10 ms·

Signal Creator on Considerations for distributed and decentralized technologies

132 points by dpeck 7y ago

rogerkirkness 7y ago
I just finished watching this, it's excellent. It's a much simpler and more cogent counter argument to people's idealogical interest in decentralization from Moxie of Signal. Really worth watching in the context of privacy, decentralized internet services as well as clear thinking about product and the future.
- inciampati 7y ago
  It's interesting that the things he says are bad aspects of decentralization (that protocols become fixed) are precisely the reasons that people want decentralization. No single actor can shift the protocol out from under a distributed system. That makes it something that can be trusted.
  - rogerkirkness 7y ago
    But for the reasons he's saying, it's very unlikely that will win, everything starts decentralized going from 0 to 1 protocol wise, and then shifts to centralization for UX.
  - Vinnl 7y ago
    Perhaps, but I'm still afraid AMP for email will be pushed through, by just getting a small number of players to agree: https://news.ycombinator.com/item?id=19493378 https://news.ycombinator.com/item?id=19493378
saurik 7y ago
1) This was posted a few days ago when it was first posted to CCC's website, where it already had a lot of conversation. I recommend people read the posts there, as this video has a number of issues in its argument. https://news.ycombinator.com/item?id=21904041 https://news.ycombinator.com/item?id=21904041 2) Moxie did not want to be recorded at this event, and was told he wouldn't be recorded, and yet the video was posted anyway for a bit before the CCC took it down (which is why it is being hosted on PeerTube). https://twitter.com/moxie/status/1211427007596154881?s=21 https://twitter.com/moxie/status/1211427007596154881?s=21
- baby 7y ago
  Oh wow that is definitely not cool. I’m happy I got to watch it, but if he didn’t want to be recorded that is a massive breach of trust from CCC. I got to hear Moxie speak at RWC when he received the Levchin prize and I gotta say it was one of the best talk I’ve heard and it’s a shame he didn’t want to be recorded back then as well.
  - lorenzhs 7y ago
    No bad intentions, just some confusion: https://twitter.com/moxie/status/1211427007596154881 https://twitter.com/moxie/status/1211427007596154881
  - lima 7y ago
    It's a volunteer-ran event and mistakes happen. Probably as simple as "someone messed up the talk metadata and VOC wasn't aware that it shouldn't be recorded".
- vineyardmike 7y ago
  Its ironic that it is made available on a decentralized platform, since now it cannot be taken down as easily. Especially considering the topic of the video.
  - hydgv 7y ago
    Actually I think it's quite a good idea if it stays up. It will show him the consequences of what he's preaching. A taste of his own medicine. (I support laws like the right to be forgotten, and I believe decentralisation to be a bad idea because it defeats those laws.)
    - lima 7y ago
      Moxie's talk is a critique of decentralization, so how is this a "taste of his own medicine"?
    - woodrowbarlow 7y ago
0xdeadb00f 7y ago
Counter argument by XMPP/OMEMO developer: https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-moving/ https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-mo...
- tialaramex 7y ago
  For Domain Fronting in particular it's embarrassing that pro-distributed people have taken it as a "victory" that AWS and Google disabled domain fronting used as an anti-censorship mechanism for Signal. That's both a terrible look "Ha! Our services are so unpopular nobody even cares to block them" and a grave misunderstanding of the situation. The big CDNs and cloud service providers are actually very enthusiastic about domain fronting, what they blocked was the technical mechanism abused to make it happen, because it causes their reliability teams pain. Domain fronting means you figure out this is a request for thing-a.example.com using SNI, your backend systems cue up the Thing A service... and then during HTTP headers the client insists it intended to talk to thing-b.example.com all along instead and you've got to either give an error or somehow backtrack and make that happen. Doing this is very easy, indeed the default, in say one Apache httpd on a Linux box. But Google or AWS isn't a data centre full of Apache httpds on Linux boxes, it's a bit more complicated than that. When I say they're enthusiastic I don't mean just empty words, the active direction of QUIC, eSNI, the revised HTTP service record for DNS and so on are all aligned with the domain fronting concept, just not in the form of abusing different protocol layers. They want to know early in the connection which service you're intending to reach, while preserving your privacy from snooping governments, etc.
- StavrosK 7y ago
