6 ms·

Is Signal considered to be (or attempting to be) an open ecosystem? My understanding is that Signal (the app) is private, not anonymous, centralized, and close

by smt88 3y ago

Is Signal considered to be (or attempting to be) an open ecosystem? My understanding is that Signal (the app) is private, not anonymous, centralized, and closed. The underlying protocol is open and could be used for an open ecosystem, but I didn't think Signal aspired to do that.

lima 3y ago
The apps and most of the backend are open source too, not just the protocol. The important distinction is that it's not decentralized like XMPP or email, which is a conscious decision: it would become very difficult to change it to add new features and they'd be left behind by closed-source competitors (see: XMPP).
- ezst 3y ago
  I see that it is a ton of wishful thinking and FUD on the side of Signal to claim that: XMPP is alive and kicking, has all the features one needs, runs everywhere, at scale, offers the same or better crypto, better privacy, better resilience and is more sustainable. When Signal will inevitably fail/turn against its users/enshittify itself or get acquired, all federated and P2P protocols will keep on going. For decades. That's the kind of communications systems we should be demanding in the present era, nothing less.
  - kiwijamo 3y ago
    Yet I'd wager most HN readers have a grand total of zero XMPP contacts. Myself included. Proving the GPs point.
    - AJ007 3y ago
      Because of what Google did with Google Talk. https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html https://ploum.net/2023-06-23-how-to-kill-decentralised-netwo... XMPP is underrated. A lot of people are imagining Pidgen in 2011, but the protocol has been extended, the actively developed clients are good, and it avoids the heavier parts of Matrix (both client and server side.) I wouldn't be surprised if Slack's replacement when Salesforce inevitably fucks it up will be XMPP based rather than Matrix.
      - smt88 3y ago
        Slack's replacement is going to be Teams. No corporation chooses internal chat clients based on interoperability or openness of source code.
      - hot_gril 3y ago
        "The protocol has been extended" has been XMPP's theme for decades, and also its problem. Name your favorite client, it probably won't have several extensions, and a lot of useful things require support on both ends plus the server. Lots of things that should be ubiquitous are not, including s2s auth. There needed to be more structure, like AIM back then or Signal now. Also the XML stuff is a nightmare. Even if Google Talk kept XMPP, they weren't going to save it, cause nobody used Google Talk. Facebook was by far the biggest XMPP-supported platform (though it wasn't federated), and they stopped probably cause they didn't see enough clients. Even Slack supported XMPP for a while, did you use that?
        freeAgent 3y ago
        My entire friend/acquaintance group used Google Talk in the late-‘00s.
    - zaik 3y ago
      I kicked out all the walled-garden apps like Signal and went standard XMPP only. I have a lot of XMPP contacts now. You just need to commit to it.
      - cortesoft 3y ago
        And have friends who are all willing to commit to it, too
        zaik 3y ago
        Not really, my friends are still using proprietary apps besides their XMPP client.
      - WhyNotHugo 3y ago
        Did you set up bridges for contacts on legacy networks?
        zaik 3y ago
        Only Biboumi for IRC.
  - hot_gril 3y ago
    Is it really a wish if it's already come true? I can't name a single person who uses XMPP. If a federated chat protocol ever wins, it'll probably be something more modern like Matrix. At least there's email too.
kaanyalova 3y ago
Both the app and the server is open source https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server There are forks like Session which doesn't require a phone number to sign up https://github.com/oxen-io/session-android https://github.com/oxen-io/session-android
- smt88 3y ago
  I understand this, but Signal doesn't attempt to tolerate third-party apps on their servers as far as I know. They don't support interoperability.
  - godelski 3y ago
    You can run Signal app forks on the Signal server. Molly is a popular one. You just can't create new servers. I wish you could, but I get the reasoning of not wanting honeypots. But that doesn't stop you from running your own network of Signal servers. So I don't see anything stopping anyone. I mean Mullvad runs their own stuff and I don't see half the complaints about them. I've always been curious why Signal is so unique here. If 1/100th the people that made these concerns developed a open community of signal servers, I'm sure we'd have a viable alternative network. What's stopping everyone?
    - AJ007 3y ago
      One of the big lessons from Twitter and Reddit was third party apps are tolerated or even encouraged until they are not. Unlike, for example Discord, I haven't see any indication that third party clients are causing account bans, yet. The status of open source, privacy respecting messaging apps looks really healthy to me, compared to where we've been over the past 30+ years (thinking starting with ICQ.) Signal was a big leap toward getting average people using much more secure messaging, although it is pretty clear even most 'tech' people don't grasp what is going on or why it is important to be able to use e2ee separate from a combined client+server provider.
Vinnl 3y ago
They've described what they're attempting to be here: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
- greyface- 3y ago
  The author is no longer CEO, though, and there are a lot of "I" statements in the post. Is it still accurate? Has the current CEO made any comment on it?
  - sdenton4 3y ago
    It's a great encapsulation of why Signal is not federated, and, unless you find the current CEO stating otherwise, is unlikely to change. Changes like the one detailed in the link simply wouldn't be possible to roll out efficiently in a federated ecosystem. Signal has consistently focused on helping /most/ users do what they want with the app without sacrificing security. This change - away from requiring phone numbers - helps plug one of the biggest criticisms, both on the security and product side. Nothing about their mission requires federation, so I respect that they haven't sacrificed their mission in order to do it.
- fsflover 3y ago
  Matrix debunked these arguments: https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom/ https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom...
  - bjoli 3y ago
    I tested matrix in 2021 and found the experience pretty darn awful outside the main client. And by a cursory glance the ecosystem is still pretty much controlled by the matrix.org folks. When I was using it there was a lot of accusations that Synapse did not follow the specification and that server implementera had to reverse engineer what Synapse did to be able to federate. And talking about that: does federation work properly yet? I used a third party provider and it made my life miserable. I am all for federation, but in my experience the "federated" part of matrix was a lot worse than the jabber one they want to replace.
WhyNotHugo 3y ago
It's not [attempting to be an open ecosystem]. Their ToS used to forbid using third party clients. I don't think this has changed. They haven't banned anyone for using third party clients (to the best of my knowledge), but they're openly against an open ecosystem. It's private, centralised and the network is closed (e.g.: non-federated), but the source code is public and open source. I think that for the server implementation they do code dumps every once in a while, rather than continuously keep it public.
faiD9Eet 3y ago
> My understanding is that Signal (the app) is private, not anonymous, centralized, and closed. You are right about that. There used to be an open source build called LibreSignal Moxie Marlinspike made clear [1]: You may inspect the code. You are even allowed to compile it. You are not allowed to connect your self compiled client to our message servers. We are not interested in a federated protocol. Make sure your fork creates its own bubble that does not overlap with Open Wisper Systems. Stop using the name Signal. [1] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

