6 ms·

I honestly find this centralization as worrying as mass surveillance itself. I'm as afraid of the Facebooks of this world as I am of any government, and I don't

by rvense 10y ago

I honestly find this centralization as worrying as mass surveillance itself. I'm as afraid of the Facebooks of this world as I am of any government, and I don't want all my communication locked in with one company. This is why I will not use or recommend Signal. Moxie's anti-federation stance is unacceptable to me. It's replacing one problem with another.

bogomipz 10y ago
Can you elaborate on the "anti-federation" stance of Signal's creator? I'm not familiar with this.
- Arnt 10y ago
  You can't run your own signal server. All accounts use phone numbers in the same namespace as ID, and all messages go from the phone to opensystems.org, further on to google, and from google to the destination phone (with lots of encryption being added and removed at various points). This has advantages (it's difficult for the Man distinguish a received signal message from other android notifications) but also disadvantage (moxie can do traffic analysis and you can't do anything about it).
  - lorenzhs 10y ago
    You can totally run your own server for yourself and your friends: https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server (you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy) What you won't be able to do is federate with the official servers. Oh, and there's also a WebSocket transport (used by the Desktop client) that doesn't involve Google. That just doesn't provide a pleasant experience on mobile.
    - rvense 10y ago
      Yeah, so instead of being in Whisper Systems' walled garden, I can set up my own and ask people to install Rvense's Magical Messenger App. Sit there in my treehouse with a bucket on my head and a NO DUMMIES sign or something.
      - whyever 10y ago
        Seems like you want the advantages of both centralization and federation without any of the disadvantages.
        deleted 10y ago
        [deleted]
        spiznnx 10y ago
        Being able to set up your own server is not federation unless your users can communicate with users on other servers.
    - eropple 10y ago
      > you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy I'm sorry, but is this a joke? "To not use a centralized server that you can neither audit nor trust, you have to recompile the client, but that's easy?" This smacks of "oh, PGP for email is fiiiiiine." To say nothing of the silliness of the inability to federate.
      - AckSyn 10y ago
        No, it's not a joke and you shouldn't treat it as such. Non-technical people really shouldn't be whining that their "free service" doesn't cater to a click-and-run crowd. The source is available to the public to create their own, and changing a URL in the code is a single regex command away. Don't casually disregard him because you or others can't understand basics of doing what it takes to alter and run a service in your own private space.
        eropple 10y ago
        I don't casually disregard him. I thoughtfully and with consideration disregard him, and you as well. The idea that there is a priestly-class of technical people and "non-technical people shouldn't whine" is silly. This is not for technical people. This is for non-technical people. I've been doing this stuff for twenty years. But me being able to do it doesn't do a damned thing to help the people who actually need help. I don't need Signal to communicate with knowledgeable people. We need something to communicate with everyone else.
        bobbyd3 10y ago
        ^ this
        baudehlo 10y ago
        And yet the same argument has been made time and time again against SMTP. Let's stand back for a second and understand why SMTP has stood the test of time. Yes it has flaws that allow the "first contact" problem (ie spam). But the people working on SMTP at least understand the weaknesses and advantages of that.
    - jamesgeck0 10y ago
      Distributing a modified client is non-trivial, especially if any of your friends use iOS.
