Hacker News Reader

Comment by jankotek | Hacker News Reader

I had run LineageOS for some time. It works, but FDroid is missing too many apps, even opensource like Signal. I have to update apks manually every few months.

View on HN

Signal team fought a long war against any forks or unauthorised builds of Signal. There are (or were) FDroid repositories with Signal compatible builds, but Moxie stated that any such build will be considered malware. Signal team was making such builds increasingly difficult to produce.

Official F-Droid repo doesn't allow proprietary dependencies on which Signal depends for some messages (push?)

Signal is open-source in the "look at it, but don't even try to tun it" way. I'd rather support a protocol that supports federation and encourages alternative clients.

https://matrix.org is a good one

Not upvoting or downvoting, but Matrix is an experimental choice at this point. I have some hope for the near future, but so far Matrix protocol is far from an established standard.

> supports federation and encourages alternative clients

Currently, the only featureful matrix server (synapse) uses gigabytes of RAM just for a handful of users (see also progress on dendrite and conduit). As for supporting alternative clients, Matrix ecosystem has an overdependence on 3rd party web widgets (eg. Jitsi) for client features because they are not supported by the protocol itself yet, making it harder to implement a native client with good performance and all Element features.

As i'm writing this, i realize nheko client now supports WebRTC audio-video calls when a recent GStreamer is available, congratulations on that, and good luck for the multi-platform implementation!

> overdependence on 3rd party web widgets (eg. Jitsi)

Is there any other example than Jitsi? I thought that was the only third party integrated in the core, and even that can be self-hosted.

It may be the only one. I was simply aware of this example. My point is not that Jitsi cannot be selfhosted but that using it in your client means your client requires a full web rendering engine to provide that feature, making clients more resource-hungry. To be clear, i'm great it exists at all. It has provided useful services for tech conferences like FOSDEM. I'm just concerned with interoperability and the webification of everything.

Using HTTPS for transport as part of the matrix protocol is great for punching through firewalls, i'm just not convinced the rest of the web stack is well-suited to social networking usecases with a lot of information pouring in. Web engines and the DOM model were designed for static data, not for highly-dynamic information, although there's ongoing R&D around virtual DOMs to optimize those usecases.

Actually, Jitsi is the only one, but it used only in case of group calls, so I can't complain. 1:1 calls handled without any 3rdParty

You mean something like XMPP protocol, which is a widely-deployed IETF standard with robust free-software implementations?

Why doesn't Signal maintain an F-Droid compatible build? (if there's a dependency problem, then they should considering dropping it, release a Signal lite perhaps)

Making your own F-Droid repository was harder a few years back, and UX client-side was bad. Nowadays setting up a 3rd-party repo is as easy as scanning/approving a QRCode (for example for Newpipe repo).

Not that i approve Signal's attitude on this topic at all, but there are (were?) technical reasons for which they would do something else. Of course, F-Droid maintaining proper LibreSignal builds in their place alleviates the concern, and that's what Signal team famously opposed. For the uninformed, F-Droid has very serious review/build process for apps and i don't think malware was ever distributed on there (and antipatterns are listed in the UI client-side).

Probably the same reason they don't maintain a Flatpak, Snap, or any other package other than for Debian/Ubuntu for Signal-Desktop.

Which according to the GitHub discussion, the answer is: ????

> Signal team fought a long war against any forks or unauthorised builds of Signal.

Yeah, this is main reason why I avoid Signal together with Google Services usage.

Yes it's a shame that Signal is not on F-Droid, but there's a self updating apk available[1] for side-loading which doesn't use Google Push Notifications if not available and as for why it's not there on F-Droid here's their official response[1], Which IMO makes some reasonable (against forks using their servers) and unreasonable (against normalizing side-loading) justifications.

[1] https://community.signalusers.org/t/wiki-signal-android-app-...

> some reasonable (against forks using their servers) (...) justifications

How is that reasonable in a centralized client-server model? That's precisely what we find unreasonable with Twitter and others shutting down or making life hard for 3rd party clients. Why would it be more acceptable from a free-software service?

The network effect says a centralized protocol like Signal has "zero" value without reusing the same servers. All this because Signal maintainers have an ideological argument against decentralization, which received many great responses including this one from a Jabber/XMPP client developer: https://gultsch.de/objection.html

In all cases, Signal servers control who has an account, what permissions and what can be posted. You can't just extend the protocol to enrich your client by abusing Signal's servers, but you can make your client compatible with Signal protocol (interoperability). Preventing that is rather user-hostile.

You are asking some very pertinent questions.

The reason why I felt there's some reason to Signal's stand on forks was because forks not standing up Them having their own F-Droid repository is to the quality standards, not adhering to feature parity while consuming their resources might not go well with their funders.

Signal having its own repo on F-Droid is the viable solution for them but they don't seem have any intention of doing it.

I don't agree with Moxie's reasoning against federated technologies, TBH I prefer email over any real-time communication due to its federated nature.

> the quality standards (...) feature parity

F-Droid community was interested to package Signal but at the time upstream had a hard dependency on Google Play Services (which according to my/F-Droid quality standards is pretty bad), and made it clear they didn't want any unapproved builds using their servers. This would include reproducible builds from the same source code as is standard in F-Droid official repo. Still, such builds would hypothetically have the same quality standards and feature parity with upstream.

I agree, Even the standalone apk which can use web sockets for notifications still has Google Play Services and so the F-Droid repo should be a separate code base without GPS.

