5 ms·

> you pay a monthly fee for someone to man-in-the-middle all your communications. All Matrix homeservers and bridges are open source. I self host some of the

> you pay a monthly fee for someone to man-in-the-middle all your communications. All Matrix homeservers and bridges are open source. I self host some of them myself. Have been doing that long before Element One was a thing.

tiagod 5y ago
How can I verify you're running unmodified, unhooked source in your server if I'm a user?
- cyborgx7 5y ago
  You can't. You can find a provider you trust or set them up yourself.
- dunefox 5y ago
  How can anyone verify that?
  - Diti 5y ago
    Reproducible builds. https://reproducible-builds.org/ https://reproducible-builds.org/
    - efreak 5y ago
      Reproducible builds allow verifying that your build is correct by rebuilding it It doesn't help you verify that the server you're connected to is running the binary you've been given.
- IggleSniggle 5y ago
  You don't, you self-host your own server. My problem with the self-hosted model is that I don't trust myself to get it right and/or keep it updated. My problem with the 3rd-party model is that I don't trust them, either. So, lacking trust in either myself or the third-party, I'm just one of those people you can get only via secure e-mail, clear-text SMS, or whatever well-supported encrypted service happens to be the one with a plurality of users in my friend/family group. Clear-text sucks, but it can be used to negotiate a secure channel. Unfortunately, the levels of spam in my traditional telephony services have dramatically increased in recent years, and as a tradeoff, I've just gotten harder and harder to get in touch with directly as I increasingly default to ignoring more and more methods of communication. I don't even think I'm someone with anything to hide or anything to fear my communications being in the public, there's just too much information to manage.
  - mindslight 5y ago
    I'm excited about NixOS (/GuixSD) because they would seem to provide a straightforward path to running secure services (self-compiled from publicly reviewable source) while keeping them automatically updated (build rules administered by a third party). I'm not saying this is a good approach for you personally right now, but I can definitely see it becoming popular in several years.
  - colbyhub 5y ago
    I feel the same way, I don't fully trust hosted solutions but don't completely trust myself to host my own -- which is where E2E encryption comes into play, but a malicious host would still have access to loads of metadata (timestamps, IPs, etc.). Blockchain-based solutions like Status.im appear to do away with these sorts of issues through decentralization -- but you still have to put trust into their network. Solutions like TLS & OMEMO over Tor for XMPP seem to be a very strong privacy-centered solution outside of blockchain-based applications.
- axelthegerman 5y ago
  How can you verify what the latest update of Google Play Services is doing on your Android that's running a proprietary WhatsApp client just so you feel happy you have "E2E" encryption?

tiagod 5y ago

How can I verify you're running unmodified, unhooked source in your server if I'm a user?

cyborgx7 5y ago
You can't. You can find a provider you trust or set them up yourself.
dunefox 5y ago
How can anyone verify that?
- Diti 5y ago
  Reproducible builds. https://reproducible-builds.org/ https://reproducible-builds.org/
  - efreak 5y ago
    Reproducible builds allow verifying that your build is correct by rebuilding it It doesn't help you verify that the server you're connected to is running the binary you've been given.
IggleSniggle 5y ago
You don't, you self-host your own server. My problem with the self-hosted model is that I don't trust myself to get it right and/or keep it updated. My problem with the 3rd-party model is that I don't trust them, either. So, lacking trust in either myself or the third-party, I'm just one of those people you can get only via secure e-mail, clear-text SMS, or whatever well-supported encrypted service happens to be the one with a plurality of users in my friend/family group. Clear-text sucks, but it can be used to negotiate a secure channel. Unfortunately, the levels of spam in my traditional telephony services have dramatically increased in recent years, and as a tradeoff, I've just gotten harder and harder to get in touch with directly as I increasingly default to ignoring more and more methods of communication. I don't even think I'm someone with anything to hide or anything to fear my communications being in the public, there's just too much information to manage.
- mindslight 5y ago
  I'm excited about NixOS (/GuixSD) because they would seem to provide a straightforward path to running secure services (self-compiled from publicly reviewable source) while keeping them automatically updated (build rules administered by a third party). I'm not saying this is a good approach for you personally right now, but I can definitely see it becoming popular in several years.
- colbyhub 5y ago
  I feel the same way, I don't fully trust hosted solutions but don't completely trust myself to host my own -- which is where E2E encryption comes into play, but a malicious host would still have access to loads of metadata (timestamps, IPs, etc.). Blockchain-based solutions like Status.im appear to do away with these sorts of issues through decentralization -- but you still have to put trust into their network. Solutions like TLS & OMEMO over Tor for XMPP seem to be a very strong privacy-centered solution outside of blockchain-based applications.
axelthegerman 5y ago
How can you verify what the latest update of Google Play Services is doing on your Android that's running a proprietary WhatsApp client just so you feel happy you have "E2E" encryption?