  > 5 years are not a long time to update the entirety of the internet Given that WhatsApp manages to update its entirety of the internet in a few days, I'd say that is quite a long time. Is there a name for this fallacious "arguing for/against something without comparing it to alternatives"? > But the answer to this problem would logically be that we need to increase our efforts to change that by reducing the number of GMail accounts and increasing the number of self-hosted email servers, right? No, the argument is that decentralized services will mostly be centralized anyway due to the fact that centralization can move faster. Everyone has Gmail on the other end because Gmail is better than other services (that is the argument, not what I personally believe, as I think Fastmail is better). Given that decentralization will lead to the existence of a few large points of centralization anyway, we should make those points secure, and centralizing allows us to do that better, the argument goes. > While this is an issue, there are solutions to this problem, one being nomadic identities. The point is that nobody has zero-knowledge nomadic identities. AFAIK Signal were the first ones to come up with a practical implementation a few days ago. > For some reason Marlinspike confuses a decentralized system with a centralized, but distributed system. It even reads “Centralized Service” on his slides… Moxie is talking about a centralized service. It says centralized on the slides, he said centralized twice, the author seems confused here. > These suites act as maps that point a way through the XEP jungle. Yes, and a centralized service needs none of this. Personally, I don't see this article debunking many of the points. Decentralized is better for censorship-resistance, and I prefer it, but it's better for that because centralized platforms aren't usually designed for censorship resistance. Signal knows nothing about its messages, and thus it's much harder to censor people using it. I feel like Moxie made some good arguments, and would like to see some solutions in making decentralized servers and clients more easily upgradable. Signal's approach works for signal, but it also works for almost every other person, since everyone seems happy to use Facebook or Slack or whatnot instead of Riot for their communications. I really like what Mastodon is doing in the federated microblogging space, and hopefully that will extend to other areas.
MajesticHobo2 7y ago
While I found the talk more compelling, it's also worth mentioning Moxie's 2016 article, "Reflections: The ecosystem is moving", for several of the key points: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
j88439h84 7y ago
Matrix seems like a great path forward. Widely supported, well-funded, decentralized. Mozilla has adopted Matrix as its internal messaging system. https://matrix.org/blog/2019/12/19/welcoming-mozilla-to-matrix/ https://matrix.org/blog/2019/12/19/welcoming-mozilla-to-matr... https://about.riot.im/ https://about.riot.im/
- baby 7y ago
  I would be interested in a blogpost going through Moxie’s argument with Matrix. I don’t know much about the project but it seems like Matrix doesn’t target normal users no?
  - Arathorn 7y ago
    Matrix absolutely targets normal users, much as the Web does too. I guess on the Matrix side we'll put a blog post together to respond to Moxie's points.
    - newscracker 7y ago
      > I guess on the Matrix side we'll put a blog post together to respond to Moxie's points. I personally would love to see the blog post on this.
      - Arathorn 7y ago
        writing it atm
        Arathorn 7y ago
        https://matrix.org/blog/2020/02/01/on-privacy-versus-freedom/ https://matrix.org/blog/2020/02/01/on-privacy-versus-freedom...
        j88439h84 7y ago
        Fwiw one of the things I don't like about Signal is that I have to share my phone number, which makes it a poor fit for anonymous communication.
nimbius 7y ago
the greatest concern to centralized systems like Signal is not ease of use, its censorship and de-platforming. In China, Signal servers are outright banned. No servers, no secure communications. In the United states players like Cloudflare have demonstrated twice the can and will de-platform entire communities for controversial speech. senator Joseph Lieberman, with a single phonecall, had wikileaks immediately deplatformed from AWS. All it takes is a violation of a term of service and that service vanishes. Increasingly Moxie seems to value the developer experience over any project goal for Signal. its still AWS, it still depends greatly on google services and play store for distribution. Begrudgingly hes added a secret-ish link on the signal website to download the APK directly, but he still ardently refuses to publish the package on FDroid. and as for his "federated services are stuck in time" argument, these are glaring architectural issues that have plagued his application for five years. The only tangible evolution of signal in the past year has been new cat and dog stickers that no one asked for.
- rapsey 7y ago
  > Increasingly Moxie seems to value the developer experience over any project goal for Signal. This has always been the case.
- StavrosK 7y ago
  > In the United states players like Cloudflare have demonstrated twice the can and will de-platform entire communities for controversial speech. What are the two instances?
  - jml7c5 7y ago
    The Daily Stormer and 8chan, AFAIK.
  - olefoo 7y ago
    Some Nazis were briefly inconvenienced. And a lot of people gave Cloudflare a lot of grief for not de-platforming them sooner. But, hey. This person sees that as a fatal flaw. https://www.wired.com/story/free-speech-issue-cloudflare/ https://www.wired.com/story/free-speech-issue-cloudflare/
3xblah 7y ago
