Hacker News Reader

Comment by hjkgfdfgh | Hacker News Reader

If Signal were federated, there would be no single entity to shut down. Alas...

I get where you are coming from but given the walled garden there is no need to kill the severs. Merely blocking all clients from the Apple Store and the Play Store would accomplish the same thing, federated or not.

That's why it is essential for end user to have an ability to sideload apps to the phone (i.e. to bypass vendor's store).

Which they do. Well, on Android phones anyway.

Signal recommends downloading through the play store. They don't endorse downloaded apks

And for a very good reason. They're also offering the APK for those that need it, and they might make it more accessible e.g. for US users if EARN IT passes.

While Signal would prefer that most people with Play store use Play store, downloaded APKs are not entirely unendorsed. Firstly, Signal continues to offer an APK for download. Secondly, if you install Signal from the downloaded APK, then Signal acts as its own app store in order to prompt the user to install updates when available.

Android sideloading has been progressively weakened. Google’s plans for AOSP are that sideloading will soon require using the ADB debugging bridge, which would require enabling developer mode on Android versions that allow it (which would scare most ordinary people away) and would be impossible on Android versions where the manufacturer has forbidden it.

Given the amount of open source code already, it should be possible to clone.

Edit: see below, server code is open. Keeping original text below:

IIRC the server code is proprietary, but the clients are open. That's a decent starting point.

https://github.com/signalapp/Signal-Android

The server is also open source https://github.com/signalapp/Signal-Server

Am I mistaken or isn't there some way in which Signal effectively prevents anyone from running their own server? I seem to recall hearing this.

(I mean, there's the obvious practical problem that the official server URL is hardcoded into the app, so if you wanted to use your own server you'd have to build your own copies of the app for you and your communicants, but other than that...?)

A pile of separate Signal clones = zero interoperability = zero functionality. So that's why there aren't any.

You could solve that by Federating, except... Federation would be lovely if you could actually deliver Signal's goals and do federation for free, but what we always see from proponents of Federation is that was their goal and so they're done. Oh you wanted security? Sorry, we federated everything, so you'll need to get every single member of the federation on board with every single change you need, we know you can't get that done but that's fine because our priority was federating stuff, so we are successful, shame about your goals.

As an example, somebody earlier in this thread mentions you can "just" know who is communicating with who anyway. Signal got rid of that, because they can, and it's a security improvement, so they put all the work in and did it. Now even Signal's own servers don't know who sent most messages! "Sealed Sender" means Signal has no idea who is sending this message to my friend Steve. Maybe it's me? No idea. It just has to be somebody who Steve allows to send him messages. Could be Steve loves spam and so it's a spammer. Could be Steve loves the AfD and so it's a Nazi. No way to know without reading the message which only Steve's Signal client can do.

Now imagine trying to roll that out to a federated system. After years of effort maybe you switch it on, and then you find a bug and have to switch it off again for a few years while you fix that. Hopeless.

But conversely, if legislation really succeeds in killing Signal in the entirety of US (and EU won't be far behind!) to the point where they're forced to use geo-IP blocks, the end result is still strictly worse off.

> You could solve that by Federating, except... Federation would be lovely if you could actually deliver Signal's goals and do federation for free, but what we always see from proponents of Federation is that was their goal and so they're done. Oh you wanted security? Sorry, we federated everything, so you'll need to get every single member of the federation on board with every single change you need, we know you can't get that done but that's fine because our priority was federating stuff, so we are successful, shame about your goals.

I have a lot of serious criticisms of Matrix, to the point where I don't recommend it to friends (yet?), but this feels like an unfair and unserious criticism. I don't think you can fault their motives.

And as another user points out, if Signal goes down in the United States because of legislation, so much for the supposed convenience of your non-federated central server approach! If that happens I'll take Matrix over nothing, thanks.

Your comment makes zero sense, let me explain: most people use signal through the iOS app. It is very easy to shut down an iOS app.

Hope you got it!

> Your comment makes zero sense, let me explain: most people use signal through the iOS app. It is very easy to shut down an iOS app.

If Apple users actually controlled the software running on their devices that wouldn't be an issue.

A want for federated services complements a want for control over our computing.

If you care so much about uncensorable resilient service you probably already use either jailbroken iOS or Android. And if you don't, then do. iOS has a 13% market share anyways.

Hope you got it!

> iOS has a 13% market share anyways.

Not in the US, where as of March 2020 it maintains a 60.1% share.

That'd be easy to fix, if Apple wanted to.

Why the stupid downvotes? Signal's walled garden can be its demise.

Signal is open source. If you want to develop and host your own Signal, go right ahead. You’d just be opening yourself up to the same problem facing the Signal Foundation. As it is, the Signal Foundation would suddenly be open to lawsuits, and they’re the main developers of Signal.

So don't be discoverable!

> If you want to develop and host your own Signal, go right ahead.

...and have an ecosystem of users that cannot communicate with users on Signal. That's what lock-in is and "go right ahead" is just not enough.

> You’d just be opening yourself up to the same problem facing the Signal Foundation

citation needed

Reply on news.ycombinator.com