dlmetcalf

> What in the world do you think our motivation is, then?

I didn't have much doubt before. But once you double-down on technical strategies that entrench concentrated power of Google, Apple, etc and leave users without open source options, I have to start to wonder.

> What code contributions?

I guess we'll never know. I think more could have been done to bring them back in though. There was obviously significant interest in LibreSignal for a reason and the community sure looked big enough to curate a PR between them. I'm pretty sure that the only reason they'd have given a different name to the fork (which might have evolved into a solid PR), was that they'd been told blanket that FDroid was never going to happen and hard Google dependencies would continue to be baked in.

> It does not entitle you to use our service for your product, or to use our name for your product.

Mate, you've been spending too much time with corporate lawyers. Take a breath. It's not a "product". In the days that GPL was written, operating as a closed service wasn't something the founders had even contemplated. It just wasn't the done thing.

> We'd all be better off if projects like XMPP had also learned from their mistakes.

The core issue with XMPP was that MSN Messenger, ICQ, etc. had deeper pockets. It wasn't fundamental technical flaws in open protocols. Sure, protocols don't always get it right the first time. I don't think HTTP would be better today though if we had to use 10 different browsers from 10 different vendors with pages that won't link together. Yes, XMPP had some issues (chief of which for mobile, was battery drain resolved by push). Let's hope Matrix gets traction.

> I don't know what you consider "the FOSS community," but I think of them as being the same people who have been sending me a torrent of verbal abuse, legal threats, and even death threats pretty much non-stop over the past three years. At no point have I wanted any part of that.

Well that's pretty sad. The BSD kernel of your iPhone, the Linux kernel of your Google devices and the GNU user space you enjoy on Linux are what the FOSS community have built. It just sounds like you're painting the whole community as abusive now.

Death threats etc should be reported to police. Likewise the community shouldn't be tolerating abuse. My condolences that you've had to go through that @moxie. It's bullshit and behaviours like that help no one.

No doubt, it's been traumatic and stressful, so I want to cut you a lot of slack. This in no way excuses their behaviour and I've never seen you engage in abuse, but mate (and recognising we're all human), your tone hasn't always come across as encouraging either.

> Plenty of people have used the Signal source to build their own projects (some even in "the FOSS community" like SMSSecure), so I don't know how you can say it's closed. Plenty of other people have also come to our project with an understanding of our development goals, and have helped to contribute to making Signal something better. A very small vocal minority of FOSS moralists have decided that we should have to do whatever they want if they scream loudly enough, and have contributed very little of anything but verbal abuse.

It sounds like it's always just going to be a protocol issue. Signal is a closed service and a closed network, unless you're using Signal's App. The GPL for the app in that context seems fairly meaningless in practical terms.

To anyone looking on, from the outside, it looks like OWS has taken a giant flip from their previous position: https://twitter.com/lyon01_david/status/733096322304249856. Maybe you need to work on your PR. When people see companies like Facebook given rights, but open source are not, it naturally raises eyebrows. Good on you for opening the iOS libraries now, but maybe it should just have been clearly stated (or repeated when necessary) that it was your intention all along, otherwise it really does give the impression it was only due to 'complaints'.

The fact that you keep painting other projects as "products" and legitimate security concerns as mere 'FOSS moralism', does make people really ponder what the development goals are.

I wonder who voted this down. I didn't know Google tax lawyers hung out on Hacker News. PR bot?

http://www.taxjustice.net/tag/google/

I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106

i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms. It's not like LibreSignal were doing anything particularly different to Desktop. LibreSignal would have been thrilled to have just had it upstreamed anyway.

How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic.

Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected?

Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network.

Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community.

The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.

It's ironic that WhatsApp runs fine on open source Android, but Signal won't.

Are you _sure_ that wasn't part of the deal @moxie? ;)

Thanks @Arathorn. That's great to hear an FDroid candidate's available. Great turn around! The only device I'd have to test it on right at the moment, unfortunately doesn't take 3rd party APKs (FDroid's been signed, but I'm reluctant to otherwise open that particular device). Will see what else I can pull together. I could sign the APK with my own OS build, but then I'd miss OTA updates (so a different security risk). MicroG sounds a good option. As for Copperhead specifically, I don't think MicroG will be on the table for a while though. Another push would be ideal I suppose (but I know you need to balance priorities).

