Re:Signald: Unofficial daemon for interacting with Signal
by jeltz on Monday April 26, 2021 @05:57AM
(#26940904)
They probably do not have a leg to stand on legally but what should I do if they ban me? Sue them?
Re:Signald: Unofficial daemon for interacting with Signal
by sneak on Monday April 26, 2021 @05:59AM
(#26940917)
How or why would they ban you for publishing software?
If they ban end-user accounts that use your client software to connect to their API, that's obviously a bug in your software as it diverges from the behavior of the official client. This is why anyone making an alternative client should be doing so with a fork of upstream that is regularly updated. You'd need to keep it in sync pretty closely. Most official Signal clients autoupdate (a huge security vulnerability in and of itself[1], as SolarWinds demonstrated very nicely for everyone), but not all of them (you can't override the user's systemwide app autoupdate setting on iOS), so they have to maintain BC with out of date versions for at least a few weeks/months.
[1]: https://github.com/signalapp/Signal-Desktop/issues/4578
Re:Signald: Unofficial daemon for interacting with Signal
by jeltz on Monday April 26, 2021 @07:32AM
(#26941416)
I was referring to banning of users who use third party clients and I do not think it would be particularly hard to do if they really wanted to. You can for example use request patterns or the fact that the unofficial clients do not autoupdate. I doubt that they would go that far, but it would be trivial if they really wanted to.
Re:Signald: Unofficial daemon for interacting with Signal
by sneak on Monday April 26, 2021 @09:40AM
(#26942378)
Banning the set of users that are so passionate about your service that they jumped through hoops to work around your dogshit software is probably not the best decision a product company can make.
Re:Signald: Unofficial daemon for interacting with Signal
by slenk on Monday April 26, 2021 @01:46PM
(#26945520)
Yea but Moxie is trying to make money out of said dogshit software with his crypto editions
Re:Signald: Unofficial daemon for interacting with Signal
by sneak on Monday April 26, 2021 @08:37PM
(#26950224)
FWIW Moxie has claimed to own zero mobilecoin, and Signal/OWS is a nonprofit.
You're accusing him of lying.
Re:Signald: Unofficial daemon for interacting with Signal
by orhmeh09 on Tuesday April 27, 2021 @03:14PM
(#26960171)
Nothing GP said has to contradict either of these. I think you’re accusing them of accusing him of lying. Was Marlinspike paid for his services to mobilecoin, possibly even as CTO? Be more careful with your accusations. https://www.coindesk.com/signal-founder-may-have-been-more-t...
Re:Signald: Unofficial daemon for interacting with Signal
by andrepd on Monday April 26, 2021 @07:02AM
(#26941252)
That thread is a bit ridiculous, the guy was already told that he can block updates.signal.org if he really wants to inspect the commits first, but he insists there no workaround.
Re:Signald: Unofficial daemon for interacting with Signal
by sneak on Monday April 26, 2021 @09:39AM
(#26942367)
My mitigation strategy for this issue has already been posted in that thread; I didn't file it because of my own computer.
Re:Signald: Unofficial daemon for interacting with Signal
by ejfiskbkkd on Monday April 26, 2021 @08:47AM
(#26941940)
Is the link you provided right? I don't see how it relates to this. I generally agree with your statements, but I wouldn't want to run a project like LibreSignal with the lead of the original project not wanting my project to exist, although I find moxy's behaviour in this case very unsetteling.
Re:Signald: Unofficial daemon for interacting with Signal
by sneak on Monday April 26, 2021 @09:41AM
(#26942388)
My rant about the licensing confusion is at the bottom of the post, below the part about how it silently ruins the files you attach. It should probably be a different blog post, but I don't feel the rant alone is worthy of its own webpage. I like dispelling misinformation, but I don't like drawing specific attention to misinformation, if that makes sense?
Re:Signald: Unofficial daemon for interacting with Signal
by diegoperini on Monday April 26, 2021 @05:52AM
(#26940874)
Thanks for letting us witness your research.
The ToS for the signal service API applies to end users who connect to that API. The ToS of the API does not apply to software - the AGPL license applies to that, and the AGPL permits anyone to make forks (including ones that are configured to talk to the official servers).
EDIT: Disregard the following paragraph. See below.
There is a little bit of an issue, though, because contributions to Signal's upstream are not accepted unless the contributors sign the CLA, which allows Signal to relicense future versions more restrictively as they wish. They could relicense and then introduce intentional incompatibilities in the protocol if they really wanted to harm forks, but that would make them non-free, non-open-source software.
EDIT: Turns out I'm wrong in the above - the Signal CLA, to their immense credit, only permits relicensing under OSI-approved free software licenses. Fork away!
Moral of the story: don't listen to bluster, stick to what the license says (and the AGPL says you can fork), and never sign a CLA. You don't have to sign a CLA to contribute to the Linux kernel, and you shouldn't ever sign one to contribute to any other open source project.
I also wonder if it's even possible to enforce an "official clients only" restriction in the ToS for the service API. This would be a little bit like Google claiming that you aren't authorized to use Firefox to access google.com (i.e. insanity). Technologically if you tracked upstream closely enough, they probably wouldn't even be able to tell if a given 3p client user is running your fork or the official one.
(This whole comment is a paraphrase of a blog post[1] I published just a few hours ago that tries to dispel this whole "but you can't fork Signal and use the official servers" false meme.)
[1]: https://news.ycombinator.com/item?id=26940342