TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Why Not Signal?

43 点作者 awll大约 3 年前

11 条评论

kuyan大约 3 年前
Things I agree with:<p>- MobileCoin rollout was pretty poorly done and communicated, regardless of the team’s intent. Withholding server source for a year to conceal MobileCoin development really didn’t attract any goodwill, either.<p>- Phone numbers being required is a bummer. I know that there’s work being done to remove this requirement, and I know that there are valid UX reasons to require phone numbers, but still not desirable for a secure messenger.<p>- The lack of federation is a valid critique. Moxie has defended this position at length in writing, but I found Matrix’s rebuttal (also a good read) more convincing.<p>Things I wish were substantiated more strongly:<p>&gt; The reason the US government hasn&#x27;t tried to block or hinder Signal, is because it&#x27;s satisfied with the amount of information Signal can provide to it.<p>I found this unconvincing; this is a pretty big leap to make without more evidence. (Good counterexamples are all of the Signal alternatives mentioned in TFA.) I also don’t think it’s accurate to say the USG hasn’t tried to block or hinder Signal or E2EE messaging in general.<p>This reasoning would also disqualify Tor, which the author cites as a technology used in one of the Signal alternatives.<p>&gt; Signals database [has] Message senders and recipients (via phone number identifiers)<p>Doesn’t Sealed Sender mean this isn’t the case? To their credit, the author mentions this a couple paragraphs after. I didn’t find that analysis consistent.<p>It would have been more persuasive to directly address Signal’s blog posts on collected data released in subpoenas (<a href="https:&#x2F;&#x2F;signal.org&#x2F;bigbrother&#x2F;central-california-grand-jury&#x2F;" rel="nofollow">https:&#x2F;&#x2F;signal.org&#x2F;bigbrother&#x2F;central-california-grand-jury&#x2F;</a> - maybe I missed it) and the zero-trust model of the protocol itself. Reflections on trusting trust, and all that.<p>And more, but this is most of it.
评论 #30873109 未加载
flaburgan大约 3 年前
&gt;Signal also notably isn&#x27;t self-hostable: there&#x27;s no way to run your own signal server, and control your data. Marlinspike ruthlessly shuts down anyone attempting to build alternate clients or servers that could communicate with the main one.<p>That is perfectly wrong. As a maintainer of <a href="https:&#x2F;&#x2F;axolotl.chat" rel="nofollow">https:&#x2F;&#x2F;axolotl.chat</a>, a third-party signal client initially built for Ubuntu Touch but which runs on almost everything now, I can tell you that our client is speaking without any problems to the official Signal servers, and also that the code of the server is available and is running fine, we used it to test our code.
评论 #30873046 未加载
评论 #30873310 未加载
评论 #30877828 未加载
akerl_大约 3 年前
Throughout this page, the author fluidly shifts between conspiracy theories (that the CIA may be controlling Signal), opinions (that for a messaging platform to be good it must be self-hostable), and misdirection (NSLs exist, but it’s noteworthy that if you use a non-US company, the USG doesn’t need a warrant at all to compromise and extract data).<p>Moxie has been pretty clear about the problem Signal is trying to solve: radically upgrading the security of messaging for the masses. I’d say he’s clearly accomplished that: for the average human, migrating from SMS &#x2F; email &#x2F; etc to Signal or WhatsApp will immediately make their communications an order of magnitude more secure.
dijit大约 3 年前
People get very emotional about this. So, maybe instead of it being “signal” it was instead: “closed chat app”.<p>I have an issue with closed chat app. My issue is that it’s closed, but often pretends to be secure.<p>I can’t be sure it is secure, because they pay lip service to open source, they also integrate another Foreign (to me) companies binary SDK which is also not open source.<p>They’re also a closed system, meaning that they have direct network effects and have been hostile to third party implementations of clients.<p>The protocol is documented (somewhat homegrown, more like an evolution of something existing), and the server is “open”, but it’s not possible to actually use these things.<p>The politics of the founder are sometimes in question. They’re also foreign to me and have had brushes with their nations law enforcement. Whether I can trust them shouldn’t be my concern- if the service were open it would not be.<p>So, I personally don’t believe in it.<p>I would _rather_ have a small collection of TLS irc servers or zulip servers, because lots of small targets is better than a big centralised one; Better than that is matrix which is properly federated.<p>Tell me though, was I talking about signal, whatsapp or telegram?<p>They all suffer the same problems and people like to bicker about their personal favourite; forgetting that you shouldn’t be throwing in to this kind closed ecosystem with its stupid network effects.
