Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

GCM depends on Play Services, so I'm really not.


view as:

GCM is merely one minor component. The existence of the microg project proves that you can implement one without the other.

MicroG does not implement GCM.

MicroG does implement the GCM client! I've been getting push notifications through that thing for several months.

Through Google, yes, but you can't bring along your own push notification delivery service.

Your argument has become circular, because the what Signal uses push notifications for isn't security-relevant: the messages are empty and used only as a wakeup.

They still contain information, though. They say when you're talking on Signal. Matched with someone else's messages at about the right frequency to indicate a conversation, they give a pretty decent idea of who you're talking to.

They give the same information that TCP/IP traffic analysis does.

Perhaps, but we can at least start to explore solutions to that if we can work on the server too.

You're ping-ponging all over the place. Which is it? "Glaring security problems", or impediments to fully exploring the solutions space?

Why can't it be both? You're a real difficult person to have a rational discussion with, you know.

Because it's clearly not both.

If I say "your house is on fire!" and you rebut "no it isn't" and I respond "well, your shoelace is untied", any reasonable observer will conclude that you've conceded the house fire.

If my house was really on fire, you'd say "no, really, look at it! Flames are shooting out of the bedroom window!". If your strong argument was valid, you'd restate it, perhaps with additional evidence.


No, it implements one half of it.

Signal still has to be linked with a proprietary binary, which contains lots of tracking code.


Legal | privacy