      - lorenzhs 10y ago
        You can sideload apps without a developer subscription. It's annoying but works. But you have an unsolved update problem on both Android and iOS. You really shouldn't do this if you're not 100% sure of the implications.
- lorenzhs 10y ago
  I assume the GP is referring to https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
  - fapjacks 10y ago
    That seems to be a very coherent, insightful post by a very highly-respected cypherpunk. I am pretty much 100% on board with what he is saying.
    - rvense 10y ago
      My response is that we just have to try harder. He's focusing only on encryption and ignoring the massive social problem of one company or a few companies having a monopoly on digital communication. Just like whether or not I'm spied on is irrelevant to whether or not I have the right to private (encrypted) communications, it doesn't matter who has monopoly or what they use it for. We should not be building infrastructure that encourages monopolies, and unfederated services are by definition monopolies.
      - Arnt 10y ago
        Go on and try harder, and please post a Show HN when you have something to show.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]
Arnt 10y ago
Makes me wonder... what's the current total number of active XMPP users (for chat, I mean, not for Android notifications)? Is it still bigger than the number of Signal uses? I have a feeling that federation is one of those Good Things that reduce the potential user base until it isn't good any more.
newscracker 10y ago
I don't like this either. My long time wishes have been to have federated systems for instant messaging and for social networks. Neither seem to be getting any traction with the big and rich corporations actively working against any kind of interoperability. All the pro-privacy solutions depend on getting all your contacts into another walled garden, albeit a nicer one than the likes of Facebook and Google. Beyond federation, I would also like the solutions to have good features and usability. Right now I'm bouncing between a few walled systems: 1. Telegram - really fast development pace, poor crypto, E2E encryption is only for chosen chats and single device. 2. Signal - slow to deliver messages, not multi-device and has usability bugs and issues. I update it somewhat regularly and try using it, but still go back to Telegram because basic expectations aren't met. 3. Wire - I discovered this recently and like the feature set (it's a lot richer than Signal). It claims to use the Signal protocol and has support for voice and video too. All chats are E2E encrypted (unlike Telegram where non-secret chats are by default not encrypted on the device or on Telegram's servers), and it has multi-device support with message sync (only from the time the device is joined to the account). Clients are available for different mobile and desktop platforms. But this one also has poor usability in getting started with it and has simple things missing - like no message delivered or message read indicators (the latter could at least be present as a user selectable option for privacy). I don't know how slow this is to deliver messages, but it's definitely not as fast as Telegram is. Not knowing if a message reached or not is unacceptable in this era. I'm still waiting for some more strong solutions to appear in this space. Seeing that more platforms are adopting the Signal protocol, it would be great to have some standardization in user identification and federation. I actually do not want any of these solutions to be completely free and wish they would provide some way to help them monetarily (at least for the people who do want to help them). I feel repelled by the "free forever" and "we'll sell premium things later, like stickers" parts. That also brings suspicions about the motives of the company/developers and the future viability of the application or platform. At least allow people to donate to you so that you feel some kind of return obligation for all users!