Btw it seems I had a brain fart when typing this -

>The reason why I felt there's some reason to Signal's stand on forks was because forks not standing up Them having their own F-Droid repository is to the quality standards...

The reason why I felt there's some reason to Signal's stand on forks was because forks not standing up to their quality standards...

> still has Google Play Services and so the F-Droid repo should be a separate code base without GPS

A simple/single F-Droid patch could be enough.. Such a simple change doesn't have to be a huge maintenance burden.

This exact issue years ago made me think less of (and stop using) Signal rather than F-Droid. You're better off with XMPP or Matrix, plus an ordinary SMS app.

One has to already bend heaven and earth to bring people who don't care about Privacy from WhatsApp, Messenger to Signal.

Only reason someone is able to do that now is because WhatsApp, Messenger gets into some legal trouble and the media advertises Signal.

Preaching about significance of interoperable protocol and suggesting apps which use them is beyond the capacity of even those media.

The solution is always the same, focus on a stellar UX.

Stellar UX are always welcomed, But the network effects of a chat application are too high of a variable for to just rely on stellar UX to be successful.

Case in point: There was a chat app called Hike[1] in India run by the son of the leading Telecom Billionaire. It had more features(free SMS, Stickers) and arguably better UX than WhatsApp according to its users(100M). But it could never gain over WhatsApp's initial market size in India(Why change what works?).

Final nail on the coffin for Hike was when WhatsApp was made available on the 4G feature phone released by a competing Telecom operator and loads of people got to experience WhatsApp on their first ever Internet enabled compute device.

[1] https://en.wikipedia.org/wiki/Hike_Messenger

That's a very good example of why net-neutrality and anti-monopoly principles are important. Thanks for bringing it up

Thanks, It's indeed a good example for how oligopoly in telecom stifle innovation and how not even well-funded startups can survive in it.

Monopoly or Duopoly is a straight death sentence to innovation.

> Monopoly or Duopoly

Yeah or any kind of cartel, really. It's hard enough for a small coop to fight economies of scale, but in many areas you're facing an actual mafia.

Somewhat off-topic, but what's the situation with DIY non-profit ISPs in India? If you're not familiar with the topic, you can look up NYCMesh (New York), Guifi (Spain), Freifunk (Germany), FFDN Federation (France) or Rhizomatica (Mexico). Another interesting development in the telecoms field is https://jmp.chat/ promoting and developing free-software for cellphone<->XMPP/SIP interoperability.

ISPs by itself are heavily scrutinized entities in India, Even Starlink hasn't able to get its license yet AFAIK. I've seen couple of small for-profit ISPs come up and disappear in the form of both non-innovative distributors of bigger ISP and innovative original technology ISPs like WiFi Dabba(YC)[1](Not disappeared, but changed USP from mobile Internet to home broadband & moved the HQ from B'lore to Delaware).

As for non-profit ISP, even if possible it definitely cannot be open i.e. without oversight as in the examples from other countries you've sighted. Closest I've come to community run networks I've seen are LoRA networks.

jmp looks great, Google Voice has been shutdown in India can I use jmp as a replacement?

Edit: I've submitted jmp to HN as I didn't see any large discussions on it.

[1] https://www.wifidabba.com/

> non-profit ISP (...) cannot be open i.e. without oversight

That's also the case here. In France you need to declare your ISP activity to the telecoms regulator and follow some regulations. In Germany too there are regulations, but Freifunk as an activist collective ignored them in order to protect their users' privacy, and went up to the supreme court and won their right to operate a privacy-friendly ISP.

> jmp looks great, Google Voice has been shutdown in India can I use jmp as a replacement?

JMP is great from what i heard. It may not be as featureful as Google Voice yet, but there's active development and the user support (i hang out in their channel despite not being a client) is the best i've seen across the entire telecoms industry, and by far. The maintainers are very happy to work on new features and open to suggestions, but due to being a very small organization they're prioritizing obviously new features requests on a "who would pay for that?" basis.

You may be interested to learn that stellar UX is an important point for the snikket.org family of XMPP clients, despite not being there yet. There's an upcoming UX study if you'd like to take part: https://snikket.org/blog/simply-secure-collaboration/

I definitively like that they care

If you install signal from the apk they(moxie, signal) provide it works without google play services and it will update itself automatically, just requiring you to click a confirmation every few weeks.

Calyxos ships with Signal installed. I think it's an install time option? And it updates in an identical fashion.

> it will update itself automatically

is it possible to disable the auto-update? i'd rather see signal stop working than auto-update behind my back.

By auto-update I mean it opens a prompt asking you to update. If you choose not to update it eventually stops working because they change the protocol periodically.

I use lineage, and the signal apk from the website, and signal nags me to upgrade -- that doesn't happen automatically as far as I can tell. I've disabled the "install unknown apps" permission, but I don't know precisely what "unknown" means in this context.

You need to manually update apps from Fdroid due to artificial limitations introduced by Google for third party app stores - only Google Play and possibly device vendor apps stores can update apps automatically on non-rooted device.

FDroid has Silence and Jami which is what I switched to after signal started collecting and permanently storing user data in the cloud.

Silence is great but needs more contributors. Advertise it to your privacy-friendly friends and Android devs you know :)

Anecdote i learned recently about Silence: it's maintained by a jurist who works for a pro-privacy non-profit in France (La Quadrature Du Net)

Reply on news.ycombinator.com