7 ms·

As Signal is a non-profit what are the possible solutions to reduce costs going forward while maintaining availability?

toomuchtodo 6y ago
Move from the cloud to k8s hosted on their own metal. The Signal server is simplistic (a compliment), it’s the bandwidth that you’re going to get raked over the coals for at cloud providers. Burst to the cloud for outlier events.
- imposterr 6y ago
  If I'm not mistaken, signal is specifically hosted on AWS to so that governments can't just blacklist their IPs without blacklisting all of AWS. So moving to bare metal isn't really an option.
  - deleted 6y ago
    [deleted]
  - xfer 6y ago
    Governments can easily block AWS as well and they have. Even simpler, they just go for the kill-switch and kill internet.
    - ardy42 6y ago
      > Governments can easily block AWS as well and they have. Even simpler, they just go for the kill-switch and kill internet. They can, but the collateral damage of doing that is high, which is a deterrent. The only regimes where that's realistically an option are ones where they've consciously developed an independent tech ecosystem (e.g. China) or where their power is so secure they couldn't care less about the damage.
      - xfer 6y ago
        Unless you are talking about very stable countries(where this is not even an issue to begin with), we have already seen a few(russia, india etc) doing this without a second thought, not just china. The damage can be attributed to someone else when you own the communication channels.
        ardy42 6y ago
        > we have already seen a few(russia, india etc) doing this without a second thought, not just china. The damage can be attributed to someone else when you own the communication channels. Russia might fall under the category of "regimes...where their power is so secure they couldn't care less about the damage," and it appears they did in fact see a lot of collateral damage during the attempt. India's blocks look to be localized an temporary.
  - _Understated_ 6y ago
    Remember that AWS can terminate (as shown recently with Parler) any time they want.
    - spijdar 6y ago
      You can't win every fight. In this case, they're (intentionally or not) making a trade-off between being easier for governments to censor, and easier for Amazon to censor. I guess in their case, the many governments in the world are a bigger threat than Amazon specifically.
  - rzz3 6y ago
    Cloudflare could fix that. Governments can’t just blacklist Cloudflare either.
  - xrisk 6y ago
    Why would they blacklist IPs? The bans I've seen (in India) are based on sniffing SNI. Using AWS doesn't help at all in that case.
    - z77dj3kl 6y ago
      They actually get around SNI blocks (or did, I'm not sure if anymore) with a technique called "domain fronting". If I recall correctly, AWS wasn't so happy about it when it was bought to their attention and they were asked to stop. There was even some discussion on HN about it. Not exactly sure what the current state is.
- ohthehugemanate 6y ago
  Key parts of the server (eg attestation that the running server code matches the public release) run in the CPU's secure enclave, which makes it non trivial to run on your own bare metal k8s. Also, I think Azure is the only cloud provider whose kubernetes implementation supports this. I know they open sourced their implementation but I don't know how hard it is to do on your own environment.
amelius 6y ago
How about a federated solution? I'd be happy to run my own conversations on my own server.
- fartcannon 6y ago
  It's called Matrix and it already exists. The most popular client is element, you can host your own instance, it has e2e encryption on by default and it doesn't require identifying data like phone numbers.
- mxuribe 6y ago
  Because matrix (the open source protocol) is federated, you have options: matrix server (for self-hosting), SDKs, bots, libraries, etc. = https://matrix.org/docs/projects/try-matrix-now https://matrix.org/docs/projects/try-matrix-now matrix clients = https://matrix.org/clients/ https://matrix.org/clients/ matrix bridges (to interoperate between matrix and other services like irc, slack, telegram, etc.) = https://matrix.org/bridges/ https://matrix.org/bridges/ if you don't want to manage on your own, and simply want to pay someone else to host for you = https://matrix.org/hosting/ https://matrix.org/hosting/ So, yeah, matrix offers many solutions. ;-)
  - usr1106 6y ago
    How many users does matrix have? I tried it last fall on 2 different servers. (Hosting an own server is not possible on a small root server you can get for 5 EUR/USD a month, it requires signifcant resources.) My experience was a bit disappointing. It seems pretty overloaded already, especially the irc bridge. And we are talking of thousands of users. I'm pretty convinced that with millions signing up it would collapse completely. Yes, I'd hope federation of many servers is the way to go. But it seems so resource demanding that not many free servers are available and even running your own one is not cheap or easy. No idea whether it will ever scale.
    - KitDuncan 6y ago
      I have successfully hosted a Matrix server on the cheapest Hetzner VPS for like $3 and it was super smooth...

