7 ms·

> When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. It limits th

> When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Its security depends on a single company being perpetually trustworthy, free of influence, and supported. Having used many chat platforms that have been shut down/acquired/etc in the past, that’s not a bet I’m willing to take. I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet.

novok 6y ago
Signal is OSS and you can start your own fork & network if you want to. App publishing platforms not having a good binary signature verification system is the orthogonal issue that you're bringing up, that would in many ways apply to matrix for most users too. Most will never bother to sideload it.
- p1necone 6y ago
  > Signal is OSS and you can start your own fork & network if you want to. You can't though, what use is your own fork when nobody uses it?
  - askvictor 6y ago
    If you're really paranoid, you'd convince your contacts to use your fork.
    - dexterdog 6y ago
      I can't even convince my contacts to use signal.
      - sdenton4 6y ago
        My approach is to use Signal for organizing surprise birthday parties. (or at least I did before the world went to shit.) "We need SUPER SECURITY to make sure Rob doesn't find out what's up! So we're all using Signal to plan... Join up!"
        askvictor 6y ago
        Does Rob work for the NSA?
- ryukafalz 6y ago
  >Signal is OSS and you can start your own fork & network if you want to. Resources and network effects make this a much much less likely endeavor than in federated systems. I can reasonably (and do!) self-host Matrix and XMPP servers for myself and a few friends; I cannot reasonably host a Signal server for everyone I might want to possibly contact via Signal. (And that's setting aside the effort involved in convincing everyone I might possibly want to contact to use my Signal server. It's just not going to happen.) EDIT: Oh, and I don't think the VoIP side of the Signal server is FOSS? At least I believe that used to be the case. >App publishing platforms not having a good binary signature verification system is the orthogonal issue that you're bringing up, that would in many ways apply to matrix for most users too. Most will never bother to sideload it. If the main client developers are pressured to put a backdoor into their client, I would expect non-backdoored forks to rapidly pop up in the stores. If the platform provider is also legally pressured to not allow any non-backdoored clients into the store... well, I hope that never happens, but if we get to that point I hope more people would bother to learn more and start sideloading things. Maybe wishful thinking on my part.
  - est31 6y ago
    Not to mention that in a centralized system only a single entity has to be manipulated to turn over the data, whether it's through court orders, laws, extortion, corruption (as e.g. happened with Skype), or a combination of the above. In a decentralized system, the job of the centralization has to be done by the people who want access to the data in the first place. Have to ring more bells, creates more people who know about the spying. A much harder job and there isn't any "easy" access to almost all data any more.
- ploxiln 6y ago
  Signal disallows federation from forks (it has been attempted). "Using signal" requires using the official build, and that requires closed-source libraries and services (e.g. Google Play Services).
  - Mediterraneo10 6y ago
    Signal doesn't require Google Play Services. It will use Play Services if installed for notifications, but works fine without them, and it can be installed on LineageOS etc.
    - cyphar 6y ago
      In fairness to GP, this only became true a few years ago and Signal has not advertised this (nor the fact that you can now download the Signal APK from their website and it auto-updates outside of the play store[1]). Folks who opted to not use Signal some time ago likely had no way of finding this out, and Moxie's comments on this in ~2014 gave the impression that it would never happen. [1]: https://signal.org/android/apk/ https://signal.org/android/apk/
- im3w1l 6y ago
  Reddit is (was?) open source without federation just like signal. Reddit used to be pro free speech. Now they are banning people and communities like the_donald and brag about how deplatforming works. People can create their own little ghettos but it's inconsequential and no one uses them. It's not a stretch to imagine a repeat. That moxie will brag in 10 years about how much he is banning people and how well it works. I wonder who will be unpopular in 10 years.. EDIT: Or he might hang himself like Aaron Schwartz.
StavrosK 6y ago
Compile your own client binary and use that?
- ryukafalz 6y ago
  You or I can do that, but that's not something the average person is likely to be able to do. Someone could perhaps distribute their own patched client binary as well, but given Moxie/OWS's views on patched clients, I'd expect them to run into trouble at some point doing that: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
- sp332 6y ago
  The binaries are not obfuscated. You can analyze the official versions from the app stores for backdoors.
crossroadsguy 6y ago
> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my most favourite in the spirit and least favourite in usability. Any attempt to introduce friends and family has failed miserably. Irony is, I myself was not convinced and I was trying to convert them.
- ryukafalz 6y ago
  I mean, keep in mind that while Element is effectively the reference client, it's also still just one client. It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds. There are other clients in development that are closer UI-wise to your typical mobile messenger, e.g. https://dittochat.org/ https://dittochat.org/
  - _-___________-_ 6y ago
    Having spent a decent amount of time reading and attempting to implement small parts of the horrendous mess that is the Matrix protocol, I'd bet decent money that there will never be any reasonably complete alternatives to Element. Ditto looks nice, but is very barebones.
  - spurgu 6y ago
    > It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds. I'm of the completely opposite opinion I find Element absolutely atrocious compared to Slack in terms of usability The mobile app is decent though. And I don't know at what pace Element is being improved, only been using it for a couple of weeks. That said Slack has been going downhill UI/UX-wise for years now.
- 3np 6y ago
  Even the server-side software is not feature complete yet. Give it time. Another client that I think is aiming to fill that gap (and also has a provider with bridges to eg Messenger et al) is Novachat: https://nova.chat/ https://nova.chat/ Matrix is not an IM app, it’s a protocol. Anyone is encouraged to make an app for it. It’s a long game. I’d give it another year or two before I think it’s grandma-ready.
tych0 6y ago
> It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Huh? I send messages to my friends daily using the API via https://gitlab.com/thefinn93/signald https://gitlab.com/thefinn93/signald which is definitely third party.
- cyphar 6y ago
  Moxie has explicitly said several times that third-party clients connecting to the main Signal servers are actively not supported and has threatened to start blocking them or enforcing the Signal trademark if they get big enough. (I tried to find a link to the exact comments he's made, but the threads involved have hundreds of comments and I'm on my phone -- he said this in one of the huge Google Play issues.)
  - ryukafalz 6y ago
    Yup - you're probably thinking of this one and the other similar comments in the (mess of a) thread: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217339450 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Makes it pretty clear that OWS does not want people using third-party clients with the official Signal servers.
  - tych0 6y ago
    Huh, that sucks. Good to know, thanks!