upofadown大约 3 年前
&gt;In April 2021, signal outraged the open-source community by going a whole year without publishing their server code updates.<p>So? We have no way to be sure what is actually running on the server. In an end to end encrypted system, if the server can degrade security then you are doing it wrong.
评论 #30872896 未加载
评论 #30874373 未加载
gnabgib大约 3 年前
Fairly large discussion 7 months ago (45pts, 37 comments)[0] Commenters did not take too kindly to it at the time.<p>[0]: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28544735" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28544735</a>
sliken大约 3 年前
Messaging is so low bandwidth I&#x27;m surprised there&#x27;s not an E2E p2p chat client that uses a DHT to find all the other clients.
评论 #30872663 未加载
评论 #30873193 未加载
rvz大约 3 年前
Why does it need a cryptocurrency built into the messenger exactly? [0]<p>The fact that this whole post about Signal is now flagged on HN tells you about why they cannot answer this simple question.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;dessalines&#x2F;essays&#x2F;blob&#x2F;master&#x2F;why_not_signal.md#bundling-a-cryptocurrency" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;dessalines&#x2F;essays&#x2F;blob&#x2F;master&#x2F;why_not_sig...</a>
Markoff大约 3 年前
Agreed with article, but for ordinary users I would have much easier to understand reasons why I ditched Signal some time ago after years of use:<p>1. It&#x27;s unreliable, if you switch between mobile network and WiFi connection it takes way long time for Signal to register to change to send&#x2F;receive the messages, while Whatsapp has no such problem and send message almost instantly.<p>2. Devs ignore users, I waited years for file picker being able to provide such BASIC feature as selecting multiple pictures at once, for years you have to select pictures one by one, Signal devs remind of Firefox devs, zero interest in fixing basic things.<p>3. It&#x27;s unreliable poorly operated service, I remember when Signal went down and it took almost whole night in US until someone in US woke up and fixed it, I was for hours without working service.<p>4. The last drop was when they started ti push on users some PIN code nobody asked for taking 1&#x2F;3 of the screen until you created it, for some users full screen nag. Then I decided to move me and my wife and both of my parents from Signal, so good luck with such crappy service (I know they soon backpedalled from this stupid decision but it was already way too late for us and they lost at least 4 users).<p>5. It&#x27;s user hostile - there is no way knowing long pressing Send button allows you to force send message as SMS to Signal user, there was no introduction at first launch explaining this to user, each and every user have to go to Google and search how to do this. I assume also there is no automatic SMS fallback for Signal messages which are not sent&#x2F;delivered within specific time frame.<p>6. There is no 3rd party app allowed, so you are stuck with one option whether you like it or not despite their &quot;open source&quot; claims.<p>All these happened before it became hype and fashionable to be on Signal, so maybe it&#x27;s different now, but these are basic things ordinary users care about who don&#x27;t even really care all that much about privacy and other stuff.<p>If you want to use alternative service you better use Element (Matrix), it doesn&#x27;t require phone number, it doesn&#x27;t rely on one American controlled server.
评论 #30876280 未加载
V__大约 3 年前
Yes, the criticisms are generally valid. However, if the only proposed alternatives are Matrix, XMPP, Briar and Jitsi then Signal is still the best messenger. Of course those alternatives are great but for 99% of the people they are way too complicated.<p>I think what Signal should do, is set up additional multiple servers in the EU and maybe add some kind of noise messages to make it harder to analyze the meta-data&#x2F;social-graph.<p>People&#x2F;Groups&#x2F;Firms who need more security should probably switch to Matrix.
gorwell大约 3 年前
What could Signal do to prove they aren&#x27;t a honeypot?<p>I have no idea if they are or not, but it&#x27;d be a disaster if they are. Or maybe not. I suppose people might just shrug it off like the NSA. sigh.
评论 #30872714 未加载