4 ms·

Don’t suppose anyone knows why the Signal protocol wasn’t chosen?

pmlnr 8y ago
Because when you build something like this, you shouldn't: - requiere a phone - build on s3 & a lot of other services without the option of a self hosted alternative. Look up the signal server requirements.
- superkuh 8y ago
  Yup. Signal sounds great but I can't use it because I don't have (or want) a smartphone with a phone number. I use Matrix clients instead.
amandine 8y ago
Because Signal is centralized. With Matrix they can deploy different servers across the gouvernement which interoperate. And potentially open it to the wider Matrix ecosystem
- subway 8y ago
  Signal, the service is centralized, but there's no reason that Signal, the protocol can't be. In fact before Moxie went on his silly "only I can do security right" rampage, Signal was federated with a server hosted by CyanogenMod.
  - mindB 8y ago
    The E2EE in matrix is actually based on the double ratchet from the Signal protocol. So you could think of the E2E in matrix as just a federated version of Signal. :)
    - subway 8y ago
      A point in moxie's favor is that the e2ee ux in matrix is currently extremely painful. I'm willing to use it on a couple rooms that consist entirely of geeks, but don't want to subject non-geeks to the whole verification process.
      - drdaeman 8y ago
        Not only UX, but there seem to be some subtle timing (in non-crypto/non-security meaning) issues. I ran Synapse on a resource-limited machine, so it had sort of "lagged behind" (or something like that) a little bit now and then. And I saw a number of "error decrypting image" and similar issues. It had self-resolved somehow after a while (saw the message decrypted the next day) but that's still a problem. Haven't reported this because I have no idea how to collect any useful information.
      - acct1771 8y ago
        Why do your non-geek friends have to verify? None of mine do.
  - esaym 8y ago
    >In fact before Moxie went on his silly "only I can do security right" rampage Do you have link or source for that? (I'm always interested in listening or watching stuff from Moxie)
    - snthd 8y ago
      Probably https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ >Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.
      - Promarged 8y ago
        Moxie is probably annoyed by the slow pace in which federated protocols move. Having it centralized he can move it a lot faster. Fortunately there are solutions that incentivize modern features in federated protocols too, like SSLLabs HTTPS checker or https://conversations.im/compliance/ https://conversations.im/compliance/ for XMPP.
    - subway 8y ago
      The posts that really left me disappointed are: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ https://whispersystems.discoursehosting.net/t/how-to-get-signal-apks-outside-of-the-google-play-store/808/20 https://whispersystems.discoursehosting.net/t/how-to-get-sig... https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... I suppose "only I can do security right" is perhaps overly harsh, but my take away was that he considered a walled garden that could be iterated on by his team preferable to allowing even forks of his team's own client to communicate with users on the OWS network.
    - deleted 8y ago
      [deleted]

Because when you build something like this, you shouldn't: - requiere a phone - build on s3 & a lot of other services without the option of a self hosted alternative. Look up the signal server requirements.

superkuh 8y ago
Yup. Signal sounds great but I can't use it because I don't have (or want) a smartphone with a phone number. I use Matrix clients instead.

amandine 8y ago

Because Signal is centralized. With Matrix they can deploy different servers across the gouvernement which interoperate. And potentially open it to the wider Matrix ecosystem

subway 8y ago
Signal, the service is centralized, but there's no reason that Signal, the protocol can't be. In fact before Moxie went on his silly "only I can do security right" rampage, Signal was federated with a server hosted by CyanogenMod.
- mindB 8y ago
  The E2EE in matrix is actually based on the double ratchet from the Signal protocol. So you could think of the E2E in matrix as just a federated version of Signal. :)
  - subway 8y ago
    A point in moxie's favor is that the e2ee ux in matrix is currently extremely painful. I'm willing to use it on a couple rooms that consist entirely of geeks, but don't want to subject non-geeks to the whole verification process.
    - drdaeman 8y ago
      Not only UX, but there seem to be some subtle timing (in non-crypto/non-security meaning) issues. I ran Synapse on a resource-limited machine, so it had sort of "lagged behind" (or something like that) a little bit now and then. And I saw a number of "error decrypting image" and similar issues. It had self-resolved somehow after a while (saw the message decrypted the next day) but that's still a problem. Haven't reported this because I have no idea how to collect any useful information.
    - acct1771 8y ago
      Why do your non-geek friends have to verify? None of mine do.
- esaym 8y ago
  >In fact before Moxie went on his silly "only I can do security right" rampage Do you have link or source for that? (I'm always interested in listening or watching stuff from Moxie)
  - snthd 8y ago
    Probably https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ >Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.
    - Promarged 8y ago
      Moxie is probably annoyed by the slow pace in which federated protocols move. Having it centralized he can move it a lot faster. Fortunately there are solutions that incentivize modern features in federated protocols too, like SSLLabs HTTPS checker or https://conversations.im/compliance/ https://conversations.im/compliance/ for XMPP.
  - subway 8y ago
    The posts that really left me disappointed are: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ https://whispersystems.discoursehosting.net/t/how-to-get-signal-apks-outside-of-the-google-play-store/808/20 https://whispersystems.discoursehosting.net/t/how-to-get-sig... https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... I suppose "only I can do security right" is perhaps overly harsh, but my take away was that he considered a walled garden that could be iterated on by his team preferable to allowing even forks of his team's own client to communicate with users on the OWS network.
  - deleted 8y ago
    [deleted]