27 ms·

Signal: You were the chosen one [video]

348 points by kitkat_new 4y ago

kitsunesoba 4y ago
I haven’t yet watched the video, but I agree with the text in that I found the Signal’s hostility toward third party clients both confusing and disappointing. That single decision probably dampened my excitement for it as both a developer and user than anything else.
signalchaff 4y ago
As an old hacker and daily Signal user, I have mixed feelings. I want my freedom, but I recognize centralizing controlling effects can help the “network” with quality issues. As maligned as Nintendo’s NES era policies towards third-parties, there was a direct historical reason for it. Shit quality tanked the industry. So imagine a world of half-baked, likely insecure clients popping up, creating confusion and chaos around what is a great tool / protocol. It’s… hard.
- alexalx666 4y ago
  I think NES case is more about business practices and distribution problem w/o a digital network. Im sure there was a lot of talent left untapped. If they somehow passed decision making from distributors to end users they would have a healthier ecosystem with a lot of innovation coming from small teams
  - toast0 4y ago
    The NES lockout chip is almost certainly a direct reaction to the lack of a lockout chip on the Atari 2600 and the resulting immense pile of garbage games at your local retailer, and the video game crash. So much of the NES's design is an attempt to distance themselves from the previous version. Front-loading makes it look like a VCR rather than an old game system, the box and cartridge art is actual art from the games (enlarged, but blocky) rather than images that are not part of the game, etc. Of course, it's hard to measure apples to apples and see if open would be better, because nobody released an open console after that generation (Sega didn't put a lockout in the Genesis originally, but they added one in later revisions)
    - lloeki 4y ago
      > the box and cartridge art is actual art from the games (enlarged, but blocky) rather than images that are not part of the game The only ones I can recall like that is SMB and Duck Hunt, but all others I recall definitely not. SMB2, SMB3, Megaman, Contra/Probotector, Zelda, Olympus, Parodius... all had specific cover art, often of the "over the top" kind.
- deleted 4y ago
  [deleted]
- m-p-3 4y ago
  It's hard, but Matrix/Element still kinda manage it.
- nine_k 4y ago
  Imagine a world where a compliant implementation can get a certificate. You as a user might choose whether you agree to interact with non-certified clients. It's a different business model. But it seems workable (see Bluetooth, USB, JVM), and it'd be more resilient than the current single-benevolent-vendor model.
  - baisq 4y ago
    Interesting because your examples all suck in different ways, especially when devices of different manufacturers (or even models) are supposed to interact.
    - nine_k 4y ago
      Now imagine that USB did not exist, and there were only, say, Thunderbolt, controlled by the paragon of care about users, Apple.
    - kaba0 4y ago
      How does the JVM suck?
hammyhavoc 4y ago
Bring on Matrix protocol.
h4waii 4y ago
I'm really torn on Signal these days. It's still a great method of communication, but it's kinda floating in a sea of other great methods of communication. I remember using TextSecure while rockin' a Whisper System shirt, cause it was the best way to show support, but now it's opaque updates to include cryptocurrency, chat stickers, and subscriptions.
- dendrite9 4y ago
  I liked Threema but it had the same issue of getting other people to use it. For me it was usually very specific individuals I wanted to share a channel with so it wasn't too difficult. But for more general contacts and friends there was no chance. And maybe that is ok in the end.
  - cuu508 4y ago
    I've set Signal as my SMS app. When I message somebody, sometimes they happen to have Signal installed, and so it's a Signal message. Otherwise, it is a plain SMS.
    - dmix 4y ago
      You can't do that on iPhone sadly.
- public_defender 4y ago
  > other great methods of communication. Really though? From my perspective, it seems as though an option can either be a great academic solution or it can be widely adopted. I've used Signal service discovery to decloak a whole mess of colleagues. I'm talking about people who have firstname@aol.com email addresses. Good luck finding another messenger with penetration that deep and a material dedication to user privacy or security. Alternatives exist, like Telegram I guess, but I perceive the list of viable alternatives to be very short. That's not to say we should accept Signal because it's inevitable, just that network size should be a strong consideration when considering how to advocate for changes or decide between potential alternatives. Example: Signal requires a phone number as an identifier. Do we spend resources lobbying Signal to accelerate deprecation of phone numbers or advocating that people use other software? In my view, the size of the user base makes lobbying Signal worth the effort.
deleted 4y ago
[deleted]
COGlory 4y ago
Signal always left a bad taste in my mouth. It's fundamentally built on the requirement that to have conversations with any trusted individual, I need to, for no obvious reason, also incorporate and trust a 3rd party individual, who won't even use their real name, and did some shady crypto currency integration. Matrix is so so much better in that regard. I can communicate without any 3rd party needing to be trusted. The areas where I need a "3rd party" (the server and client code) are effectively diluted by the fact that thousands of eyes pore over it. Rather then trust in a single person (Marlinspike), instead I just have to trust the person I'm actually talking to. And the Matrix team have done nothing to make me question their motives.
- chitowneats 4y ago
  - Smaug123 4y ago
    What did they move on to?
    - deleted 4y ago
      [deleted]
  - deleted 4y ago
    [deleted]
- poisonborz 4y ago
  "I won't trust an individual who won't even use a real name" That's the hard privacy-killing argument of corporations. And only cultural change can help it.
  - newaccount74 4y ago
    Funny thing is you can't use Signal without revealing your phone number. So much for privacy.
laserbeam 4y ago
I tried to watch the video... But damn the speaker is hard to pay attention to. I barely got through the intro. Honestly, Signal was too unreliable and hard to use for me. I've lost too many messages, had issues with multi device use (with messages not syncing correctly or not being delivered everywhere). Security is cool but I need more reliability. Also my threat model is not that high. They just gotta work on reliability and some more joy in the UX for regular folk. Might not be easy but I've seen too little progress in that direction over the years and I don't feel it's high on their priority list. At least that's the optics from a distance.
- dodgerdan 4y ago
  When did you throw in the towel? In the last year or so they’ve been rock solid for reliability. (Note: some Android devices background app memory/power/cpu management of Signal effetely makes any type of messenger useless.)
  - MrDresden 4y ago
    I've been a Signal user for the last 6ish years, and if anything I've noticed message delivery reliability go down in the last year. This is an active discussion point within my circles that something is seriously broken at Signal as we are a large group all having these issues happen to us (i.e not tied to one platform or os version).
    - aaaaaaaaata 4y ago
      Yeah, something is regularly unexpectedly broken, and it's AWS. Nowhere near "too often", though.
- AnonHP 4y ago
  Using Signal has been frustrating for me too, though my usage is minimal. In the last few months I’ve seen messages getting delayed in delivery (like the next day or two). That along with user experience issues (pestering often to sync contacts and turn on notifications, not allowing backups on iOS) makes it hard to recommend it.
morjom 4y ago
Getting people onboard of Matrix clients vs Signal in daily life will be difficult.
- chitowneats 4y ago
  Rats. If only we had figured out how to get them to switch from TikTok and WhatsApp to Signal I'm sure we'd be Gucci. /s Almost no one uses Signal outside of your social bubble.
  - uoaei 4y ago
    What is your vendetta here?
  - rvz 4y ago
    Totally correct. The problem on this comments here is that many of them insert their own anecdotes as evidence. It isn't evidence. > Almost no one uses Signal outside of your social bubble. There is evidence support that claim. From [0]: "25.97% of participants wanted to switch to other apps (at least partially) due to the update, but only a quarter of those succeeded." "Only 0.5% of participants uninstalled WhatsApp. The data shows how installing a new app is easy, but leaving an app is not, mainly due to strong network effects, differences in functionality of different apps, and feeling a loss of control over the distribution of contacts across apps." So that wasn't the so called 'mass migration' that was religiously believed by the Signal fans here. In fact, they are still using WhatsApp or Telegram. [0] https://medium.com/@carlagriggio/the-great-messaging-app-migration-that-didnt-really-happen-56af637bc5d8 https://medium.com/@carlagriggio/the-great-messaging-app-mig...
- cardanome 4y ago
  I have multiple non-technical friend groups that uses Signal for communications. Onboarding is absolutely not in issue. Some people refuse to use Whatsapp because of privacy and general evil monopolist issues and Telegram also has also been getting a bad reputation for hosting hate groups and such. So if you want to get everyone on board, Signal is the neutral territory to go for. Signal is absolutely mainstream, at least here in Germany. My 60-something landlord uses Signal to communicate with me.
harry8 4y ago
Signal brought e2e encryption to the masses in a form that was and is usable. From signal having it came whatsapp asking the signal devs to "do that for whatsapp" and a billion more got it. That is no small thing. Bitch all you want but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses and then if I'm gonna be snarky maybe compare it to your own achievements. It would have been fantastic if signal also achieved other things on top of what they did. Maybe. Knocking what they did? Forget it. Signal is an outstanding achievement and nothing else comes close. I will cheer you so, so hard if you beat it.
- gonehome 4y ago
  +1 though to his credit he does caveat it a bit and states it’s still worth talking about the issues given the technical audience. I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. Signal is really good at doing what it does well and I’m grateful for that. Matrix is cool, but my family/friends will never use it (and element still sucked last I checked, especially to deal with encryption). Signal is easy to use, extremely secure, and I can actually use it with less technical people I care about. Like you said - these are major wins among an ocean of failure from technologists who have for years complained while failing to ship a solution with the right tradeoffs (normal) people would actually use. I don’t find his other arguments very convincing either.
