Hacker News Reader

Comment by proactivesvcs | Hacker News Reader

1. It's not stolen. It's used. It may not be used efficiently (or, if you're correct, used sensibly at all) but it's not stolen.

2. If deleted data not being purged from your iOS device is a "significant security flaw" then you shouldn't be using a device from Apple or Google; your threat model is way beyond the two big players.

3. Hyperbolic comments[1] don't help issues being re-opened. Helpful comments, preferably with steps to reproduce, and a polite note that the issue is still current, will get the issue re-opened in my experience. Getting on your high horse and making silly claims would get you put to the bottom of the pile if it were my job.

[1] https://github.com/signalapp/Signal-iOS/issues/4916#issuecom...

View on HN

It's not a hyperbolic comment. The Signal stale bot is bad and frustrates anybody contributing.

* I've reported NullPointerExceptions with stack traces, stale bot comes to close.

* I've reported Signal fatally corrupting its DB and losing all its data [1], stale bot comes to close.

Few things are more frustrating than investing your free time, and then finding an automated system pitted against you.

[1]: https://news.ycombinator.com/item?id=26841134, https://github.com/signalapp/Signal-Android/issues/11160#iss...

The most prominent red flag about Signal is that, for all its purported commitment to "developing open source privacy technology", a real, working open-source app is not on F-Droid.

https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...

I don't think availability via any particular distribution mechanism is a reasonable litmus test for "open sourcedness." Such a test would have excluded Linux for most of its development history, prior to migration to git.

This particular distribution (F-Droid) requires that the source be build-able from strictly source files, without bundling binaries.

You can download the APK directly from Signal: https://signal.org/android/apk/

When a new version is released, the Signal app notifies you.

Problem is, the APK is a closed-source binary. What they include there might be completely different from what is in the source.

Not with reproducible builds, no.

One more point in favor of Matrix/Element.

I agree it can be frustrating; the bot does seem to need tweaking.

The first issue was only closed two days ago and presumably it'll be reopened since it's effectively by design. The second issue you linked was not closed at all, and in fact looks to be been acknowledged. I don't like to nit pick but this just proves that the statement is indeed hyperbole: the Signal devs are paying attention, tickets aren't always closed and when they are closed I almost always see them re-opened.

> The second issue you linked was not closed at all

The only reason it's not closed is because I kept replying!

Had I not succumbed to the bot, it would have likely been closed before the acknowledgement, and never been looked at again.

> Getting on your high horse and making silly claims would get you put to the bottom of the pile if it were my job.

I disagree strongly. It’s not up to us — as designers and developers and maintainers of software — to decide how users engage with us. If they engage at all they are doing us a favor.

Tone-policing user bug reports is a nasty anti-pattern, a predictable way to make your software more user-hostile. Unless they degenerate into outright abuse, which is obviously unacceptable (and this does not), we should separate tone from content and see if the content is useful. A substantive response to the content, ignoring the tone, is usually the best practice.

I understand the issues you have with the claims, but I would argue that this is still a security flaw, given that Signal and other encrypted chat apps are often used by journalists and activists that may have openly hostile governments. If I were choosing an app to message about something sensitive like protests, etc., I would be pretty uncomfy with the idea that deletion doesn't actually mean deletion, even if it's only local. Especially given recent news about Russian police (reportedly) demanding to search random citizens' phones on the street[1].

[1]: https://www.independent.co.uk/news/world/europe/ukraine-mosc...

It's unfair to target individuals in this manner. If it were to me, I'd judge your comment as "borderline trolling". The OP has mentioned something specific and brought it to the notice of a larger audience.

Eh, sometimes going hyperbolic does the trick, but yeah, it’s not the most beneficial tactic, overall

>Eh, sometimes going hyperbolic does the trick

When has it ever worked?

Except that these full time engineers are getting in $110K per year to ‘fix’ these issues.

There isn’t any excuse left from that $60M in funding to fix these issues is there?

Maybe they were too busy integrating a scam private cryptocurrency over fixing these bugs.

I agree, and I am curious why your comment was downvoted. They have turned crypto shills :-)

Reply on news.ycombinator.com