While Signal is pretty awful on desktop(not to mention this[1] thing), it is my goto messenger on my phone. Brilliant security and props for being one of the very few to extensively use Rust in production. I was really sad to see they hire in the US only.
I find it odd that packaging for a specific distro is an upstream effort. I never understood why upstream source should include Debian/Fedora-specific files.
The way that Arch Linux approaches packaging makes much more sense to me - a single bash-like PKGBUILD file that describes how the upstream source should be transformed into a package that the distro knows how to deal with.
Arch PKGBUILD packaging is basically identical in design to RPM packaging, and can contain more than just s single build script (patches, pre/post scriplets in another file, etc.). Arch packaging feels familiar and "normal" if you're coming from any RPM based distro, including the SUSE family.
It is the DEB format which is generally unlike most others in architecture and design, you cannot toss "Fedora/Ubuntu" into the phrase and be honest, they are quite different and have different design goals.
> I find it odd that packaging for a specific distro is an upstream effort. I never understood why upstream source should include Debian/Fedora-specific files.
This is generally frowned-upon in Debian too. Upstream's effort are nearly always wrong from the distribution's point of view, and extra busywork has to be done to get rid of upstream's attempt.
On the flip side, I definitely do appreciate when upstream includes a debian directory, as that means I can easily self-build my own package with the latest source, even if I'm on Debian stable or whatever and don't expect and update or backport.
That's also the case if there's an official Debian package; you can build whatever package from whatever distribution (you may be missing dependencies, but it would be the same with an upstream debian directory). If one is going to contribute a debian directory, maybe it's more efficient to contribute it to Debian directly.
Note also that making "a" .deb package is not the same as making an official Debian package that satisfies the Debian Policy and passes the automated linters (lintian, piuparts, autopkgtest, etc). The second will have the minimum quality that Debian expects.
> That's also the case if there's an official Debian package; you can build whatever package from whatever distribution
Yes, I can `apt source foo` and then spend annoying painstaking time dumping in the new version of the upstream source, fixing any weirdness with the build system, updating dependencies, etc. I've done this every now and then and I hate doing it. It doesn't help that Debian's packaging tools have worse UX than git, inscrutable errors, and nearly nonexistent detailed documentation.
In contrast, if upstream has its own debian directory checked into their source repo, I can usually expect it to work; all I'll need is a `sudo apt build dep . && dpkg-buildpackage -uc -us` and it should build without any futzing on my part. And if an even newer version later ends up in the official Debian repository, it'll get seamlessly updated with no further work on my part.
(Meanwhile I also appreciate being able to grab upstream Linux kernel source, copy in my local config, and run `make deb-pkg` in its root to get a perfectly-functioning, updated kernel that installs things to the right places and properly integrates with dkms and update-initramfs. Even just rebuilding Debian's shipped kernel is usually not that easy.)
> Note also that making "a" .deb package is not the same as making an official Debian package that satisfies the Debian Policy and passes the automated linters (lintian, piuparts, autopkgtest, etc). The second will have the minimum quality that Debian expects.
I frankly do not care about that one bit. All I want is something that I can trivially build, installs on and integrates (reasonably) well with my system, will get upgraded automatically if a newer version shows up in an official Debian repo, and I can easily remove with `apt purge foo`. A debian directory checked into the upstream ticks all those boxes. Trying to shoehorn newer upstream source into an existing Debian-maintained debian directory usually very much does not. If your experience differs, all the more power to you, but this has been my experience using Debian for many years now.
For those kinda newish to linux, one thing I learned when I didn't have a deb/rpm file is to go look at the arch aur pkgbuild as a guideline of how to build the packages from source. Arch has surprisingly been a good guide for general linux questions.
Disagree. Signal on desktop works very well for me and is very useful for quickly sending files from desktop to phone and back, especially when the phone isn't handy.
The desktop app is very useful but it's mainly because there's no alternative. It's bloated, slow, under-featured. Telegram also has an electron desktop app but at least it lets me do ultra-advanced things like changing the spellchecker's language on the fly.
As somebody who's used to 100KB snappy and fully featured IRC clients I'm always baffled when I use these modern clients that use 3 orders of magnitude more resource to look and behave like a cheap clone of a smartphone SMS app, but worse.
I'll take your word for the telegram app. I prefer signal to telegram. Any benefit of the telegram desktop app seems like a marginal one when the signal one works and signal do encryption well, properly and honestly. (Maybe telegram are catching up to this now, not sure, Moxie has always been solid and has forced the entire feature set of messaging to end-to-end encryption for which he's going straight to heaven).
My own irc client I wrote when learning C and then re-wrote learning GTK+ is better than any of them in terms of doing what I want non-bloated as a client. But it doesn't quite match the whole signal thing somehow. :)
Signal is excellent software. Game changing stuff. Telegram (indirectly), Whatsapp (directly) owe signal a great debt. The reverse doesn't seem to be true.
