Comment by uph | Hacker News Reader

Comment by uph | Hacker News Reader

Parent Full thread

No one is forcing you to use proprietary software. See this comment from moxie https://news.ycombinator.com/item?id=10665520

Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private.

Google doesn't see any data via gcm, it's just a tickle. If you want push messages, you gotta use a push network.

https://twitter.com/whispersystems/status/695399112833761283

Feel free to help out with code https://github.com/LibreSignal/LibreSignal/issues/43 or money https://www.bountysource.com/issues/35722527-create-proper-p... if using Signal without GCM is important to you.

If the only thing that the remaining people here want out of LibreSignal is a websocket-only solution and gmscore isn't an option for whatever reason, I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services. However, I also realize that still won't help people that are trying to build a Google-free experience on Google's platform https://github.com/WhisperSystems/Signal-Android/issues/127 , since we still don't have the things we need https://github.com/WhisperSystems/Signal-Android/issues/127#... to be comfortable distributing software outside of Play.

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Considering how a small minority complain about this everytime Signal is mentioned you'd think they'd do something about it, but take a look at that Bountysource link and you'll see 8 backers. Guess complaining is easier.

Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions.

He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false.

(And in addition to that, Moxie even refuses to allow any distribution that doesn’t come with full analytics, which is extremely user hostile.)

> Guess complaining is easier.

No, it’s easier to use XMPP than to fix a system that’s broken by design like Signal.

EDIT: Seriously? Downvotes for criticising publicly documented user-hostile behaviour from Moxie? Fuck this, the discussion culture here really got worse than even Reddit.

Downvoting this comment without offering a counterpoint is very bad etiquette. Can someone provide a counterargument? Otherwise it's just pretty much censorship.

I do not think "censorship" means what you think it means. Censorship would be moderators deleting something. Making claims without citations is fully in play to downvote.

I guess you're right about the censorship part, but still, just downvoting comments without replying is not useful to anyone. The comments above that reply clarifying the situation are much more informative.

Could it be because some of your information is spun/misleading?

LibreSignal was abandoned according to their github, first of all. Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal.[1] As far as I understand, they disapprove of people using the name Signal or TextSecure or Redphone for their forks, due to confusion by users who believe that the fork is actually the app released by OWS. He doesn't explicitly say whether "LibreSignal" is okay, but would prefer for a namechange to reduce confusion.

Afaik, he also encourages people who don't like the GCM build in Signal to swap it out with the rewritten open source one and build with that.

[1]https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

> LibreSignal was abandoned according to their github, first of all.

Yes, because Moxie threatened in the discussion you linked?

> Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal

The issue is that Moxie refuses to federate, or allow others the right to develop third party apps interfacing with his server (Which, btw, he can’t prohibit in the EU anyway).

> Afaik, he also encourages people who don't like the GCM build in Signal to swap it out with the rewritten open source one and build with that.

Yet he threatens anyone trying to distribute an alternative build with it stripped out.

How the fuck is that open source development, if you threaten anyone forking it, and don’t allow any PRs that could make it more open, AND refuse to allow federation? That’s not any better than just using Facebook Messenger.

You're cherry-picking the bits of Jarwain's response that you like to respond to, ignoring the others, yet complain about the discussion culture and being down-voted (which is not appreciated on here) in your original post.

Moxie is taking issue with others using the name "Signal", as that would lead to confusion. Forking and using your own name and servers is totally okay with him.

And of course you can allow others from distributing apps that use your servers in the EU. There's a difference between using modified code with OWS servers (which might be okay in the EU, IANAL), and distributing apps that interface with OWS servers despite their demand that you do not (which is certainly not okay in the EU).

Forking and using your own servers is exactly one of the things about XMPP Moxie hated si much that he created Signal in the first place!

The whole point why Moxie created it is so that everyone is on the same one, to avoid federation issues.

> stributing apps that interface with OWS servers despite their demand that you do not (which is certainly not okay in the EU).

I'm not a lawyer, but:

EU law very specifically allows you to create software interfacing with third party software or services, even if they tell you not to do so, and you can even decompile their software to learn how to do that interfacing (compare §69d UrhG), as long as you don't have to break their ToS doing so. (Which I don't, the only ones possibly breaking the ToS would be the users, and there's also a legal argument that you can't prevent users from modifying the software they use to access your service (see the AdBlockPlus vs. BILD case, LG Hamburg)).

> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions.

Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion about LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative?

> He also uses the GCM library from Google, which pulls in several analytics libraries into the APK

Could you cite this as well? Here's the entire POM file for the version of the GCM library we use:

<?xml version="1.0" encoding="UTF-8"?> <project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <modelVersion>4.0.0</modelVersion> <groupId>com.google.android.gms</groupId> <artifactId>play-services-gcm</artifactId> <version>8.1.0</version> <packaging>aar</packaging> <dependencies> <dependency> <groupId>com.google.android.gms</groupId> <artifactId>play-services-base</artifactId> <version>8.1.0</version> <scope>compile</scope> <type>aar</type> </dependency> </dependencies> </project>

A single dependency. If you follow it, the only transitive dependency is the supportv4 library. Where are the "several" analytics libraries?