Regarding entitlement, it's not just an advertising company the 'product' is tied to. Google is of course one of the most aggressive global profit-shifters for tax 'minimisation'. I would prefer to call it avoidance, as I can't see any other reason for it, but I don't have pockets deep enough for the legal defense to use a word like that (or evasion).

Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it:

"I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." (https://github.com/LibreSignal/LibreSignal/issues/37#issueco...).

You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat.

'LibreSignal' never wanted their own "product" as you choose to call it. No one in that community was trying to compete with you. They just had legitimate security needs, or wanted to use Signal as it was, but without being tied to an advertising company. The App Store risks aren't even theoretical or tin-foil-hat material: https://twitter.com/SwiftOnSecurity/status/72356243560126464...

Having option to run on a reasonably secure endpoint (e.g. the Copperhead's of this world), that users have some hope of securing, seems a pretty reasonable desire. Since increased security is really the only point of using Signal, and a secure channel is useless if the endpoint is not.

The name "LibreSignal" was also not the same as "Signal". If they HAD just redistributed as "Signal" (especially if trademarked), or otherwise didn't make clear it was an independent/unofficial build, then sure that's an issue. However the developers agreed immediately to changing the name further when requested.

In terms of the voice server, I'm just going on what other developers have stated. I'm not personally aware whether the TURN server is the only missing component or not.

The fact is though, if a user wants to run Signal on a straight-forward Android Open Source device, without adding a large attack surface of Google Apps, then Signal app is not an option. Regardless whether open source clones are possible, you know communications utility comes down to the network itself too (Metcalfe's Law) and holding one tin can, with a dangling piece of string and no one on the other end is rather useless. Now Signal has captured the whole user base, there's large costs in changing.

Anyway, your code, your call. I think the key thing, is that people were surprised. Closed distribution models and controlled ecosystems, coming from a company purporting itself as being Open (and not meaning to be personal, but by a guy calling himself an anarchist), was not what people thought they'd been promoting.

We don't think you're everything bad in the world. We just wish that using Signal was an option.

Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many.

Signal app itself still can't run on Android Open Source, because it forces centralised metadata collection on the user via Google Play Store and GCM. Installing Google privacy-invading bloatware, is a prerequisite, which also further requires you to destroy your phone's security model because all non-vendor GCM options currently require you to patch a nasty hack into the kernel or otherwise prevent you using a secure, verified bootloader.

But like 'blame Apple', 'blame Google', because Signal won't provide or permit a WebSocket fallback (to do exactly the same as desktop client) - the one major thing LibreSignal wanted and were threatened legal action with if they did. Oh, that and using a trustworthy (FDroid), not just trusted, app store that doesn't require bloat, metadata leaks & GSF battery drain.

So, if your operating system can't support GCM (for good security reasons), or you just don't want to give up your data (kind of the point of Signal), then you're out in the cold.

You may think "It's open source, I'll run my own server". Nope. It's not just that they won't allow others to federate with their servers. Even if you were willing to give up your entire network of Signal contacts (that you've been building because you THOUGHT they were Open as they always painted themselves) - you can't. 'Open' Whisper aren't open sourcing their server. The voice side is locked up. Don't forget, you didn't choose GCM. Signal took the SMS option away after you'd built your network, plus convinced all your friends to drop XMPP alternatives and install Signal.

This license is too little, too late.

Matrix.org is providing a secure, viable modern, open alternative to IRC and XMPP, that also federates with them. With clients like Vector.IM that'll soon be non-GCM too. It already provides better functionality than Signal app and with Olm protocol (being merged within weeks) is equivalent to Signal encryption anyway.

Conversations.IM already works beautifully without Signal (plus is merging with the resources of ChatSecure). They've proven very well that you CAN in fact have an awesome (and secure) user experience based on XMPP.

The thing that really annoys me, is that while we spent all these years just backing Signal, singing their praises - thinking they were open (yeah, more fool us) - we were also diverting attention, installs and sentiment/resources from genuinely open protocols & projects for the web. Now those networks are gone, they're hard to get back.

