[tptacek]

Signal's use of GCM has also been beaten to death: it's a platform issue that has no impact on security (but does make it harder to deploy Signal on nonstandard Android platforms).

[Sir_Cmpwn]

That is not true. It's (1) a remotely exploitable rootkit and (2) a tracking system that's (3) operated by a multi-billion dollar company whose entire business model is invading your privacy.

Google Play Services is not the standard Android platform. AOSP is the standard Android platform.

[dublinben]

You're conflating GCM and the wider Google Play Services that is installed on most Android devices. As someone who actually uses AOSP without Google, it weakens your argument when you conflate the two.

[Sir_Cmpwn]

GCM depends on Play Services, so I'm really not.

[dublinben]

GCM is merely one minor component. The existence of the microg project proves that you can implement one without the other.

[Sir_Cmpwn]

MicroG does not implement GCM.

[floatboth]

MicroG does implement the GCM client! I've been getting push notifications through that thing for several months.