> (And in addition to that, Moxie even refuses to allow any distribution that doesn’t come with full analytics, which is extremely user hostile.)

What do you mean by "full analytics?" Is there something user hostile about having an aggregate count of the number of users you have on what platforms, so that you can develop and deploy software accordingly? About being able to receive crash reports when users choose to submit them so that you can fix their problems?

> Please cite this.

I’m sorry, what was this entire discussion then supposed to mean? https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way?

How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect?

> Could you cite this as well?

Have you actually read the code that gets compiled in when you depend on play-services-base and play-services-gcm?

As I happen to have reversed all of it to write an open source library for GCM, I have. And let me tell you, most of the code in there is "measurement"-code.

> What do you mean by "full analytics?"

Distributing through any means where the user can get the app without being required to be fully tracked by the Google Play Services?

You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices.

> If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way?

What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license https://github.com/WhisperSystems but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free.

> How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect?

https://whispersystems.org/blog/reproducible-android/

> You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices.

https://news.ycombinator.com/item?id=12689352

> What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it.

Because Moxie claims he wants to change mainstream communication?

You don't revolutionise mainstream communication by fragmenting your user base even more.

If every fork did what Moxie suggested, and create a completely new network, then soon there will be only a handful of users per network at all.

And users will just go back to Facebook or WhatsApp.

The claimed aim of Moxie is that everyone uses the same, partially safe, chat system.

The only merit Signal has over XMPP is that it aims to be used by everyone, including your grandma, trading adoption vs safety.

If that is the aim, you have to ensure it also is 100% compatible.

If you directly suggest to fragment the userbase, you are destroying the one single merit Signal has over XMPP with OMEMO.

Because then it becomes just another protocol for crypto nerds (and a worse one, in fact, considering the inclusion of Google code).

So, explain to me, how is fragmenting the userbase in any way conductive to the claimed aim?

Also, regarding

> but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free.

Nah, I don't spend months of my own free time maintaining an open source IRC app, and working on creating tools to make IRC easier for users to use.

I don't actually spend time making open chat systems more useable to users, sure.

That accusation from you doesn't belong at all on HN, and is not only a personal attack, but also wrong.

I could just run a Signal fork with my own servers tomorrow, but one of my goals is to allow users to have one single place where they can send a message to a user, and it will arrive. No matter what service the other user uses, what app, what chat system, if they're on an obscure 20 people IRC network, on Signal, WhatsApp, etc.

My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier.

And Moxie is fighting for the opposite.

He fights against any compatibility, and suggests I tell my mother to install yet another chat app, ignoring that her phone can't even install Signal in the first place because it only has 3MB of useable memory, left.

You and Moxie actively tell people to create more, and less interconnected, chat networks.

How the fuck is that going to help?

If everyone uses a different secure app, that doesn't help at all! People will just use the systems everyone has (case in point: usage of SMS in the US, or WhatsApp everywhere else), and thereby you ensure no one gets any security.

So stop insulting people you don't know, and claiming untrue motives to be theirs, just so you can justify your actions.

> My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier.

And Moxie is fighting for the opposite.

Yet here you are, pissed off that your goals don't align with someone elses. Use your open source IRC app to talk to your mom and I'll use Signal to talk with mine. No one is forcing you to do anything. Considering your goals and ideas are superior surely whatever you're suggesting will become the one service everyone uses, problem solved.

> surely whatever you're suggesting will become the one service everyone uses, problem solved.

That shows even more how much you misunderstand the entire market even worse than Google does.

An app can’t win because it is the best, but only through network lock-in effects (which Moxie tries to use for Signal, too) and marketing combined.

> Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private.

The issue is not privacy, it's the use of a proprietary service. Now, GsmCore from microG does solve the problem somewhat. But then you have to ask "where will you get the app from?". The answer is "not F-Droid because moxie doesn't like it". So you have three options for actually installing the app and keeping it up to date:

1. Use the Google Play Store (proprietary). 2. Build the app yourself and keep it up to date yourself (not fun and doesn't help anyone other than me). 3. Use an unofficial FDroid repo (or do step 2 and host the repo myself). This option means that you have some random administrator controlling updates. I actually agree with moxie that FDroid really should add developer signatures to packages (though IMO the desktop GNU/Linux model of package updates is actually fairly solid -- though you don't have the Open Build Service for android packages :P).

Overall, the choices are a shit-show. Now, I get that it isn't of concern to moxie what people like me have to do to get this to work with their phones. That's fine, I understand. But that doesn't mean that I'm not going to mention it if I get the chance -- because it does legitimately make things harder for me. I get that free software on phones isn't a big concern to many people, but it is to me.

> Considering how a small minority complain about this everytime Signal is mentioned you'd think they'd do something about it, but take a look at that Bountysource link and you'll see 8 backers. Guess complaining is easier.

I contribute (both code and money, and also as part of my day job) to many free software projects, but I refuse to contribute to a project which actively encourages the use of proprietary software in order to use it properly. I get that it makes things easier for users, but that doesn't make it right. So maybe you shouldn't be so condescending?

Reply on news.ycombinator.com