The good news is that Matrix is technically good enough to win, so I hope they do.

Why have Signal Protocol chosen now to open the license up a little? Well, I can't help but wonder if it's because Olm is finally ready, done and merging for public release.

It's not just Intel you're trusting, it's the OEMs, who also have an EXTREMELY poor record. Just take a look at the ENORMOUS number up BMC and auto-update vulnerabilities. They really just either couldn't care less, or are deliberately making machines vulnerable. Things are being pushed into IME, that aren't optional, often aren't wanted by users (or snuck in there so they wouldn't know), don't all have to be there, can't be verifiably disabled or overriden by end users. Even if it weren't backdoored (unlikely), it presents an ENORMOUS attack surface at the very worst possible privilege level. Open source designs that are at least inspectable by researchers would be a start. But more importantly - allowing users to CHOOSE whether they want to override software (it IS after all software and not hardware). Why shouldn't we be permitted to run Libreboot etc on modern hardware and know that when we turn a machine off, that it's off, without unplugging network, power cables, batteries, etc?

I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slightly more options (if slim). Agree it's not widely enough recognised either though. There's some coverage at least:

https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+... http://arstechnica.com/security/2013/08/remote-admin-tool-im... https://www.usenix.org/system/files/conference/woot13/woot13... https://community.rapid7.com/community/metasploit/blog/2013/... https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... http://www.websecuritywatch.com/authentication-bypass-vulner... http://fish2.com/ipmi/itrain.pdf

IME is horrible and we should be railing against all horrible implementations. I can assure you I let my OEM know full well how I felt about insecure automatic update software (even though I wipe the system as soon as I get it, something I can't do with ME). I'll be taking my next purchase elsewhere. Unless people speak up, it's guaranteed to only gets worse.

Vocally support Power8 and RISC-V projects and ensure Intel knows you're angry.

No doubt some of the bigger ones probably will. When it's BSD (not bound by restrictive commercial licensing agreements) though, it massively lowers the barriers to entry for manufacturers who will offer security.

Anyway, here's an entirely open source one you can inspect: http://www.lowrisc.org/. Put it on an FPGA if you want.

Totally agree. She's brilliant. Deepest respect to her.

One of the extremely few people with genuine understanding of hardware security, who's working on the side of users & humanity.

The first time I read her work, I was floored that I hadn't known of her earlier.

Yeah, right. I suppose we're just supposed to take their word for that. There's an enormous difference between the concepts of trusted and trustworthy. You're extremely naive or clearly never read anything Snowden released if you think 'trust us' is enough.

Let me make this totally clear. The top OEM hardware manufacturers couldn't give a CRAP about your security.

https://duo.com/blog/out-of-box-exploitation-a-security-anal...

e.g. http://teletext.zaibatsutel.net/post/145370716258/deadupdate...

But you're totally fine that THESE are the people with unfetted power to fill your system with backdoors? (Not to mention NSA etc who'd almost certainly have access).

What's wrong with you having zero care about the world's data security?

RISC-V architectures hold the most promise there AFAIAA.

BSD-licensed, cutting-edge architecture and it's got the right backers.

FreeBSD is already ported to it. There'll be a range silicon implementations. Cambridge's lowRISC is likely to be the first SoC, with design completing this year.

I hope these guys get lots of orders and prices fall (Raptor's Talos Secure Workstation): https://www.raptorengineering.com/TALOS/prerelease.php

With Google having ported all their software to Power8, I'm looking forward to more economies of scale kicking on.

Seriously, watch this ^. It's pretty much the canonical coverage of the topic.

Wow, no one here has mentioned Johanna Rutkovska's (Invisible Things Lab & QubesOS), "Intel x86 Considered Harmful"?

http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/2015/10/27/x86_harmful.html

Essential reading!!

https://www.youtube.com/watch?v=rcwngbUrZNg

Thanks Arathorn. Matthew's confirmed that to me also. I expected that'd be the case.

Yes, see https://matrix.org/docs/spec/olm.html. An implementation of that spec is in final testing and expected to land into master within a couple of weeks.

It's a double-ratchet, very similar to Signal protocol, but unencumbered by the GPL/iOS licensing issues that Signal's implementation has.

