Ring, officially a GNU package

https://blog.savoirfairelinux.com/en-ca/2016/ring-official-gnu-package/

by terraforming • 10 years ago

169 65 10 years ago

blog.savoirfairelinux.com

reitanqild• 10 years ago

Official web page seems to be https://ring.cx/

0xmohit• 10 years ago

And https://ring.cx/en/about/practical contains more details about the project.

Source repositories located at https://gerrit-ring.savoirfairelinux.com/#/admin/projects/ (Uses gerrit!)

metilda• 10 years ago

Has ring improved much? I remember a few months back it used 28gb of background data over LTE (which was fine since I'm uncapped) on my phone, and was less stable than sflphone, which would randomly stop registering occasionally.

I can recommend pjsip though, very reliable so long as you read its docs before writing a script to leverage it.

irl_2• 10 years ago

For voice I've found it to be quite stable, the video features a little flaky though. Sometimes it would work, sometimes it just wouldn't.

joecool1029• 10 years ago

How was your battery life with that?

And most mobile clients use pjsip, at least non-commercial ones (aside from popular sipdroid). I don't know what Bria uses but if I lose signal it slams my battery. Unfortunately it also works best for my commercial line.

Csipsimple is an android implementation of the pjsip library. Taki is another for BB10. They are both fairly reliable. I don't know any on iOS (sry).

Ruud-v-A• 10 years ago

This appears to be something phone-related, not the Ring cryptography library written in Rust based on Boringssl. (https://github.com/briansmith/ring)

Rovanion• 10 years ago

Neither is it the Clojure web server library https://github.com/ring-clojure/ring.

frumiousirc• 10 years ago

What stops attackers from poisoning the DHT? Could one publish false name <--> IP address associations?

ycmbntrthrwaway• 10 years ago

Cryptography. Identity is not simply a name. You don't choose it but generate.

magila• 10 years ago

The crypto would stop you from actually impersonating the target, but you could easily DOS someone by flooding the DHT with bogus data for their id.

Edit: You could also get the IPs of all the people trying to contact the target.

fulafel• 10 years ago

There seems to be no browseable source code around, what are the implementation language(s)? I want to know whether the protocol implementations are written in a memory-safe language.

coolguy132435• 10 years ago

check Contribute > Build instructions

aban• 10 years ago

libring (or ring-daemon) is written in C++.

P.S. I couldn't find any browseable source either, so I cloned their repo.

irl_2• 10 years ago

The DHT system for identities is cool, but the thing that gets me is that they don't have support for SRTP with ZRTP, only SRTP with SDES. There's no perfect forward secrecy, and a bunch of other features that ZRTP has.

https://www.silentcircle.com/products-and-solutions/technolo...

nextos2• 10 years ago

Yes, that's true.

A more comparable thing to Signal is Matrix [1] and it's client Riot [2]. Theoretically, it has perfect forward secrecy. It's not as distributed as Ring is, but there is no centralized server as in Signal either.

Riot is also in F-Droid. So while not a GNU member, I find it sufficiently open and free.

A totally distributed approach with forward secrecy is Tox [3]. It needs a good code audit, though. And as in Ring, P2P causes data consumption issues in mobile.

[1] https://matrix.org/

[2] https://riot.im/

[3] https://tox.chat/

akermu• 10 years ago

I think you meant "but there is no centralized server as in _Signal_ either"

drdaeman• 10 years ago

AFAIK, Matrix identity servers system isn't really decentralized yet. They're working on this, but it's not there yet.

Just saying.

lima• 10 years ago

Is it true that Matrix is based on polling? So no push?

qwertyuiop9246• 10 years ago

Tox is another system using DHT for identity (among other things), and it does have perfect forward security. So you may want to try that.

geofft7• 10 years ago

What's the advantage of being a GNU project these days? It seems like it ties you very strongly to the FSF's political opinions and in particular Richard Stallman's political opinions (e.g., eugenics) and restricts your technical decision-making options (e.g., limited plugin architecture, limited support for non-free OSes, mandatory support for things like GNUTLS), while not giving you very much in return - with the existence of GitHub and a wide variety of competitors, it's pretty easy to attract a healthy development community independent of GNU. What am I missing?

davexunit2• 10 years ago

seems like it ties you very strongly to the FSF's political opinions

Some are happy to be associated with the opinion that all software should be free.

in particular Richard Stallman's political opinions (e.g., eugenics)

