Not that I really want to defend Signal (XMPP FTW!), but the legal threats were about using the Signal name, not making an unofficial client per se. I know a bit about it because I develop an alternative signal client (a signal-XMPP gateway to be more accurate). That said, they don't help 3rd party client devs at all.
The name is what their reputation is staked on, and if a third party compiled it they have no idea if malware is secretly packaged in there too.
Having said that, the smart move is to dedicate a few engineer hours to packaging it for every linux distribution and every app store, even the smallish ones, to prevent others trying to 'be helpful' and requiring you to send a takedown.
>we really don't want forked versions of the app maintained by other parties connecting to our servers.
that's just misleading misdirection.
Firefox have issues with the legal name, that's why the source is called by other names and the branding is added later on.
signal ties the branding with the code, so it is impossible to build from the canonical source without triggering the branding issue.
So, in practice, it is a convoluted way to annoy anyone releasing from source. And as we know, actually using open source software without a "distro" is insanity. You cannot trust 1000s devs. you trust the distro, the distro trust 10s of package maintainers, the package maintainers trust 10s of devs. and everyone is happy. I trust f-droid just fine. But i don't trust the person who is publishing every apk on random sites like signal.
Even then
> You need to download it from the Google Play Store.
Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself.
> pushed the update to everyone but no one could inspect the source code.
That was for the server code, which you shouldn't care about from a security standpoint for a e2ee messenger such as Signal. AFAIK that was not the case for the clients.
Regarding your other points, they have reasons that have been discussed elsewhere[0] to avoid federation, notably a lot of the progress on the Signal protocol would be way harder in a federated setting. There's no other messenger that has the same usability ("my grandfather can use it and won't have problems using it afterwards") while being at this level security-wise.
That page tells me that the safest way is to have a Google account, with Google Play Services installed on my phone, and to download it from the Google Play Store.
It then gives me an APK link after saying "Danger zone" and "most users should not do this".
If the app developer tells me it's dangerous and I shouldn't do it, can you even expect users to do this?
I don't know how to verify the SHA fingerprint without Googling (I know how it works, just don't do it often to know the exact openssl or equivalent command).
If I'm downloading the APK directly on the phone, there's a lot that's not under Signal's control that could happen.
What if I'm directly under attack, and I'm trying to move to Signal? The attacker could MITM the connection and intercept the download.
I think that's a fair warning to show a user, because indeed most users will likely want to install apps through Play Store, that'll reduce/remove supply chain risks. Users who know enough about APKs would be able to verify the hash, or build it themselves.
Even if I download the APK, I still have to accept a similar warning when installing it on my phone.
F-Droid for as much as I love the open platform, does not provide any security guarantees about what you're downloading. It is a volunteer run project and does not have the extensive security policies and practices that Google has. From https://f-droid.org/en/about/
> Although every effort is made to ensure that everything in the repository is safe to install, you use it AT YOUR OWN RISK.
Likewise downloading and side-loading it from their website, requires you to disable some security guarantees by doing things like enabling developer mode.
If you care about reproducible builds and avoiding trusting Google, you're already in the class of not-most-users.
Signal seems to have usually taken a pragmatic stance of defaults mattering.
Afaicr, that was the argument for linking to phone numbers (it allowed for more lazy users to use it) and encryption by default (few turn on opt-in-encryption).
And it seems accurate to say 'for most users, who don't know what they're doing and don't want to play personal-IT-department, using the Google Play store is more safe and secure.'
The Telegram Org itself gives no support to volunteers at all.
You can't register with Foss builds. Only official binaries. Nowadays a lot of features are premium only. You can only get premium with official binaries. That part is closed.
Granted yes, the version commits are squashed like you said. [1] However I haven't seen source release to lag behind store releases, any sources on that?
0: https://core.telegram.org/reproducible-builds 1: https://github.com/DrKLO/Telegram
Release lag -> Telegram foss needs to wrangle the release every time. Fdroid CI takes its time.
A couple months ago I actually verified a build of Telegram on my friend's phone as he thought something might be off and didn't have any issues there (the build matched).
Pretty much all the packages on Linux repos come from package maintainers taking upstream source code, removing parts they don't like and then building that. This is a normal part of packaging and building open-source apps.
Also which distro packages Telegram?
Fedora doesn't. Debian does but at times it was so old the client crashed from receiving server comms because it wasn't fully compatible. It actually crashed as in segfault.
If you assume they are malicious, (a) I wouldn't use their product in the first point, and (b) of course they can do whatever they want independently from the published code.
You can also download the APK directly from their website: https://signal.org/android/apk/
When doing so Signal uses its own update mechanism to stay up-to-date.
If so, up-to-date source code us pretty useless.
How many people check their app's source code?
With third party clients it's pretty easy to get malicious ones
Seems like FUD. This took me 30 seconds to check just now:
-Telegram's android source code git hasn't had a tagged release in more than two months and is several versions behind the android app (10.12.0 vs 10.9.1)[1]
-Signal's android source has a tagged release two days ago that is two releases ahead of the stable version on google's app store, and has the tagged release of the version that is on the app store.[2]
Researchers of Telegram's protocol have said in some ways it's weaker than TLS.
E.g.
- https://www.wired.com/story/the-kremlin-has-entered-the-chat...
- https://therecord.media/telegram-blocks-chatbots-used-by-ukr...
- https://www.oporaua.org/en/polit_ad/and-telega-is-still-ther...
- https://www.pravda.com.ua/eng/news/2024/05/8/7454849/
- https://time.com/6280190/cia-recruit-russian-spies-telegram/
- https://www.cia.gov/stories/story/cia-launches-telegram-chan...
- https://nordvpn.com/blog/is-telegram-safe/
- https://portswigger.net/daily-swig/multiple-encryption-flaws...
For example of this sort of vetting, take a look at the standardization around AES or the post-quantum schemes.
In crypto you're almost always relying on hardness assumptions that aren't provable yet. So you need to guard against things like accidentally haven chosen the wrong constants that collapse a problem's hardness. Or, more mundanely, making a seemingly reasonable engineering choice that is known to weaken the protocol and which would be caught by a big org with a thorough review, but a startup may not catch.
- You can download an apk from signal that self-updates
- Telegram isn't encrypted by default and uses a home-brew protocol
Matrix or bust.
Any distro can have Telegram clients, both official and third-party, in their repository.
Compared to this
1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play store by long periods of time many times. One example was when they implemented cryptocurrency payments, pushed the update to everyone but no one could inspect the source code.
2. Signal has sent legal threats to repositories that package Signal. The repos either need to confuse users by offering the client under other package names or remove it.
3. They also send baseless threats to forks that use their server. Combined with their lack of federation, this results in people having to use multiple apps from different sources with a much larger attack surface.
4. They beg for donations in the app even though they made an app with payments and cryptocurrency integration with an obscure coin (which they were involved with and had ample opportunity to hoard before ever announcing it as a feature in Signal).
5. They claim to have privacy features that other messengers lack, but these features are based on known-to-be-broken technologies like Intel SGX.