4 ms·

I don’t run my own service for the same reason I don’t build my own car or I don’t do accounting for my company, I don’t have the time to learn how to do it nor

I don’t run my own service for the same reason I don’t build my own car or I don’t do accounting for my company, I don’t have the time to learn how to do it nor doing it.

pmlnr 5y ago
No, this is not the same. You want the utmost privacy, yet you still decide to trust someone over it.
- lxgr 5y ago
  The threat model is vastly different, though.
- noirbot 5y ago
  I don't want "the utmost privacy". I want something better than raw SMS. I'm not an international secret agent. I encrypt things out of principal more than because I really care if some government force reads them. If a nation-state decides I'm of interest to them for malicious reasons, I'm probably screwed either way.
  - jeltz 5y ago
    Then these bridges are fine. Virtually everything is better than raw SMS.
    - grassjumper 5y ago
      That depends a lot. In a civilized country with low risk of 2G downgrade attacks and sensible telecom laws/law enforcement restrictions, SMS is a lot more secure and private than many other options. Obviously still a long way off actual secure communication though.
    - JasonFruit 5y ago
      But Signal is better than Signal over these bridges, and it's easy too. Just because you don't want to run your own service doesn't mean you have to choose a poor option over a pretty good one.
      - axelthegerman 5y ago
        But not everyone I talk to is on Signal. And I don't want to remember which app to open to message a certain person. What's the difference between Element offering these bridges, people deploying their own bridges or others having 3rd party clients that you can't trust with your E2E encryption?
        JasonFruit 5y ago
        Nothing makes that better, you're right. I prefer to just remember who uses what and act accordingly, but you choose convenience instead — and both are reasonable choices.
  - 2Gkashmiri 5y ago
    remember that xkcd https://xkcd.com/538/ https://xkcd.com/538/ yeahh. thats not exactly a meme but i am personally facing these same state sponsored actions read here https://thekashmirwalla.com/not-pegasus-kashmiris-are-worried-about-next-checkpoint/ https://thekashmirwalla.com/not-pegasus-kashmiris-are-worrie...
    - wayoutthere 5y ago
      Yeah, infosec has its limits. But if you’re gonna challenge the state, it does help keep things quiet until you are numerous and armed.
      - 2Gkashmiri 5y ago
        I recently had my internet snapped last month and I did not want reddit to know "last 90 days IP access log" so I had a dormant account and I wrote a post locally, called a friend living overseas and made him login to that dormant account and I dictated the text.
- godelski 5y ago
  You're right, it isn't the same. Instructions on how to build a car don't change every week. As a hobbiest I wouldn't trust my life on getting in a car if that was a requirement. There's more in my life than that single hobby that I need to do and I only have so much time.
- mdavis6890 5y ago
  I also want utmost security for my money, which is why I put it in a bank rather than holding the cash myself.
  - tigroferoce 5y ago
    And you want utmost security for your body, which is why you go to the doctor instead of self threat. And also doctors go to other doctors when they are ill. The sad reality is that things are complex and you probably get suboptimal results trying to do everything yourself, what other spend their lives trying to accomplish the same. WhatsApp scaled to 1B users with only 50 engineers, but there were 50 people working full time to provide what people think they can provide in their spare time? Also as the other end of any communication is quite scaring thinking I am communicating securely with someone, but then finding out that their server is compromised because of an out of date library or service.
    - topdancing 5y ago
      If you've ever used Docker or deployed an nginx server - then you can very easily deploy a chat server. Pretty much the same thing but over a different protocol. Server getting compromised - that's largely unimportant with end-to-end encryption through OMEMO. Distros also apply security patches (just keep things up to date). You do not require 50 engineers to run a chat server for <200 of your friends. In my experience, once you have the software configured and running - it pretty much runs itself. Here's a guide on how to install everything needed onto a raspberry pi: https://samhobbs.co.uk/2016/09/installing-prosody-instant-message-chat-server-raspberry-pi-ubuntu https://samhobbs.co.uk/2016/09/installing-prosody-instant-me... As with anything else, it's a fun learning experience and something new to try.
tommek4077 5y ago
That is the kind of comment that freaks me out on HACKER news.
- aeturnum 5y ago
  If you know a problem is hard and the consequences for doing it wrong are potentially serious, it would be irrational to not consider selecting a well-managed third party solution. Being a hacker doesn't mean being all-knowing and the best hacks are done with the knowledge of human limits (both of the hacker and of the maker of the system being hacked).
- otterley 5y ago
  Not everybody hacks on everything. Many of us pick and choose our hobbies. I don't sysadmin my phone for the same reason.
- godelski 5y ago
  Why? Specialization is a thing. Not everyone specializes in security. Which let's be real, being an expert in security is really difficult, especially since it's a constantly moving goal post. Unless you're an expert it's probably not a good idea to roll your own.
  - tigroferoce 5y ago
    Also, to run your own service you must specialize in security AND devops. The two thing overlaps a bit, but not 100%. And you must hope that every contact you are talking to has the same knowledge.
    - xchaotic 5y ago
      so much this - you can make a service 100% secure - by shutting it down. But if you want to stay online and be secure at the same time, there's always some resource tradeoff between the two

I don’t run my own service for the same reason I don’t build my own car or I don’t do accounting for my company, I don’t have the time to learn how to do it nor doing it.

pmlnr 5y ago

No, this is not the same. You want the utmost privacy, yet you still decide to trust someone over it.

lxgr 5y ago
The threat model is vastly different, though.
noirbot 5y ago
I don't want "the utmost privacy". I want something better than raw SMS. I'm not an international secret agent. I encrypt things out of principal more than because I really care if some government force reads them. If a nation-state decides I'm of interest to them for malicious reasons, I'm probably screwed either way.
- jeltz 5y ago
  Then these bridges are fine. Virtually everything is better than raw SMS.
  - grassjumper 5y ago
    That depends a lot. In a civilized country with low risk of 2G downgrade attacks and sensible telecom laws/law enforcement restrictions, SMS is a lot more secure and private than many other options. Obviously still a long way off actual secure communication though.
  - JasonFruit 5y ago
    But Signal is better than Signal over these bridges, and it's easy too. Just because you don't want to run your own service doesn't mean you have to choose a poor option over a pretty good one.
    - axelthegerman 5y ago
      But not everyone I talk to is on Signal. And I don't want to remember which app to open to message a certain person. What's the difference between Element offering these bridges, people deploying their own bridges or others having 3rd party clients that you can't trust with your E2E encryption?
      - JasonFruit 5y ago
        Nothing makes that better, you're right. I prefer to just remember who uses what and act accordingly, but you choose convenience instead — and both are reasonable choices.
- 2Gkashmiri 5y ago
  remember that xkcd https://xkcd.com/538/ https://xkcd.com/538/ yeahh. thats not exactly a meme but i am personally facing these same state sponsored actions read here https://thekashmirwalla.com/not-pegasus-kashmiris-are-worried-about-next-checkpoint/ https://thekashmirwalla.com/not-pegasus-kashmiris-are-worrie...
  - wayoutthere 5y ago
    Yeah, infosec has its limits. But if you’re gonna challenge the state, it does help keep things quiet until you are numerous and armed.
    - 2Gkashmiri 5y ago
      I recently had my internet snapped last month and I did not want reddit to know "last 90 days IP access log" so I had a dormant account and I wrote a post locally, called a friend living overseas and made him login to that dormant account and I dictated the text.
godelski 5y ago
You're right, it isn't the same. Instructions on how to build a car don't change every week. As a hobbiest I wouldn't trust my life on getting in a car if that was a requirement. There's more in my life than that single hobby that I need to do and I only have so much time.
mdavis6890 5y ago
I also want utmost security for my money, which is why I put it in a bank rather than holding the cash myself.
- tigroferoce 5y ago
  And you want utmost security for your body, which is why you go to the doctor instead of self threat. And also doctors go to other doctors when they are ill. The sad reality is that things are complex and you probably get suboptimal results trying to do everything yourself, what other spend their lives trying to accomplish the same. WhatsApp scaled to 1B users with only 50 engineers, but there were 50 people working full time to provide what people think they can provide in their spare time? Also as the other end of any communication is quite scaring thinking I am communicating securely with someone, but then finding out that their server is compromised because of an out of date library or service.
  - topdancing 5y ago
    If you've ever used Docker or deployed an nginx server - then you can very easily deploy a chat server. Pretty much the same thing but over a different protocol. Server getting compromised - that's largely unimportant with end-to-end encryption through OMEMO. Distros also apply security patches (just keep things up to date). You do not require 50 engineers to run a chat server for <200 of your friends. In my experience, once you have the software configured and running - it pretty much runs itself. Here's a guide on how to install everything needed onto a raspberry pi: https://samhobbs.co.uk/2016/09/installing-prosody-instant-message-chat-server-raspberry-pi-ubuntu https://samhobbs.co.uk/2016/09/installing-prosody-instant-me... As with anything else, it's a fun learning experience and something new to try.

tommek4077 5y ago

That is the kind of comment that freaks me out on HACKER news.

aeturnum 5y ago
If you know a problem is hard and the consequences for doing it wrong are potentially serious, it would be irrational to not consider selecting a well-managed third party solution. Being a hacker doesn't mean being all-knowing and the best hacks are done with the knowledge of human limits (both of the hacker and of the maker of the system being hacked).
otterley 5y ago
Not everybody hacks on everything. Many of us pick and choose our hobbies. I don't sysadmin my phone for the same reason.
godelski 5y ago
Why? Specialization is a thing. Not everyone specializes in security. Which let's be real, being an expert in security is really difficult, especially since it's a constantly moving goal post. Unless you're an expert it's probably not a good idea to roll your own.
- tigroferoce 5y ago
  Also, to run your own service you must specialize in security AND devops. The two thing overlaps a bit, but not 100%. And you must hope that every contact you are talking to has the same knowledge.
  - xchaotic 5y ago
    so much this - you can make a service 100% secure - by shutting it down. But if you want to stay online and be secure at the same time, there's always some resource tradeoff between the two