I know Olm is open: "The Olm specification (this document) is hereby placed in the public domain.", https://matrix.org/docs/spec/olm.html).

Is the Matrix Spec public domain too?

Am I missing something here? What license is the Matrix Specification itself under? (I know most of the implementations themselves are ASLv2).

It seems really unclear from the site & repo: https://github.com/matrix-org/matrix-doc, https://matrix.org/docs/spec/ (apart from being copyright to Matrix.org)

Is this yet to be clarified? (Maybe the Google vs. Oracle case makes it slightly less relevant, but needs to be clarified).

What stops Matrix getting everyone aboard, then releasing new CLOSED versions of the major server and clients with a new spec (as the protocol formerly known as Axltl did), and carrying the critical mass of user base with them? Sure, the implementations are ASLv2, so in theory the community could fork, but in practice that doesn't always work. Is there going to be incentive to keep it open? (Signal was an 'open' implementation and spec too, but that didn't work out as people expected, even though OWS are non-profit).

Thanks.

I should add, that the ability to bridge networks, means that XMPP, IRC and others won't/don't need to be cut off from Matrix either. That's kind of the point and interop is one of the big features it will have going.

I actually think it's very good thing that people are asking that question (why not fix XMPP)!! We know from Bob Metcalfe's Law, that starting new networks has a very high cost, either in adoption/migration, lost investments in past standards, duplication of efforts when multiple need to be supported, or when they fail to gain critical mass. There's a limited pool of attention and resources and it's right for people to be instinctively cautious and have the discussions.

For me, the more I learn about Matrix, the more persuaded I am that it really does have merit. If I were a Matrix developer, I wouldn't feel disrespected. I'd be super glad that people are asking questions and genuinely seeking to test that the idea is right. From their dialogue with the community that I've seen so far, the developers are doing great and seem to thoroughly appreciate there's been a lot of false starts by various groups over the years.

TLDR;) - It may be obvious to you, but it's GOOD people are having the conversation. Questions and even dissent should be embraced. It's not about disrespect, it's about testing & validating new ideas.

Nice! I really am excited for you (and us)!

Re OWS; yes, I still keep some small hope that they've just been too preoccupied and not completely thought/worked things through. People are human and they've clearly had a lot going on! Their position as stated really did surprise a lot of people. Matrix.org's views on decentralisation certainly sounds FAR closer to the future I'd like to see for the net. Being able to evolve or change clients and integrate new technologies, without cutting off the entire network, seems clearly a very good thing indeed.

It's great to see how open you are to community feedback. Hats off for your responsiveness!

I hadn't tried it, no. Was just going on what others had said here. That's great to hear it has at least some sort of fallback! Polling however is typically too battery draining to be practical. Battery drain was one of the biggest reasons XMPP lost traction.

If Matrix adds something like XEP-0357 Push Notifications, enables verifiable builds & FDroid distribution, plus gets full featured XMPP bridge implementations done, then I think you're onto a winner. It gets extremely hard to convince people to install N+1 different IM clients once N>5, let alone the >10 that're becoming common. The XMPP Push XEP is working fantastically in Conversations IM and extremely fast too BTW (much snappier than Signal at least).

Congratulations on your work on the Olm implementation too!!! Now that Signal Protocol has been locked up in legalese (turns out Open Whisper WEREN'T really open), you guys are THE leading E2E implementation. It's really a fantastic contribution to the community and we owe Matrix devs a huge thank you!

Leaving people no option but to use Google's infrastructure (if they want to participate with anything better than a browser) seems an ENORMOUS gap, given the rest of the project's goals. If you want to use it on mobile, it IS still centralised around Play Store and GCM (where Google can collect all your metadata).

You can't even install the Matrix mobile app on open source Android phone that doesn't have all the Google bloatware installed (which you can't do on decent OS's like Copperhead yet while keeping a signed & verified boot loader).

You've done some great work, so I don't want to be too critical (I don't have time to implement the fix for a start!) - but this is almost like how Signal claims to be open source, but you can't ACTUALLY USE the iOS version, because GPL is incompatible with Apple Store.

You claim to be open source and decentralised, but you can't actually use it on an open source and decentralised platform. So I kinda don't see the point.