5 ms·

I can't help but feeling that Moxie's opinions about federation is nothing more to protect is business interests, which is to sell the Signal protocol to chat c

I can't help but feeling that Moxie's opinions about federation is nothing more to protect is business interests, which is to sell the Signal protocol to chat companies like Google and Facebook/WhatsApp. Matrix/Riot is a good example of a federated chat protocol which supports all the latest and shiny things you could find on a chat service (cross-platform, E2E encryption, audio/video group calls, multimedia content, etc) and which is also very easy to use and which has great UX. I would say that Matrix/Riot is even more feature complete than Signal. I get that the guy thinks non-federation makes things simpler for himself but the way he argues against federation is nonsensical.

dijit 9y ago
You're taking a new thing and assuming it's the same forever. His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues. Matrix/Riot is too new to have those, they have never deprecated a cipher yet.
- secfirstmd 9y ago
  While I love Signal for its simplicity and Matrix/Riot for its features. I regularly train high risk activists/journalists/aid workers on both and they always default to Signal. Matrix unfortunately suffers because it has too many features - and by far the biggest one we hear about is key exchange. I love the granular options but the vast majority of people just looking to communicate don't.
  - dharma1 9y ago
    I'm going to be working on some UX improvements to Matrix/Riot and agree with you on feature bloat, or at least hiding complexity for most users. Would love to have a chat with you about the issues the people you train have come across with Matrix
    - secfirstmd 9y ago
      Cool. Hit me up on the mail in my bio! :)
  - anc84 9y ago
    We have a matrix chatroom for three colleagues. The list of keys and devices we have to verify against each other does not fit anyone's screen, it is insane.
- pedroaraujo 9y ago
  If we are going to make the argument that updating all servers and clients on a federated network to follow the latest and securest crypto is a big issue, we also have to pull the argument that the crypto of a non-federated network can be manipulated at any time without your consent. In other words, you are at the mercy of whoever owns the chat platform. To me, this is a bigger privacy issue than the issue with updating servers/clients on a non-federated network.
- zeveb 9y ago
  > His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues. I think that he exaggerates the problem. Right now, it's possible for someone to install the Signal client, and then never upgrade it: the Signal servers must have a way, eventually, to refuse service to that client (upon which it will receive a message from the server stating something to the effect of 'your client is too outdated; please update it'). With a federated system, eventually some servers will be so out of date that other servers will refuse service to them. They'll have to send a message to those servers to the effect of 'you are too outdated; please update yourself'; the server can forward that message to its administrator. The clients of such servers might also receive a message stating 'your server is too outdated; please ask your administrator to upgrade or switch servers.' A similar pattern exists with respect to client updates in a federated network. Moxie's just wrong on this, I think: it's not significantly worse; the pattern with federation is very similar to the pattern with centralisation; and there are real benefits to federation & decentralisation.

dijit 9y ago

You're taking a new thing and assuming it's the same forever. His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues. Matrix/Riot is too new to have those, they have never deprecated a cipher yet.

secfirstmd 9y ago
While I love Signal for its simplicity and Matrix/Riot for its features. I regularly train high risk activists/journalists/aid workers on both and they always default to Signal. Matrix unfortunately suffers because it has too many features - and by far the biggest one we hear about is key exchange. I love the granular options but the vast majority of people just looking to communicate don't.
- dharma1 9y ago
  I'm going to be working on some UX improvements to Matrix/Riot and agree with you on feature bloat, or at least hiding complexity for most users. Would love to have a chat with you about the issues the people you train have come across with Matrix
  - secfirstmd 9y ago
    Cool. Hit me up on the mail in my bio! :)
- anc84 9y ago
  We have a matrix chatroom for three colleagues. The list of keys and devices we have to verify against each other does not fit anyone's screen, it is insane.
pedroaraujo 9y ago
If we are going to make the argument that updating all servers and clients on a federated network to follow the latest and securest crypto is a big issue, we also have to pull the argument that the crypto of a non-federated network can be manipulated at any time without your consent. In other words, you are at the mercy of whoever owns the chat platform. To me, this is a bigger privacy issue than the issue with updating servers/clients on a non-federated network.
zeveb 9y ago
> His point was that upgrading all clients/servers on a federated network is difficult/impossible and you end up with compatibility issues. I think that he exaggerates the problem. Right now, it's possible for someone to install the Signal client, and then never upgrade it: the Signal servers must have a way, eventually, to refuse service to that client (upon which it will receive a message from the server stating something to the effect of 'your client is too outdated; please update it'). With a federated system, eventually some servers will be so out of date that other servers will refuse service to them. They'll have to send a message to those servers to the effect of 'you are too outdated; please update yourself'; the server can forward that message to its administrator. The clients of such servers might also receive a message stating 'your server is too outdated; please ask your administrator to upgrade or switch servers.' A similar pattern exists with respect to client updates in a federated network. Moxie's just wrong on this, I think: it's not significantly worse; the pattern with federation is very similar to the pattern with centralisation; and there are real benefits to federation & decentralisation.