7 ms·

Why should our communication belong to one company? Makes no sense to me. Therefore start using signal and try to spread the word. E-Mail is an open Standard. I

Why should our communication belong to one company? Makes no sense to me. Therefore start using signal and try to spread the word. E-Mail is an open Standard. Instant messaging can be too!

Taek 6y ago
Signal is hosted over centralized servers, I don't think it's that much of a break from the status quo in terms of control. That's not to say it's not the best out there. As a company, Signal is a million times better and more deserving of our trust than almost any other option on the market, but if we want to break out into open communications, the Signal protocol needs better decentralization.
- godelski 6y ago
  In theory I like the idea of decentralization but in practice I haven't seen it work out well. For example email didn't become prolific until large centralized players became the dominant force. I see federation/decentralization being better as a late feature in software. Through centralization you can move a lot faster, which in the case of Signal is extremely useful. They wouldn't be able to provide the product they have with decentralization. That's why Moxie has been against decentralization. Maybe I'm wrong, but I don't see chat apps as having an unbounded number of features. As I see it once Signal moves into more of maintenance mode then we can talk about federation, by allowing outside servers being able to communicate to the main Signal server. But for now it seems better to focus on getting people to the platform and if we're talking about it from a privacy and security point of view, this is the higher priority. Decentralization doesn't provide much more security while Signal is still trustworthy. There's bigger fish to fry right now.
  - Taek 6y ago
    For what it's worth I think you are wrong. Decentralization is a complicated technology that needs a lot longer to mature than I think most people realize. But once it is mature - and we're getting close, imo just a few years left - it'll move way faster and more efficiently than the centralized world ever did. In many ways it feels like decentralization is the same as discovering the internal combustion engine before modern alloys existed. We have to invent a lot of extra stuff to make decentralization practical, and we will, but the vision definitely started many steps ahead of the technological progress.
    - godelski 6y ago
      > For what it's worth I think you are wrong. I'm happy for disagreeing opinions. > But once it is mature You may be right, and if it turns out that you are I'll happily change my opinion. But it seems like you agree that currently centralization is the way to go for an app like Signal. Honestly I'd love to see Signal decentralized, but I don't think it is the right move right now or in the near future. But given what you said I still don't think it means it is the right time to call for decentralization. Signal doesn't have to be the leader in advancing decentralization technology. They are already leading in secure and private communication and I don't think such a small group can be experts in too many things. They got their niche and I'm happy someone is doing it. I'm curious though, why do you think decentralization will move faster in the future? What advantage do you see in that? I've always seen decentralization as lagging in updates because it is more difficult to get users to update and software can't exist in isolation (software rots).
      - Taek 6y ago
        Open data models allow for faster innovation and stronger collaboration. That's basically the meat of it. Right now the cost outweighs the benefit but the cost is decreasing and the benefit remains.
        growse 6y ago
        Sure, you can potentially innovate faster, but unless you've got a good way of enforcing your changes on the whole network, one of two things happen. Either you either end up forking the network into multiple islands or building some crazy complex "negotiation" mechanism where two random clients need to agree on what features they support before they communicate. We saw incompatible islands appear in decentralised systems before (this tends to not be good for users), and we've also seen how any implementation of "protocol/feature negotiation" is basically a disaster for security. I don't currently see how any truly decentralised system is lowering either of these costs. WhatsApp never used to be e2e for everyone, but they were able to make it universal relatively quickly because it's centralised. All of the poster child decentralised protocols (SMTP, XMPP etc.) are still not e2e for everyone despite decades of effort.
  - kortilla 6y ago
    > For example email didn't become prolific until large centralized players became the dominant force. What? Email was massively popular before gmail even got into the game. It was popular when Microsoft bought hotmail. It was so popular I remember a dial-up ISP (Juno) offering a free email-only dial-up account. Email was one of the only easy to convey selling points for early Internet. Online shopping was a shitty Wild West and most web pages consisted of some basic info and a visitor counter. But being able to send a “love letter” across the country in seconds was amazing!
    - godelski 6y ago
      > It was popular when Microsoft bought hotmail I'm sorry, but is Hotmail not a large centralized player?
      - r_sreeram 6y ago
        I think the GP was saying that email was already popular before Hotmail entered the picture. I agree with the claim that it didn't need centralized players to become popular.
        godelski 6y ago
        I don't think this is accurate though. I wouldn't call the internet popular when it was just nerds on it. At least not in the context of what we're discussing (communication clients). That's not popular until the masses join. It is clear that the masses did not join until there were large centralized services like AOL, Netscape, Yahoo, and Hotmail that provided email services. I am fundamentally disagreeing with the premise that email became popular before large centralized players provided the services.
        kortilla 6y ago
        And you’re wrong. Email was the main selling point to get non-nerds online in the late 90s. It was how we got my mother in-law online, my uncles, and my non-techie friends.
  - Spooky23 6y ago
    Lol. Email was the internet for most people when you were in diapers. It attracted federal regulation as early as 1986. Decentralization is hard to build a business around.
weikju 6y ago
email is federated, Signal is not, it may not be a company but it still is one entity that is pretty much in control of the communication and contact discovery...
thaumasiotes 6y ago
> Why should our communication belong to one company? Makes no sense to me. Therefore start using signal ...this would make the problem you identify worse. Signal is one company. > E-Mail is an open Standard. Instant messaging can be too! It can be, but Signal definitely isn't. Email and instant messaging don't actually differ in terms of what they're doing. They differ only in the social perception of what you should use them for. Why not use, say, Delta Chat, which is a messaging app frontend that delivers its messages by email?
- Spooky23 6y ago