"You are blocking Javascript, and we totally get that. However this endpoint uses Angular, so the front end is in full JavaScript and won't work without it. There will be other non JS-based clients to access PeerTube, but for now none is available. Be sure we will update this page with a list once alternative clients are developed. You can certainly develop you own in the meantime as our code is open source and libre software under GNU AGPLv3.0. There might be numerous reasons you refuse to use JavaScript. If it has just to do with security (or lack thereof) of JavaScript-based webapps, then depending on your threat menace you might want to go through the code running on the node you are trying to access, and look for security audits. We are sorry but it seems that PeerTube is not compatible with your web browser. Please try with the latest version of Mozilla Firefox. If you think this is a mistake, do not hesitate to report it." peertube-dl(){ a=$(case $1 in "")sed t;;https://*)echo $1;esac|sed 's/videos/static/;s/watch/webseed/');curl -4O $a-720.mp4; } Usage: peertube-dl https://peertube.co.uk/videos/watch/12be5396-2a25-4ec8-a92a-674b1cb6b270 echo https://peertube.co.uk/videos/watch/12be5396-2a25-4ec8-a92a-674b1cb6b270|peertube-dl Download link: https://peertube.co.uk/static/webseed/12be5396-2a25-4ec8-a92a-674b1cb6b270-720.mp4 https://peertube.co.uk/static/webseed/12be5396-2a25-4ec8-a92...
- majewsky 7y ago
  The standard tool for downloading videos from websites, youtube-dl, also works great with PeerTube. (Don't let the name mislead you. YouTube is only one of hundreds of supported providers.)
  - BuildTheRobots 7y ago
    You're not kidding - there seems to be well over 1,000 sites supported: https://github.com/ytdl-org/youtube-dl/blob/master/docs/supportedsites.md https://github.com/ytdl-org/youtube-dl/blob/master/docs/supp... I do have to give peertube some thanks though - it might require javascript, but there's a large and obvious download button (at least on the mobile page).
- 3xblah 7y ago
  No Javascript or Python needed. Reminds me of when Google used to provide JSON from YouTube (and other) endpoints without requiring users to "sign up". # list instances curl "https://instances.joinpeertube.org/api/v1/instances?start=0&count=5&sort=-createdAt" # search an instance curl "https://${instance}/api/v1/search/videos?start=0&count=50&search=$1" # list video categories curl https://${instance}/api/v1/videos/categories/ # list videos curl "https://${instance}/api/v1/videos?start=0&count=500"
newscracker 7y ago
At the risk of burning away virtual points, I have the following observations and opinions. I respect the encryption technologies that Signal has developed, but I'm always frustrated with Signal as an app, platform and where it seems to be headed. Throughout this talk, the one quote that came to my mind for every point he was defending was this: "It is difficult to get a man to understand something, when his salary depends on his not understanding it." ― Upton Sinclair I also found it amusing when he said that it's easier to switch from WhatsApp to Telegram to Signal. The truth is that switching people from WhatsApp to Telegram, in my experience, will earn you brownie points because Telegram is a lot more feature rich than WhatsApp (let's keep the encryption part aside for the moment). If you manage to switch people from WhatsApp or Telegram to Signal, again in my experience, you'll lose credibility and trust because Signal, for all the money the foundation has, moves at snail's pace. Moxie's argument early in the talk about centralized systems being able to change fast just does not apply to Signal. It still lacks stability in delivering messages. Its UX for joining groups, re-joining groups after reinstalling your OS, etc., completely sucks. Don't even get me started on Signal treating its users as if everyone uses a burner phone and doesn't care about keeping their conversations when they switch devices or even have to wipe a device and get it running again (Signal on iOS still explicitly prohibits backups after so many years, and the Signal team's most recent addition to the app was stickers!). The example for switching from WhatsApp to Telegram to Signal being easy because it's tied to phone numbers is disingenuous. Following how WhatsApp and Telegram identify their users may not be the best thing to do. Signal assumes that people always have the same phone number and that phone numbers are the best way to identify people. But it fails to acknowledge that using email addresses to sign up (at least as an option for those who want to avoid phone numbers), like how Wire does, provides people a choice in how they want to appear on a platform. I know people who don't want to use a phone number based platform because they don't want all their phone contacts to know that they're on a particular platform (this was partially solved by Telegram in an update a few months ago, where you have control on who gets to know that you're using it, even if they have your number in their address book). His non-answer for the question around the 38 minute mark on Signal being tied to a phone number and that being a risk shows that Signal is stuck with what he/they believe is ideal, and refusing to acknowledge that this is a big problem for some sections of people...the very people Signal claims to be most useful for.
baby 7y ago
Related, this prompted me to write about the history of end-to-end encryption: https://www.cryptologie.net/article/487/a-history-of-end-to-end-encryption-and-the-death-of-pgp/ https://www.cryptologie.net/article/487/a-history-of-end-to-...