  - NoGravitas 4y ago
    > I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. I'm not so sure about that. I feel like Matrix has pretty much solved the problems with federation, E2EE, and multi-device usage. I typically have Matrix clients running on three devices, talking to my self-hosted homeserver, with encrypted chats with people on different homeservers, and it's been... at least a year?... since I had any issues with encrypted messages. It's been really good at disproving Moxie's assertion that you have to have centralization to evolve a protocol, too. The introduction of Spaces (like Discord servers) was really smooth and backward-compatible. There are features it lacks that I miss (stickers, sending multiple images in one message), but they're not essential. I do still also use Signal with less technical people, and I think Signal has been very successful at making adoption very easy, but with serious trade-offs for anyone not on the happy path (changing devices is a nightmare, it's too easy to lose chat history, multi-device is a trainwreck).
denkmoon 4y ago
Matrix is the chosen one.
nicoco 4y ago
No mention of XMPP so I'll be that guy. XMPP has a variety of clients for about all platforms, is federated, can (optionally) be e2ee. Its most used client on Android is user-friendly and has built-in (optional, again) tor support. On a cheap vps you can easily run a server with many users. I think it deserves a little more love than it receives.
- Semaphor 4y ago
  I love XMPP/Jabber and the available clients are vastly superior to what Matrix and Signal offer. Sadly, the amount of people I know who use it make Matrix shine in comparison :(
  - fsflover 4y ago
    > and the available clients are vastly superior to what Matrix and Signal offer Care to elaborate?
    - Semaphor 4y ago
      Signal has a bulky, slow Windows client. Elements is a [0] bulky, slow Windows client. Gajim is fast (I’m guessing it’s the only native of the 3, but I haven’t checked). Configurability is also better. And then there are other options (which I’ll evaluate soon, as I did not like the recent redesign), while there are none for Signal and none that are stable for Matrix. It’s not as bad on mobile (I can only talk about Signal here, not Matrix), as clients are far more constrained, but once again Signal has a slow Android client (every action only happens after a noticeable delay) while the biggest XMPP client Conversations is instant. [0]: I tried a beta version that felt like an alpha, but OTOH the last time I tried it, it seemed reasonably stable.
- heywoodlh 4y ago
  Thanks for being that guy, this gets me thinking about setting up an XMPP server and integrating stuff into it. Random tangent: I feel like XMPP is everywhere but nobody really talks about it. It just quietly works and stays out of the way.
LAC-Tech 4y ago
I like Signal because the video calls work excellently. I've only had bad experience with matrix & jitsi.
- alexmingoia 4y ago
  Also worth pointing out that Jitsi isn’t a standard protocol (AFAIK), but an open-source library. Matrix, the protocol, doesn’t actually have support for video/voice chat.
  - tcfhgj 4y ago
    What's this then? https://spec.matrix.org/v1.3/client-server-api/#voice-over-ip https://spec.matrix.org/v1.3/client-server-api/#voice-over-i...
    - alexmingoia 4y ago
      Ah TIL. Matrix can be used to setup a WebRTC session between two participants. But that looks like pretty rudimentary. Do any chat clients use this? I thought Elements used Jitsi.
      - Arathorn 4y ago
        This is how 1:1 calls have worked in Matrix since 2015 - predating even Vector/Riot/Element.
  - Arathorn 4y ago
    Matrix has great native support for voip/video, including conferencing: https://element.io/blog/introducing-native-matrix-voip-with-element-call/ https://element.io/blog/introducing-native-matrix-voip-with-... etc.
    - alexmingoia 4y ago
      Ah, I didn’t know that. I’m not sure I consider that “great support.” It looks relatively new, and from the blog post it seems the spec is still in proposal and development stage. It’s not implemented in any of the chat clients either. Excited to know it’s on the way though.
alexjurkiewicz 4y ago
The "major problems" this talk seems to address are essentially that Signal doesn't support third party clients. Really? Supporting SailfishOS won't move the needle on Signal adoption. Just say the truth: you want the ability to hack around with the protocol and clients, for fun.
dogecoinbase 4y ago
As a concrete reminder, Signal didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 while they secretly added a cryptocurrency payment system, which Moxie denied they were doing in January 2021 (I'm on phone at the moment, happy to provide cites later but truly, they're not hard to find). Don't trust Moxie; don't trust the server side of Signal.
- sschueller 4y ago
  I am in the same boat. I don't trust Moxie.
- growse 4y ago
  The whole point of the design is that you shouldn't have to trust the server.
  - ls15 4y ago
    Then why no custom clients?
    - growse 4y ago
      Because they provide no guarantees around the stability of the protocol, and presumably don't want to drag around the weight of a load of poorly-maintained clients that break all the time. Besides, it's their service, they get to say who and how they connect.
- anjbe 4y ago
  Don’t trust the server side of any service. Open source or not, federated or not, it’s impossible to verify that a server you talk to runs the code it says it does. Which leads to one of the selling points of Signal: that the client is designed to expose as little metadata as possible to the server. Sure, the Signal servers could be slurping up IP addresses and timings despite advertising that they don’t. But I can’t think of a single alternative service that can guarantee otherwise, and that problem is compounded by clients that leak much more metadata than Signal.
asojfdowgh 4y ago
the examples given (matrix, activitypubkindathing) both have major players (matrix, mastodon) that move fast enough that everyone else is constantly chasing after parity with them, which IMO kinda re-enforces moxie's point. As far as I can tell, if you want to do fully open and parity, you got either IRC, the joke being still lack of parity, no client can agree on using the same E2E encryption method, etc. Or XMPP, once again, 5million extensions to the spec (the XSF recommends reading through 23 seperate RFCs to get an idea of how to implement a client). - - - So, if you have issues with the current options, and concrete ideas of how to solve them, please free us all from the hell that is current open communications. This isn't a "just fork it", its an earnest plea.
- MattJ100 4y ago
  > Or XMPP, once again, 5million extensions to the spec (the XSF recommends reading through 23 seperate RFCs to get an idea of how to implement a client). Fact check: The XMPP core protocol is split into three RFCs, one describing the fundamental building blocks of the protocol (RFC 6120, "XMPP core") and the second describing how to compose these for instant messaging (RFC 6121, "XMPP IM"). Finally, there is an additional short RFC which describes the address syntax and rules (RFC 6122). These documents are stable, and need to be updated rarely. Other things such as audio/video calls, file transfers, push notifications and such, are defined by the XMPP Standards Foundation (XSF), as I imagine you know, in documents known as "XEPs". These have enabled the evolution of the protocol over the years, and are why XMPP didn't get stuck frozen in time in the early 2000s. People like to point at the "5 million" XEPs (actually, 468). However the truth is that these are not required reading. They are not all applicable to IM clients (e.g. XMPP is used in IoT and other places), and many are simply proposals/experiments that didn't take off (XEPs have a lifecycle, including states such as "proposed" and "stable"). The XSF is a place of sharing and collaboration, and these proposals are a natural side-effect of that process. The actual required reading is published annually in the "compliance suites" which describes what implementations are expected to be supporting in any given year. This promotes interoperability, encourages regular reviews of the ecosystem, and helps developers to discuss and plan their roadmaps. The 2022 document is here: https://xmpp.org/extensions/xep-0459.html https://xmpp.org/extensions/xep-0459.html An alternative resource is the protocol overview on modernxmpp.org: https://docs.modernxmpp.org/client/protocol/ https://docs.modernxmpp.org/client/protocol/ Why is all this relevant? Because, although I don't claim XMPP to be perfect (what software/protocol is?), I think this has been a pretty successful model that has stood the test of time and continues to deliver sensible community-driven evolution. The Matrix model is extremely similar (they have "MSCs" instead of "XEPs", and they regularly release versioned documents, though not strictly on an annual basis), IRC folk are trying something with IRCv3. Open protocols and ecosystems are hard work, but they are worth it.
izacus 4y ago
Signal is yet another of those products that Knows Better Than You what's good for you. It Knows Better what you're allowed to do with your messages, what kind of client you're allowed to use, what kind of multidevice experience you need and when it should destroy messages you care about. The arrogance of the owner directly transfers to the arrogance and lack of control in the software which is fundamentally limiting its usefulness for everyone.
- teekert 4y ago
  Signal works for me (and many of my friends/family because it looks/works like Whatsapp). I'm not an expert, one has to trust someone, at some point. I love Matrix but the sign-up process (and even understanding it's federated model) is much more complicated than what Signal offers.
  - deleted 4y ago
    [deleted]
- growse 4y ago
  Or, to re-frame it, the people who own Signal have opinions on what the right way to do things are. You may disagree with those, and for good reasons depending on your context, and that's ok! There's plenty of other messaging options out there which may fit your context better. Life is about compromise. Complaining that someone else's compromise doesn't work for you is not particularly productive.
  - ddevault 4y ago
    When it stops being okay is when Signal's know-better-than-you/opinions are motivated by their commercial interests, and in conflict with the interests of the users.
    - tankenmate 4y ago
      Can you provide an example?
checkyoursudo 4y ago
What I don't understand about the phone app version of Signal is, when I say "No I don't want to share my contacts" or "No I don't want notifications", it says Ok, we'll remind you later. And it sure does. I thought that apps were generally supposed to respect a user's decision to tell it to fuck off.
- bsaul 4y ago
  problem is that those are two really core features of a messenging app, so they probably don't see how you can keep using the app without them and not have a shite experience. edit : in case people wonder "share your contact" is actually the only way an app can tell you if a friend from your contact book can be contacted through the app. It's a pretty important thing especially for the onboarding of new people.