  They differ a lot. Email is more like a letter and is a killer app unto itself, chat has proven to be a thing that gets bolted on to something else. No chat client to date has ever been able to stand alone, and none of the early leaders ever amounted to anything. Hell, Yahoo had entire verticals like ocean shipping self organizing around Yahoo Chat back in the day and never figured out how to monetize. Slack is going to be another salesforce widget.
  - thaumasiotes 6y ago
    I don't understand what you're saying. They're both asynchronous delivery of written messages. There are no length limits on either. There are no technical differences between them. And they're both monetized exactly the same way, as part of a more comprehensive suite of office productivity offerings. People don't pay for Yahoo Chat the exact same way they don't pay for Yahoo Mail.
    - Spooky23 6y ago
      Sure there is. Email is an open standard, enabled by other other open standards. Things like authentication and service location are dictated by implementation. As a user, I can email anyone on the planet and retain those communications. My employer retains some email dating as far back as 1992, in native format. Chat is almost always a closed loop. There are usually large implementations, and as a user I can only message within one. There are some exceptions to that. Chat always gets kicked around as corporate strategy changes. At work, I’ve probably used a dozen incompatible Microsoft solutions as their strategy meandered around. Jabber was the big attempt to make chat like email, and it failed. Email still runs the world, despite its many flaws.
geoduck14 6y ago
I have an idea! An app that aggregates all of your different social networking apps (think AIM, but for social networks). When you talk with your friends, each of your messages get sent to different social networks -round robin style- this only gives each social network a portion of the conversation. Your friends must, of course, also use the same tool to stitch the conversation back together.
- Zuider 6y ago
  Social media aggregators intended to post messages to many clients have been tried before, but they have consistently failed because the social media companies, notably Twitter, changed their APIs to frustrate the possibility.
- AnthonyMouse 6y ago
  There used to exist applications like this, at the time (i.e. the 90s) when apps didn't have automatic updates. What happens now is that the same company that runs the server and makes the official app updates them both at the same time to change the protocol, causing the app that supports all of them to break until they update it to support the new secret protocol. Then people stop using it because it's breaking all the time.
- ccleve 6y ago
  Seems similar to spread spectrum radio signals, also known as frequency-hopping. By hopping from frequency to frequency in a way that only the sender and the receiver know, you can avoid both obstacles and eavesdropping.
Blikkentrekker 6y ago
Most of my instant message communication is still i.r.c., followed by XMPP. I've read many times that the former is very much dying but I'm not seeing it in the channels I frequent.
ashtonkem 6y ago
I have really bad news about how federated email is in practice. It turns out if gmail rejects you as a source of “spam”, you’re dead as an email provider.
cyphar 6y ago
Matrix is far closer to being "the email for instant messaging" -- Signal-like double ratchet encryption by default for private rooms, federated in a similar way to email servers (but much simpler to manage as an admin), much nicer group chat UX, simpler identity key verification (it has Signal-like QR codes but it also has emojicode verification which is nice if you're not in the same place when doing verification), has an open specification, multiple client implementations, a couple of still-in-progress alternative server implementations, it even has bridges (which have pretty decent UX) to other social networks like IRC, Slack, Discord, and so on. Signal is far from an open standard. I use it and am quite happy using it, but with the knowledge that Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough). And it's fine to have that opinion, I just disagree with it and you shouldn't sell Signal as something the lead developer has said they're explicitly against. For folks saying (read: hoping) that Signal may become federated in the future -- I think it's a much safer bet to just use Matrix since it's already federated and has at least equivalent privacy guarantees (or even larger if you self-host your own server) and hope that Signal will peer with them in the future (which I personally think is about as likely as Signal becoming federated itself -- namely, it's very unlikely either way). But you do you.
- hactually 6y ago
  > Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough) Well that's a shame - I wonder if, given moxie is a member of the HN community, he'd clarify what is meant by that. I had a quick search and didnt find anything.
  - cyphar 6y ago
    [1] is Moxie saying that he is against third-party clients using Signal servers (meaning third-party clients cannot communicate with Signal users). [2] is Moxie saying that he is also against federating with other Signal servers (and implies that they use their trademark aggressively to stop the term "Signal" from being used by third-party apps). Given how explicit he was about this at the time (and the lack of comments to the contrary in the past 5 years), I honestly don't think any clarification is necessary. That's his opinion and while I may disagree with his opinion, we shouldn't pretend that he is likely to change it in the future (or to imply that isn't his opinion on the topic). If you feel strongly that you want decentralised instant messaging, use Matrix (or something like it) rather than hoping Signal will become something Moxie has said he is against it becoming. [1]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... [2]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217231557 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
pmlnr 6y ago
Email and (XMPP or Matrix ) Signal is also centralized, even if it's open.
system2 6y ago
No one is forcing to use you WhatsApp or the others. You have free will. These apps come and go and you can even come up with your own app and make others use it. Free market for you my friend.
fsflover 6y ago
> Therefore start using signal and try to spread the word. E-Mail is an open Standard. Instant messaging can be too! Is Signal even open source? Where is the server code for this patch: https://news.ycombinator.com/item?id=25803010 https://news.ycombinator.com/item?id=25803010 ?
- cyphar 6y ago
  Isn't [1] (one of) the patches fixing the issue? The solution doesn't need to be a server patch, in fact it appears it was a client-side patch to handle 508 errors properly as well as doing exponential backoff. [1]: https://github.com/signalapp/Signal-Android/commit/c95f0fce6ee3b78ff82fde865b2ee49288e1303f https://github.com/signalapp/Signal-Android/commit/c95f0fce6...
  - fsflover 6y ago
    Does it mean that I can create a malicious client without that patch and break the server again?
    - cyphar 6y ago
      The reason it was a DDoS was that every single Android Signal client in the world was retrying the API without an exponential backoff. If you intentionally try to DDoS the API yourself, then that's just a DDoS and you don't need a custom Signal client for that.