Richard Stallman's opinions, outside of the realm of free software, are irrelevant in the context of the GNU project. Throwing out eugenics like that feels manipulative to me.

restricts your technical decision-making options

The next few paragraphs will explain why what you see as restrictions aren't seen the same way from the perspective of GNU developers.

limited plugin architecture

You are of course referring to exposing the AST of GCC to other (possibly proprietary) programs, which was a GCC-specific issue. It doesn't broadly apply to everything. I help maintain GNU Guix, a project designed from the ground up to be as extensible as possible, and there has been no such issue. Nor does GNU Emacs have an issue with extensibility.

limited support for non-free OSes

I think this is distorting the truth a bit. The point is that the focus of the GNU project is to develop a fully free operating system, and maintainers should focus their efforts accordingly. That doesn't mean that GNU software shouldn't work well on other, proprietary operating systems, and maintainers shouldn't reject patches from contributors that add or improve such support unless it adds a significant burden. Bottom line is: GNU software should work the best on the GNU system, which seems sensible to me. The GNU maintainer guidelines go into more detail about this topic.

mandatory support for things like GNUTLS

Software in the GNU project should work well with or use other software in the GNU system. Again, those that participate in the GNU project think this is positive, because GNU should form a cohesive whole, just like MacOS or Windows should.

while not giving you very much in return

GNU and the FSF give Guix a place to host many Git repos, space for a website, several mailing lists, a bug tracker, they colocate our hardware in their datacenter, give us virtual machines on their own servers, handle donations, and promote our releases. I think it's a pretty great deal given the project is philosophically aligned with the free software movement.

With the existence of GitHub and a wide variety of competitors

I wouldn't call GitHub a competitor. GitHub is just a code hosting site, GNU is a unified project with a political mission.

What am I missing?

Hopefully I've helped answer this question.

geofft7• 10 years ago

Richard Stallman's opinions, outside of the realm of free software, are irrelevant in the context of the GNU project.

But his entire point is that free software is a moral imperative, and that it is morally better to have no software at all than non-free software. How can you separate morality into parts?

And, if you do, where do you divide it? Are politics that affect what copyright laws may exist relevant? Are meta-politics like voting rights or styles of government or campaign finance relevant, if they affect how copyright laws get decided?

the focus of the GNU project is to develop a fully free operating system, and maintainers should focus their efforts accordingly

Right. It seems to me that becoming a GNU project means that you are required to focus your efforts in certain ways. You are completely free to focus your efforts in those ways without being part of the GNU project, though. It simply restricts your options.

If you trust the GNU project to be better at you at finding the morally right thing to do, then it makes sense to ask GNU to restrict what you can do. As a churchgoer I totally understand why you might want to outsource your morality to a larger organization consisting of more people than you who think harder about things - but it matters a lot that you find the right organization, and that you can trust the people who run the organization to be making good moral choices in general. There are a number of churches where I do not, and I don't associate myself with them, no matter how much I agree with most of their views. Similarly, I find it hard to trust the future moral decision-making of someone who supports eugenics. If I support their current moral stances on free software (and, as it happens, I agree with the vast majority of what Stallman says about free software), I can always just adopt those stances as my own.

I wouldn't call GitHub a competitor.

Sorry, that was unclear - I meant GitHub and GitHub's competitors (in case you philosophically disagree with GitHub). It gets you a lot of stuff self-service that years ago was much more easily had through affiliation with GNU, or Apache, or Red Hat, or someone else.

I concede that donations and marketing are things you get from GNU that you wouldn't get from GitHub etc. (Although I think many projects find that being on GitHub gives them visibility in a way that seems likely to make up for the lack of explicit marketing, depending on the project.)

themihai2• 10 years ago

> limited support for non-free OSes

Some believe that's not necessary a bad thing.

geofft7• 10 years ago

Sure. I'm not saying it is; you're welcome to implement that choice voluntarily. What's the benefit of being required to make that choice as part of being a GNU project?

snvzz5• 10 years ago

What's the advantage of being a GNU project these days?

I can't think of anything.

and in particular Richard Stallman's political opinions (e.g., eugenics)

Utter nonsense. Being part of GNU doesn't imply agreeing with every word Stallman utters on any topic.

restricts your technical decision-making options

Very real (see gcc and frontend/backend separation) and a very good reason to stay away.

belorn5• 10 years ago

Over half an hour before you posted, a project maintainer directly contradicted your post under this thread. The technical decision-making are made by the maintainers, not by the GNU project.