novok 6y ago

Signal is OSS and you can start your own fork & network if you want to. App publishing platforms not having a good binary signature verification system is the orthogonal issue that you're bringing up, that would in many ways apply to matrix for most users too. Most will never bother to sideload it.

p1necone 6y ago
> Signal is OSS and you can start your own fork & network if you want to. You can't though, what use is your own fork when nobody uses it?
- askvictor 6y ago
  If you're really paranoid, you'd convince your contacts to use your fork.
  - dexterdog 6y ago
    I can't even convince my contacts to use signal.
    - sdenton4 6y ago
      My approach is to use Signal for organizing surprise birthday parties. (or at least I did before the world went to shit.) "We need SUPER SECURITY to make sure Rob doesn't find out what's up! So we're all using Signal to plan... Join up!"
      - askvictor 6y ago
        Does Rob work for the NSA?
ryukafalz 6y ago
>Signal is OSS and you can start your own fork & network if you want to. Resources and network effects make this a much much less likely endeavor than in federated systems. I can reasonably (and do!) self-host Matrix and XMPP servers for myself and a few friends; I cannot reasonably host a Signal server for everyone I might want to possibly contact via Signal. (And that's setting aside the effort involved in convincing everyone I might possibly want to contact to use my Signal server. It's just not going to happen.) EDIT: Oh, and I don't think the VoIP side of the Signal server is FOSS? At least I believe that used to be the case. >App publishing platforms not having a good binary signature verification system is the orthogonal issue that you're bringing up, that would in many ways apply to matrix for most users too. Most will never bother to sideload it. If the main client developers are pressured to put a backdoor into their client, I would expect non-backdoored forks to rapidly pop up in the stores. If the platform provider is also legally pressured to not allow any non-backdoored clients into the store... well, I hope that never happens, but if we get to that point I hope more people would bother to learn more and start sideloading things. Maybe wishful thinking on my part.
- est31 6y ago
  Not to mention that in a centralized system only a single entity has to be manipulated to turn over the data, whether it's through court orders, laws, extortion, corruption (as e.g. happened with Skype), or a combination of the above. In a decentralized system, the job of the centralization has to be done by the people who want access to the data in the first place. Have to ring more bells, creates more people who know about the spying. A much harder job and there isn't any "easy" access to almost all data any more.
ploxiln 6y ago
Signal disallows federation from forks (it has been attempted). "Using signal" requires using the official build, and that requires closed-source libraries and services (e.g. Google Play Services).
- Mediterraneo10 6y ago
  Signal doesn't require Google Play Services. It will use Play Services if installed for notifications, but works fine without them, and it can be installed on LineageOS etc.
  - cyphar 6y ago
    In fairness to GP, this only became true a few years ago and Signal has not advertised this (nor the fact that you can now download the Signal APK from their website and it auto-updates outside of the play store[1]). Folks who opted to not use Signal some time ago likely had no way of finding this out, and Moxie's comments on this in ~2014 gave the impression that it would never happen. [1]: https://signal.org/android/apk/ https://signal.org/android/apk/
im3w1l 6y ago
Reddit is (was?) open source without federation just like signal. Reddit used to be pro free speech. Now they are banning people and communities like the_donald and brag about how deplatforming works. People can create their own little ghettos but it's inconsequential and no one uses them. It's not a stretch to imagine a repeat. That moxie will brag in 10 years about how much he is banning people and how well it works. I wonder who will be unpopular in 10 years.. EDIT: Or he might hang himself like Aaron Schwartz.

