4 ms·

If Signal was not centralized, it could not be forced to comply with anything, and also could not be withdrawn from any country. Centralization remains incompa

by lrvick 4y ago

If Signal was not centralized, it could not be forced to comply with anything, and also could not be withdrawn from any country. Centralization remains incompatible with privacy and censorship resistance.

idlewords 4y ago
That's ridiculous. If Signal weren't centralized, it would long ago have split into four thousand mutually incompatible OpenSignal apps, all of which would be just as easy to ban in the UK app store.
- sschueller 4y ago
  Like IRC /s Only because something is decentralized doesn't mean it will scatter into an incompatible mess.
- t09i209ba893 4y ago
  Matrix hasn't split into thousands of mutually incompatible apps. I speculate that having a complete, "flagship" client helps prevent this.
  - tptacek 4y ago
    The story of the Matrix project is about the closest thing you could find to a total vindication of Moxie's original take about federation. Federation delayed the convergence of Matrix to E2E-by-default by (as I recall?†) years, and will drastically complicate their response to the Nebuchadnezzar results, which were themselves in part a complication of decentralization and loose coupling. You can coherently argue that decentralization is an important, or even necessary, goal for private communications. I won't agree, but I can productively hear that argument out. But I don't think you can cite Matrix as the counter to Moxie's point; with respect to Matrix, the more appropriate assessment of Moxie's federation argument might be "prophetic". I will never sound like it, but I'm in Matrix's corner. I see clearly where they fit into the ecosystem. The world where Matrix replaces Discourse, Slack, IRC, and Telegram is a better world. I do not see Matrix replacing Signal, or whatever post-Signal project is carrying forward their ideals 20 years from now. † A Matrix project person will be sure to correct me on this, and I call it out in part to be candid that I'm not certain about the specific duration.
    - simfree 4y ago
      Signal without SMS support is a poorer performing version of Element to me. There is little practical difference between Signal and most other popular messaging apps that implements end to end encryption. Compare Element and Signal Desktop startup times, Element is nearly instantaneous, while Signal takes significant time to even open. Both are using the same software stack on desktop, Electron with SQLite.
      - 3np 4y ago
        When you get up to the thousands of rooms and tens of millions of messages (bridging and integrations will do that to you), Element Desktop Linux performance degrades severely and will regularly lose connection requiring restarts. And good luck getting out of that scenario or splitting up/archiving the account or groups of the rooms in a digestible format... We've had Matrix in an org I'm in for a few years now and this has become a meme now.
        Arathorn 4y ago
        Fixing this has been the primary focus of the core Matrix team over the last year - we revealed the end result at FOSDEM a few weeks ago, and it literally improves performance to be better than Telegram/Discord/Slack or anything else we've benchmarked against: https://youtu.be/eUPJ9zFV5IE?t=566 https://youtu.be/eUPJ9zFV5IE?t=566 If you're feeling adventurous, try develop.element.io and enable Sliding Sync in Labs, and you should get instant login, sync, and orders of magnitude better performance (but it is definitely beta). You may need to run your own SS proxy, for which we published a guide yesterday: https://youtu.be/25wkV2ZCSsM https://youtu.be/25wkV2ZCSsM
        3np 4y ago
        Thanks for the follow-up. Unfortunately, those are all orthogonal: you are referring to server and client-server-sync performance. I'm referring to opening and navigating the client UI, and these issues are as present when offline and no homeserver communication and syncing is involved. The developments you mention are all important, great, and exciting but from what I've seen so far the UI performance issues are unaddressed. We had users try to report these issues on GH historically but they tended to get dismissed as "can't reproduce on my mac" or left unattended.
  - lampshades 4y ago
    Maybe that’s because Matrix sucks for a usability perspective and nobody cares to split it.
jayzalowitz 4y ago
Its open source except for anti spam for obvious reasons, go make your own spam filled signal...
mgbmtl 4y ago
Sure, but the main problem here is Apple/Google stores. Remove it there, and 99% of their users disappear. Governments don't care much about Tor, for example, because they have very little leverage (and their law enforcement use it, but members of parliament also use Signal but can't admit it openly).
- jakear 4y ago
  Have we forgotten about the internet? It wouldn't be difficult to make Signal as a PWA, and with iOS 16.4 coming all the relevant API's should be present. As for TOR, I'd wager governments love it. Everyone the world over has decided to congregate one one official "secret stuff" platform and get this: it's made by the US Government. And by all accounts the US government is well able to spy on it - but won't say how instead preferring to bring up cases by parallel construction^. It's perfect. I don't know what more a government could want. ^ https://www.technologyreview.com/2020/02/08/349016/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught https://www.technologyreview.com/2020/02/08/349016/a-dark-we...
- stiltzkin 4y ago
  Less than 99%, many users are aware how to download an APK without Google Store.
- lrvick 4y ago
  It is fundamentally not possible to have strong privacy or censorship resistance on proprietary operating systems like iOS and Android if a state is targeting you. Even the so-called open source Android ROMs have no choice but to include hundreds of privileged binary blobs to make the proprietary hardware work. All a state actor need do is leverage their no doubt existing backdoors into said binaries and all plaintext is revealed on those devices. They could also issue a secret order to mobile app stores to issue slightly tweaked Signal binaries. In either case Signal would never know that users are compromised. For my own company which does security research, privacy is critical. We bring in only people who have been trained to only access the channel from dedicated QubesOS VMs, with no mobile access permitted. This is not perfect but it is as reasonable best effort until we can run Matrix home servers in a TEE (working on foundations for this atm). Signal by contrast demands a phone number and assumes mobile handsets can be fully trusted so it already has ruled itself out for high risk use cases. Matrix on the other hand I can run a private server of, and enforce whatever rules are appropriate for my threat model.