End to end ecryption for the masses is a huge, huge win that Moxie can take a vast amount of credit for making happen, then improving and increasing. So there's a little hero-worship for Moxie, a man with whom politically I probably have very, very little in common. It's a good feeling when you can do that.
Signal desktop was missing basic features like answering calls not long ago. It also had at least one significant vulnerability (some code injection IIRC) so I don't know if I'd say that it does "encryption well". Having applications with such a needlessly huge attack surface is not good crypto in my book.
I do like Signal, otherwise I wouldn't put up with that software. But you can both enjoy the protocol and Android client and think that the desktop app is a pile a donkey dung.
And you can put the stated criticisms of it in proper context. Then assess the costs and risks to yourself. Compare its use along with the rest of signal to the alternatives. And examine the response of Moxies team to issues.
At least that's what I did and came up with a "Hard Disagree" on that statement. Signal desktop is pretty good. (And no I don't like electron apps as a rule - it's the only one I use).
Deviation from perfection is not donkey dung.
>Signal desktop was missing basic features like answering [voice] calls...
vs
Messaging on phone and internet everywhere was missing end to end encryption before Signal. (Yes I used OTR with like 3 people, now I encryption with almost everyone, thanks signal).
Advantage signal. By a huge margin, for mine. Picked the essential feature. Got it right. Expanded from there. I find it pretty hard to fault what they're doing. People who want to do it differently because they think it's "better" (eg federation), don't seem to actually get much done in comparison to signal's massive win they chalked up for all of us.
I find it kinda odd that here, where people understand tech, there is more sticking up for facebrick, goo, appletax etc when they screw their users yet again than there is for Signal doing the opposite. The contrast between how they view people who use their stuff is very, very stark. Signal are pretty great. We need more love for anyone who can achieve at a similar level to make computing better for us. To push competition toward being better at privacy, security and so on and away from the direction of turnkey totalitarianism surveillance that the Stasi could only have wet dreams about. Alarmist right? Could bad things really happen here? Are the interests of Cook, Zuck, Seregey, Larry, Jeff et al not precisely yours or a wider population's? They all do seem really quite friendly to despotic regimes. But I guess those reigimes are foreign?
The Signal devs have always been extremely hostile to anybody making third party clients, because they say they know better than everybody else. Instead of making a library or daemon that could interoperate with third party software and decently built messengers, they preferred to create their own Moxie Approved(tm) bloated elecron crap.
So be it. But then when their software is crap I won't just accept the "well at least it's not Facebook" defense.
They've given their reasons for why they have the policies they do. If they were bad reasons somebody else would have made something that makes signal redundant.
Somebody will make signal redundant one day. When I look at it I see that day has not come. When it does the world is a better place for the advances made by signal.
The decisions they've made are /why/ signal is the leader of the pack by a margin. But please do make better ones. Please do give us something better than signal. Their libraries are all capital F Free. Go for it.
Crapping on them from the sideline, sure, go ahead but acknowledge they've done rather better than /anyone/ else in this space. It's not even close. So maybe their decisions are worth considering as having some merit? Disagree sure, but really. They've done it. Well. I haven't. Nobody else has.
I don't like electron. The desktop client works well for me on linux and for non-techy family members on mainstream consumer machines. There's some merit there you're completely discounting which doesn't seem quite fair.
And it's not "At least it's not facebook"
It is: "Whatsapp now is end to end encrypted thanks to signal" and "new players have to match signal's encryption"
That's crap loads more than "at least it's not facebook" that's actually good as opposed less evil. Straight to heaven for achieving that, for mine.
Almost every time I start it after a few days it just purges all my conversations, demands I relink my phone and then doesn't show any conversation history.
It's hard to call it useful when it's so unreliable and broken.
Lots of people don't know about that feature...If anyone is wondering. You can send a message (for example on your Desktop) to "Note to Self" on and it will be available for you on your other Signal versions (e.g. on your Phone). Very useful.
There are efforts to get Signal working on the PinePhone and Librem phone through Anbox. Signal also does not require Google Play Services, it can run with completely libre software all the way down. So, Signal is becoming a viable choice on a device that meets Free Software standards and is not a “spyphone”.
I think (but haven't tried myself) that you can nowadays even confirm your number on desktop, i.e. receive a text message on a dumbphone if need be, and then enter the confirmation code on your desktop.
Yeah it's so odd to me that Signal has such top tier engineers and they can't manage to get a presentable desktop app. It looks and feels like a boilerplate Electron chat app with no styling and subpar performance (oh but they have stickers :eyeroll:).
I see people complaining about it being slow, but that's not been my experience.
