Signal-Server VS ringrtc

> They could at least BSL the server code and allow others to verify the server code and host but not compete.

This is exactly what they do (except they use AGPL): https://github.com/signalapp/Signal-Server

https://github.com/signalapp/Signal-Server/blob/main/service/src/main/java/org/whispersystems/textsecuregcm/push/APNSender.java for APNs push notification payloads

git clone https://github.com/signalapp/Signal-Server.git

yes it is available here https://github.com/signalapp/Signal-Server/blob/main/service/pom.xml

You could also start your own signal server, but with blackjack, and hookers

The fact that it locks you into using their servers, does not distribute on F-Droid (only Google Play OR an APK with an insecure update mechanism), and has a completely closed-source "abusive message filter" module server side, that could functionally be used for censorship, storing messages for future decryption, or any other number of nefarious purposes - we have no idea since it's not open source (https://github.com/signalapp/Signal-Server/blob/main/.gitmod...).

Additionally, you cannot distribute branded forks or Signal, and if you do fork it, your fork is not allowed to connect to Signal's "official" OWS (open whisper systems) servers - hostility to federation should be viewed with prejudice and suspicion at the very least, it suggests a vested interest in a single point of failure (or control), which goes against user interests.

Further reading: https://drewdevault.com/2018/08/08/Signal.html

It’s actually the signal server that isn’t reproducible because of the abusive message filter that’s in a private repository. It’s clear as day here: https://github.com/signalapp/Signal-Server

On the two points you raised: - Panther is the codename given by Google for the Pixel 7 device. - RingRTC is a middleware library providing Signal Messenger applications with video and voice calling services built on top of WebRTC: https://github.com/signalapp/ringrtc

If you did not know, there is also https://github.com/signalapp/ringrtc by the Signal App team, which is written in Rust

Huh, Signal's WebRTC implementation seems to be using Rust implementations of crypto primitives such as AES: example usage, Cargo.toml

Signal is still an improvement over other non-federated messengers in that it's open-source, so you actually can try to improve the situation, although it's notoriously difficult. As an example of more platform support: https://github.com/signalapp/ringrtc/pull/12

signal-cli is an example of a 3rd party client which is tolerated for now: https://github.com/AsamK/signal-cli

The main problem right now is that they don't have enough developers to take care of everything, but it's not specific to centralized services (no developer == no code). If you care about it, you can develop your own client using their library (à la signal-cli).

Regarding your last paragraph: I could probably list 20 features I'd like to see in Signal. That doesn't mean I want somebody implementing them with no guarantee about how securely they are implemented. One of the main goals of Signal is to provide guarantees against dragnet surveillance, and that constraint takes precedence.

I know their voice/video chats are built on top of WebRTC, they call it RingRTC perhaps you can find the answers there

Outside of the Android app, they had a bunch of "new developers" join, and they ported the call signalling framework to Rust: https://github.com/signalapp/ringrtc . This Rust library is now used by the other apps.