  - dybber 4y ago
    Works fine for e.g. Facebook Messenger, Element app etc. You just put in their email adress, username or phone number and you connect. What’s the problem?
    - bsaul 4y ago
      You'll have to do that, hoping that they're on the platform, then the server will respond "sorry, i don't know this guy". Then either you send him a SMS or email, saying "hey, when you're on signal, let me know". or you repeat the process every day until finally the person is on signal. That's a crap experience for an onboarding to the platform.
      - checkyoursudo 4y ago
        Most people will allow contacts and notifications, which will help with onboarding ordinary users. I don't need help. I already want to use it the way I want to use it. Don't need to keep reminding me after every update or more than once or whatever. How about a "No, and don't remind me again" option? But yeah, I get what you are saying about most users.
mananaysiempre 4y ago
CCC’s self-hosted page: https://media.ccc.de/v/mch2022-196-signal-you-were-the-chosen-one- https://media.ccc.de/v/mch2022-196-signal-you-were-the-chose...
medo-bear 4y ago
im curious what people think about briar. it seems to be the next iteration of secure communication protocol. real time physical conversation happens (usually) without a middle man. there is no reason we need a cetralized server to regulate all of our chats
andrewclunn 4y ago
Signal has vastly improved in its user experience in the past few years, it's simple enough that my parents and girlfriend use it, and the enforced policies err on the side of security. This reads like a Linux user who gets frustrated when people use Ubuntu. You like Matrix? Cool, use it, but I for one don't give a damn about your self destructive purity spiral.
hosh 4y ago
I wonder why XMPP is not more popular. It’s like people forgot that it has e2ee, and that the protocol is flexible enough for people to iterate quickly with, or how there’s a well laid out path to get extensions into the standard, and there are already robust, battle-tested, and scalable implementations of both clients and servers in multiple languages. Instead we end up trying to reinvent an ecosystem with Matrix?
- tcfhgj 4y ago
  To get federation up to speed and make it more attractive for the masses
  - hosh 4y ago
    They could have done that by making more streamlined XMPP clients or improving release engineering for servers, or creating new logos to rally around, or solving the spam problem or pushing the idea of “Jabber home servers”, or provide services to aggregate RSS, or even making a completey open-source and open standard “skin” for a Slack experience, or protoyping a Websocket replacement for BOSH, or write Javascript XMPP libraries that let devs hack on the front end. But they did not do any of that. It’s as if the people involved with Matrix don’t really know what is available for XMPP, or have studied its history to see what is in store for their own efforts. I have a friend that was seriously trying to create a service backed by Matrix. He saw it as a way to bring e2ee to more people. Yet recently, when I revisited XMPP and discussed it with him, the more I dig into XMPP, the more I’m scratching my head — why didn’t we just start with XMPP?
    - Arathorn 4y ago
      Speaking as project lead for Matrix: Matrix is not an attempt to reinvent XMPP, plus we had extensive XMPP experience before creating Matrix (running 10M+ user ejabberd deployments; writing XMPP clients based on Smack, XMPP.Framework and Strophe.js; writing our own ejabberd modules for things like push notifications and persistent chat history, etc). Instead, Matrix is an entirely different architecture with different tradeoffs which you may or may not agree with. The main differentiators are: * It's a protocol for replicating conversation history; not for passing messages. * You get eventually consistent conversation history, as well as decentralised key-value store for metadata about the room. * Rooms are entirely decentralised over the participating servers; there are no single points of failure/control in a room. * It automatically heals after network partitions * It's a single monolithic spec * E2EE is on by default. If anything, Matrix is more like NNTP than XMPP. Now, you're welcome to dislike Matrix and build on XMPP (or SMTP or NNTP or SIP or MSRP or IRC or whatever other messaging protocol floats your boat) instead, but it's completely and utterly wrong to claim that Matrix is just a reinvention of XMPP by people who don't understand XMPP, or a marketing gimmick.
meowfly 4y ago
There definitely seems to be a gap between what a certain subset of people want out of Signal and what I do. I like Signal because it is a fairly pure messaging app. Admittedly, introduction of Mobile Coin has marred that though. I want something analogous to SMS but is E2E encrypted. I'm personally not intentionally trying to evade state governments, I'm concerned about Comcast. My favorite Signal feature is automatic deleting messages. I can have ephemeral conversations with people about politics, a health issue, etc and generally trust that it won't be on their phone later. When that feature rolled out, it was controversial. The security types complained that it provided a fake assurance of privacy since there was nothing stopping screenshotting or simply taking a picture of your phone. It reminds me of the federation discussion in that I understand the concern from security pureists, but Signal still seems like the better option than an FB managed app or SMS while still providing something my parents can easily use.
- hnarn 4y ago
  > I'm personally not intentionally trying to evade state governments, I'm concerned about Comcast. There’s a pretty interesting irony, or a joke, buried somewhere in the fact that those living in authoritarian regimes use Signal to evade the regime, while those of us living in the “free world” use it to not primarily evade state owned institutions but the private for-profit institutions that start doing very similar things to the regime. Here’s an attempt at a joke: Q: what’s the difference between your private communications being intercepted in Iran and the US? A: in the US it increases the value of your stock portfolio
  - 863862836 4y ago
    I don't think you can compare Comcast with a government. Governments kill, imprison, and torture people based on the information they collect. The worst Comcast could do it give it to a government, they are not going to do those things to you directly.
    - hnarn 4y ago
      Just because someone draws parallels between A and B doesn’t mean they are claiming exact equivalence.
phs318u 4y ago
I'm surprised no one here has mentioned https://www.gnunet.org/ https://www.gnunet.org/ Currently they're pretty far off something robust and usable by relatively tech savvy folks let alone the masses, but the direction is sound and I'm sure they'd be happy for help.
- stkdump 4y ago
  Gnunet is >20 years old. Will it be ready before hurd?
m1keil 4y ago
I really wanted to address the speaker's points but what's the point, it's just a rant (kudos to him for being upfront about it). Instead I just went and donated to Signal once again.
- chairmanwow1 4y ago
  Same, this thread is filled with similar reality-disconnection.
aembleton 4y ago
rysiek claims in this talk that the Signal desktop app requires 4GB of RAM in order to run because it is an electron app. Where does he get that number from? I'm currently running Signal on OSX and it has been open for 7 days. It has 5 processes, that combined are using 440MB. This is a lot, but an order of magnitude smaller than rysiek claims. Thought I'd look at other electron apps I have running. Slack is using ~700MB and VSCode is using ~1.4GB.
baxuz 4y ago
The biggest issue I have with it is the fact that everyone using it behaves like they're the main character in a blockbuster action thriller. Everyone else is out to get them but they are using this brand new 1337 h4xx0r technology called E2EE®™© which keeps the Bad Guys™ away. Meanwhile, I'd just like to have a messaging service that I can use on multiple devices and which isn't tied to my phone (number), and which doesn't have a trash client.
- Aachen 4y ago
  I don't really see this behavior you're describing, but related seems to be the tendency to share full name on WhatsApp and Telegram but only have a single letter on Signal because now they suddenly feel the need for privacy/secrecy/mystery. Then start a PM chat and expect I have any idea whom I'm talking to. Sure enough, once they send me an actual name I know them, but...
jillesvangurp 4y ago
In the past 30 years I've used email, and close to three dozen different messaging solutions that each came and went. Patterns why none of these chat solutions really stick long: - Lack of standardization and ecosystem. There are multiple standards of course. But unlike email, none of the standard based products ever managed to become entrenched enough such that the rest of the market could not afford to ignore the standard. Jabber for example never really ended up mattering because at no point did it get over ever a percent of user adoption. Email had the advantage that you could email the whole world or only people inside a single company with corporate mailing systems. By the time MS figured out that they wanted in, they tried really hard to change that but never really were able to make people use their protocols rather than SMTP for delivering emails. For better or worse, that's how mail gets delivered. - Walled gardens where companies jealously aim to keep all competitors outside. Microsoft, Facebook, Google, Yahoo, AOL, etc. each had a go at this space with long forgotten products. And some of the products that disrupted those are also long gone. - Reinvention of the same wheels over and over again. It's disgusting how close e.g. ICQ was in functionality to things like Signal and Whatsapp. That was in the late nineties! This space is running around in circles. Arguably it had some useful features that some contemporary products still lack. - Federation is consistently rejected as a feature by new players and a contributing factor for their inevitable demise; even if initially successful. What matters more to people is who they can chat with than what the feature set is when they are chatting. Whatsapp cleverly capitalized on that end ended up disrupting lot of entrenched things simply by offering wider access to essentially everyone with a phone, which at this point is most of the planet. Of course, whatsapp's popularity has suffered a lot in recent years courtesy of Facebook doing what every other big company has done in this space historic: get overly possessive and throw out the baby with the bathwater. Signal is backed by the Whatsapp founder. And ironically repeats most of its mistakes. - Users inevitably try out a new app and as they move, some apps go in and out of favor. And since they don't federate, users go where the other users are. Wake me up when Telegram, Whatsapp, Signal, whatever the hell Google is calling their chat app this month, iMessage, etc. can talk to each other. I have close to a dozen chat and messaging apps on my phone and they all get used. It's beyond ridiculous. All proprietary walled gardens with enough people in them that I somehow need to be there as well. That's why email is still a thing. Because when you have to reach somebody, you send them an email. Instead of playing roulette with your selection of chat apps to see which one of those might get a response. Pun intended of course, chat roulette was a thing at some point.
