Free, secure universal communication software
Ringing In Change
In the last few years, secure text, voice, and video transmission have become major areas of free software development. One of the leaders in this field is Ring.
Ring [1] is a GNU communication project started by Savoir-faire Linux [2]. Based in Montreal, Savoir-faire Linux was founded in the late 1990s, when the possibilities of free software were first being widely recognized. "Our bet was that open source software would become a key player of the world's digital economy and that organizations that wouldn't be open source experts would need partners like us," says the Ring team. The bet paid off, and today Savoir-faire employs a multidiscipline team of 150 employees, working with "tools ranging from Red Hat to the Azure cloud" and designing products on every level, from kernel hacking to application and mobile development. In addition to Ring, the company contributes to a wide range of projects, including the Linux kernel, FFmpeg, Debian, Buildroot, and Eclipse.
What makes Ring stand out as a telephony solution is its attention to cutting edge security techniques. Ring as a whole depends on OpenDHT [3], a library developed by Savoir-faire that is similar to the distributed hash table (DHT) used by BitTorrent to find peers sharing a file on a network. Each installation of Ring runs its own DHT node, so users connect peer to peer and control their own accounts and identities; damage to systems from denial of service attacks and natural disaster is therefore contained rather than affecting the entire network.
Ring identifies users via their RSA public key, with control of an account defined by control over a particular private key. Different devices connected to the same account are associated with an x509 certificate chain [4], with each device assigned a new key and certificate pair signed using the main Ring account's private key. The certificate chain is verified each time a device is used to prevent man-in-the-middle attacks.
A somewhat novel aspect of Ring is its use of an Ethereum blockchain [5] – a free software version of the distributed databases used in other distributed systems, such as Bitcoin – as a directory of usernames. According to the Ring team, in the first versions of Ring, users could identify each other only by their public key fingerprints – a 40-character hash that is cumbersome to transmit and difficult for humans to use. By using a blockchain, in newer versions of Ring, users can register unique usernames without the need for a centralized database.
Information is shared through Ring with perfect forward secrecy (PFS) protocols [6], which change the exchanged keys in each session. Media streams do much the same, using a Secure Real-Time Transport Protocol (SRTP) [7].
The User Experience
Such details have been a major obstacle to the general use of security and encryption. As the Ring team notes, users are accustomed to weak security, such as passwords on email, and can be reluctant to change their habits, even when the necessity is obvious. In fact, a truism in security circles is that, when asked to choose between convenience and security, users will almost always choose convenience. In this situation, the challenge for the developers of applications like Ring is to provide the features that users expect without compromising the distributed network and encryption.
Ring is currently in beta release, but it is already well on its way to balancing these requirements. Ring can be downloaded for Android, GNU/Linux, Mac OS X, and Windows, along with full instructions for each [8]. For GNU/Linux, recent releases of Debian, Ubuntu, and Fedora are officially supported (Figure 1), with options for installation from the project site, packages, and tarballs. The only potential problem is that releases are not upgradable, which means that an installed version must be removed before an upgrade is installed. If not, the users of one version cannot communicate with the users of another.
Once installed, users must register with the blockchain, using the starting wizard to register an avatar, user name, and password (Figure 2). Users may also want to adjust the settings, configuring such features as notifications for calls and chat, and the position of the chat window on the desktop. Users may also want to install Ring on another device, associating it with the already installed account and adding a PIN, so they can receive incoming calls without being on a particular device (Figure 3).
With this setup, Ring works much like Signal or the standard Android apps for voice and chat messaging. However, you might want to study Ring's other features [9] before you need them. The feature list includes putting a call on hold, disabling the microphone and video camera, recording audio, and sharing screens and files.
Overall, Ring is not as easy to use as the apps on the average phone. However, the beta hides much of the complexity from average users and is a promising indicator of what the general release will be like. The biggest challenge, says the Ring team, is to provide the same features across different platforms.
Future Development
Ring already includes many features that similar software does not. However, before general release, Savoir-faire hopes to add such features as content management; synchronized contact lists; history, group chat, and enhanced file sharing; and improved encryption for texting. "In general," says the Ring team, "we work to make Ring as user friendly as possible while preserving user privacy and the distributed nature of Ring."
Future plans include bringing Ring to embedded systems, smart TVs, and other Internet of Things devices – all supported by documentation.
Ring is an ambitious effort that appears to be making a successful transition from a walled garden to a public project. Although it has not reached the level of simplicity for the end user as its rival Signal, it is not far off and offers more features, as well. If Ring can develop its user interface as well as it has its behind-the-scenes technology, it has a strong chance of becoming one of the leading free software tools of the next few years.
Infos
- Ring: https://ring.cx/
- Savoir-faire Linux: https://www.savoirfairelinux.com/en/home
- OpenDHT: https://blog.savoirfairelinux.com/en-ca/s/opendht/
- x509 certificate chain: https://en.wikipedia.org/wiki/X.509#Certificate_chains_and_cross-certification
- Ethereum blockchain: https://en.wikipedia.org/wiki/Ethereum
- PFS: https://en.wikipedia.org/wiki/Forward_secrecy
- SRTP: https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol
- Downloads: https://ring.cx/en/download
- Useful functions: https://ring.cx/en/documentation/useful-functions-for-a-call-in-progress-on-gnulinux
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.