132 points by dpeck 7y ago

I just finished watching this, it's excellent. It's a much simpler and more cogent counter argument to people's idealogical interest in decentralization from Moxie of Signal. Really worth watching in the context of privacy, decentralized internet services as well as clear thinking about product and the future.

inciampati 7y ago
It's interesting that the things he says are bad aspects of decentralization (that protocols become fixed) are precisely the reasons that people want decentralization. No single actor can shift the protocol out from under a distributed system. That makes it something that can be trusted.
- rogerkirkness 7y ago
  But for the reasons he's saying, it's very unlikely that will win, everything starts decentralized going from 0 to 1 protocol wise, and then shifts to centralization for UX.
- Vinnl 7y ago
  Perhaps, but I'm still afraid AMP for email will be pushed through, by just getting a small number of players to agree: https://news.ycombinator.com/item?id=19493378 https://news.ycombinator.com/item?id=19493378

saurik 7y ago

1) This was posted a few days ago when it was first posted to CCC's website, where it already had a lot of conversation. I recommend people read the posts there, as this video has a number of issues in its argument. https://news.ycombinator.com/item?id=21904041 https://news.ycombinator.com/item?id=21904041 2) Moxie did not want to be recorded at this event, and was told he wouldn't be recorded, and yet the video was posted anyway for a bit before the CCC took it down (which is why it is being hosted on PeerTube). https://twitter.com/moxie/status/1211427007596154881?s=21 https://twitter.com/moxie/status/1211427007596154881?s=21