My main complaint with the desktop app is that I really want it to sync message history with the phone app. If you, for example, don't use your laptop for a while, you'll have to re-authorize it and it won't have any messages from when it was off. I realize all of that is a trade-off for their security design, but having access to all my messages and being able to search them is important to me.
Does someone know more about the architecture of Signal's group calls? From looking at the ringrtc source, it seems that the calls are not fully meshed, but use some kind of group key and a SFU for server-side media distribution. Is that correct?
i want to like signal but the UX is wanting. i installed it today and it only imported some of my sms messages; found almost 1000 open issues on github. then i sent the "get signal" message to a friend who installed it but our messages still kept saying they were insecure sms. turns out we had to "refresh" our contact lists (there is no menu option to do this, you're just supposed to know to pull down on the contacts page -- discovered while reading the github issue related to the failed import). i also find the contrast ratio too high in dark mode and the random colors for all my contacts just make my eyes bleed. basically i felt like in 5 minutes of using it i'd uncovered as many bugs. maybe soon i can try to make the switch again.
The UI could be improved but it is fine IMO. I'm happy that I have a messenger over which I can talk private stuff and be reasonably sure that no one else can listen in. Everything else is secondary for me.
Contact discovery can have a slight time delay, but so far it has worked very well after a while. (I don't use SMS)
so i convinced my friend to get signal for a secure conversation. we both got it installed, and started talking. but it still said "unsecure sms" in faint grey letters in the input box. i almost didn't notice. she sent me screenshots she was messaging me from signal. we both verified our numbers. what was going on? after "refreshing" the contact list the unsecure message went away. were those initial message sent securely? i have no idea. that is the kind of poor ux that mars the experience -- without trust there is no point using it
> i also find the contrast ratio too high in dark mode
I actually tend to prefer this style of dark mode for messaging or other short-term use apps on an AMOLED display because it's just "off" with no background, but I agree that there really should be another option. Plenty of apps I've seen have Dark and Dark (AMOLED) versions, or similar.
Signal has been my daily messenger for messaging my SO and family for the past couple of years, so I'm looking forward to the moment when our legacy group gets upgraded and we can finally do group (video) calls.
unless they allow no phone accounts, its a non starter for many. including me. having been persecuted for having whatsapp installed on the phone, (which i personally dont, btw) for an adversary like a police state, whatsapp encryption is somewhat moot. public 'news' groups on whatsapp have admins and they are made to report to the local police station where that malware is installed. then its just a matter of time waiting for people to talk. the issue here is every account is linked to a phone number. easy for police to cross reference a person with that number because of already stringent kyc norms on phone numbers.
oh, telegram also suffers from this.
I'm not sure. Doesn't look like you're negative now (except this one). I guess because you're complaining about something that is in the works? But I'm not sure how you'd be expected to know what is going on. We're not all experts in the same things here and in the same areas. Whatever ¯\_(ツ)_/¯ This comment is downvoted because you asked about down votes.
Ah. Dont talk about fight club. Eh?.
'Anyways, I was not complaining. I was arguing why was phone used in the first place when there are real world security issues with it. Only because everyone is doing it. Then using a flawed tech with "security". I am hoping for signal to have usernames because until then I am not going to link
Agreed. Though Signal has more utility than WhatsApp thanks to its disappearing messages features.
Technological solutions only go so far when offline restrictions can be imposed. It's entirely likely that once Signal figures out username based registration & sees some traction in, Governments will just ban it.
yeah. my name seems to trigger "some" people. banning can be bypassed by whatever means available. the issue is that username wouldn't be tied to you which the police can just knock on the door which has happened more times i can count.
take for example matrix or discord. these services because of their non phone nature, it is very difficult for police to track down dissent. encryption is a fancy word when you are the only one using it.
i remember actively avoiding using tor back a decade ago because while it could be used to securely communicate online, i would have been the sore thumb.
mass adoption of encryption of all forms in all communications without leaving afk trails is the only way to keep internet safe from governmental control.
Is that on the roadmap? I was under the impression that native video calls will never happen. They might bundle jitsi automatically with the homeserver though
Assuming you’re suggesting WhatsApp is a Signal replacement, rather than what the previous commentor said, I’m afraid you’re mixing things up. From your Wikipedia link:
> The Signal Protocol's development was started by Trevor Perrin and Moxie Marlinspike (Open Whisper Systems) in 2013.
From the WhatsApp Wikipedia page:
> After months at beta stage, [WhatsApp] launched in November 2009, exclusively on the App Store for the iPhone.
From my own experience, I was on WhatsApp back in 2009-2010 on my OG iPhone that I got as a hand-me-down from a friend who’d just upgraded to the 3G/3GS.
WhatsApp integrated Signal protocol to all communication around 2014, so not much is left after the 2009 old school WhatsApp.