Move from the cloud to k8s hosted on their own metal. The Signal server is simplistic (a compliment), it’s the bandwidth that you’re going to get raked over the coals for at cloud providers. Burst to the cloud for outlier events.

imposterr 6y ago
If I'm not mistaken, signal is specifically hosted on AWS to so that governments can't just blacklist their IPs without blacklisting all of AWS. So moving to bare metal isn't really an option.
- deleted 6y ago
  [deleted]
- xfer 6y ago
  Governments can easily block AWS as well and they have. Even simpler, they just go for the kill-switch and kill internet.
  - ardy42 6y ago
    > Governments can easily block AWS as well and they have. Even simpler, they just go for the kill-switch and kill internet. They can, but the collateral damage of doing that is high, which is a deterrent. The only regimes where that's realistically an option are ones where they've consciously developed an independent tech ecosystem (e.g. China) or where their power is so secure they couldn't care less about the damage.
    - xfer 6y ago
      Unless you are talking about very stable countries(where this is not even an issue to begin with), we have already seen a few(russia, india etc) doing this without a second thought, not just china. The damage can be attributed to someone else when you own the communication channels.
      - ardy42 6y ago
        > we have already seen a few(russia, india etc) doing this without a second thought, not just china. The damage can be attributed to someone else when you own the communication channels. Russia might fall under the category of "regimes...where their power is so secure they couldn't care less about the damage," and it appears they did in fact see a lot of collateral damage during the attempt. India's blocks look to be localized an temporary.
- _Understated_ 6y ago
  Remember that AWS can terminate (as shown recently with Parler) any time they want.
  - spijdar 6y ago
    You can't win every fight. In this case, they're (intentionally or not) making a trade-off between being easier for governments to censor, and easier for Amazon to censor. I guess in their case, the many governments in the world are a bigger threat than Amazon specifically.
- rzz3 6y ago
  Cloudflare could fix that. Governments can’t just blacklist Cloudflare either.
- xrisk 6y ago
  Why would they blacklist IPs? The bans I've seen (in India) are based on sniffing SNI. Using AWS doesn't help at all in that case.
  - z77dj3kl 6y ago
    They actually get around SNI blocks (or did, I'm not sure if anymore) with a technique called "domain fronting". If I recall correctly, AWS wasn't so happy about it when it was bought to their attention and they were asked to stop. There was even some discussion on HN about it. Not exactly sure what the current state is.
ohthehugemanate 6y ago
Key parts of the server (eg attestation that the running server code matches the public release) run in the CPU's secure enclave, which makes it non trivial to run on your own bare metal k8s. Also, I think Azure is the only cloud provider whose kubernetes implementation supports this. I know they open sourced their implementation but I don't know how hard it is to do on your own environment.

amelius 6y ago

How about a federated solution? I'd be happy to run my own conversations on my own server.

fartcannon 6y ago
It's called Matrix and it already exists. The most popular client is element, you can host your own instance, it has e2e encryption on by default and it doesn't require identifying data like phone numbers.
mxuribe 6y ago
Because matrix (the open source protocol) is federated, you have options: matrix server (for self-hosting), SDKs, bots, libraries, etc. = https://matrix.org/docs/projects/try-matrix-now https://matrix.org/docs/projects/try-matrix-now matrix clients = https://matrix.org/clients/ https://matrix.org/clients/ matrix bridges (to interoperate between matrix and other services like irc, slack, telegram, etc.) = https://matrix.org/bridges/ https://matrix.org/bridges/ if you don't want to manage on your own, and simply want to pay someone else to host for you = https://matrix.org/hosting/ https://matrix.org/hosting/ So, yeah, matrix offers many solutions. ;-)
- usr1106 6y ago
  How many users does matrix have? I tried it last fall on 2 different servers. (Hosting an own server is not possible on a small root server you can get for 5 EUR/USD a month, it requires signifcant resources.) My experience was a bit disappointing. It seems pretty overloaded already, especially the irc bridge. And we are talking of thousands of users. I'm pretty convinced that with millions signing up it would collapse completely. Yes, I'd hope federation of many servers is the way to go. But it seems so resource demanding that not many free servers are available and even running your own one is not cheap or easy. No idea whether it will ever scale.
  - KitDuncan 6y ago
    I have successfully hosted a Matrix server on the cheapest Hetzner VPS for like $3 and it was super smooth...