dhlaoq 4y ago
Why do you need centralization for "network effects"? Send a cc mail to all people you want to communicate with, exchange keys in person and use PGP. Worried about traffic analysis? Well, in that case don't trust Signal and send encrypted messages regularly (including fake messages) to some Usenet group, using mixmaster or Tor.
- anjbe 4y ago
  I was a PGP enthusiast for some time, and advocated it to technical friends. In the end, though, I only ever received a single PGP‐encrypted mail from a single person. These days, I have over a dozen reliable Signal contacts, nearly all with safety numbers verified in person, and have sent to or received from them hundreds (perhaps thousands) of encrypted texts and voice messages, and dozens of encrypted audio calls. The majority of my immediate social circle doesn’t use Signal (and some have tried and rejected it), but a sizeable chunk does use it, including non‐family. When it comes to volume and quality of E2EE communication in my daily life, I cannot call PGP anything but a failure, and I cannot call Signal anything but a success.
mayop100 4y ago
The author notes: "Finally, we need to talk federation. Does it make moving fast and breaking things more difficult? Yes, yes it does, and that can be a good thing." The other, super-underrated feature of federated systems is that antagonistic parties are willing to use them together. For example, the US military, Russian government, major international banks, Google, Facebook, etc ALL use email and happily exchange messages over SMTP. There's no centralized service you could get all these parties to agree to use (not even Signal). The result of this is that everyone has an email address, and that makes it the universal standard for business-to-business communication. I can loop in any number of parties on a single thread from all over the world and it just works. My startup Shortwave is trying to build a messaging future that is email. We're trying to evolve and upgrade email to have the look and feel and features of a product like Signal, but with all the universal, federated goodness of the global SMTP network. It's a long project -- federated systems evolve slowly! -- but it's the bright open future I think we need. I go into some detail here: https://www.shortwave.com/blog/future-of-messaging/ https://www.shortwave.com/blog/future-of-messaging/
- greatjack613 4y ago
  Are open shameless plugs like this allowed on hacker news without disclosure?
  - junon 4y ago
    Yes. It's just typically not well received.
    - Aeolun 4y ago
      It’s fine if it’s on-topic I think? In this case it’s on topic.
  - baisq 4y ago
    Isn't "My startup Shortwave" enough disclosure?
  - matthiaswh 4y ago
diimdeep 4y ago
I use Telegram because it is a superior product. Then I don't see the point in encrypted chats with many users, no use case for me. For work, I would use self-hosted solution like Mattermost. Then, if it is true that Signal behave like they know better VC company and block 3rd party clients, etc. Signal is centralized, but I want decentralization, not just from technological point of view. With today predatory imperialistic sanctions issued by US against whole countries, I do not want to place all my eggs in same bucket, controlled by US government and I still remember Snowden revelations.
- Aachen 4y ago
  It sounds like you are still under the impression that Telegram is, or ever was, Russian. It's run on infrastructure from the USA and its allies just like Signal, Wire, etc. What you're looking for might be WeChat (this is definitely the first and hopefully will be the last time I recommend that) On a less sarcastic note, Threema makes a point of running in Switzerland. Not that they're friendly with military powers other than NATO, but (per your desire) it's slightly better than running on US/UK infrastructure directly.
BlackLotus89 4y ago
He starts with saying that this is is the Q and A session that we didn't get and then rants for 25 minutes. 7 people tried to talk and were rushed/talked off topic * you can't download the APk * yes you can * telegram lets you download the apk and it's on fdroid * yeah would be nice if signal was on fdroid -- * there is wire... you should know there is wire * moxy complained about the update problem... and he was right * tor does this better -- * I don't want to use my phone number (rants over why he needs it) * signal is working on it -- * E-Mail comparison isn't fair. it's survivor bias, many others failed * signal has good cryptography and has a good usability -- * there are other third party clients that just work and it's ok * it's not that frowned upon, but they are hard to maintain because signal is a moving target -- * clearos has signal fork called ClearSIGNAL I wonder if this will be shut down winkwink -- * signal has too much of a silicon valley vipe for me --- This wasn't the Q and A we were missing. This talk wasn't what was promised and most talking points he had were easy enough to counter. But yeah signal clients that aren't signal would be nice. Kind of Edit sorry for the horrible formatting
whitenickel08 4y ago
I found plenty of my contacts moved to Signal in the last two years. I can even order in some restaurant nearby with Signal, but not having to reveal my phone number is one of the things I like from Threema.
GekkePrutser 4y ago
I've always hated Moxie's stance on federation and alternative clients. As a result I've never promoted Signal among my friends as an alternative for WhatsApp. I strongly believe in federation and open client ecosystems. Matrix is ideal for me but people don't seem to like it. I'm kinda hoping that signal will change now that Moxie is gone.
- Aachen 4y ago
  I mean, I see it the same way, but it's still better than running on centralized Facebook or Telegram infrastructure. What do you recommend to your family instead, or are they all still on WhatsApp / plain text SMS for this reason? For me, comparing Wire, Signal, Threema as the most mature and stable e2ee messengers that have any kind of network effect (so people will grow the network beyond just talking to this weirdo called Aachen), Signal has by far the largest network effect and by a very small margin the best user experience. My family is on Signal now and I was regretting not going for Wire (which has more features and fewer connectivity problems) until I needed to use Wire on Android again a few weeks ago and the Android user experience turns out to have degraded severely. The only realistic alternative I'd see to Signal, Wire or Threema (all centralized, though Wire has some enterprise on-prem thing I'm not familiar with) is self hosting something that just uses TLS to the server, but then you're always going to be on call and they won't use it with anyone else, also because you can always read all their messages. A friend has a matrix server (UX on Element is awful and buggy as heck) and every few weeks there's some problem and we temporarily fall back to Wire, and when that doesn't work, back to Signal, and when that doesn't work, calling.
  - GekkePrutser 4y ago
    My family are all on WhatsApp yes. I don't have the energy to push them to move over especially because they also have their circles that use WhatsApp. So I decided to just set up Matrix Bridges and get all that shit (WhatsApp, Telegram, Signal, Discord) off my phone, I use them all through Element now. But I'm not going to do free promotion for what is yet another walled garden. PS: Element works pretty well for me, and it gives me the added benefit of having all my chats stored in one place. Also gives me the ability to read chats that have been deleted by the user, make copies of what people put in their WhatsApp 'status updates' etc.
deleted 4y ago
[deleted]
JustSomeNobody 4y ago
Can't read the article as it is being HN'd to death. But... I really like signal. I send a message and the other person receives it. They send me one and I get it. Rarely is it down for me and I use this app as my primary means of communication with a number of people. Is it perfect? No, but it is mostly there. My personal wants: Don't use phone numbers - though I totally get why they chose to and I'm okay with that. But move on. At the very least let me use one account on multiple phones - there are far too many of us that have two or more phones. Some sort of mesh operation. If I'm on the same network as someone, my messages should go straight to them. But, you know, as long as Signal doesn't degrade I can live with the features it currently has and be perfectly fine and I'll continue to donate.
mellosouls 4y ago
(Video)
Yaina 4y ago
I primary use Telegram and sometimes Signal when I need to. Telegram >is< very – very, very – shady but it's hard to argue with the extreme polish and attention to detail with which all of it's apps are made. Signal does not even come close in terms of user experience (neither does Matrix) and Signal also does not seem to strive to catch up. Their position seems to be that security as a feature has to be enough. I'd love to have an alternative to Telegram, but Signal ain't it.
- kaba0 4y ago
  Why is telegram shady in your opinion?
api 4y ago
I'm glad to see someone push back a bit on Moxie's reasoning in that essay. For those who have not seen it: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ I've thought he's wrong for a while. The problem is not that you can't innovate within the context of a (well designed) federated system. If that were true the Internet would still be using telnet, rlogin, finger, Gopher, and vanilla ftp. The problem with decentralized and federated systems, as I've repeated ad nauseum, is lack of an economic model. It's the same as the problem with any kind of consumer-oriented open source. IMHO every other explanation is mental contortions to avoid looking at the economic factor. The innovation isn't happening because producing high quality software with support for multiple platforms, diverse network environments, etc. is fabulously expensive yet we pretend it's something hobbyists (who don't have trust funds) can do in their spare time. Centralized systems can have their choice of viable economic models: commercial software rental (SaaS), non-profit fund raising, free core with paid upgrades, advertising, and of course less savory ones like surveillance and pay-to-play addictionware. You can try to raise money for clients/nodes to run in decentralized and federated systems, but since there's always more than one and very few people pay for anything unless compelled there's always going to be too little funding to make any of them great. For a little while I was optimistic that cryptocurrency and tokenization might provide a mechanism, but then scammers and gamblers destroyed that ecosystem.
Winnie080 4y ago
I was used to be a digital marketer of Alexa, but now the website was closed. I find another alternative one: Blexb.
- Winnie080 4y ago
  [dead]