by lrvick 4y ago

idlewords 4y ago

That's ridiculous. If Signal weren't centralized, it would long ago have split into four thousand mutually incompatible OpenSignal apps, all of which would be just as easy to ban in the UK app store.

sschueller 4y ago
Like IRC /s Only because something is decentralized doesn't mean it will scatter into an incompatible mess.
t09i209ba893 4y ago
Matrix hasn't split into thousands of mutually incompatible apps. I speculate that having a complete, "flagship" client helps prevent this.
- tptacek 4y ago
  The story of the Matrix project is about the closest thing you could find to a total vindication of Moxie's original take about federation. Federation delayed the convergence of Matrix to E2E-by-default by (as I recall?†) years, and will drastically complicate their response to the Nebuchadnezzar results, which were themselves in part a complication of decentralization and loose coupling. You can coherently argue that decentralization is an important, or even necessary, goal for private communications. I won't agree, but I can productively hear that argument out. But I don't think you can cite Matrix as the counter to Moxie's point; with respect to Matrix, the more appropriate assessment of Moxie's federation argument might be "prophetic". I will never sound like it, but I'm in Matrix's corner. I see clearly where they fit into the ecosystem. The world where Matrix replaces Discourse, Slack, IRC, and Telegram is a better world. I do not see Matrix replacing Signal, or whatever post-Signal project is carrying forward their ideals 20 years from now. † A Matrix project person will be sure to correct me on this, and I call it out in part to be candid that I'm not certain about the specific duration.
  - simfree 4y ago
    Signal without SMS support is a poorer performing version of Element to me. There is little practical difference between Signal and most other popular messaging apps that implements end to end encryption. Compare Element and Signal Desktop startup times, Element is nearly instantaneous, while Signal takes significant time to even open. Both are using the same software stack on desktop, Electron with SQLite.
    - 3np 4y ago
      When you get up to the thousands of rooms and tens of millions of messages (bridging and integrations will do that to you), Element Desktop Linux performance degrades severely and will regularly lose connection requiring restarts. And good luck getting out of that scenario or splitting up/archiving the account or groups of the rooms in a digestible format... We've had Matrix in an org I'm in for a few years now and this has become a meme now.
      - Arathorn 4y ago
        Fixing this has been the primary focus of the core Matrix team over the last year - we revealed the end result at FOSDEM a few weeks ago, and it literally improves performance to be better than Telegram/Discord/Slack or anything else we've benchmarked against: https://youtu.be/eUPJ9zFV5IE?t=566 https://youtu.be/eUPJ9zFV5IE?t=566 If you're feeling adventurous, try develop.element.io and enable Sliding Sync in Labs, and you should get instant login, sync, and orders of magnitude better performance (but it is definitely beta). You may need to run your own SS proxy, for which we published a guide yesterday: https://youtu.be/25wkV2ZCSsM https://youtu.be/25wkV2ZCSsM
        3np 4y ago
        Thanks for the follow-up. Unfortunately, those are all orthogonal: you are referring to server and client-server-sync performance. I'm referring to opening and navigating the client UI, and these issues are as present when offline and no homeserver communication and syncing is involved. The developments you mention are all important, great, and exciting but from what I've seen so far the UI performance issues are unaddressed. We had users try to report these issues on GH historically but they tended to get dismissed as "can't reproduce on my mac" or left unattended.
- lampshades 4y ago
  Maybe that’s because Matrix sucks for a usability perspective and nobody cares to split it.

jayzalowitz 4y ago

Its open source except for anti spam for obvious reasons, go make your own spam filled signal...

mgbmtl 4y ago

Sure, but the main problem here is Apple/Google stores. Remove it there, and 99% of their users disappear. Governments don't care much about Tor, for example, because they have very little leverage (and their law enforcement use it, but members of parliament also use Signal but can't admit it openly).

jakear 4y ago
Have we forgotten about the internet? It wouldn't be difficult to make Signal as a PWA, and with iOS 16.4 coming all the relevant API's should be present. As for TOR, I'd wager governments love it. Everyone the world over has decided to congregate one one official "secret stuff" platform and get this: it's made by the US Government. And by all accounts the US government is well able to spy on it - but won't say how instead preferring to bring up cases by parallel construction^. It's perfect. I don't know what more a government could want. ^ https://www.technologyreview.com/2020/02/08/349016/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught https://www.technologyreview.com/2020/02/08/349016/a-dark-we...
stiltzkin 4y ago
Less than 99%, many users are aware how to download an APK without Google Store.
lrvick 4y ago
It is fundamentally not possible to have strong privacy or censorship resistance on proprietary operating systems like iOS and Android if a state is targeting you. Even the so-called open source Android ROMs have no choice but to include hundreds of privileged binary blobs to make the proprietary hardware work. All a state actor need do is leverage their no doubt existing backdoors into said binaries and all plaintext is revealed on those devices. They could also issue a secret order to mobile app stores to issue slightly tweaked Signal binaries. In either case Signal would never know that users are compromised. For my own company which does security research, privacy is critical. We bring in only people who have been trained to only access the channel from dedicated QubesOS VMs, with no mobile access permitted. This is not perfect but it is as reasonable best effort until we can run Matrix home servers in a TEE (working on foundations for this atm). Signal by contrast demands a phone number and assumes mobile handsets can be fully trusted so it already has ruled itself out for high risk use cases. Matrix on the other hand I can run a private server of, and enforce whatever rules are appropriate for my threat model.