baby 7y ago
Oh wow that is definitely not cool. I’m happy I got to watch it, but if he didn’t want to be recorded that is a massive breach of trust from CCC. I got to hear Moxie speak at RWC when he received the Levchin prize and I gotta say it was one of the best talk I’ve heard and it’s a shame he didn’t want to be recorded back then as well.
- lorenzhs 7y ago
  No bad intentions, just some confusion: https://twitter.com/moxie/status/1211427007596154881 https://twitter.com/moxie/status/1211427007596154881
- lima 7y ago
  It's a volunteer-ran event and mistakes happen. Probably as simple as "someone messed up the talk metadata and VOC wasn't aware that it shouldn't be recorded".
vineyardmike 7y ago
Its ironic that it is made available on a decentralized platform, since now it cannot be taken down as easily. Especially considering the topic of the video.
- hydgv 7y ago
  Actually I think it's quite a good idea if it stays up. It will show him the consequences of what he's preaching. A taste of his own medicine. (I support laws like the right to be forgotten, and I believe decentralisation to be a bad idea because it defeats those laws.)
  - lima 7y ago
    Moxie's talk is a critique of decentralization, so how is this a "taste of his own medicine"?
  - woodrowbarlow 7y ago

0xdeadb00f 7y ago

Counter argument by XMPP/OMEMO developer: https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-moving/ https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-mo...

tialaramex 7y ago
For Domain Fronting in particular it's embarrassing that pro-distributed people have taken it as a "victory" that AWS and Google disabled domain fronting used as an anti-censorship mechanism for Signal. That's both a terrible look "Ha! Our services are so unpopular nobody even cares to block them" and a grave misunderstanding of the situation. The big CDNs and cloud service providers are actually very enthusiastic about domain fronting, what they blocked was the technical mechanism abused to make it happen, because it causes their reliability teams pain. Domain fronting means you figure out this is a request for thing-a.example.com using SNI, your backend systems cue up the Thing A service... and then during HTTP headers the client insists it intended to talk to thing-b.example.com all along instead and you've got to either give an error or somehow backtrack and make that happen. Doing this is very easy, indeed the default, in say one Apache httpd on a Linux box. But Google or AWS isn't a data centre full of Apache httpds on Linux boxes, it's a bit more complicated than that. When I say they're enthusiastic I don't mean just empty words, the active direction of QUIC, eSNI, the revised HTTP service record for DNS and so on are all aligned with the domain fronting concept, just not in the form of abusing different protocol layers. They want to know early in the connection which service you're intending to reach, while preserving your privacy from snooping governments, etc.
StavrosK 7y ago
> 5 years are not a long time to update the entirety of the internet Given that WhatsApp manages to update its entirety of the internet in a few days, I'd say that is quite a long time. Is there a name for this fallacious "arguing for/against something without comparing it to alternatives"? > But the answer to this problem would logically be that we need to increase our efforts to change that by reducing the number of GMail accounts and increasing the number of self-hosted email servers, right? No, the argument is that decentralized services will mostly be centralized anyway due to the fact that centralization can move faster. Everyone has Gmail on the other end because Gmail is better than other services (that is the argument, not what I personally believe, as I think Fastmail is better). Given that decentralization will lead to the existence of a few large points of centralization anyway, we should make those points secure, and centralizing allows us to do that better, the argument goes. > While this is an issue, there are solutions to this problem, one being nomadic identities. The point is that nobody has zero-knowledge nomadic identities. AFAIK Signal were the first ones to come up with a practical implementation a few days ago. > For some reason Marlinspike confuses a decentralized system with a centralized, but distributed system. It even reads “Centralized Service” on his slides… Moxie is talking about a centralized service. It says centralized on the slides, he said centralized twice, the author seems confused here. > These suites act as maps that point a way through the XEP jungle. Yes, and a centralized service needs none of this. Personally, I don't see this article debunking many of the points. Decentralized is better for censorship-resistance, and I prefer it, but it's better for that because centralized platforms aren't usually designed for censorship resistance. Signal knows nothing about its messages, and thus it's much harder to censor people using it. I feel like Moxie made some good arguments, and would like to see some solutions in making decentralized servers and clients more easily upgradable. Signal's approach works for signal, but it also works for almost every other person, since everyone seems happy to use Facebook or Slack or whatnot instead of Riot for their communications. I really like what Mastodon is doing in the federated microblogging space, and hopefully that will extend to other areas.