348 points by kitkat_new 4y ago

I haven’t yet watched the video, but I agree with the text in that I found the Signal’s hostility toward third party clients both confusing and disappointing. That single decision probably dampened my excitement for it as both a developer and user than anything else.

signalchaff 4y ago

As an old hacker and daily Signal user, I have mixed feelings. I want my freedom, but I recognize centralizing controlling effects can help the “network” with quality issues. As maligned as Nintendo’s NES era policies towards third-parties, there was a direct historical reason for it. Shit quality tanked the industry. So imagine a world of half-baked, likely insecure clients popping up, creating confusion and chaos around what is a great tool / protocol. It’s… hard.

alexalx666 4y ago
I think NES case is more about business practices and distribution problem w/o a digital network. Im sure there was a lot of talent left untapped. If they somehow passed decision making from distributors to end users they would have a healthier ecosystem with a lot of innovation coming from small teams
- toast0 4y ago
  The NES lockout chip is almost certainly a direct reaction to the lack of a lockout chip on the Atari 2600 and the resulting immense pile of garbage games at your local retailer, and the video game crash. So much of the NES's design is an attempt to distance themselves from the previous version. Front-loading makes it look like a VCR rather than an old game system, the box and cartridge art is actual art from the games (enlarged, but blocky) rather than images that are not part of the game, etc. Of course, it's hard to measure apples to apples and see if open would be better, because nobody released an open console after that generation (Sega didn't put a lockout in the Genesis originally, but they added one in later revisions)
  - lloeki 4y ago
    > the box and cartridge art is actual art from the games (enlarged, but blocky) rather than images that are not part of the game The only ones I can recall like that is SMB and Duck Hunt, but all others I recall definitely not. SMB2, SMB3, Megaman, Contra/Probotector, Zelda, Olympus, Parodius... all had specific cover art, often of the "over the top" kind.
deleted 4y ago
[deleted]
m-p-3 4y ago
It's hard, but Matrix/Element still kinda manage it.
nine_k 4y ago
Imagine a world where a compliant implementation can get a certificate. You as a user might choose whether you agree to interact with non-certified clients. It's a different business model. But it seems workable (see Bluetooth, USB, JVM), and it'd be more resilient than the current single-benevolent-vendor model.
- baisq 4y ago
  Interesting because your examples all suck in different ways, especially when devices of different manufacturers (or even models) are supposed to interact.
  - nine_k 4y ago
    Now imagine that USB did not exist, and there were only, say, Thunderbolt, controlled by the paragon of care about users, Apple.
  - kaba0 4y ago
    How does the JVM suck?

hammyhavoc 4y ago

Bring on Matrix protocol.

h4waii 4y ago

I'm really torn on Signal these days. It's still a great method of communication, but it's kinda floating in a sea of other great methods of communication. I remember using TextSecure while rockin' a Whisper System shirt, cause it was the best way to show support, but now it's opaque updates to include cryptocurrency, chat stickers, and subscriptions.

dendrite9 4y ago
I liked Threema but it had the same issue of getting other people to use it. For me it was usually very specific individuals I wanted to share a channel with so it wasn't too difficult. But for more general contacts and friends there was no chance. And maybe that is ok in the end.
- cuu508 4y ago
  I've set Signal as my SMS app. When I message somebody, sometimes they happen to have Signal installed, and so it's a Signal message. Otherwise, it is a plain SMS.
  - dmix 4y ago
    You can't do that on iPhone sadly.
public_defender 4y ago
> other great methods of communication. Really though? From my perspective, it seems as though an option can either be a great academic solution or it can be widely adopted. I've used Signal service discovery to decloak a whole mess of colleagues. I'm talking about people who have firstname@aol.com email addresses. Good luck finding another messenger with penetration that deep and a material dedication to user privacy or security. Alternatives exist, like Telegram I guess, but I perceive the list of viable alternatives to be very short. That's not to say we should accept Signal because it's inevitable, just that network size should be a strong consideration when considering how to advocate for changes or decide between potential alternatives. Example: Signal requires a phone number as an identifier. Do we spend resources lobbying Signal to accelerate deprecation of phone numbers or advocating that people use other software? In my view, the size of the user base makes lobbying Signal worth the effort.

deleted 4y ago

[deleted]

COGlory 4y ago

Signal always left a bad taste in my mouth. It's fundamentally built on the requirement that to have conversations with any trusted individual, I need to, for no obvious reason, also incorporate and trust a 3rd party individual, who won't even use their real name, and did some shady crypto currency integration. Matrix is so so much better in that regard. I can communicate without any 3rd party needing to be trusted. The areas where I need a "3rd party" (the server and client code) are effectively diluted by the fact that thousands of eyes pore over it. Rather then trust in a single person (Marlinspike), instead I just have to trust the person I'm actually talking to. And the Matrix team have done nothing to make me question their motives.

chitowneats 4y ago
- Smaug123 4y ago
  What did they move on to?
  - deleted 4y ago
    [deleted]
- deleted 4y ago
  [deleted]
poisonborz 4y ago
"I won't trust an individual who won't even use a real name" That's the hard privacy-killing argument of corporations. And only cultural change can help it.
- newaccount74 4y ago
  Funny thing is you can't use Signal without revealing your phone number. So much for privacy.

laserbeam 4y ago

I tried to watch the video... But damn the speaker is hard to pay attention to. I barely got through the intro. Honestly, Signal was too unreliable and hard to use for me. I've lost too many messages, had issues with multi device use (with messages not syncing correctly or not being delivered everywhere). Security is cool but I need more reliability. Also my threat model is not that high. They just gotta work on reliability and some more joy in the UX for regular folk. Might not be easy but I've seen too little progress in that direction over the years and I don't feel it's high on their priority list. At least that's the optics from a distance.

dodgerdan 4y ago
When did you throw in the towel? In the last year or so they’ve been rock solid for reliability. (Note: some Android devices background app memory/power/cpu management of Signal effetely makes any type of messenger useless.)
- MrDresden 4y ago
  I've been a Signal user for the last 6ish years, and if anything I've noticed message delivery reliability go down in the last year. This is an active discussion point within my circles that something is seriously broken at Signal as we are a large group all having these issues happen to us (i.e not tied to one platform or os version).
  - aaaaaaaaata 4y ago
    Yeah, something is regularly unexpectedly broken, and it's AWS. Nowhere near "too often", though.
AnonHP 4y ago
Using Signal has been frustrating for me too, though my usage is minimal. In the last few months I’ve seen messages getting delayed in delivery (like the next day or two). That along with user experience issues (pestering often to sync contacts and turn on notifications, not allowing backups on iOS) makes it hard to recommend it.

morjom 4y ago

Getting people onboard of Matrix clients vs Signal in daily life will be difficult.

chitowneats 4y ago
Rats. If only we had figured out how to get them to switch from TikTok and WhatsApp to Signal I'm sure we'd be Gucci. /s Almost no one uses Signal outside of your social bubble.
- uoaei 4y ago
  What is your vendetta here?
- rvz 4y ago
  Totally correct. The problem on this comments here is that many of them insert their own anecdotes as evidence. It isn't evidence. > Almost no one uses Signal outside of your social bubble. There is evidence support that claim. From [0]: "25.97% of participants wanted to switch to other apps (at least partially) due to the update, but only a quarter of those succeeded." "Only 0.5% of participants uninstalled WhatsApp. The data shows how installing a new app is easy, but leaving an app is not, mainly due to strong network effects, differences in functionality of different apps, and feeling a loss of control over the distribution of contacts across apps." So that wasn't the so called 'mass migration' that was religiously believed by the Signal fans here. In fact, they are still using WhatsApp or Telegram. [0] https://medium.com/@carlagriggio/the-great-messaging-app-migration-that-didnt-really-happen-56af637bc5d8 https://medium.com/@carlagriggio/the-great-messaging-app-mig...
cardanome 4y ago
I have multiple non-technical friend groups that uses Signal for communications. Onboarding is absolutely not in issue. Some people refuse to use Whatsapp because of privacy and general evil monopolist issues and Telegram also has also been getting a bad reputation for hosting hate groups and such. So if you want to get everyone on board, Signal is the neutral territory to go for. Signal is absolutely mainstream, at least here in Germany. My 60-something landlord uses Signal to communicate with me.

harry8 4y ago

Signal brought e2e encryption to the masses in a form that was and is usable. From signal having it came whatsapp asking the signal devs to "do that for whatsapp" and a billion more got it. That is no small thing. Bitch all you want but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses and then if I'm gonna be snarky maybe compare it to your own achievements. It would have been fantastic if signal also achieved other things on top of what they did. Maybe. Knocking what they did? Forget it. Signal is an outstanding achievement and nothing else comes close. I will cheer you so, so hard if you beat it.

gonehome 4y ago
+1 though to his credit he does caveat it a bit and states it’s still worth talking about the issues given the technical audience. I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. Signal is really good at doing what it does well and I’m grateful for that. Matrix is cool, but my family/friends will never use it (and element still sucked last I checked, especially to deal with encryption). Signal is easy to use, extremely secure, and I can actually use it with less technical people I care about. Like you said - these are major wins among an ocean of failure from technologists who have for years complained while failing to ship a solution with the right tradeoffs (normal) people would actually use. I don’t find his other arguments very convincing either.
- NoGravitas 4y ago
  > I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. I'm not so sure about that. I feel like Matrix has pretty much solved the problems with federation, E2EE, and multi-device usage. I typically have Matrix clients running on three devices, talking to my self-hosted homeserver, with encrypted chats with people on different homeservers, and it's been... at least a year?... since I had any issues with encrypted messages. It's been really good at disproving Moxie's assertion that you have to have centralization to evolve a protocol, too. The introduction of Spaces (like Discord servers) was really smooth and backward-compatible. There are features it lacks that I miss (stickers, sending multiple images in one message), but they're not essential. I do still also use Signal with less technical people, and I think Signal has been very successful at making adoption very easy, but with serious trade-offs for anyone not on the happy path (changing devices is a nightmare, it's too easy to lose chat history, multi-device is a trainwreck).

denkmoon 4y ago

Matrix is the chosen one.

nicoco 4y ago

No mention of XMPP so I'll be that guy. XMPP has a variety of clients for about all platforms, is federated, can (optionally) be e2ee. Its most used client on Android is user-friendly and has built-in (optional, again) tor support. On a cheap vps you can easily run a server with many users. I think it deserves a little more love than it receives.

