opening the iOS libraries now, but maybe it should just have been clearly stated (or repeated when necessary) that it was your intention all along, otherwise it really does give the impression it was only due to 'complaints'.

The fact that you keep painting other projects as "products" and legitimate security concerns as mere 'FOSS moralism', does make people really ponder what the development goals are.

> To anyone looking on, from the outside, it looks like OWS has taken a giant flip from their previous position:

This is not a "giant flip." We told Chris and everyone else both in person and publicly that they were free to use these libraries in their apps so long as they were otherwise complying with the GPL. You can even see my response to that exact comment here: https://news.ycombinator.com/item?id=11727870

Even though we had given explicit permission for Chris and others to use this code in their OSS apps, people like you -- who wish to see conspiracy in every choice we make -- continued to paint it as some kind of cold calculated move to prevent OSS apps from using our software (for what reason is beyond me). So we worked with a lawyer on this solution.

And now, what? This is part of the conspiracy too. Great.

p.s. 'FOSS moralism' is the only reason that you have other development targets than just Blackberry & Windows CE to work with today.

I should clarify "The core issue with XMPP was that MSN Messenger, ICQ, etc. had deeper pockets.", is not precisely correct. The core issue is that they had a captive audience, continual popups and enormous barriers to entry against better technologies, allowing them to bully others out of the market. Another closed network.

I never equated anything with assault. I in fact presented using the term "assault" as being melodramatic and an overreaction, just like calling upon the Computer Fraud and Abuse Act in this case is being melodramatic and an overreaction, and which Moxie has never done.

Ahh okaay, hitting someone (as you put it) is not assault now?

Let's cut to the chase. Were they legally free to continue, or not? No. Were they at risk of Aaron Swartz style incarceration if the did? Possibly, since that community also includes among it public interest defenders, political dissidents, journalists, whistleblowers, etc. and we've seen it all before. 50 years imprisonment and $1 million for Aaron Swartz (for a download), a hellish trial he couldn't afford against Goliaths, or plee bargain guilty to a minimum 6 months imprisonment and lifetime exclusion from any political life (which he'd planned) - DESPITE MIT & JSTOR declining to proceed

Was LibreSignal technically doing something wrong in the first place? Debatable. I haven't read that part of Signal's ToS, but it had been implied to be an open community (and certainly they immediately ceased and desisted on request). Was it ethically wrong? Hardly "because what they did was illegal" as you put it, a major crime and DEFINITELY not the equivalent of hitting someone.

The implication that OWS had directly threatened explicit legal action, was too strongly stated and I'm happy to withdraw that (I had another case in mind). Nevertheless, the end result hasn't been all that different for practical purposes.

> "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run."

Yes, that is what I said, after they explicitly asked "Let's ask @moxie0 if he is OK with LibreSignal using OWS servers."

They asked, "are you OK with this," and I responded "I'm not OK with this." I never took any action at all, just gave them my opinion when they asked for it.

If you think it's reasonable to go around telling people that I "threatened legal action" to LibreSignal based on that exchange, I don't know how you expect me to take anything you say seriously.

Read down thread my reply to laughinghan. The implication you personally, explicitly threatened direct legal action (whether implied or not) is possibly too strongly stated and I'm willing to rephrase that.

Suggesting it was meerly stated as a preference though, is not how a reasonable person would read "you're not entitled to use" and "we are not letting other people use our name in their products".

Perhaps it wasn't your intent, but the implication was clear and additionally the law follows the letter first. They "were threatened legal action with if they did" and even if you didn't actually intend to open that risk to them from yourself (as it was understood), they were still after that, at threat from others.

Reply on news.ycombinator.com