oasis VS LibreSignal

You reminded me for trying Oasis: https://github.com/oasislinux/oasis

When you say a fork of LLVM, am I correct in assuming that you specifically mean a fork of Clang? I don't see how the compiler backend would affect support for language extensions, regardless of whether it's an exception to that such as Tcc, Cproc, the MIR C jitter, lacc, 8cc, 9cc, and chibicc. Most of those are not for production, excluding Cproc and Tcc (at least according to Suckless or Oasis).

Not a big issue for someone who maintains his own Linux version, https://github.com/oasislinux/oasis.

The code is readable and maintainable, and can be used in the Linux distro that the author maintains without pulling in a huge number of dependencies to build a C++ compiler.

https://github.com/oasislinux/oasis

https://sr.ht/~mcf/cproc/

If you're into very small linux desktops- I've had a lot of fun with Oasis: https://github.com/oasislinux/oasis

The full desktop image is 77mb

Oh dear, you definitely chose the wrong person to accuse of not auditing their code.

I'm typing this from my OpenBSD laptop, which, I assure you, I have audited extensively; but that's hardly relevant to this topic.. I just think it's funny that you would assume this of me. I'm also big on system-transparency[0] and micro systems like Oasis Linux[1] which attempt to limit things being able to hide.

Granted, nothing is perfectly secure.

But, again, besides the point entirely.

Your central thesis is that nothing is safe.

Why, then, should I not just use telegram? Or VK, or WeChat?

We have consensus in the HN community that those chat systems (especially telegram) are inherently insecure. Why?

Don't worry, I'll answer for you: Because they do not support E2EE except when specifically asked to, and because they used their own encryption.

This is enough for the security community to decide that Telegram is a bad product(tm).

I'm not arguing in defense of telegram, I'm just letting you know what happens to "secure messengers" under a microscope.

The same criticism has not been levied to Signal, despite them offering no more protection in real terms than HTTPS would. There are theoretical safety-nets but nothing you can concretely audit.

Your argument that "it's their code they can do what they like" holds as much water as an inverted plate, given the context that they've chosen to live under.

So, instead of attempting to talk me down with and Argument from fallacy[2]

[0]: https://www.system-transparency.org/

[1]: https://github.com/oasislinux/oasis

[2]: https://en.wikipedia.org/wiki/Argument_from_fallacy

Oasis. Good luck!

>what does this mean?

Moxie (Signal's founder) has thrown fits in the past over the existence of third-party clients using their servers: https://github.com/libresignal/libresignal/issues/37#issueco...

0: https://github.com/libresignal/libresignal/issues/37

I push back when anyone recommends Signal because they are fundamentally not an open network.

OWS has historically been hostile to third party implementations outside of their clients. There are multiple unofficial options but the only one I've been looking at is the bridge with matrix, though setting up a matrix server just for this is likely overkill.

I have to say that I find him fascinating too, but there are a few things that raise my suspicion, but of course do not convict him of anything:

The way he is attacking this alternative Signal client and rules out interoperability:

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Signal was a word before he decided to turn it into a brand.

The signal server source code repo was not updated for a year. Communication intransparent.

https://www.androidpolice.com/2021/04/06/it-looks-like-signa...

I am not even against crypto integration, but I found the choice of MobileCoin odd. Instead of integrating an existing privacy coin or working with the community, he decided to integrate MOB and to be one of their "advisors":

https://techcrunch.com/2018/04/24/mobilecoin-moxie-marlinspi...

https://www.coingecko.com/en/coins/mobilecoin

Is that so surprising? Signal had always a hostile attitude to alternative clients. They have this weird disconnect of the new CEO saying they want to be available to as many people as possible and be a fully commited FOSS app, and then have no version on F-Droid (while Telegram has!) and actively fight alternative clients (see https://github.com/LibreSignal/LibreSignal/issues/37#issueco...)

Because of this hostility Signal is not a trustworthy organization at all.

LibreSignal existed before Moxie was like “no, don’t”: https://github.com/LibreSignal/LibreSignal

They have shut down third party clients, and resve the roght to continue that.

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

1) You need to audit that code, which.. everyone will have to do.

2) https://signal.org/blog/reproducible-android/

> the Signal Android codebase includes some native shared libraries that we employ for voice calls (WebRTC, etc). At the time this native code was added, there was no Gradle NDK support yet, so the shared libraries aren’t compiled with the project build.

a good answer in my opinion, but it means what you run from the play store is not reproducible and thus can never really be confirmed to be what the sources actually include. There are also binary blobs needed for interacting with Google Play.

3) Signal is openly hostile to third party client implementations: https://github.com/LibreSignal/LibreSignal/issues/37

Moxie Marlinspike on May 5th 2016:

> I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name "Signal." You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run.

> If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.

Moxie Marlinspike left Signal this January[2] 2022.

Whose to say whether there will be any change, but it's been interesting seeing Signal as a somewhat defended property. Although various third party clients/tools/libraries do exist already.

The claim that running servers is expensive would have been more interesting, imo, had there been any viable way to run your own. But for a long while Signal server source code wasn't being updated at all.

[1] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

[2] https://signal.org/blog/new-year-new-ceo/