Semaphor 4y ago
I love XMPP/Jabber and the available clients are vastly superior to what Matrix and Signal offer. Sadly, the amount of people I know who use it make Matrix shine in comparison :(
- fsflover 4y ago
  > and the available clients are vastly superior to what Matrix and Signal offer Care to elaborate?
  - Semaphor 4y ago
    Signal has a bulky, slow Windows client. Elements is a [0] bulky, slow Windows client. Gajim is fast (I’m guessing it’s the only native of the 3, but I haven’t checked). Configurability is also better. And then there are other options (which I’ll evaluate soon, as I did not like the recent redesign), while there are none for Signal and none that are stable for Matrix. It’s not as bad on mobile (I can only talk about Signal here, not Matrix), as clients are far more constrained, but once again Signal has a slow Android client (every action only happens after a noticeable delay) while the biggest XMPP client Conversations is instant. [0]: I tried a beta version that felt like an alpha, but OTOH the last time I tried it, it seemed reasonably stable.
heywoodlh 4y ago
Thanks for being that guy, this gets me thinking about setting up an XMPP server and integrating stuff into it. Random tangent: I feel like XMPP is everywhere but nobody really talks about it. It just quietly works and stays out of the way.

LAC-Tech 4y ago

I like Signal because the video calls work excellently. I've only had bad experience with matrix & jitsi.

alexmingoia 4y ago
Also worth pointing out that Jitsi isn’t a standard protocol (AFAIK), but an open-source library. Matrix, the protocol, doesn’t actually have support for video/voice chat.
- tcfhgj 4y ago
  What's this then? https://spec.matrix.org/v1.3/client-server-api/#voice-over-ip https://spec.matrix.org/v1.3/client-server-api/#voice-over-i...
  - alexmingoia 4y ago
    Ah TIL. Matrix can be used to setup a WebRTC session between two participants. But that looks like pretty rudimentary. Do any chat clients use this? I thought Elements used Jitsi.
    - Arathorn 4y ago
      This is how 1:1 calls have worked in Matrix since 2015 - predating even Vector/Riot/Element.
- Arathorn 4y ago
  Matrix has great native support for voip/video, including conferencing: https://element.io/blog/introducing-native-matrix-voip-with-element-call/ https://element.io/blog/introducing-native-matrix-voip-with-... etc.
  - alexmingoia 4y ago
    Ah, I didn’t know that. I’m not sure I consider that “great support.” It looks relatively new, and from the blog post it seems the spec is still in proposal and development stage. It’s not implemented in any of the chat clients either. Excited to know it’s on the way though.

alexjurkiewicz 4y ago

The "major problems" this talk seems to address are essentially that Signal doesn't support third party clients. Really? Supporting SailfishOS won't move the needle on Signal adoption. Just say the truth: you want the ability to hack around with the protocol and clients, for fun.

dogecoinbase 4y ago

As a concrete reminder, Signal didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 while they secretly added a cryptocurrency payment system, which Moxie denied they were doing in January 2021 (I'm on phone at the moment, happy to provide cites later but truly, they're not hard to find). Don't trust Moxie; don't trust the server side of Signal.

sschueller 4y ago
I am in the same boat. I don't trust Moxie.
growse 4y ago
The whole point of the design is that you shouldn't have to trust the server.
- ls15 4y ago
  Then why no custom clients?
  - growse 4y ago
    Because they provide no guarantees around the stability of the protocol, and presumably don't want to drag around the weight of a load of poorly-maintained clients that break all the time. Besides, it's their service, they get to say who and how they connect.
anjbe 4y ago
Don’t trust the server side of any service. Open source or not, federated or not, it’s impossible to verify that a server you talk to runs the code it says it does. Which leads to one of the selling points of Signal: that the client is designed to expose as little metadata as possible to the server. Sure, the Signal servers could be slurping up IP addresses and timings despite advertising that they don’t. But I can’t think of a single alternative service that can guarantee otherwise, and that problem is compounded by clients that leak much more metadata than Signal.

asojfdowgh 4y ago

the examples given (matrix, activitypubkindathing) both have major players (matrix, mastodon) that move fast enough that everyone else is constantly chasing after parity with them, which IMO kinda re-enforces moxie's point. As far as I can tell, if you want to do fully open and parity, you got either IRC, the joke being still lack of parity, no client can agree on using the same E2E encryption method, etc. Or XMPP, once again, 5million extensions to the spec (the XSF recommends reading through 23 seperate RFCs to get an idea of how to implement a client). - - - So, if you have issues with the current options, and concrete ideas of how to solve them, please free us all from the hell that is current open communications. This isn't a "just fork it", its an earnest plea.

MattJ100 4y ago
> Or XMPP, once again, 5million extensions to the spec (the XSF recommends reading through 23 seperate RFCs to get an idea of how to implement a client). Fact check: The XMPP core protocol is split into three RFCs, one describing the fundamental building blocks of the protocol (RFC 6120, "XMPP core") and the second describing how to compose these for instant messaging (RFC 6121, "XMPP IM"). Finally, there is an additional short RFC which describes the address syntax and rules (RFC 6122). These documents are stable, and need to be updated rarely. Other things such as audio/video calls, file transfers, push notifications and such, are defined by the XMPP Standards Foundation (XSF), as I imagine you know, in documents known as "XEPs". These have enabled the evolution of the protocol over the years, and are why XMPP didn't get stuck frozen in time in the early 2000s. People like to point at the "5 million" XEPs (actually, 468). However the truth is that these are not required reading. They are not all applicable to IM clients (e.g. XMPP is used in IoT and other places), and many are simply proposals/experiments that didn't take off (XEPs have a lifecycle, including states such as "proposed" and "stable"). The XSF is a place of sharing and collaboration, and these proposals are a natural side-effect of that process. The actual required reading is published annually in the "compliance suites" which describes what implementations are expected to be supporting in any given year. This promotes interoperability, encourages regular reviews of the ecosystem, and helps developers to discuss and plan their roadmaps. The 2022 document is here: https://xmpp.org/extensions/xep-0459.html https://xmpp.org/extensions/xep-0459.html An alternative resource is the protocol overview on modernxmpp.org: https://docs.modernxmpp.org/client/protocol/ https://docs.modernxmpp.org/client/protocol/ Why is all this relevant? Because, although I don't claim XMPP to be perfect (what software/protocol is?), I think this has been a pretty successful model that has stood the test of time and continues to deliver sensible community-driven evolution. The Matrix model is extremely similar (they have "MSCs" instead of "XEPs", and they regularly release versioned documents, though not strictly on an annual basis), IRC folk are trying something with IRCv3. Open protocols and ecosystems are hard work, but they are worth it.

izacus 4y ago

Signal is yet another of those products that Knows Better Than You what's good for you. It Knows Better what you're allowed to do with your messages, what kind of client you're allowed to use, what kind of multidevice experience you need and when it should destroy messages you care about. The arrogance of the owner directly transfers to the arrogance and lack of control in the software which is fundamentally limiting its usefulness for everyone.

teekert 4y ago
Signal works for me (and many of my friends/family because it looks/works like Whatsapp). I'm not an expert, one has to trust someone, at some point. I love Matrix but the sign-up process (and even understanding it's federated model) is much more complicated than what Signal offers.
- deleted 4y ago
  [deleted]
growse 4y ago
Or, to re-frame it, the people who own Signal have opinions on what the right way to do things are. You may disagree with those, and for good reasons depending on your context, and that's ok! There's plenty of other messaging options out there which may fit your context better. Life is about compromise. Complaining that someone else's compromise doesn't work for you is not particularly productive.
- ddevault 4y ago
  When it stops being okay is when Signal's know-better-than-you/opinions are motivated by their commercial interests, and in conflict with the interests of the users.
  - tankenmate 4y ago
    Can you provide an example?

checkyoursudo 4y ago

What I don't understand about the phone app version of Signal is, when I say "No I don't want to share my contacts" or "No I don't want notifications", it says Ok, we'll remind you later. And it sure does. I thought that apps were generally supposed to respect a user's decision to tell it to fuck off.

