3 ms·

> Pavel routinely criticizes WhatsApp, and even the government-sponsored encryption it uses, with Telegram preferring to hire its own Ph. Ds and roll its own en

by aorth 5y ago

> Pavel routinely criticizes WhatsApp, and even the government-sponsored encryption it uses, with Telegram preferring to hire its own Ph. Ds and roll its own encryption that, to date, has never been broken according to Telegram’s own website. Hmm, I don't think "government sponsored" in this case is as suspicious as you you make it sound. People like tptacek have written about this several times on HN. You link to a tweet from 2017 where Pavel predicts that a backdoor will be found in Signal's cryptography in "five years". Now it's 2022 so let's see if he's right. Lastly, Telegram claims their cryptography has never been broken. Ok... so what? Has Signal's? Signal's crypto has been audited many times and is widely praised. Can't say the same about Telegram's. > Even if what they say is true at one point, it takes a single person in their organization to ship a backdoor in an update, that immediately ends that whole guarantee. Wait what? Signal's source code is openly available and I've been compiling and signing my own builds for at least five years. If they ship a backdoor it will be noticed eventually. And because I sign my own builds nobody can ship me an update that I didn't compile and sign myself... we don't need any Web 3 magic to achieve this...

EGreg 5y ago
The reproducible builds thing was covered in an earlier thread: https://news.ycombinator.com/item?id=29862082 https://news.ycombinator.com/item?id=29862082 But why do we have only one choice of client when it comes to WhatsApp or Signal’s network? At least Telegram lets you roll your own client. But protocols are better, because they make it so that I have a choice of clients — choice leads to competition. However, as the above article admits, it is a mystery why competition hasn’t driven Infura and others to send more signature/proof info with the blocks.
- EGreg 5y ago
  Seems I wrote similar things a couple months ago: https://news.ycombinator.com/item?id=29109997 https://news.ycombinator.com/item?id=29109997
- aorth 5y ago
  > _But why do we have only one choice of client when it comes to WhatsApp or Signal’s network? At least Telegram lets you roll your own client._ > _But protocols are better, because they make it so that I have a choice of clients — choice leads to competition._ In the Signal context, all we know about Moxie's stance on third-party clients is summarized in his "Ecosystem is moving" post from 2016 https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/. It's his call to make... As for the protocol argument more generally, I was briefly caught up in the XMPP hype around 2014 and tried to run my own Prosody server. The XMPP ecosystem has the concept of "extensions" (XEP) whereby clients and servers can indicate whether they support some extension and then fail gracefully (or not) depending on that. I'd be curious how that has worked out for them—are there XEPs for mission critical things other than emojis, stickers, etc that you might want in a secure messaging application? What do you do if clients/servers are using old versions that don't/won't support them? Since Signal controls the client and server they can make breaking changes to core things without having to ask anyone. That's definitely a benefit for them (and my non-technical friends and family!)... In my experience I got tired of hosting my own server and couldn't get enough people to switch to XMPP and remember my address. Now I have dozens of contacts on Signal. If someone asks me to WhatsApp them I tell them I don't have it, and then I use a regular SMS (or email).
  - EGreg 5y ago
    > It’s his call to make… Of course! In his own ecosystem. That’s what I am talking about. Privately owned ecosystems (or owned in some sense by private or wall street investors). That is the Web2 model and we see where it leads. Whatever Zuck or Moxie decided, that’s what we got. We were locked in, due to the network effect. If you leave, you have to reconstruct your whole network, connections, assets elsewhere. And no one was really motivated to make it extremely interoperable. Protocols are way more interoperable. And yes, the Web moved from http protocol to http/2, and also https, not too much more slowly than Signal

by aorth 5y ago

EGreg 5y ago

The reproducible builds thing was covered in an earlier thread: https://news.ycombinator.com/item?id=29862082 https://news.ycombinator.com/item?id=29862082 But why do we have only one choice of client when it comes to WhatsApp or Signal’s network? At least Telegram lets you roll your own client. But protocols are better, because they make it so that I have a choice of clients — choice leads to competition. However, as the above article admits, it is a mystery why competition hasn’t driven Infura and others to send more signature/proof info with the blocks.

EGreg 5y ago
Seems I wrote similar things a couple months ago: https://news.ycombinator.com/item?id=29109997 https://news.ycombinator.com/item?id=29109997
aorth 5y ago
> _But why do we have only one choice of client when it comes to WhatsApp or Signal’s network? At least Telegram lets you roll your own client._ > _But protocols are better, because they make it so that I have a choice of clients — choice leads to competition._ In the Signal context, all we know about Moxie's stance on third-party clients is summarized in his "Ecosystem is moving" post from 2016 https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/. It's his call to make... As for the protocol argument more generally, I was briefly caught up in the XMPP hype around 2014 and tried to run my own Prosody server. The XMPP ecosystem has the concept of "extensions" (XEP) whereby clients and servers can indicate whether they support some extension and then fail gracefully (or not) depending on that. I'd be curious how that has worked out for them—are there XEPs for mission critical things other than emojis, stickers, etc that you might want in a secure messaging application? What do you do if clients/servers are using old versions that don't/won't support them? Since Signal controls the client and server they can make breaking changes to core things without having to ask anyone. That's definitely a benefit for them (and my non-technical friends and family!)... In my experience I got tired of hosting my own server and couldn't get enough people to switch to XMPP and remember my address. Now I have dozens of contacts on Signal. If someone asks me to WhatsApp them I tell them I don't have it, and then I use a regular SMS (or email).
- EGreg 5y ago
  > It’s his call to make… Of course! In his own ecosystem. That’s what I am talking about. Privately owned ecosystems (or owned in some sense by private or wall street investors). That is the Web2 model and we see where it leads. Whatever Zuck or Moxie decided, that’s what we got. We were locked in, due to the network effect. If you leave, you have to reconstruct your whole network, connections, assets elsewhere. And no one was really motivated to make it extremely interoperable. Protocols are way more interoperable. And yes, the Web moved from http protocol to http/2, and also https, not too much more slowly than Signal