MajesticHobo2 7y ago

While I found the talk more compelling, it's also worth mentioning Moxie's 2016 article, "Reflections: The ecosystem is moving", for several of the key points: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

j88439h84 7y ago

Matrix seems like a great path forward. Widely supported, well-funded, decentralized. Mozilla has adopted Matrix as its internal messaging system. https://matrix.org/blog/2019/12/19/welcoming-mozilla-to-matrix/ https://matrix.org/blog/2019/12/19/welcoming-mozilla-to-matr... https://about.riot.im/ https://about.riot.im/

baby 7y ago
I would be interested in a blogpost going through Moxie’s argument with Matrix. I don’t know much about the project but it seems like Matrix doesn’t target normal users no?
- Arathorn 7y ago
  Matrix absolutely targets normal users, much as the Web does too. I guess on the Matrix side we'll put a blog post together to respond to Moxie's points.
  - newscracker 7y ago
    > I guess on the Matrix side we'll put a blog post together to respond to Moxie's points. I personally would love to see the blog post on this.
    - Arathorn 7y ago
      writing it atm
      - Arathorn 7y ago
        https://matrix.org/blog/2020/02/01/on-privacy-versus-freedom/ https://matrix.org/blog/2020/02/01/on-privacy-versus-freedom...
        j88439h84 7y ago
        Fwiw one of the things I don't like about Signal is that I have to share my phone number, which makes it a poor fit for anonymous communication.

nimbius 7y ago

the greatest concern to centralized systems like Signal is not ease of use, its censorship and de-platforming. In China, Signal servers are outright banned. No servers, no secure communications. In the United states players like Cloudflare have demonstrated twice the can and will de-platform entire communities for controversial speech. senator Joseph Lieberman, with a single phonecall, had wikileaks immediately deplatformed from AWS. All it takes is a violation of a term of service and that service vanishes. Increasingly Moxie seems to value the developer experience over any project goal for Signal. its still AWS, it still depends greatly on google services and play store for distribution. Begrudgingly hes added a secret-ish link on the signal website to download the APK directly, but he still ardently refuses to publish the package on FDroid. and as for his "federated services are stuck in time" argument, these are glaring architectural issues that have plagued his application for five years. The only tangible evolution of signal in the past year has been new cat and dog stickers that no one asked for.

rapsey 7y ago
> Increasingly Moxie seems to value the developer experience over any project goal for Signal. This has always been the case.
StavrosK 7y ago
> In the United states players like Cloudflare have demonstrated twice the can and will de-platform entire communities for controversial speech. What are the two instances?
- jml7c5 7y ago
  The Daily Stormer and 8chan, AFAIK.
- olefoo 7y ago
  Some Nazis were briefly inconvenienced. And a lot of people gave Cloudflare a lot of grief for not de-platforming them sooner. But, hey. This person sees that as a fatal flaw. https://www.wired.com/story/free-speech-issue-cloudflare/ https://www.wired.com/story/free-speech-issue-cloudflare/

3xblah 7y ago

"You are blocking Javascript, and we totally get that. However this endpoint uses Angular, so the front end is in full JavaScript and won't work without it. There will be other non JS-based clients to access PeerTube, but for now none is available. Be sure we will update this page with a list once alternative clients are developed. You can certainly develop you own in the meantime as our code is open source and libre software under GNU AGPLv3.0. There might be numerous reasons you refuse to use JavaScript. If it has just to do with security (or lack thereof) of JavaScript-based webapps, then depending on your threat menace you might want to go through the code running on the node you are trying to access, and look for security audits. We are sorry but it seems that PeerTube is not compatible with your web browser. Please try with the latest version of Mozilla Firefox. If you think this is a mistake, do not hesitate to report it." peertube-dl(){ a=$(case $1 in "")sed t;;https://*)echo $1;esac|sed 's/videos/static/;s/watch/webseed/');curl -4O $a-720.mp4; } Usage: peertube-dl https://peertube.co.uk/videos/watch/12be5396-2a25-4ec8-a92a-674b1cb6b270 echo https://peertube.co.uk/videos/watch/12be5396-2a25-4ec8-a92a-674b1cb6b270|peertube-dl Download link: https://peertube.co.uk/static/webseed/12be5396-2a25-4ec8-a92a-674b1cb6b270-720.mp4 https://peertube.co.uk/static/webseed/12be5396-2a25-4ec8-a92...

