openinwa VS Signal-Server

I use an app called "Open In WhatsApp" which lets you paste / write a phone number and it will open a conversation with that number (by using android intents). You can also share contacts from the Phone app to this App.

https://github.com/SubhamTyagi/openinwa (I recommend downloading from f-droid)

FWIW: I've been using whatsapp without access to my contacts with the help of this little app: "Open in Whatsapp"

https://github.com/subhamtyagi/openinwa

You can enter a number in that app and it will launch a conversation with them in whatsapp. I think it makes use of the API mentioned in sibling comments.

> They could at least BSL the server code and allow others to verify the server code and host but not compete.

This is exactly what they do (except they use AGPL): https://github.com/signalapp/Signal-Server

https://github.com/signalapp/Signal-Server/blob/main/service/src/main/java/org/whispersystems/textsecuregcm/push/APNSender.java for APNs push notification payloads

I am trying to build and run signal server https://github.com/signalapp/Signal-Server

yes it is available here https://github.com/signalapp/Signal-Server/blob/main/service/pom.xml

You could also start your own signal server, but with blackjack, and hookers

The fact that it locks you into using their servers, does not distribute on F-Droid (only Google Play OR an APK with an insecure update mechanism), and has a completely closed-source "abusive message filter" module server side, that could functionally be used for censorship, storing messages for future decryption, or any other number of nefarious purposes - we have no idea since it's not open source (https://github.com/signalapp/Signal-Server/blob/main/.gitmod...).

Additionally, you cannot distribute branded forks or Signal, and if you do fork it, your fork is not allowed to connect to Signal's "official" OWS (open whisper systems) servers - hostility to federation should be viewed with prejudice and suspicion at the very least, it suggests a vested interest in a single point of failure (or control), which goes against user interests.

Further reading: https://drewdevault.com/2018/08/08/Signal.html

It’s actually the signal server that isn’t reproducible because of the abusive message filter that’s in a private repository. It’s clear as day here: https://github.com/signalapp/Signal-Server

So phone numbers are not part of group metadata and can’t be accessed directly even if someone gets access to the groups server. However, because (as far as I know) the server still has a 1:1 mapping of UUID <-> phone number that it knows, then if the malicious actor has access to the main Signal server, they’d be able to access the phone numbers of members as well.

That article is almost 2 years old. Right now GitHub is being updated regularly. Latest update to their server code is from 5 days ago.