Submitted 2 days ago by Dot@feddit.org to technology@lemmy.world
Signal forks can have unexpected behaviours like retaining deleted messages and also they don’t get updated at the same rate that Signal get updated.
Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossiable or very hard to be done If they blocked third party clients.
I saw what WhatsApp did to forbid modification of it’s app which works in stopping a lot of distributions, why doesn’t Signal do the same?
They don’t allow 3rd party clients, as per their ToS:
You must not (or assist others to) access, use, modify, distribute, transfer, or exploit our Services in unauthorized manners, or in ways that harm Signal, our Services, or systems. For example you must not (a) gain or try to gain unauthorized access to our Services or systems; (b) disrupt the integrity or performance of our Services; © create accounts for our Services through unauthorized or automated means; (d) collect information about our users in any unauthorized manner; or (e) sell, rent, or charge for our Services.
You need authorization to access Signal servers, which they don’t give:
we really don’t want forked versions of the app maintained by other parties connecting to our servers. Not only could the users using the forked version have a subpar experience, but the people they’re talking to (using official clients) could also have a subpar experience (for example, an official client could try to send a new kind of message that the fork, having fallen out of date, doesn’t support). I know you say you’d advocate for a build expiry, but you know how things go. Of course you have our full support if you’d like to fork Signal, name it something else, and use your own servers.
In my opinion, this is a horrible decision from Signal.
Yeah this is a big part why I’m very skeptical of Signal. It feels a lot like Ubuntu’s snap store, it’s technically open but you can’t really interact with the main corporate controlled ecosystem.
Signal forks can have unexpected behaviours like retaining deleted messages and also they don’t get updated at the same rate that Signal get updated.
There are ways to save messages before they are deleted even if the stock app is used. Do not ever rely on this feature to work in a “save” way.
Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossible or very hard to be done If they blocked third party clients. (Ex: 1)
That is a problem the users who prefer 3rd party clients have to deal with. Obviously if you care enough to not use the official build, you of cause have to take care of using a trustworthy source. That is not “your problem” though.
The amount of people who use third party Signal clients are very few anyway.
That sounds a lot like “I don’t use it, so none else needs it either” argument. In my opinion, none of your arguments above are a good reason to combat 3rd party clients.
That’s a lot of flack from an application which refuses to distribute itself outside the play store.
SimpleX Chat seems to be the new kid on the block.
At least until the official client allows registration from desktop without VM shenanigans, there NEED to be third-party clients like signal-cli.
How do Signat stop the from connecting to their servers?
AllNewTypeFace@leminal.space 2 days ago
IIRC, they do forbid third-party clients from their network. You can build it from source, but you won’t be able to connect to production Signal servers.
Third-party clients would not necessarily be a bad thing. Signal has limited resources, and as such has to cut corners. I for one would love a native desktop client that’s not Electron bloatware.
Dot@feddit.org 2 days ago
There is already 2 third party forks I know of, molly and Signal-jw.
They both use and access the main production Signal servers.
Static_Rocket@lemmy.world 2 days ago
I could appreciate a client certification that is optional, like a list of approved clients on their website or something along those lines.
It should not be enforced by killing the client. I like security, but I enjoy software freedom more.
rottingleaf@lemmy.world 2 days ago
You mean running a trojan “as a mean of security”, similar to anticheats? Are you sure this is a good idea?
Or if by “program” you mean having some allowed clients as opposite to only the official one allowed, it’s a social thing, not a technical one. So it still won’t prevent anyone from connecting with another client.
just_another_person@lemmy.world 2 days ago
It takes resources to run and maintain such things. Probably not something they feel they can or want to take on.