by rvense 10y ago

bogomipz 10y ago

Can you elaborate on the "anti-federation" stance of Signal's creator? I'm not familiar with this.

Arnt 10y ago
You can't run your own signal server. All accounts use phone numbers in the same namespace as ID, and all messages go from the phone to opensystems.org, further on to google, and from google to the destination phone (with lots of encryption being added and removed at various points). This has advantages (it's difficult for the Man distinguish a received signal message from other android notifications) but also disadvantage (moxie can do traffic analysis and you can't do anything about it).
- lorenzhs 10y ago
  You can totally run your own server for yourself and your friends: https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server (you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy) What you won't be able to do is federate with the official servers. Oh, and there's also a WebSocket transport (used by the Desktop client) that doesn't involve Google. That just doesn't provide a pleasant experience on mobile.
  - rvense 10y ago
    Yeah, so instead of being in Whisper Systems' walled garden, I can set up my own and ask people to install Rvense's Magical Messenger App. Sit there in my treehouse with a bucket on my head and a NO DUMMIES sign or something.
    - whyever 10y ago
      Seems like you want the advantages of both centralization and federation without any of the disadvantages.
      - deleted 10y ago
        [deleted]
      - spiznnx 10y ago
        Being able to set up your own server is not federation unless your users can communicate with users on other servers.
  - eropple 10y ago
    > you'll have to change the server's URL in the client's source as well and compile it yourself, but that's really easy I'm sorry, but is this a joke? "To not use a centralized server that you can neither audit nor trust, you have to recompile the client, but that's easy?" This smacks of "oh, PGP for email is fiiiiiine." To say nothing of the silliness of the inability to federate.
    - AckSyn 10y ago
      No, it's not a joke and you shouldn't treat it as such. Non-technical people really shouldn't be whining that their "free service" doesn't cater to a click-and-run crowd. The source is available to the public to create their own, and changing a URL in the code is a single regex command away. Don't casually disregard him because you or others can't understand basics of doing what it takes to alter and run a service in your own private space.
      - eropple 10y ago
        I don't casually disregard him. I thoughtfully and with consideration disregard him, and you as well. The idea that there is a priestly-class of technical people and "non-technical people shouldn't whine" is silly. This is not for technical people. This is for non-technical people. I've been doing this stuff for twenty years. But me being able to do it doesn't do a damned thing to help the people who actually need help. I don't need Signal to communicate with knowledgeable people. We need something to communicate with everyone else.
        bobbyd3 10y ago
        ^ this
        baudehlo 10y ago
        And yet the same argument has been made time and time again against SMTP. Let's stand back for a second and understand why SMTP has stood the test of time. Yes it has flaws that allow the "first contact" problem (ie spam). But the people working on SMTP at least understand the weaknesses and advantages of that.
  - jamesgeck0 10y ago
    Distributing a modified client is non-trivial, especially if any of your friends use iOS.
    - lorenzhs 10y ago
      You can sideload apps without a developer subscription. It's annoying but works. But you have an unsolved update problem on both Android and iOS. You really shouldn't do this if you're not 100% sure of the implications.
lorenzhs 10y ago
I assume the GP is referring to https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
- fapjacks 10y ago
  That seems to be a very coherent, insightful post by a very highly-respected cypherpunk. I am pretty much 100% on board with what he is saying.
  - rvense 10y ago
    My response is that we just have to try harder. He's focusing only on encryption and ignoring the massive social problem of one company or a few companies having a monopoly on digital communication. Just like whether or not I'm spied on is irrelevant to whether or not I have the right to private (encrypted) communications, it doesn't matter who has monopoly or what they use it for. We should not be building infrastructure that encourages monopolies, and unfederated services are by definition monopolies.
    - Arnt 10y ago
      Go on and try harder, and please post a Show HN when you have something to show.
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]

Arnt 10y ago

Makes me wonder... what's the current total number of active XMPP users (for chat, I mean, not for Android notifications)? Is it still bigger than the number of Signal uses? I have a feeling that federation is one of those Good Things that reduce the potential user base until it isn't good any more.

newscracker 10y ago

I don't like this either. My long time wishes have been to have federated systems for instant messaging and for social networks. Neither seem to be getting any traction with the big and rich corporations actively working against any kind of interoperability. All the pro-privacy solutions depend on getting all your contacts into another walled garden, albeit a nicer one than the likes of Facebook and Google. Beyond federation, I would also like the solutions to have good features and usability. Right now I'm bouncing between a few walled systems: 1. Telegram - really fast development pace, poor crypto, E2E encryption is only for chosen chats and single device. 2. Signal - slow to deliver messages, not multi-device and has usability bugs and issues. I update it somewhat regularly and try using it, but still go back to Telegram because basic expectations aren't met. 3. Wire - I discovered this recently and like the feature set (it's a lot richer than Signal). It claims to use the Signal protocol and has support for voice and video too. All chats are E2E encrypted (unlike Telegram where non-secret chats are by default not encrypted on the device or on Telegram's servers), and it has multi-device support with message sync (only from the time the device is joined to the account). Clients are available for different mobile and desktop platforms. But this one also has poor usability in getting started with it and has simple things missing - like no message delivered or message read indicators (the latter could at least be present as a user selectable option for privacy). I don't know how slow this is to deliver messages, but it's definitely not as fast as Telegram is. Not knowing if a message reached or not is unacceptable in this era. I'm still waiting for some more strong solutions to appear in this space. Seeing that more platforms are adopting the Signal protocol, it would be great to have some standardization in user identification and federation. I actually do not want any of these solutions to be completely free and wish they would provide some way to help them monetarily (at least for the people who do want to help them). I feel repelled by the "free forever" and "we'll sell premium things later, like stickers" parts. That also brings suspicions about the motives of the company/developers and the future viability of the application or platform. At least allow people to donate to you so that you feel some kind of return obligation for all users!