4 ms·

The lack of development-in-the-open on Signal-Server is a little concerning, in terms of not giving visibility on what's at least theoretically running serversi

The lack of development-in-the-open on Signal-Server is a little concerning, in terms of not giving visibility on what's at least theoretically running serverside. If you compare it with Matrix, the last commits to Synapse were ~32 hours ago, Dendrite was ~31 hours ago, and Conduit was 3 hours ago - so you can keep up with where development is at, and of course see what is meant to be running in production (and run it yourself if you're able to). My assumption is that what's happening is that Signal-Server is going through contortions to switch everything to UUIDs, in order to avoid hardcoding phone numbers everywhere as identifiers, and this work is being done on a private branch. Meanwhile, there's presumably a private branch for the current live production deployment too. (For Matrix, we maintain a separate branch for the live matrix.org homeserver instance, to allow for hotfixes etc - although it's public, at https://github.com/matrix-org/synapse/tree/matrix-org-hotfixes https://github.com/matrix-org/synapse/tree/matrix-org-hotfix...)

vlmutolo 6y ago
Very much agree with everything you just said. Quick question, semi-relevant: does the matrix.org homeserver have open monitoring? Is there someone I can look to see server load? I’m curious whether Matrix saw a similar influx of users this past week.
herodoturtle 6y ago
> and of course see what is meant to be running in production (and run it yourself if you're able to). This comment of yours is only the second time I'm hearing of Matrix (the first time was several days ago, in a bunch of comments on an ASK HN discussing the WA policy announcement). And because of your comment (and the implication that Matrix is something one can run independently in production) I am now perusing matrix.org - thanks for sharing. Also I enjoyed your insight with respect to the Signal dev team and what they're possibly currently frantically busy with. Mind if I ask you, what your thoughts are on the Signal project long-term?
- bilal4hmed 6y ago
  Read this https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom
  - herodoturtle 6y ago
    That was mightily insightful, thanks. From the article you linked: > It’s also true that decentralised systems are harder to evolve than centralised ones - you can’t just push out a given feature with a single app update, but you have to agree and publish a public spec, support incremental migration, and build governance processes and community dynamics which encourage everyone to implement and upgrade. This is hard, but not impossible: we’ve spent loads of time and money on Matrix’s governance model and spec process to get it right. For me it seems to largely come down to a juxtaposition between the above risk (owed to Matrix) and the below risk (owed to Signal). > you end up thoroughly putting all your eggs in one basket, trusting past, present & future Signal to retain its values, stay up and somehow dodge compromise & censorship… despite probably being the single highest value attack target on the ‘net. Definitely something to think deeply about. Might I add, as a complete Matrix newcomer, the description of its decentralised model in that article reminds me a bit of IRC in the 90s - except with solid encryption. It certainly seems to make sense if liberty is one's priority.
owowow 6y ago
Thank you for making Synapse happen Arathorn! I have given you flack over the Synapse migration path for server operators over the last few years, but this Signal outage brought home how important it is that Matrix is a more than suitable replacement for Signal among my family and friends, and how smooth it has been to run my Synapse server over the last year. You and your team are doing an awesome job!
jsilence 6y ago
A couple of days ago an old long forgotten friend popped up apparently using Telegram now. Looking at the profile picture it became very clear that friend must have abandoned this phone number a while ago. Not really a privacy issue for the new user, since this is his public avatar, but a nice reminder for this issue that phone number are ill suited as identifiers
- deleted 6y ago
  [deleted]
- foolmeonce 6y ago
  > phone number are ill suited as identifiers Yes and no.. I think a resource like a phone number is better than the yahoo/etc email reallocation situation. So far it seems to be rarer that someone tries to get allocated a number to impersonate a previous owner's identity.
- footrot 6y ago
  Phone numbers make sense for quick onboarding, but for multiple numbers, identities, it all becomes a mess. I am not even that interested in having a fixed phone number, I would rather ever changing throwaways for many contacts. As soon as my number gets into the wrong hands, the fight against spam is painful, and I have to drop it.

vlmutolo 6y ago

Very much agree with everything you just said. Quick question, semi-relevant: does the matrix.org homeserver have open monitoring? Is there someone I can look to see server load? I’m curious whether Matrix saw a similar influx of users this past week.

herodoturtle 6y ago

> and of course see what is meant to be running in production (and run it yourself if you're able to). This comment of yours is only the second time I'm hearing of Matrix (the first time was several days ago, in a bunch of comments on an ASK HN discussing the WA policy announcement). And because of your comment (and the implication that Matrix is something one can run independently in production) I am now perusing matrix.org - thanks for sharing. Also I enjoyed your insight with respect to the Signal dev team and what they're possibly currently frantically busy with. Mind if I ask you, what your thoughts are on the Signal project long-term?

bilal4hmed 6y ago
Read this https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom
- herodoturtle 6y ago
  That was mightily insightful, thanks. From the article you linked: > It’s also true that decentralised systems are harder to evolve than centralised ones - you can’t just push out a given feature with a single app update, but you have to agree and publish a public spec, support incremental migration, and build governance processes and community dynamics which encourage everyone to implement and upgrade. This is hard, but not impossible: we’ve spent loads of time and money on Matrix’s governance model and spec process to get it right. For me it seems to largely come down to a juxtaposition between the above risk (owed to Matrix) and the below risk (owed to Signal). > you end up thoroughly putting all your eggs in one basket, trusting past, present & future Signal to retain its values, stay up and somehow dodge compromise & censorship… despite probably being the single highest value attack target on the ‘net. Definitely something to think deeply about. Might I add, as a complete Matrix newcomer, the description of its decentralised model in that article reminds me a bit of IRC in the 90s - except with solid encryption. It certainly seems to make sense if liberty is one's priority.

owowow 6y ago

Thank you for making Synapse happen Arathorn! I have given you flack over the Synapse migration path for server operators over the last few years, but this Signal outage brought home how important it is that Matrix is a more than suitable replacement for Signal among my family and friends, and how smooth it has been to run my Synapse server over the last year. You and your team are doing an awesome job!

jsilence 6y ago

A couple of days ago an old long forgotten friend popped up apparently using Telegram now. Looking at the profile picture it became very clear that friend must have abandoned this phone number a while ago. Not really a privacy issue for the new user, since this is his public avatar, but a nice reminder for this issue that phone number are ill suited as identifiers

deleted 6y ago
[deleted]
foolmeonce 6y ago
> phone number are ill suited as identifiers Yes and no.. I think a resource like a phone number is better than the yahoo/etc email reallocation situation. So far it seems to be rarer that someone tries to get allocated a number to impersonate a previous owner's identity.
footrot 6y ago
Phone numbers make sense for quick onboarding, but for multiple numbers, identities, it all becomes a mess. I am not even that interested in having a fixed phone number, I would rather ever changing throwaways for many contacts. As soon as my number gets into the wrong hands, the fight against spam is painful, and I have to drop it.