Hacker News new | past | comments | ask | show | jobs | submit | topdancing's comments login

This is just a marketing gimmick, it's been broken as a technology since its inception: https://www.ndss-symposium.org/ndss-paper/improving-signals-...


> Signal does not know numbers or how these contatcs interact.

> It is described here [2]. Number is only needed for creating the unique hash. Server knows only the recipient, not the sender.

Signal does know everyone's numbers as everybody is logged into a Signal account on the server end (this is how your client fetches messages for your number). That same account and IP are also used when you send a message.

On top of that fact, sealed sender has been known to be broken for some time now: https://www.ndss-symposium.org/ndss-paper/improving-signals-...


> Yes, and security has a large performance impact.

Not necessarily. The linked blog talks about SPARK which is about running your code through theorem provers to mathematically formally verify that your code does the correct thing _in all instances_.

Once you have passed this level of verification - you can disable assertions and checks in the release version of the application (whilst of course - having the option of keeping them enabled in development releases).


> SPARK itself can handle and prove some ownership properties but to the best of my knowledge isn't at the level of rust in memory safety on dynamically allocated memory.

It actually is: https://www.adacore.com/uploads/techPapers/Safe-Dynamic-Memo...

And using https://www.adacore.com/sparkpro as a reference (ignore the 'Pro' bit as it's also available in the GPL edition) - anything certified to SPARK Silver level is far safer than any Rust code out there.


Seems I missed some of the progress... Things are moving fast these days.


Or you could use https://en.m.wikipedia.org/wiki/SPARK_(programming_language) which is already a formal defined language and literally the thing discussed in the link right at the top.



Funny how before Alire was a thing, people complained that there was no easy way to take other people's Ada code and add it to one's own software projects.

Now Alire exists and people complain that it's easy to add people's code into their own projects.

You don't even have to use Alire in the first place - every modern Linux distro ships with an Ada compiler - on Fedora just install gcc-gnat and off you go.


> What are people using VPNs for mostly, if they're living in a country without internet censorship?

I find it's a convenient way to prevent services beyond my ISP from knowing where am I based on IP address.

All of those apps you have on your devices presumably have permanent connections back to their servers and they can very easily tell if you're at home, out on mobile data, in an office, or in a cafe/public library or even in a different country.

With a VPN, they currently think I'm in Dallas; which I'm nowhere near right now.


Many apps on your phone are entitled to read WiFi SSID's, mapping your location as accurately as GPS - and indoors, too! Go ahead and google "where am I" with a native Android/iOS search app with your VPN enabled, you may be surprised by the results. Not to mention accelerometers and other sensors can reliably predict your movement and location, too.


They do not have such an entitlement: https://grapheneos.org/faq#hardware-identifiers (edit: and also: https://grapheneos.org/usage#wifi-privacy )

And the only app that has access to GPS on my device is: https://organicmaps.app/

And Googling "where am I" indeed shows me at my VPN exit [with my always-on and enforced VPN].


Curious (since you mentioned grapheneOS) whether you have Play Services on your device? The results I expected assumed you would. Thanks.


> Most of what they complain about have tooling, documentation and solutions. They're just not using them.

OP's problem is that they do not want to learn. In general - if you see a person complaining about SELinux - it's because they have no interest in learning.


> Conversations, draugr.de, can't really say much on steps to reproduce - it worked reliably and then it didn't just yesterday

So it worked fine for some time, glitched one day, you presumably have done zero debugging as you have no logs or error messages to show us and somehow that means that clients "just lose messages".


Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: