Signal-Android VS ContactDiscoveryService

Haven't used Signal FOSS, but as it happens Molly bas just implemented OSM support, perhaps when it lands you might have better luck with it. Anyway, is there no issue tracker for that fork? I tried looking in their repo and found it disabled

Try using the Signal FOSS version from https://www.twinhelix.com/apps/signal-foss/

Yeah I followed that whole story. Since then some forks have been created that do not care what Signal Foundation thinks about using their servers. Molly and Signal-FOSS for example, both compatible to regular Signal. Those two forks will not keep SMS support, Molly never had it, and Signal-FOSS will most likely drop it because they think it's too much work to keep it while staying compatible and up to date. I hope there is going to be another fork specifically dedicated to keeping SMS support. We'll see.

You can get a completely open source version without the Google stuff here: https://www.twinhelix.com/apps/signal-foss/

Signal FOSS removes proprietary google blobs https://www.twinhelix.com/apps/signal-foss/

Signal - Molly , Foss-Signal

Maybe they had outdated info from when the server software was not updated for a long time. Or, it's regarding the dependencies on closed-source Google Mobile Services and Firebase libraries, though those can be removed... and have been in this fork.

[1] https://signal.org/blog/private-contact-discovery/

Signal uses SGX for remote attestation, which presumably lets the client verify that the code running on the server is a build of the OSS code and not a modified version. But I don't know the details or if this is reliable.

SGX and remote attestation described here:

https://signal.org/blog/private-contact-discovery/

Signal does private contact discovery and the effort they've gone to to do this is quite impressive.

TEEs have numerous privacy-enhancing applications that may benefit users. One of them is, as discussed earlier, private contact discovery; the Signal application uses a contact discovery service enhanced using Intel SGX, a TEE technology, to protect its users' privacy. A similar application of TEEs is performing malware analysis in a remote cloud service, so that the service may not identify users by the contents of their devices, such as the applications they have installed, especially important as 98.93% of users may be uniquely identified by the list of applications they have installed.

Signal (or, more accurately, one of its predecessors) used to use client-side private set intersection for contact discovery, but this scales poorly [1].

Now they use a solution based on Intel SGX and server-side trusted computing [2].

[1] https://signal.org/blog/contact-discovery/

[2] https://signal.org/blog/private-contact-discovery/