On its 10th anniversary, Signal’s president wants to remind you that the world’s most secure communications platform is a nonprofit. It’s free. It doesn’t track you or serve you ads. It pays its engineers very well. And it’s a go-to app for hundreds of millions of people.
In the Libra signal issue that you linked to, they made it clear they don’t want third-party clients talking to signal servers
You’re free to use our source code for whatever you would like under the terms of the license, but you’re not entitled to use our name or the service that we run.
If you think running servers is difficult and expensive (you’re right), ask yourself why you feel entitled for us to run them for your product.
He was specifically talking to that developer. The “You” and “You’re” in that quote was specifically targeted at the LibreSignal developer.
I recall the gurk-rs developer specifically mentioned that his client reports to Signal’s servers as a non-official app. The Signal admins can see the client name and version - just like websites can tell what browser you’re using - and could easily block third party clients if they wanted to but they don’t.
If Signal wanted to block third party clients, they would have blocked them already.
Moxie made it incredibly clear, he does not want third party is talking to the signal servers.
Libra signal took him at his word and turn themselves off
The other developers, like Molly, take a stronger road.
Is signal currently banning third party clients? No. But they’ve made it clear they don’t like them. They didn’t actually ban Libra signal, they just asked them to stop. Could they ban the clients in the future? Yes
I respectfully disagree. They could be waiting until it becomes a big issue. Right now that would just cost them good PR, but if somebody was using the signal network and their client became very popular they absolutely have expressed the desire, intent, and as you indicated the capability to do so.
They could be waiting until it becomes a big issue
I guess I don’t see that as a problem if its causing a big issue.
Let me throw it back to you: If you were providing a service and a third party client was using your resources and causing a “big issue” like you stated, would you not want to remediate the problem? Lets say you introduced a new feature, but it doesn’t work for 15% of your user base because they’re using an outdated third party client that may not get fixed for another year or two - if ever. What would you do?
Here’s another example, lets say someone develops a client that lets you upload significantly bigger files and has an aggressive retry rate that as more people start using your client, it starts increasing the hardware requirements for your infrastructure. Do you just say “oh well”, suck it up and deal with having to stand up more infrastructure due to the third party client doing things you didn’t expect? Is that reasonable?
They have demonstrated history of asking third party clients to not use the signal name, and not use the signal network. The client that currently exists that do this do it against the wishes of the signal foundation
you keep moving the goal posts, Ive justified my position in the original comment.
By all means, use signal, I do. But let’s not deny the realities. I think we’ve covered all that we need to cover in this discussion thread. We don’t have to agree and that’s okay, and I wish you a good day, but I’m not going to respond anymore
The servers should absolutely not trust the client. Likewise, the client should not trust the server. When that is the case it is impossible for the third client to have more functionality than the mainstream client.
In the Libra signal issue that you linked to, they made it clear they don’t want third-party clients talking to signal servers
He was specifically talking to that developer. The “You” and “You’re” in that quote was specifically targeted at the LibreSignal developer.
I recall the gurk-rs developer specifically mentioned that his client reports to Signal’s servers as a non-official app. The Signal admins can see the client name and version - just like websites can tell what browser you’re using - and could easily block third party clients if they wanted to but they don’t.
If Signal wanted to block third party clients, they would have blocked them already.
Moxie made it incredibly clear, he does not want third party is talking to the signal servers.
Libra signal took him at his word and turn themselves off
The other developers, like Molly, take a stronger road.
Is signal currently banning third party clients? No. But they’ve made it clear they don’t like them. They didn’t actually ban Libra signal, they just asked them to stop. Could they ban the clients in the future? Yes
I’ll reiterate my statement as you didn’t address it.
I respectfully disagree. They could be waiting until it becomes a big issue. Right now that would just cost them good PR, but if somebody was using the signal network and their client became very popular they absolutely have expressed the desire, intent, and as you indicated the capability to do so.
I guess I don’t see that as a problem if its causing a big issue.
Let me throw it back to you: If you were providing a service and a third party client was using your resources and causing a “big issue” like you stated, would you not want to remediate the problem? Lets say you introduced a new feature, but it doesn’t work for 15% of your user base because they’re using an outdated third party client that may not get fixed for another year or two - if ever. What would you do?
Here’s another example, lets say someone develops a client that lets you upload significantly bigger files and has an aggressive retry rate that as more people start using your client, it starts increasing the hardware requirements for your infrastructure. Do you just say “oh well”, suck it up and deal with having to stand up more infrastructure due to the third party client doing things you didn’t expect? Is that reasonable?
https://hackertalks.com/comment/4806772
you keep moving the goal posts, Ive justified my position in the original comment.
By all means, use signal, I do. But let’s not deny the realities. I think we’ve covered all that we need to cover in this discussion thread. We don’t have to agree and that’s okay, and I wish you a good day, but I’m not going to respond anymore
The servers should absolutely not trust the client. Likewise, the client should not trust the server. When that is the case it is impossible for the third client to have more functionality than the mainstream client.
I haven’t seen evidence to back up your claims
If you have a backdoored client, then you would naturally object to third party clients :)