Did you just miss davexunit post?

geofft7• 10 years ago

Utter nonsense. Being part of GNU doesn't imply agreeing with every word Stallman utters on any topic.

Of course it doesn't. But associating yourself with GNU is, very straightforwardly, associating yourself with Stallman. What is the advantage of doing so?

If there is such an advantage, then yeah, I think it's totally fair to dissociate yourself from his political views. But it seems to me like joining GNU is solely a political statement and a sign of agreement with Stallman's views on morality (since he frames free software / computing freedom as a moral issue). I don't know why anyone would want to make that statement unless they actually want to be associated with his political and moral views. That's all I'm asking. Is there another reason to associate yourself with GNU?

pvg• 10 years ago

What are Stallman's supposed opinions on eugenics?

geofft7• 10 years ago

https://stallman.org/notes/current.html#31_October_2016_(Dow...

"A new noninvasive test for Down's syndrome will eliminate the small risk of the current test.

"This might lead more women to get tested, and abort fetuses that have Down's syndrome. Let's hope so! It is very wrong to intentionally subject a person to life with a serious disability, given the option to abort and try again."

themihai2• 10 years ago

Is there a well-known discovery document or any other way to create shortcuts for the ringID? (i.e. mapping it somehow to web or email address) I doubt many fancy spelling ringIDs.

qwertyuiop9246• 10 years ago

Why this over Tox, Psyc, or Matrix? There doesn't seem to be much benefit...

snvzz5• 10 years ago

I hear tox has been approached before, but they were uninterested.

Remember GNU requires transferring rights to the FSF, which many aren't comfortable with.

I personally favor tox, because ec25519 and full forward secrecy. Also, not fond of SIP.

qwertyuiop9246• 10 years ago

Well, that explains some of it.

I heard tox needs a code review. Has its security been verified in any way?

paroneayea• 10 years ago

GNU developer here (MediaGoblin lead developer). GNU projects get to decide whether or not to do copyright assignment to the FSF. As an example, MediaGoblin and Guix don't require copyright assignment, while Guile does.

sitkack• 10 years ago

I have interacted with Tox core devs, the exchange was not pleasant. The overlap between professional and mature (both in social and engineering aspects) seems to very slim in the security space.

Mindless2112• 10 years ago

Seems like it's not possible to change your password after you use it to create a Ring ID...

alpb• 10 years ago

Little bit off-topic but:

respects freedoms and privacy of its users

It downloads the binary over http on http://ring.cx, makes it susceptible to tampering. Is serving binaries over HTTP a GNU thing because the expectation is that you would check the signature?

brute2• 10 years ago

Care to elaborate? http://ring.cx has a 301 forward to https://ring.cx, and all the downloads seem to use https as well. Where is it using plain http? Or was the forward added in the last hour?

teraflop• 10 years ago

The links on the "Downloads" page are HTTPS, but the download button on the home page points to http://gpl.savoirfairelinux.net/ring-download/windows/ring-w... with no security.

alphapapa• 10 years ago

Couldn't a MitM attack skip the redirect?

snvzz5• 10 years ago

While I'm sure it's well-intended, it does have a couple of fatal flaws.

* Lack of full forward secrecy means logged network logs can be decrypted in the future if an endpoint key is ever compromised.

* e2e encryption is optional, due to legacy SIP support. This is extremely dangerous as it will no doubt lead to false sense of security, with users assuming they're safe just because Ring is the program they're talking through.

Due to these two I cannot actually recommend it to anyone.

Note that Tox got these two right, and is a pretty active project which gets commits semi-daily, regardless of the nonsense about it being dead that some party seems to be spreading.

synchronise2• 10 years ago

e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right?

Either way, I don't use SIP so that feature isn't a dealbreaker for me.

snvzz5• 10 years ago

e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right?

That needs user intervention, which implies his understanding of why it is necessary.

Here's a better idea, remove backwards compatibility. Perhaps they could release a separate SIP client under a different name. Just keep it away from Ring itself. Let Ring be actually secure.

davexunit2• 10 years ago

The Tox community is absolutely toxic, no pun intended. I have abandoned that ship.

davidcollantes• 10 years ago

I could not find this anywhere; do Ring uses a server (NAT traversal, or similar)? Thanks!

davidbanham• 10 years ago

According to the docs, it gives you the option deep in the settings to add your own STUN and TURN servers. It seems like it doesn't ship with any preconfigured. That makes it a non starter for me.

Ring, officially a GNU package

Related Stories