bsaul 4y ago
problem is that those are two really core features of a messenging app, so they probably don't see how you can keep using the app without them and not have a shite experience. edit : in case people wonder "share your contact" is actually the only way an app can tell you if a friend from your contact book can be contacted through the app. It's a pretty important thing especially for the onboarding of new people.
- dybber 4y ago
  Works fine for e.g. Facebook Messenger, Element app etc. You just put in their email adress, username or phone number and you connect. What’s the problem?
  - bsaul 4y ago
    You'll have to do that, hoping that they're on the platform, then the server will respond "sorry, i don't know this guy". Then either you send him a SMS or email, saying "hey, when you're on signal, let me know". or you repeat the process every day until finally the person is on signal. That's a crap experience for an onboarding to the platform.
    - checkyoursudo 4y ago
      Most people will allow contacts and notifications, which will help with onboarding ordinary users. I don't need help. I already want to use it the way I want to use it. Don't need to keep reminding me after every update or more than once or whatever. How about a "No, and don't remind me again" option? But yeah, I get what you are saying about most users.

mananaysiempre 4y ago

CCC’s self-hosted page: https://media.ccc.de/v/mch2022-196-signal-you-were-the-chosen-one- https://media.ccc.de/v/mch2022-196-signal-you-were-the-chose...

medo-bear 4y ago

im curious what people think about briar. it seems to be the next iteration of secure communication protocol. real time physical conversation happens (usually) without a middle man. there is no reason we need a cetralized server to regulate all of our chats

andrewclunn 4y ago

Signal has vastly improved in its user experience in the past few years, it's simple enough that my parents and girlfriend use it, and the enforced policies err on the side of security. This reads like a Linux user who gets frustrated when people use Ubuntu. You like Matrix? Cool, use it, but I for one don't give a damn about your self destructive purity spiral.

hosh 4y ago

I wonder why XMPP is not more popular. It’s like people forgot that it has e2ee, and that the protocol is flexible enough for people to iterate quickly with, or how there’s a well laid out path to get extensions into the standard, and there are already robust, battle-tested, and scalable implementations of both clients and servers in multiple languages. Instead we end up trying to reinvent an ecosystem with Matrix?

tcfhgj 4y ago
To get federation up to speed and make it more attractive for the masses
- hosh 4y ago
  They could have done that by making more streamlined XMPP clients or improving release engineering for servers, or creating new logos to rally around, or solving the spam problem or pushing the idea of “Jabber home servers”, or provide services to aggregate RSS, or even making a completey open-source and open standard “skin” for a Slack experience, or protoyping a Websocket replacement for BOSH, or write Javascript XMPP libraries that let devs hack on the front end. But they did not do any of that. It’s as if the people involved with Matrix don’t really know what is available for XMPP, or have studied its history to see what is in store for their own efforts. I have a friend that was seriously trying to create a service backed by Matrix. He saw it as a way to bring e2ee to more people. Yet recently, when I revisited XMPP and discussed it with him, the more I dig into XMPP, the more I’m scratching my head — why didn’t we just start with XMPP?
  - Arathorn 4y ago
    Speaking as project lead for Matrix: Matrix is not an attempt to reinvent XMPP, plus we had extensive XMPP experience before creating Matrix (running 10M+ user ejabberd deployments; writing XMPP clients based on Smack, XMPP.Framework and Strophe.js; writing our own ejabberd modules for things like push notifications and persistent chat history, etc). Instead, Matrix is an entirely different architecture with different tradeoffs which you may or may not agree with. The main differentiators are: * It's a protocol for replicating conversation history; not for passing messages. * You get eventually consistent conversation history, as well as decentralised key-value store for metadata about the room. * Rooms are entirely decentralised over the participating servers; there are no single points of failure/control in a room. * It automatically heals after network partitions * It's a single monolithic spec * E2EE is on by default. If anything, Matrix is more like NNTP than XMPP. Now, you're welcome to dislike Matrix and build on XMPP (or SMTP or NNTP or SIP or MSRP or IRC or whatever other messaging protocol floats your boat) instead, but it's completely and utterly wrong to claim that Matrix is just a reinvention of XMPP by people who don't understand XMPP, or a marketing gimmick.

meowfly 4y ago

There definitely seems to be a gap between what a certain subset of people want out of Signal and what I do. I like Signal because it is a fairly pure messaging app. Admittedly, introduction of Mobile Coin has marred that though. I want something analogous to SMS but is E2E encrypted. I'm personally not intentionally trying to evade state governments, I'm concerned about Comcast. My favorite Signal feature is automatic deleting messages. I can have ephemeral conversations with people about politics, a health issue, etc and generally trust that it won't be on their phone later. When that feature rolled out, it was controversial. The security types complained that it provided a fake assurance of privacy since there was nothing stopping screenshotting or simply taking a picture of your phone. It reminds me of the federation discussion in that I understand the concern from security pureists, but Signal still seems like the better option than an FB managed app or SMS while still providing something my parents can easily use.

hnarn 4y ago
> I'm personally not intentionally trying to evade state governments, I'm concerned about Comcast. There’s a pretty interesting irony, or a joke, buried somewhere in the fact that those living in authoritarian regimes use Signal to evade the regime, while those of us living in the “free world” use it to not primarily evade state owned institutions but the private for-profit institutions that start doing very similar things to the regime. Here’s an attempt at a joke: Q: what’s the difference between your private communications being intercepted in Iran and the US? A: in the US it increases the value of your stock portfolio
- 863862836 4y ago
  I don't think you can compare Comcast with a government. Governments kill, imprison, and torture people based on the information they collect. The worst Comcast could do it give it to a government, they are not going to do those things to you directly.
  - hnarn 4y ago
    Just because someone draws parallels between A and B doesn’t mean they are claiming exact equivalence.

phs318u 4y ago

I'm surprised no one here has mentioned https://www.gnunet.org/ https://www.gnunet.org/ Currently they're pretty far off something robust and usable by relatively tech savvy folks let alone the masses, but the direction is sound and I'm sure they'd be happy for help.

stkdump 4y ago
Gnunet is >20 years old. Will it be ready before hurd?

m1keil 4y ago

I really wanted to address the speaker's points but what's the point, it's just a rant (kudos to him for being upfront about it). Instead I just went and donated to Signal once again.

chairmanwow1 4y ago
Same, this thread is filled with similar reality-disconnection.

aembleton 4y ago

rysiek claims in this talk that the Signal desktop app requires 4GB of RAM in order to run because it is an electron app. Where does he get that number from? I'm currently running Signal on OSX and it has been open for 7 days. It has 5 processes, that combined are using 440MB. This is a lot, but an order of magnitude smaller than rysiek claims. Thought I'd look at other electron apps I have running. Slack is using ~700MB and VSCode is using ~1.4GB.

baxuz 4y ago

The biggest issue I have with it is the fact that everyone using it behaves like they're the main character in a blockbuster action thriller. Everyone else is out to get them but they are using this brand new 1337 h4xx0r technology called E2EE®™© which keeps the Bad Guys™ away. Meanwhile, I'd just like to have a messaging service that I can use on multiple devices and which isn't tied to my phone (number), and which doesn't have a trash client.

Aachen 4y ago
I don't really see this behavior you're describing, but related seems to be the tendency to share full name on WhatsApp and Telegram but only have a single letter on Signal because now they suddenly feel the need for privacy/secrecy/mystery. Then start a PM chat and expect I have any idea whom I'm talking to. Sure enough, once they send me an actual name I know them, but...

jillesvangurp 4y ago

In the past 30 years I've used email, and close to three dozen different messaging solutions that each came and went. Patterns why none of these chat solutions really stick long: - Lack of standardization and ecosystem. There are multiple standards of course. But unlike email, none of the standard based products ever managed to become entrenched enough such that the rest of the market could not afford to ignore the standard. Jabber for example never really ended up mattering because at no point did it get over ever a percent of user adoption. Email had the advantage that you could email the whole world or only people inside a single company with corporate mailing systems. By the time MS figured out that they wanted in, they tried really hard to change that but never really were able to make people use their protocols rather than SMTP for delivering emails. For better or worse, that's how mail gets delivered. - Walled gardens where companies jealously aim to keep all competitors outside. Microsoft, Facebook, Google, Yahoo, AOL, etc. each had a go at this space with long forgotten products. And some of the products that disrupted those are also long gone. - Reinvention of the same wheels over and over again. It's disgusting how close e.g. ICQ was in functionality to things like Signal and Whatsapp. That was in the late nineties! This space is running around in circles. Arguably it had some useful features that some contemporary products still lack. - Federation is consistently rejected as a feature by new players and a contributing factor for their inevitable demise; even if initially successful. What matters more to people is who they can chat with than what the feature set is when they are chatting. Whatsapp cleverly capitalized on that end ended up disrupting lot of entrenched things simply by offering wider access to essentially everyone with a phone, which at this point is most of the planet. Of course, whatsapp's popularity has suffered a lot in recent years courtesy of Facebook doing what every other big company has done in this space historic: get overly possessive and throw out the baby with the bathwater. Signal is backed by the Whatsapp founder. And ironically repeats most of its mistakes. - Users inevitably try out a new app and as they move, some apps go in and out of favor. And since they don't federate, users go where the other users are. Wake me up when Telegram, Whatsapp, Signal, whatever the hell Google is calling their chat app this month, iMessage, etc. can talk to each other. I have close to a dozen chat and messaging apps on my phone and they all get used. It's beyond ridiculous. All proprietary walled gardens with enough people in them that I somehow need to be there as well. That's why email is still a thing. Because when you have to reach somebody, you send them an email. Instead of playing roulette with your selection of chat apps to see which one of those might get a response. Pun intended of course, chat roulette was a thing at some point.

