4 ms·

One of the points in the older threads was "e2e by default". According to the github issue [1] it looks like E2E is now enabled by default in Riot. The "compat

One of the points in the older threads was "e2e by default". According to the github issue [1] it looks like E2E is now enabled by default in Riot. The "compatibility with the least common denominator client" point still stands though. I'm curious whether Signal is likely to add features that Riot will fail to add. [1] https://github.com/vector-im/riot-web/issues/6779 https://github.com/vector-im/riot-web/issues/6779

tptacek 7y ago
Signal is basically built out of features Matrix doesn't and won't have. Think of Signal this way: Signal is an effort to build an Internet scale messaging system that is end-to-end encrypted by default and that maintains the smallest possible metadata footprint. Core messaging application features have been absent from Signal for years as they work out how to get them deployed without turning their servers into repositories of valuable metadata, which is why we only just recently got user profiles. Similarly: the Signal feature most hated by message board nerds (myself included!), its reliance on phone numbers, is a straightforward consequence of that project goal; using phone numbers allows Signal to piggyback on people's local contact databases instead of maintaining that directory serverside. It seems like an inconsequential difference not worthy of the UX debacle of having to ask for people's "Signal number" until you realize that Signal's competitors are forced to maintain plaintext databases detailing every pair of users that have communicated with each other. Eventually, Signal will get all this stuff worked out. We'll have a reference design for how to do privacy-respecting Internet-scale messaging with modern cryptography. At that point, it will make a lot of sense to start asking about federating Signal; I would not be surprised to see Marlinspike himself opening up to it. But we are not there yet: we're still using phone numbers with it! Signal is aggressively evolving, and that's it's job, and people shouldn't demand Signal do things that retard that job. Riot will no doubt get a whole bunch of cool messaging features Signal won't have, because it is much easier for Riot to add features, because they operate without the security and privacy constraints Signal has opted into. Which is fine! It's how this should work. Let a thousand flowers bloom. I just get to make fun of the people who choose the plaintext-by-default flowers. (Yes, my understanding is that Matrix either is or soon will be all E2E by default, this year... 2 years after DeVault recommended it as a secure alternative to Signal, in his post attributing malign intent to Moxie Marlinspike.)
- ncmncm 7y ago
  I would take it as a favor if someone were to explain how to make Signal stop pestering me to fill out a profile. After I have said "maybe later" a half-dozen times, it could maybe take the hint.
- neiljohnson 7y ago
  This post (from the Matrix team) gives a good account of the differences in design philosophy between Matrix and Signal https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom

tptacek 7y ago

Signal is basically built out of features Matrix doesn't and won't have. Think of Signal this way: Signal is an effort to build an Internet scale messaging system that is end-to-end encrypted by default and that maintains the smallest possible metadata footprint. Core messaging application features have been absent from Signal for years as they work out how to get them deployed without turning their servers into repositories of valuable metadata, which is why we only just recently got user profiles. Similarly: the Signal feature most hated by message board nerds (myself included!), its reliance on phone numbers, is a straightforward consequence of that project goal; using phone numbers allows Signal to piggyback on people's local contact databases instead of maintaining that directory serverside. It seems like an inconsequential difference not worthy of the UX debacle of having to ask for people's "Signal number" until you realize that Signal's competitors are forced to maintain plaintext databases detailing every pair of users that have communicated with each other. Eventually, Signal will get all this stuff worked out. We'll have a reference design for how to do privacy-respecting Internet-scale messaging with modern cryptography. At that point, it will make a lot of sense to start asking about federating Signal; I would not be surprised to see Marlinspike himself opening up to it. But we are not there yet: we're still using phone numbers with it! Signal is aggressively evolving, and that's it's job, and people shouldn't demand Signal do things that retard that job. Riot will no doubt get a whole bunch of cool messaging features Signal won't have, because it is much easier for Riot to add features, because they operate without the security and privacy constraints Signal has opted into. Which is fine! It's how this should work. Let a thousand flowers bloom. I just get to make fun of the people who choose the plaintext-by-default flowers. (Yes, my understanding is that Matrix either is or soon will be all E2E by default, this year... 2 years after DeVault recommended it as a secure alternative to Signal, in his post attributing malign intent to Moxie Marlinspike.)

ncmncm 7y ago
I would take it as a favor if someone were to explain how to make Signal stop pestering me to fill out a profile. After I have said "maybe later" a half-dozen times, it could maybe take the hint.
neiljohnson 7y ago
This post (from the Matrix team) gives a good account of the differences in design philosophy between Matrix and Signal https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom