8 ms·

Although this bug report [0] states the difficulties facing them, zulip doesn't do e2e, which is a deal breaker for many communities. So, a title as you suggest

Although this bug report [0] states the difficulties facing them, zulip doesn't do e2e, which is a deal breaker for many communities. So, a title as you suggest should be "Why your Zulip data will stand the test of time, provided no one steals it". Aren't we a long way down the road of understanding that all server systems should be regarded as an "untrust" environment? I feel this way about my own self hosted systems. If your critical data leaks, you're hosed. If corporate needs to have audit trails then there needs to be a system that deliberately breaks e2e, something that all clients posting on that system know about and display messages about, rather than the current implementation. About server side search... that's a different issue, but couldn't it be done with hashing keywords on the client and a disclaimer on how this may reduce security? So, all in all, I get why e2e is hard for zulip, but standing the test of time without it could be difficult. [0] https://github.com/zulip/zulip/issues/6096 https://github.com/zulip/zulip/issues/6096

bachmeier 5y ago
I don't think Slack offers e2e. If they do, it's a recent development.
aidenn0 5y ago
I don't see any value for e2e on a team chat. With e2e you lose not only server-side search but also message archives for new users (and new clients for old users too, if you use something with forward secrecy). In exchange, it makes hacking the server prevent leakage. Meanwhile if even a single client gets hacked, all of your group-chats are still compromised. A big part of the value of something like Zulip versus e-mail is you can link to historical threads, and know that everyone can read them. E2E is purposefully hostile towards "everyone reading them" so it's a major tradeoff. Do you want E2E on your bugtracker? CI logs? Doing so for Zulip makes about as much sense IMO. Note that if GH used E2E for issues (which is arguably a form of group chat), the link you posted to the discussion would not be readable by me.
- cmroanirgo 5y ago
  There are other teams than corporate IT teams. There are other non technical groups that would greatly benefit from e2e groups like Signal has, that would love the added luxury of self hosting/non centralised hosting. I can easily envisage different groups wanting these things. Some do not want the 'historical' chats to be kept, & server side search is not really relevant in those cases. Of course, some will. If we think of more than tech teams, it's easy to see these features as being vitally important. So while bugtracking, CI, bots, etc, etc is important for you and I, there are groups and communities where such things would be met with bafflement as to their purpose.
  - aidenn0 5y ago
    We are on HN so I used bug tracking and CI as examples of things people want a history of. NNTP is another example that was not limited to technical topics. If you really need e2e chats, then xmpp and matrix can self host. I do think this is niche though. Every client logs history, so compromising one client completely defeats e2e.

bachmeier 5y ago

I don't think Slack offers e2e. If they do, it's a recent development.

aidenn0 5y ago

I don't see any value for e2e on a team chat. With e2e you lose not only server-side search but also message archives for new users (and new clients for old users too, if you use something with forward secrecy). In exchange, it makes hacking the server prevent leakage. Meanwhile if even a single client gets hacked, all of your group-chats are still compromised. A big part of the value of something like Zulip versus e-mail is you can link to historical threads, and know that everyone can read them. E2E is purposefully hostile towards "everyone reading them" so it's a major tradeoff. Do you want E2E on your bugtracker? CI logs? Doing so for Zulip makes about as much sense IMO. Note that if GH used E2E for issues (which is arguably a form of group chat), the link you posted to the discussion would not be readable by me.

cmroanirgo 5y ago
There are other teams than corporate IT teams. There are other non technical groups that would greatly benefit from e2e groups like Signal has, that would love the added luxury of self hosting/non centralised hosting. I can easily envisage different groups wanting these things. Some do not want the 'historical' chats to be kept, & server side search is not really relevant in those cases. Of course, some will. If we think of more than tech teams, it's easy to see these features as being vitally important. So while bugtracking, CI, bots, etc, etc is important for you and I, there are groups and communities where such things would be met with bafflement as to their purpose.
- aidenn0 5y ago
  We are on HN so I used bug tracking and CI as examples of things people want a history of. NNTP is another example that was not limited to technical topics. If you really need e2e chats, then xmpp and matrix can self host. I do think this is niche though. Every client logs history, so compromising one client completely defeats e2e.