Why should our communication belong to one company? Makes no sense to me. Therefore start using signal and try to spread the word. E-Mail is an open Standard. Instant messaging can be too!

Taek 6y ago

Signal is hosted over centralized servers, I don't think it's that much of a break from the status quo in terms of control. That's not to say it's not the best out there. As a company, Signal is a million times better and more deserving of our trust than almost any other option on the market, but if we want to break out into open communications, the Signal protocol needs better decentralization.

godelski 6y ago
In theory I like the idea of decentralization but in practice I haven't seen it work out well. For example email didn't become prolific until large centralized players became the dominant force. I see federation/decentralization being better as a late feature in software. Through centralization you can move a lot faster, which in the case of Signal is extremely useful. They wouldn't be able to provide the product they have with decentralization. That's why Moxie has been against decentralization. Maybe I'm wrong, but I don't see chat apps as having an unbounded number of features. As I see it once Signal moves into more of maintenance mode then we can talk about federation, by allowing outside servers being able to communicate to the main Signal server. But for now it seems better to focus on getting people to the platform and if we're talking about it from a privacy and security point of view, this is the higher priority. Decentralization doesn't provide much more security while Signal is still trustworthy. There's bigger fish to fry right now.
- Taek 6y ago
  For what it's worth I think you are wrong. Decentralization is a complicated technology that needs a lot longer to mature than I think most people realize. But once it is mature - and we're getting close, imo just a few years left - it'll move way faster and more efficiently than the centralized world ever did. In many ways it feels like decentralization is the same as discovering the internal combustion engine before modern alloys existed. We have to invent a lot of extra stuff to make decentralization practical, and we will, but the vision definitely started many steps ahead of the technological progress.
  - godelski 6y ago
    > For what it's worth I think you are wrong. I'm happy for disagreeing opinions. > But once it is mature You may be right, and if it turns out that you are I'll happily change my opinion. But it seems like you agree that currently centralization is the way to go for an app like Signal. Honestly I'd love to see Signal decentralized, but I don't think it is the right move right now or in the near future. But given what you said I still don't think it means it is the right time to call for decentralization. Signal doesn't have to be the leader in advancing decentralization technology. They are already leading in secure and private communication and I don't think such a small group can be experts in too many things. They got their niche and I'm happy someone is doing it. I'm curious though, why do you think decentralization will move faster in the future? What advantage do you see in that? I've always seen decentralization as lagging in updates because it is more difficult to get users to update and software can't exist in isolation (software rots).
    - Taek 6y ago
      Open data models allow for faster innovation and stronger collaboration. That's basically the meat of it. Right now the cost outweighs the benefit but the cost is decreasing and the benefit remains.
      - growse 6y ago
        Sure, you can potentially innovate faster, but unless you've got a good way of enforcing your changes on the whole network, one of two things happen. Either you either end up forking the network into multiple islands or building some crazy complex "negotiation" mechanism where two random clients need to agree on what features they support before they communicate. We saw incompatible islands appear in decentralised systems before (this tends to not be good for users), and we've also seen how any implementation of "protocol/feature negotiation" is basically a disaster for security. I don't currently see how any truly decentralised system is lowering either of these costs. WhatsApp never used to be e2e for everyone, but they were able to make it universal relatively quickly because it's centralised. All of the poster child decentralised protocols (SMTP, XMPP etc.) are still not e2e for everyone despite decades of effort.
- kortilla 6y ago
