Conversation

Notices

1. Meredith Whittaker (mer__edith@mastodon.world)'s status on Tuesday, 17-Sep-2024 01:35:10 JST Meredith Whittaker

   • BrianKrebs
   • F. Maury ⏚
   • Apicultor 🐝

   @apicultor @x_cli @briankrebs

   That Flatpak package, linked above in this thread, is unofficial.

   Our official download instructions for Linux tell people how to install our APT key, and every release is signed.

   I'm assuming Brian Krebs' original is referring to macOS. Our releases are signed on macOS and Windows too.

   💐

   • F. Maury ⏚ (x_cli@infosec.exchange)'s status on Tuesday, 17-Sep-2024 01:35:09 JST F. Maury ⏚

     in reply to

     • BrianKrebs
     • Apicultor 🐝

     @Mer__edith
     Yet, the flatpak is said to be published "by Signal Foundation". If that's not the case, the package is usurping Signal Foundation identity and people using Flatpak oriented distros are targeted by this usurper. Can you request a takedown, please?
     @apicultor @briankrebs

   • Aral Balkan (aral@mastodon.ar.al)'s status on Tuesday, 17-Sep-2024 01:35:09 JST Aral Balkan

     in reply to

     • BrianKrebs
     • F. Maury ⏚
     • Apicultor 🐝

     @x_cli @apicultor @briankrebs Oh, damn, I’m using the Flatpak package on Fedora because of that (I thought it was the official package).

     Better than a takedown, would Signal be able to take it over and make it official, please, @Mer__edith? We can’t run apt packages on Fedora, etc.

     Barring that, yeah, it should either be taken down or marked as unofficial.

   • Alex Haydock (alexhaydock@infosec.exchange)'s status on Tuesday, 17-Sep-2024 04:04:07 JST Alex Haydock

     in reply to

     • Aral Balkan
     • BrianKrebs
     • F. Maury ⏚
     • Apicultor 🐝

     @aral @x_cli @apicultor @briankrebs @Mer__edith

     It's marked as unofficial quite clearly on Flathub but this is a confusion point I've seen before with store fronts like GNOME Software & co, which don't pass through that clear visual to the end-user.

     I definitely echo the suggestion though. It would be good if Signal would officially take over the Flatpak maintenance. It would help make Signal more (officially) accessible on distros other than Debian/Ubuntu.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Tuesday, 17-Sep-2024 04:04:07 JST Aral Balkan

     in reply to

     • BrianKrebs
     • Alex Haydock
     • F. Maury ⏚
     • Apicultor 🐝

     @alexhaydock @x_cli @apicultor @briankrebs @Mer__edith Yeah, I almost never hit the Flathub site. GNOME software not displaying the verification state at the top is quite a security issue. As is having Signal Foundation as the owner. All this time I thought I was using the official Signal flatpak.