They are a US company and they control what version of the app is in the play/apple store. They could be force to push a version of a flaw and no one could verify it. The source looks good but the app that has been distributed is not.
Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store?
To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down.
Is any other app sharing the same protocol?
GitHub message about fallback to WebSocket you are referring to is here: [1]. So you can remove all Google services from your phone and install APK, it will still work, but now Wire server pings your phone whenever it wants. TLDR on the thread is that APK is not uploaded to F-Droid due to dependency (not really) on Google services.
[0] https://developer.android.com/training/monitoring-device-sta...
[1] https://github.com/wireapp/wire-android/issues/5#issuecommen...
The project is also kind of a mess. Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar).
Check out some of the code. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like searches, and rolled their own messaging crypto.
They have been caught lying about what kind of encryption they provide[1], they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire are usually on Wire's marketing team.
1: http://www.pcworld.com/article/2855745/new-communications-ap...
My understanding is that the developers sit in Berlin, but the legal entity is in Switzerland.
Their privacy policy [1] states that they retain logs for 72h, and not much else. Only hashed contact info (emails/phone numbers) are uploaded, after opt-in. It all sounds very reasonable.
Your argument seems to be that they're an untrustworthy mess - but I don't see much evidence of that, except for possibly some braggadocio in that old article.
> Check out some of the code.
Yes, it is on github [2], so you can do that, which is nice.
[1] https://medium.com/wire-news/simple-privacy-policy-72-hour-l...
https://github.com/LibreSignal/LibreSignal
There is a bounty for modifying the signal app source to drop play services.
https://www.bountysource.com/issues/35722527-create-proper-p...
Wow, even Microsoft didn't behave that juvenile about LibreOffice.