3 ms·

I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own se

by xt00 4y ago

I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own server, where that server runs a VM that you configure and setup on your own PC locally then upload to AWS or something and has some facility to constantly report to you the hash of the memory and disk contents, along with some contract from AWS that states that Amazon cannot alter the results of the hash function results sent to you under any circumstances. Plus there would be some facility to validate the contents of what runs in that VM at any instant in time. Basically the idea is you can’t trust anybody at all. I guess pgp would maybe solve this for direct messaging?

spongechameleon 4y ago
I think something like Ricochet (if it were still actively maintained) could be a good solution. https://github.com/ricochet-im/ricochet https://github.com/ricochet-im/ricochet Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.
- blepyzdiec 4y ago
  Briar https://briarproject.org/ https://briarproject.org/ is similar, plus, AFAIK, it's using E2E on top of Tor service. However, looking at massively caught Tor services, I believe, to keep it truly secure, you have to rotate your service address, aka reinstall the app, losing all your history of communication.
cwoolfe 4y ago
It's pretty easy to host your own chat server. https://twitter.com/inputmice/status/1170651869359804416 https://twitter.com/inputmice/status/1170651869359804416
danielschonfeld 4y ago
There’s plenty of that stuff. Jabber and XMPP. And also more up to date is Matrix.org which nobody seems to want to use and I’m not sure why. The problem though is that you’re still trusting the code. Nothing stops self hosted from rotting on you unless you look and read the code yourself.
- proto_lambda 4y ago
  > Matrix.org which nobody seems to want to use and I’m not sure why Lots of people are using it (and probably more every day), but there are also some quite vocal haters. Of course it has its share of problems (availability of non-Electron clients and different servers among then), but many of them constantly improve as the ecosystem grows.
- MattJ100 4y ago
  In case anyone is in doubt after reading your comment, I want to clarify that XMPP is "up to date" and has an active community and ecosystem of software projects, open-source and commercial. Matrix is similar in many ways, and certainly younger, but also has a vastly different design at the protocol layer. It's more akin to a distributed JSON database/log, while XMPP is more focused on message routing and synchronization. Therefore each has different strengths/weaknesses for different use cases. Despite these differences, both protocols indeed have IM apps and a whole lot of other software built on top of them.
- blepyzdiec 4y ago
throwaway1777 4y ago
You could still have holes in a self hosted setup. The self hosted version could forward stuff on to someone else… so you could setup a firewall. But is it really blocking everything or is it just telling you it’s blocking things. This can go on forever, it all depends on the threat model and how far down the rabbit hole you have time to go.
Ashoat 4y ago
We're basically working on this at Comm: https://github.com/CommE2E/comm https://github.com/CommE2E/comm

by xt00 4y ago

spongechameleon 4y ago

I think something like Ricochet (if it were still actively maintained) could be a good solution. https://github.com/ricochet-im/ricochet https://github.com/ricochet-im/ricochet Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

blepyzdiec 4y ago
Briar https://briarproject.org/ https://briarproject.org/ is similar, plus, AFAIK, it's using E2E on top of Tor service. However, looking at massively caught Tor services, I believe, to keep it truly secure, you have to rotate your service address, aka reinstall the app, losing all your history of communication.

cwoolfe 4y ago

It's pretty easy to host your own chat server. https://twitter.com/inputmice/status/1170651869359804416 https://twitter.com/inputmice/status/1170651869359804416

danielschonfeld 4y ago

There’s plenty of that stuff. Jabber and XMPP. And also more up to date is Matrix.org which nobody seems to want to use and I’m not sure why. The problem though is that you’re still trusting the code. Nothing stops self hosted from rotting on you unless you look and read the code yourself.

proto_lambda 4y ago
> Matrix.org which nobody seems to want to use and I’m not sure why Lots of people are using it (and probably more every day), but there are also some quite vocal haters. Of course it has its share of problems (availability of non-Electron clients and different servers among then), but many of them constantly improve as the ecosystem grows.
MattJ100 4y ago
In case anyone is in doubt after reading your comment, I want to clarify that XMPP is "up to date" and has an active community and ecosystem of software projects, open-source and commercial. Matrix is similar in many ways, and certainly younger, but also has a vastly different design at the protocol layer. It's more akin to a distributed JSON database/log, while XMPP is more focused on message routing and synchronization. Therefore each has different strengths/weaknesses for different use cases. Despite these differences, both protocols indeed have IM apps and a whole lot of other software built on top of them.
blepyzdiec 4y ago

throwaway1777 4y ago

You could still have holes in a self hosted setup. The self hosted version could forward stuff on to someone else… so you could setup a firewall. But is it really blocking everything or is it just telling you it’s blocking things. This can go on forever, it all depends on the threat model and how far down the rabbit hole you have time to go.

Ashoat 4y ago

We're basically working on this at Comm: https://github.com/CommE2E/comm https://github.com/CommE2E/comm