3 ms·

Agree. I'm not a cryptographer and never claimed to be either. -- and I think it would be difficult to mistake me for a hipster. For one, I don't have that snaz

Agree. I'm not a cryptographer and never claimed to be either. -- and I think it would be difficult to mistake me for a hipster. For one, I don't have that snazzy majestic beard.. Anyway, on to the point. :) Yes, the phone number thing is a policy decision by the Signal people. As I write in my article, it's maybe marginally easier to get connected using phone numbers, but I may want to communicate via Signal with someone I don't want to give my phone number to. Handing out personal phone numbers on the willy nilly is not something I'm comfortable with. There's no reason why we couldn't have some other identifier, possibly easy to remember to connect us to via Signal. So this was a policy decision by the Signal people. Federation is indeed hard to get right, but I think with proper versioning, and various teams keeping their software up-to-date and close to the reference paper/the Signal protocol, I see no reason why it cannot be overcome. For XMPP/Jabber it also works quite well.

pvg 10y ago
Moxie has written at some length about the problems they've had with federation in the specific case of their experience with Signal and also more generally about federation and its potential impact of the development of network technologies. Your answer to all that is "I heard it's hard but really, versioning/XMPP and also, it's not hard". How well has 'proper versioning' worked out for SSL/TLS? Federation hasn't really 'worked out' for XMPP. Never mind anything substantial in response to Moxie's writing. People calling your piece 'hipsterism' are being very, very polite.
- Arathorn 10y ago
  It's unquestionable that federation and decentralisation increase complexity significantly. For context, prior to Matrix the Matrix team used to write commercial comms app silos for telcos - and then we had the epiphany that building silos is harmful to end-users and the industry as a whole, and shifted entirely to the longer-term mission to build an entirely decentralised & open alternative. Despite the fact that we already had an entirely functional centralised implementation, it took about 1.5x longer to create Matrix. And if had been starting from an entirely clean slate, I suspect it'd have been 3-4x longer. However, we very strongly feel that the resulting freedom and choice from the resulting open ecosystem is worth the additional complexity. Users can choose any service provider without compromising interoperability. They can run their own servers. They can write their own clients. They can write their own servers. They can choose precisely who they trust with their data. They can contribute to the spec and help define the ecosystem. They aren't forced into trusting a provider who may be trustworthy today, but who knows in future. I believe Moxie's viewpoint is that privacy is paramount, and any complexity which could introduce bugs which could undermine security/privacy is anathema. From a cryptography dev perspective, this makes perfect sense. On the other hand, Matrix believes that there is more to life than just privacy, though (as critical as privacy is, of course) - and it is possible to have both privacy and freedom. Yes, it slows down the rate of development a bit. Yes, it means you have to think much more carefully about layering the protocol to allow the different layers to evolve as independently and efficiently as possible, with the necessary mechanisms (both technical and organisational) to upgrade and lock out obsolete clients and servers. Yes, it means there's more complexity, where bugs could hide. Yes, it means that you may not be able to force the world to upgrade as rapidly as a silo might in the face of a critical security issue. However, we think it's worth it.
petre 10y ago
Use Wire then. You can either use you e-mail or phone number. Uses Signal OTR protocol and a single sign in for all your devices. The clients are open source. IMHO Signal is only usable on smartphones. I don't want to link my desktop client with the phone, so I use Wire on the desktop. Oh and Wire is a Swiss company. I see you run your blog off the .ch TLD.
- darklajid 10y ago
  That has other issues though. Last I checked you're unable to remove contacts from your contact list. I'm not kidding. You can 'block' people, but simply removing them? Nope. Why do I care? Because at one point the 'upload all contacts to Wire to help you find them on Wire' wasn't optional (I understand it is now) and now I'm stuck with entries on my contact list that I just don't care about. Very weird..

pvg 10y ago

Moxie has written at some length about the problems they've had with federation in the specific case of their experience with Signal and also more generally about federation and its potential impact of the development of network technologies. Your answer to all that is "I heard it's hard but really, versioning/XMPP and also, it's not hard". How well has 'proper versioning' worked out for SSL/TLS? Federation hasn't really 'worked out' for XMPP. Never mind anything substantial in response to Moxie's writing. People calling your piece 'hipsterism' are being very, very polite.

Arathorn 10y ago
It's unquestionable that federation and decentralisation increase complexity significantly. For context, prior to Matrix the Matrix team used to write commercial comms app silos for telcos - and then we had the epiphany that building silos is harmful to end-users and the industry as a whole, and shifted entirely to the longer-term mission to build an entirely decentralised & open alternative. Despite the fact that we already had an entirely functional centralised implementation, it took about 1.5x longer to create Matrix. And if had been starting from an entirely clean slate, I suspect it'd have been 3-4x longer. However, we very strongly feel that the resulting freedom and choice from the resulting open ecosystem is worth the additional complexity. Users can choose any service provider without compromising interoperability. They can run their own servers. They can write their own clients. They can write their own servers. They can choose precisely who they trust with their data. They can contribute to the spec and help define the ecosystem. They aren't forced into trusting a provider who may be trustworthy today, but who knows in future. I believe Moxie's viewpoint is that privacy is paramount, and any complexity which could introduce bugs which could undermine security/privacy is anathema. From a cryptography dev perspective, this makes perfect sense. On the other hand, Matrix believes that there is more to life than just privacy, though (as critical as privacy is, of course) - and it is possible to have both privacy and freedom. Yes, it slows down the rate of development a bit. Yes, it means you have to think much more carefully about layering the protocol to allow the different layers to evolve as independently and efficiently as possible, with the necessary mechanisms (both technical and organisational) to upgrade and lock out obsolete clients and servers. Yes, it means there's more complexity, where bugs could hide. Yes, it means that you may not be able to force the world to upgrade as rapidly as a silo might in the face of a critical security issue. However, we think it's worth it.

petre 10y ago

Use Wire then. You can either use you e-mail or phone number. Uses Signal OTR protocol and a single sign in for all your devices. The clients are open source. IMHO Signal is only usable on smartphones. I don't want to link my desktop client with the phone, so I use Wire on the desktop. Oh and Wire is a Swiss company. I see you run your blog off the .ch TLD.

darklajid 10y ago
That has other issues though. Last I checked you're unable to remove contacts from your contact list. I'm not kidding. You can 'block' people, but simply removing them? Nope. Why do I care? Because at one point the 'upload all contacts to Wire to help you find them on Wire' wasn't optional (I understand it is now) and now I'm stuck with entries on my contact list that I just don't care about. Very weird..