majewsky 7y ago
The standard tool for downloading videos from websites, youtube-dl, also works great with PeerTube. (Don't let the name mislead you. YouTube is only one of hundreds of supported providers.)
- BuildTheRobots 7y ago
  You're not kidding - there seems to be well over 1,000 sites supported: https://github.com/ytdl-org/youtube-dl/blob/master/docs/supportedsites.md https://github.com/ytdl-org/youtube-dl/blob/master/docs/supp... I do have to give peertube some thanks though - it might require javascript, but there's a large and obvious download button (at least on the mobile page).
3xblah 7y ago
No Javascript or Python needed. Reminds me of when Google used to provide JSON from YouTube (and other) endpoints without requiring users to "sign up". # list instances curl "https://instances.joinpeertube.org/api/v1/instances?start=0&count=5&sort=-createdAt" # search an instance curl "https://${instance}/api/v1/search/videos?start=0&count=50&search=$1" # list video categories curl https://${instance}/api/v1/videos/categories/ # list videos curl "https://${instance}/api/v1/videos?start=0&count=500"

newscracker 7y ago

At the risk of burning away virtual points, I have the following observations and opinions. I respect the encryption technologies that Signal has developed, but I'm always frustrated with Signal as an app, platform and where it seems to be headed. Throughout this talk, the one quote that came to my mind for every point he was defending was this: "It is difficult to get a man to understand something, when his salary depends on his not understanding it." ― Upton Sinclair I also found it amusing when he said that it's easier to switch from WhatsApp to Telegram to Signal. The truth is that switching people from WhatsApp to Telegram, in my experience, will earn you brownie points because Telegram is a lot more feature rich than WhatsApp (let's keep the encryption part aside for the moment). If you manage to switch people from WhatsApp or Telegram to Signal, again in my experience, you'll lose credibility and trust because Signal, for all the money the foundation has, moves at snail's pace. Moxie's argument early in the talk about centralized systems being able to change fast just does not apply to Signal. It still lacks stability in delivering messages. Its UX for joining groups, re-joining groups after reinstalling your OS, etc., completely sucks. Don't even get me started on Signal treating its users as if everyone uses a burner phone and doesn't care about keeping their conversations when they switch devices or even have to wipe a device and get it running again (Signal on iOS still explicitly prohibits backups after so many years, and the Signal team's most recent addition to the app was stickers!). The example for switching from WhatsApp to Telegram to Signal being easy because it's tied to phone numbers is disingenuous. Following how WhatsApp and Telegram identify their users may not be the best thing to do. Signal assumes that people always have the same phone number and that phone numbers are the best way to identify people. But it fails to acknowledge that using email addresses to sign up (at least as an option for those who want to avoid phone numbers), like how Wire does, provides people a choice in how they want to appear on a platform. I know people who don't want to use a phone number based platform because they don't want all their phone contacts to know that they're on a particular platform (this was partially solved by Telegram in an update a few months ago, where you have control on who gets to know that you're using it, even if they have your number in their address book). His non-answer for the question around the 38 minute mark on Signal being tied to a phone number and that being a risk shows that Signal is stuck with what he/they believe is ideal, and refusing to acknowledge that this is a big problem for some sections of people...the very people Signal claims to be most useful for.

baby 7y ago

Related, this prompted me to write about the history of end-to-end encryption: https://www.cryptologie.net/article/487/a-history-of-end-to-end-encryption-and-the-death-of-pgp/ https://www.cryptologie.net/article/487/a-history-of-end-to-...