StavrosK 6y ago

Compile your own client binary and use that?

ryukafalz 6y ago
You or I can do that, but that's not something the average person is likely to be able to do. Someone could perhaps distribute their own patched client binary as well, but given Moxie/OWS's views on patched clients, I'd expect them to run into trouble at some point doing that: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
sp332 6y ago
The binaries are not obfuscated. You can analyze the official versions from the app stores for backdoors.

crossroadsguy 6y ago

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my most favourite in the spirit and least favourite in usability. Any attempt to introduce friends and family has failed miserably. Irony is, I myself was not convinced and I was trying to convert them.

ryukafalz 6y ago
I mean, keep in mind that while Element is effectively the reference client, it's also still just one client. It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds. There are other clients in development that are closer UI-wise to your typical mobile messenger, e.g. https://dittochat.org/ https://dittochat.org/
- _-___________-_ 6y ago
  Having spent a decent amount of time reading and attempting to implement small parts of the horrendous mess that is the Matrix protocol, I'd bet decent money that there will never be any reasonably complete alternatives to Element. Ditto looks nice, but is very barebones.
- spurgu 6y ago
  > It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds. I'm of the completely opposite opinion I find Element absolutely atrocious compared to Slack in terms of usability The mobile app is decent though. And I don't know at what pace Element is being improved, only been using it for a couple of weeks. That said Slack has been going downhill UI/UX-wise for years now.
3np 6y ago
Even the server-side software is not feature complete yet. Give it time. Another client that I think is aiming to fill that gap (and also has a provider with bridges to eg Messenger et al) is Novachat: https://nova.chat/ https://nova.chat/ Matrix is not an IM app, it’s a protocol. Anyone is encouraged to make an app for it. It’s a long game. I’d give it another year or two before I think it’s grandma-ready.

tych0 6y ago

> It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Huh? I send messages to my friends daily using the API via https://gitlab.com/thefinn93/signald https://gitlab.com/thefinn93/signald which is definitely third party.

cyphar 6y ago
Moxie has explicitly said several times that third-party clients connecting to the main Signal servers are actively not supported and has threatened to start blocking them or enforcing the Signal trademark if they get big enough. (I tried to find a link to the exact comments he's made, but the threads involved have hundreds of comments and I'm on my phone -- he said this in one of the huge Google Play issues.)
- ryukafalz 6y ago
  Yup - you're probably thinking of this one and the other similar comments in the (mess of a) thread: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217339450 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Makes it pretty clear that OWS does not want people using third-party clients with the official Signal servers.
- tych0 6y ago
  Huh, that sucks. Good to know, thanks!