  > For example email didn't become prolific until large centralized players became the dominant force. What? Email was massively popular before gmail even got into the game. It was popular when Microsoft bought hotmail. It was so popular I remember a dial-up ISP (Juno) offering a free email-only dial-up account. Email was one of the only easy to convey selling points for early Internet. Online shopping was a shitty Wild West and most web pages consisted of some basic info and a visitor counter. But being able to send a “love letter” across the country in seconds was amazing!
  - godelski 6y ago
    > It was popular when Microsoft bought hotmail I'm sorry, but is Hotmail not a large centralized player?
    - r_sreeram 6y ago
      I think the GP was saying that email was already popular before Hotmail entered the picture. I agree with the claim that it didn't need centralized players to become popular.
      - godelski 6y ago
        I don't think this is accurate though. I wouldn't call the internet popular when it was just nerds on it. At least not in the context of what we're discussing (communication clients). That's not popular until the masses join. It is clear that the masses did not join until there were large centralized services like AOL, Netscape, Yahoo, and Hotmail that provided email services. I am fundamentally disagreeing with the premise that email became popular before large centralized players provided the services.
        kortilla 6y ago
        And you’re wrong. Email was the main selling point to get non-nerds online in the late 90s. It was how we got my mother in-law online, my uncles, and my non-techie friends.
- Spooky23 6y ago
  Lol. Email was the internet for most people when you were in diapers. It attracted federal regulation as early as 1986. Decentralization is hard to build a business around.

weikju 6y ago

email is federated, Signal is not, it may not be a company but it still is one entity that is pretty much in control of the communication and contact discovery...

thaumasiotes 6y ago

> Why should our communication belong to one company? Makes no sense to me. Therefore start using signal ...this would make the problem you identify worse. Signal is one company. > E-Mail is an open Standard. Instant messaging can be too! It can be, but Signal definitely isn't. Email and instant messaging don't actually differ in terms of what they're doing. They differ only in the social perception of what you should use them for. Why not use, say, Delta Chat, which is a messaging app frontend that delivers its messages by email?

Spooky23 6y ago
They differ a lot. Email is more like a letter and is a killer app unto itself, chat has proven to be a thing that gets bolted on to something else. No chat client to date has ever been able to stand alone, and none of the early leaders ever amounted to anything. Hell, Yahoo had entire verticals like ocean shipping self organizing around Yahoo Chat back in the day and never figured out how to monetize. Slack is going to be another salesforce widget.
- thaumasiotes 6y ago
  I don't understand what you're saying. They're both asynchronous delivery of written messages. There are no length limits on either. There are no technical differences between them. And they're both monetized exactly the same way, as part of a more comprehensive suite of office productivity offerings. People don't pay for Yahoo Chat the exact same way they don't pay for Yahoo Mail.
  - Spooky23 6y ago
    Sure there is. Email is an open standard, enabled by other other open standards. Things like authentication and service location are dictated by implementation. As a user, I can email anyone on the planet and retain those communications. My employer retains some email dating as far back as 1992, in native format. Chat is almost always a closed loop. There are usually large implementations, and as a user I can only message within one. There are some exceptions to that. Chat always gets kicked around as corporate strategy changes. At work, I’ve probably used a dozen incompatible Microsoft solutions as their strategy meandered around. Jabber was the big attempt to make chat like email, and it failed. Email still runs the world, despite its many flaws.

geoduck14 6y ago

I have an idea! An app that aggregates all of your different social networking apps (think AIM, but for social networks). When you talk with your friends, each of your messages get sent to different social networks -round robin style- this only gives each social network a portion of the conversation. Your friends must, of course, also use the same tool to stitch the conversation back together.

