16 ms·

> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solution

by moxie 10y ago

> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion about LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative? > He also uses the GCM library from Google, which pulls in several analytics libraries into the APK Could you cite this as well? Here's the entire POM file for the version of the GCM library we use: <?xml version="1.0" encoding="UTF-8"?> <project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> http://www.w3.org/2001/XMLSchema-instance"> <modelVersion>4.0.0</modelVersion> <groupId>com.google.android.gms</groupId> <artifactId>play-services-gcm</artifactId> <version>8.1.0</version> <packaging>aar</packaging> <dependencies> <dependency> <groupId>com.google.android.gms</groupId> <artifactId>play-services-base</artifactId> <version>8.1.0</version> <scope>compile</scope> <type>aar</type> </dependency> </dependencies> </project> A single dependency. If you follow it, the only transitive dependency is the supportv4 library. Where are the "several" analytics libraries? > (And in addition to that, Moxie even refuses to allow any distribution that doesn’t come with full analytics, which is extremely user hostile.) What do you mean by "full analytics?" Is there something user hostile about having an aggregate count of the number of users you have on what platforms, so that you can develop and deploy software accordingly? About being able to receive crash reports when users choose to submit them so that you can fix their problems?

topkeks 10y ago
kuschku BTFO
- kelnos 10y ago
  > If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? "Open" doesn't mean you get to use someone else's servers. It just means that the code is there and you can make use of it in your app. There are a ton of things in that code that are valuable and useful as open source beyond the line that lists the URL of their servers.
  - kuschku 10y ago
    The whole point of Signal is that it trades a little bit of security away, and in turn you get something everyone can use. If you fragment the user base, you throw exactly that away. Because no user is going to be willing to install 20 Signal forks to talk to all their friends. So, in practice, Signal is either at most visible source, or it's actually destructive to the average person's message security. The only advantage Signal has over XMPP with OMEMO is the "everyone can use it, just works, everyone uses the same version" part.
    - kelnos 10y ago
      I don't disagree with you, but the reality of running an API service in the cloud means it's tough to support more than just your own clients if you don't have a large budget. And it's easier to coordinate breaking changes if you have control over both the client and server.
kuschku 10y ago
> Please cite this. I’m sorry, what was this entire discussion then supposed to mean? https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect? > Could you cite this as well? Have you actually read the code that gets compiled in when you depend on play-services-base and play-services-gcm? As I happen to have reversed all of it to write an open source library for GCM, I have. And let me tell you, most of the code in there is "measurement"-code. > What do you mean by "full analytics?" Distributing through any means where the user can get the app without being required to be fully tracked by the Google Play Services? You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices.
- uph 10y ago
  > If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license https://github.com/WhisperSystems https://github.com/WhisperSystems but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free. > How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect? https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/ > You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices. https://news.ycombinator.com/item?id=12689352 https://news.ycombinator.com/item?id=12689352
  - kuschku 10y ago
    > What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. Because Moxie claims he wants to change mainstream communication? You don't revolutionise mainstream communication by fragmenting your user base even more. If every fork did what Moxie suggested, and create a completely new network, then soon there will be only a handful of users per network at all. And users will just go back to Facebook or WhatsApp. The claimed aim of Moxie is that everyone uses the same, partially safe, chat system. The only merit Signal has over XMPP is that it aims to be used by everyone, including your grandma, trading adoption vs safety. If that is the aim, you have to ensure it also is 100% compatible. If you directly suggest to fragment the userbase, you are destroying the one single merit Signal has over XMPP with OMEMO. Because then it becomes just another protocol for crypto nerds (and a worse one, in fact, considering the inclusion of Google code). So, explain to me, how is fragmenting the userbase in any way conductive to the claimed aim?

by moxie 10y ago

topkeks 10y ago

kuschku BTFO

kelnos 10y ago
> If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? "Open" doesn't mean you get to use someone else's servers. It just means that the code is there and you can make use of it in your app. There are a ton of things in that code that are valuable and useful as open source beyond the line that lists the URL of their servers.
- kuschku 10y ago
  The whole point of Signal is that it trades a little bit of security away, and in turn you get something everyone can use. If you fragment the user base, you throw exactly that away. Because no user is going to be willing to install 20 Signal forks to talk to all their friends. So, in practice, Signal is either at most visible source, or it's actually destructive to the average person's message security. The only advantage Signal has over XMPP with OMEMO is the "everyone can use it, just works, everyone uses the same version" part.
  - kelnos 10y ago
    I don't disagree with you, but the reality of running an API service in the cloud means it's tough to support more than just your own clients if you don't have a large budget. And it's easier to coordinate breaking changes if you have control over both the client and server.

kuschku 10y ago

> Please cite this. I’m sorry, what was this entire discussion then supposed to mean? https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect? > Could you cite this as well? Have you actually read the code that gets compiled in when you depend on play-services-base and play-services-gcm? As I happen to have reversed all of it to write an open source library for GCM, I have. And let me tell you, most of the code in there is "measurement"-code. > What do you mean by "full analytics?" Distributing through any means where the user can get the app without being required to be fully tracked by the Google Play Services? You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices.

uph 10y ago
> If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license https://github.com/WhisperSystems https://github.com/WhisperSystems but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free. > How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect? https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/ > You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices. https://news.ycombinator.com/item?id=12689352 https://news.ycombinator.com/item?id=12689352
- kuschku 10y ago
  > What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. Because Moxie claims he wants to change mainstream communication? You don't revolutionise mainstream communication by fragmenting your user base even more. If every fork did what Moxie suggested, and create a completely new network, then soon there will be only a handful of users per network at all. And users will just go back to Facebook or WhatsApp. The claimed aim of Moxie is that everyone uses the same, partially safe, chat system. The only merit Signal has over XMPP is that it aims to be used by everyone, including your grandma, trading adoption vs safety. If that is the aim, you have to ensure it also is 100% compatible. If you directly suggest to fragment the userbase, you are destroying the one single merit Signal has over XMPP with OMEMO. Because then it becomes just another protocol for crypto nerds (and a worse one, in fact, considering the inclusion of Google code). So, explain to me, how is fragmenting the userbase in any way conductive to the claimed aim?