5 ms·

A null vision. Moxie is against federation, and he's against interoperable clients. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/t

A null vision. Moxie is against federation, and he's against interoperable clients. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37

zeveb 9y ago
I really, really wish that he'd reconsider. Interoperability is a huge Good Deal.
- walterbell 9y ago
  Signal now has the resources to compete with the IETF effort by Mozilla, Google, Cisco, Facebook, Wire, Twitter, MIT and INRIA: https://news.ycombinator.com/item?id=16325803 https://news.ycombinator.com/item?id=16325803
baby 9y ago
I don't think he's against federation, it just doesn't make sense to federate an experiment. Once you've got something really really really solid, then it does make sense. They've been able to iterate their protocol really fast thanks to it not being an RFC or something.
- carussell 9y ago
  If you're suggesting that Signal will eventually federate, there's nothing in those two links to support that interpretation. In fact, to the contrary: > Early on, I thought we’d federate Signal once its velocity had subsided. Now I realize that things will probably never slow down, and if anything the velocity of the entire landscape seems to be steadily increasing. > You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run. If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.
- mashedvikings 9y ago
  Fully agree and I want to elaborate. After SHA-1 broke, IETF's OpenPGP work group have failed the community by wrestling hand over what hash function should be in 5th revision of fingerprint protocol. When they couldn't reach an agreement, the development of the next standard was abandoned, leaving all users vulnerable with no date for fix. And FFS, it hasn't even got anything to do with protocol, it's something the client can do by itself. Having worked on secure messaging apps, I would never go to federated protocols. Signal's infrastructure allows rapid improvement of protocol and fast elimination of insecure protocol revisions. That's where we need to be at. Just look at the history of TLS and the potential in downgrade attacks. Old revisions die slowly. Signal can easily monitor what versions are still running, push updates to users and ensure codebase isn't bloated by code that merely represents insecure protocols. Signal succeeds because of it's "closed" ecosystem, it doesn't suffer from the tyranny of the majority that occurs when there's disagreement about e.g. seriousness of some attack, when some feature might be risky. With Matrix, I worry developers of clients can affect choices, and the protocol is already dangerous, to ensure (backwards) compatibility with older clients and (other) protocols, Matrix is not end-to-end encrypted by default. I will eat my hat with mustard the day I see all Matrix clients support only end-to-end encryption for everything.
aidenn0 9y ago
The axolotl ratchet has been used in at least two different federated protocols that I am aware of. There is no plan to federate signal itself, but he not only allows, but seems to encourage the protocol's use elsewhere.

zeveb 9y ago

I really, really wish that he'd reconsider. Interoperability is a huge Good Deal.

walterbell 9y ago
Signal now has the resources to compete with the IETF effort by Mozilla, Google, Cisco, Facebook, Wire, Twitter, MIT and INRIA: https://news.ycombinator.com/item?id=16325803 https://news.ycombinator.com/item?id=16325803

baby 9y ago

I don't think he's against federation, it just doesn't make sense to federate an experiment. Once you've got something really really really solid, then it does make sense. They've been able to iterate their protocol really fast thanks to it not being an RFC or something.

carussell 9y ago
If you're suggesting that Signal will eventually federate, there's nothing in those two links to support that interpretation. In fact, to the contrary: > Early on, I thought we’d federate Signal once its velocity had subsided. Now I realize that things will probably never slow down, and if anything the velocity of the entire landscape seems to be steadily increasing. > You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run. If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product.
mashedvikings 9y ago
Fully agree and I want to elaborate. After SHA-1 broke, IETF's OpenPGP work group have failed the community by wrestling hand over what hash function should be in 5th revision of fingerprint protocol. When they couldn't reach an agreement, the development of the next standard was abandoned, leaving all users vulnerable with no date for fix. And FFS, it hasn't even got anything to do with protocol, it's something the client can do by itself. Having worked on secure messaging apps, I would never go to federated protocols. Signal's infrastructure allows rapid improvement of protocol and fast elimination of insecure protocol revisions. That's where we need to be at. Just look at the history of TLS and the potential in downgrade attacks. Old revisions die slowly. Signal can easily monitor what versions are still running, push updates to users and ensure codebase isn't bloated by code that merely represents insecure protocols. Signal succeeds because of it's "closed" ecosystem, it doesn't suffer from the tyranny of the majority that occurs when there's disagreement about e.g. seriousness of some attack, when some feature might be risky. With Matrix, I worry developers of clients can affect choices, and the protocol is already dangerous, to ensure (backwards) compatibility with older clients and (other) protocols, Matrix is not end-to-end encrypted by default. I will eat my hat with mustard the day I see all Matrix clients support only end-to-end encryption for everything.

aidenn0 9y ago

The axolotl ratchet has been used in at least two different federated protocols that I am aware of. There is no plan to federate signal itself, but he not only allows, but seems to encourage the protocol's use elsewhere.