Hacker News Reader

As far as I know, while the DevOps code is not open source, the server and app code are on GitHub; that is you’re able to roll your own version however it defined by the licensing; recent attack on Signal by security researcher used a self-compiled app as a proof of concept; Signal patched the issue.

View on HN

Just to clarify, the bug you're talking about was in WebRTC. We submitted a patch upstream:

https://webrtc-review.googlesource.com/c/src/+/175960

Right, here’s another comment on the topic by Signal staff too: https://news.ycombinator.com/user?id=pthatcherg

I didn't mean to imply Signal wasn't open-source, just that it was based on TextSecure and can be forked.

If the commercial entity fails or is held liable, we just need a distributed profile system, should be easy enough.

Reply on news.ycombinator.com