dhlaoq 4y ago

Why do you need centralization for "network effects"? Send a cc mail to all people you want to communicate with, exchange keys in person and use PGP. Worried about traffic analysis? Well, in that case don't trust Signal and send encrypted messages regularly (including fake messages) to some Usenet group, using mixmaster or Tor.

anjbe 4y ago
I was a PGP enthusiast for some time, and advocated it to technical friends. In the end, though, I only ever received a single PGP‐encrypted mail from a single person. These days, I have over a dozen reliable Signal contacts, nearly all with safety numbers verified in person, and have sent to or received from them hundreds (perhaps thousands) of encrypted texts and voice messages, and dozens of encrypted audio calls. The majority of my immediate social circle doesn’t use Signal (and some have tried and rejected it), but a sizeable chunk does use it, including non‐family. When it comes to volume and quality of E2EE communication in my daily life, I cannot call PGP anything but a failure, and I cannot call Signal anything but a success.

mayop100 4y ago

The author notes: "Finally, we need to talk federation. Does it make moving fast and breaking things more difficult? Yes, yes it does, and that can be a good thing." The other, super-underrated feature of federated systems is that antagonistic parties are willing to use them together. For example, the US military, Russian government, major international banks, Google, Facebook, etc ALL use email and happily exchange messages over SMTP. There's no centralized service you could get all these parties to agree to use (not even Signal). The result of this is that everyone has an email address, and that makes it the universal standard for business-to-business communication. I can loop in any number of parties on a single thread from all over the world and it just works. My startup Shortwave is trying to build a messaging future that is email. We're trying to evolve and upgrade email to have the look and feel and features of a product like Signal, but with all the universal, federated goodness of the global SMTP network. It's a long project -- federated systems evolve slowly! -- but it's the bright open future I think we need. I go into some detail here: https://www.shortwave.com/blog/future-of-messaging/ https://www.shortwave.com/blog/future-of-messaging/

greatjack613 4y ago
Are open shameless plugs like this allowed on hacker news without disclosure?
- junon 4y ago
  Yes. It's just typically not well received.
  - Aeolun 4y ago
    It’s fine if it’s on-topic I think? In this case it’s on topic.
- baisq 4y ago
  Isn't "My startup Shortwave" enough disclosure?
- matthiaswh 4y ago

diimdeep 4y ago

I use Telegram because it is a superior product. Then I don't see the point in encrypted chats with many users, no use case for me. For work, I would use self-hosted solution like Mattermost. Then, if it is true that Signal behave like they know better VC company and block 3rd party clients, etc. Signal is centralized, but I want decentralization, not just from technological point of view. With today predatory imperialistic sanctions issued by US against whole countries, I do not want to place all my eggs in same bucket, controlled by US government and I still remember Snowden revelations.

Aachen 4y ago
It sounds like you are still under the impression that Telegram is, or ever was, Russian. It's run on infrastructure from the USA and its allies just like Signal, Wire, etc. What you're looking for might be WeChat (this is definitely the first and hopefully will be the last time I recommend that) On a less sarcastic note, Threema makes a point of running in Switzerland. Not that they're friendly with military powers other than NATO, but (per your desire) it's slightly better than running on US/UK infrastructure directly.

BlackLotus89 4y ago

He starts with saying that this is is the Q and A session that we didn't get and then rants for 25 minutes. 7 people tried to talk and were rushed/talked off topic * you can't download the APk * yes you can * telegram lets you download the apk and it's on fdroid * yeah would be nice if signal was on fdroid -- * there is wire... you should know there is wire * moxy complained about the update problem... and he was right * tor does this better -- * I don't want to use my phone number (rants over why he needs it) * signal is working on it -- * E-Mail comparison isn't fair. it's survivor bias, many others failed * signal has good cryptography and has a good usability -- * there are other third party clients that just work and it's ok * it's not that frowned upon, but they are hard to maintain because signal is a moving target -- * clearos has signal fork called ClearSIGNAL I wonder if this will be shut down winkwink -- * signal has too much of a silicon valley vipe for me --- This wasn't the Q and A we were missing. This talk wasn't what was promised and most talking points he had were easy enough to counter. But yeah signal clients that aren't signal would be nice. Kind of Edit sorry for the horrible formatting

whitenickel08 4y ago

I found plenty of my contacts moved to Signal in the last two years. I can even order in some restaurant nearby with Signal, but not having to reveal my phone number is one of the things I like from Threema.

GekkePrutser 4y ago

I've always hated Moxie's stance on federation and alternative clients. As a result I've never promoted Signal among my friends as an alternative for WhatsApp. I strongly believe in federation and open client ecosystems. Matrix is ideal for me but people don't seem to like it. I'm kinda hoping that signal will change now that Moxie is gone.

Aachen 4y ago
I mean, I see it the same way, but it's still better than running on centralized Facebook or Telegram infrastructure. What do you recommend to your family instead, or are they all still on WhatsApp / plain text SMS for this reason? For me, comparing Wire, Signal, Threema as the most mature and stable e2ee messengers that have any kind of network effect (so people will grow the network beyond just talking to this weirdo called Aachen), Signal has by far the largest network effect and by a very small margin the best user experience. My family is on Signal now and I was regretting not going for Wire (which has more features and fewer connectivity problems) until I needed to use Wire on Android again a few weeks ago and the Android user experience turns out to have degraded severely. The only realistic alternative I'd see to Signal, Wire or Threema (all centralized, though Wire has some enterprise on-prem thing I'm not familiar with) is self hosting something that just uses TLS to the server, but then you're always going to be on call and they won't use it with anyone else, also because you can always read all their messages. A friend has a matrix server (UX on Element is awful and buggy as heck) and every few weeks there's some problem and we temporarily fall back to Wire, and when that doesn't work, back to Signal, and when that doesn't work, calling.
- GekkePrutser 4y ago
  My family are all on WhatsApp yes. I don't have the energy to push them to move over especially because they also have their circles that use WhatsApp. So I decided to just set up Matrix Bridges and get all that shit (WhatsApp, Telegram, Signal, Discord) off my phone, I use them all through Element now. But I'm not going to do free promotion for what is yet another walled garden. PS: Element works pretty well for me, and it gives me the added benefit of having all my chats stored in one place. Also gives me the ability to read chats that have been deleted by the user, make copies of what people put in their WhatsApp 'status updates' etc.

deleted 4y ago

[deleted]

JustSomeNobody 4y ago

Can't read the article as it is being HN'd to death. But... I really like signal. I send a message and the other person receives it. They send me one and I get it. Rarely is it down for me and I use this app as my primary means of communication with a number of people. Is it perfect? No, but it is mostly there. My personal wants: Don't use phone numbers - though I totally get why they chose to and I'm okay with that. But move on. At the very least let me use one account on multiple phones - there are far too many of us that have two or more phones. Some sort of mesh operation. If I'm on the same network as someone, my messages should go straight to them. But, you know, as long as Signal doesn't degrade I can live with the features it currently has and be perfectly fine and I'll continue to donate.

mellosouls 4y ago

(Video)

Yaina 4y ago

I primary use Telegram and sometimes Signal when I need to. Telegram >is< very – very, very – shady but it's hard to argue with the extreme polish and attention to detail with which all of it's apps are made. Signal does not even come close in terms of user experience (neither does Matrix) and Signal also does not seem to strive to catch up. Their position seems to be that security as a feature has to be enough. I'd love to have an alternative to Telegram, but Signal ain't it.

kaba0 4y ago
Why is telegram shady in your opinion?

api 4y ago

I'm glad to see someone push back a bit on Moxie's reasoning in that essay. For those who have not seen it: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ I've thought he's wrong for a while. The problem is not that you can't innovate within the context of a (well designed) federated system. If that were true the Internet would still be using telnet, rlogin, finger, Gopher, and vanilla ftp. The problem with decentralized and federated systems, as I've repeated ad nauseum, is lack of an economic model. It's the same as the problem with any kind of consumer-oriented open source. IMHO every other explanation is mental contortions to avoid looking at the economic factor. The innovation isn't happening because producing high quality software with support for multiple platforms, diverse network environments, etc. is fabulously expensive yet we pretend it's something hobbyists (who don't have trust funds) can do in their spare time. Centralized systems can have their choice of viable economic models: commercial software rental (SaaS), non-profit fund raising, free core with paid upgrades, advertising, and of course less savory ones like surveillance and pay-to-play addictionware. You can try to raise money for clients/nodes to run in decentralized and federated systems, but since there's always more than one and very few people pay for anything unless compelled there's always going to be too little funding to make any of them great. For a little while I was optimistic that cryptocurrency and tokenization might provide a mechanism, but then scammers and gamblers destroyed that ecosystem.

Winnie080 4y ago

I was used to be a digital marketer of Alexa, but now the website was closed. I find another alternative one: Blexb.

Winnie080 4y ago
[dead]