It's mentioned on the same wiki page.
So the branding and history of WhatsApp is longer, but the core is Signal. Also if you used both apps and their desktop clients you can easily see how close these two are.
Fair points. The whatsapp backend and protocol may have changed significantly to essentially just be a clone of open whisper systems.
The front end, however, remains significantly better on WhatsApp than on Signal.
I continue to use both daily, and as much as I loathe Facebook, I still prefer the UX on WhatsApp way more than Signal. That they look similar is more down to the fact that messengers today all look the same (look at facebook messenger, iMessage) than that WhatsApp has taken Signal's front end. If anything, Signal is slowly trying to emulate WhatsApp features, in a more privacy-preserving way, which understandably takes time.
They still force you to give your phone number, they still refuse to be on F-Droid, they still force you to go through their own server and not self host, their UX still sucks.
Once those points are addressed Signal would be great
It's still not very stable for video calls compared to e.g. Whatsapp. Video and audio often is desynchronized and considerable lags are present, even on good connection
Threema is not open source yet so I wouldn't use it for that reason. I did like their security whitepaper, though, and they do have some impressive clients (Mercedes-Benz, etc.).
Open source is a precondition. They can promise you the world, but if you can't build it yourself and get reproducible builds, who knows what's in there.
It seems that Threema charges for the app instead of requiring a phone number. Do they offer anonymous payment options like cryptocurrency or cash by mail?
I'm not sure how data protection works with Google Play and App Store payments, but I feel like this could be a potential privacy problem.
I use Signal as my primary SMS, and more and more of my contacts are using it. As such, I'm doing a lot more Signal voice and video calls. On my several year old, cheapy Moto G6, I've never had an issue with the battery draining noticeably faster when using Signal. I've done probably 45-60 minute calls over wifi, after which my battery is... maybe 70% full charge?
I had a successful hour-long video call on Signal recently using my aging iPhone SE (1st gen), which has battery-life issues in general but I made it through without needing to plug in. First time I’d used that feature of the app.
My biggest issue with calls on Signal is that if the app crashes, the call disconnects. This has happened to my on my up-to-date iPhone (10S) if I'm on a long call and get another Signal message, which means I need to unlock the app again.
On the desktop, I really wish that you could resize the contacts sidebar to just show the sender's icon, as you can in iMessage, but the maintainers don't seem to be particularly interested: https://github.com/signalapp/Signal-Desktop/issues/2510
> My biggest issue with calls on Signal is that if the app crashes, the call disconnects.
Of course the app crashing during a call is an issue, but I don't see how the call could stay open with the app closed without security expectations breaking?
Second that. I hear back my own voice, it drains the battery and the connection is almost always choppy.
I wanted to be able to use Signal to replace whatsapp, telegram and FB messenger. I've convinced some of my friends to install it, but none of them are happy with it.
On both mobile and desktop sometimes messages take hours to appear and on mobile it reserves ~2GB of storage for no apparent reason.
I trust that people behind Signal are brilliant got the security right, but the UX is simply not there yet.
2 GB on a fresh install? That would be definitely a bug. Did you check the storage usage (settings, storage)? Is it there as well?
Your debug logs would also be welcome for messages taking hours to appear. For mobile it's usually something with battery savings or FCM. For desktop that's the first time I read about that, are you sure that the messages had actually been sent?
I feel that for mobile it is still not as reliable as WhatsApp, but for desktop it's nice to be able to get your messages without mobile connection.
In case the storage is due to numerous messages and media, you have the option to limit the number of messages saved for each conversation, default is no limit I think.
IMO this was part of a misinformation campaign against Zoom from several months back.
Zoom is not malware and never was malware, although Zoom did so some installer tricks to help computer illiterate users get into meeting more
quickly, which coincidentally is their entire value-add.
Note I own no shares in Zoom, do not and never have worked for Zoom, and have no financial interest in Zoom.
And I don't want to diminish the skills of Zoom engineers, but when Google and Facebook (WA) can't offer more than 32 / 8, which tradeoff is Zoom doing to be able to offer E2EE calls with 1000 people?
I don't think my phone would be able to receive 1000 different video streams simultaneously for instance.
This is copied from the latest Android beta changelist. For what it's worth one of my groups has been converted so it seems to be happening.
> Your Legacy Signal Groups will be automatically upgraded to New Groups so they can get in on the new features we recently released, like admins, @mentions, group links, and more. Upgrades don’t happen all at once or instantly, and some groups may not upgrade for a while.
Hi, Signal employee here. The latest builds of all of our clients support upgrading. You just need to make sure everyone in the group is on the latest clients, including their linked desktops. In the future, we'll add the ability to force a migration for scenarios where some group members are inactive.
[1] https://github.com/signalapp/Signal-Desktop/issues/1630