Zuider 6y ago
Social media aggregators intended to post messages to many clients have been tried before, but they have consistently failed because the social media companies, notably Twitter, changed their APIs to frustrate the possibility.
AnthonyMouse 6y ago
There used to exist applications like this, at the time (i.e. the 90s) when apps didn't have automatic updates. What happens now is that the same company that runs the server and makes the official app updates them both at the same time to change the protocol, causing the app that supports all of them to break until they update it to support the new secret protocol. Then people stop using it because it's breaking all the time.
ccleve 6y ago
Seems similar to spread spectrum radio signals, also known as frequency-hopping. By hopping from frequency to frequency in a way that only the sender and the receiver know, you can avoid both obstacles and eavesdropping.

Blikkentrekker 6y ago

Most of my instant message communication is still i.r.c., followed by XMPP. I've read many times that the former is very much dying but I'm not seeing it in the channels I frequent.

ashtonkem 6y ago

I have really bad news about how federated email is in practice. It turns out if gmail rejects you as a source of “spam”, you’re dead as an email provider.

cyphar 6y ago

Matrix is far closer to being "the email for instant messaging" -- Signal-like double ratchet encryption by default for private rooms, federated in a similar way to email servers (but much simpler to manage as an admin), much nicer group chat UX, simpler identity key verification (it has Signal-like QR codes but it also has emojicode verification which is nice if you're not in the same place when doing verification), has an open specification, multiple client implementations, a couple of still-in-progress alternative server implementations, it even has bridges (which have pretty decent UX) to other social networks like IRC, Slack, Discord, and so on. Signal is far from an open standard. I use it and am quite happy using it, but with the knowledge that Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough). And it's fine to have that opinion, I just disagree with it and you shouldn't sell Signal as something the lead developer has said they're explicitly against. For folks saying (read: hoping) that Signal may become federated in the future -- I think it's a much safer bet to just use Matrix since it's already federated and has at least equivalent privacy guarantees (or even larger if you self-host your own server) and hope that Signal will peer with them in the future (which I personally think is about as likely as Signal becoming federated itself -- namely, it's very unlikely either way). But you do you.

hactually 6y ago
> Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough) Well that's a shame - I wonder if, given moxie is a member of the HN community, he'd clarify what is meant by that. I had a quick search and didnt find anything.
- cyphar 6y ago
  [1] is Moxie saying that he is against third-party clients using Signal servers (meaning third-party clients cannot communicate with Signal users). [2] is Moxie saying that he is also against federating with other Signal servers (and implies that they use their trademark aggressively to stop the term "Signal" from being used by third-party apps). Given how explicit he was about this at the time (and the lack of comments to the contrary in the past 5 years), I honestly don't think any clarification is necessary. That's his opinion and while I may disagree with his opinion, we shouldn't pretend that he is likely to change it in the future (or to imply that isn't his opinion on the topic). If you feel strongly that you want decentralised instant messaging, use Matrix (or something like it) rather than hoping Signal will become something Moxie has said he is against it becoming. [1]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... [2]: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217231557 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

pmlnr 6y ago

Email and (XMPP or Matrix ) Signal is also centralized, even if it's open.

system2 6y ago

No one is forcing to use you WhatsApp or the others. You have free will. These apps come and go and you can even come up with your own app and make others use it. Free market for you my friend.

fsflover 6y ago

> Therefore start using signal and try to spread the word. E-Mail is an open Standard. Instant messaging can be too! Is Signal even open source? Where is the server code for this patch: https://news.ycombinator.com/item?id=25803010 https://news.ycombinator.com/item?id=25803010 ?

cyphar 6y ago
Isn't [1] (one of) the patches fixing the issue? The solution doesn't need to be a server patch, in fact it appears it was a client-side patch to handle 508 errors properly as well as doing exponential backoff. [1]: https://github.com/signalapp/Signal-Android/commit/c95f0fce6ee3b78ff82fde865b2ee49288e1303f https://github.com/signalapp/Signal-Android/commit/c95f0fce6...
- fsflover 6y ago
  Does it mean that I can create a malicious client without that patch and break the server again?
  - cyphar 6y ago
    The reason it was a DDoS was that every single Android Signal client in the world was retrying the API without an exponential backoff. If you intentionally try to DDoS the API yourself, then that's just a DDoS and you don't need a custom Signal client for that.