by smt88 3y ago

lima 3y ago

The apps and most of the backend are open source too, not just the protocol. The important distinction is that it's not decentralized like XMPP or email, which is a conscious decision: it would become very difficult to change it to add new features and they'd be left behind by closed-source competitors (see: XMPP).

ezst 3y ago
I see that it is a ton of wishful thinking and FUD on the side of Signal to claim that: XMPP is alive and kicking, has all the features one needs, runs everywhere, at scale, offers the same or better crypto, better privacy, better resilience and is more sustainable. When Signal will inevitably fail/turn against its users/enshittify itself or get acquired, all federated and P2P protocols will keep on going. For decades. That's the kind of communications systems we should be demanding in the present era, nothing less.
- kiwijamo 3y ago
  Yet I'd wager most HN readers have a grand total of zero XMPP contacts. Myself included. Proving the GPs point.
  - AJ007 3y ago
    Because of what Google did with Google Talk. https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html https://ploum.net/2023-06-23-how-to-kill-decentralised-netwo... XMPP is underrated. A lot of people are imagining Pidgen in 2011, but the protocol has been extended, the actively developed clients are good, and it avoids the heavier parts of Matrix (both client and server side.) I wouldn't be surprised if Slack's replacement when Salesforce inevitably fucks it up will be XMPP based rather than Matrix.
    - smt88 3y ago
      Slack's replacement is going to be Teams. No corporation chooses internal chat clients based on interoperability or openness of source code.
    - hot_gril 3y ago
      "The protocol has been extended" has been XMPP's theme for decades, and also its problem. Name your favorite client, it probably won't have several extensions, and a lot of useful things require support on both ends plus the server. Lots of things that should be ubiquitous are not, including s2s auth. There needed to be more structure, like AIM back then or Signal now. Also the XML stuff is a nightmare. Even if Google Talk kept XMPP, they weren't going to save it, cause nobody used Google Talk. Facebook was by far the biggest XMPP-supported platform (though it wasn't federated), and they stopped probably cause they didn't see enough clients. Even Slack supported XMPP for a while, did you use that?
      - freeAgent 3y ago
        My entire friend/acquaintance group used Google Talk in the late-‘00s.
  - zaik 3y ago
    I kicked out all the walled-garden apps like Signal and went standard XMPP only. I have a lot of XMPP contacts now. You just need to commit to it.
    - cortesoft 3y ago
      And have friends who are all willing to commit to it, too
      - zaik 3y ago
        Not really, my friends are still using proprietary apps besides their XMPP client.
    - WhyNotHugo 3y ago
      Did you set up bridges for contacts on legacy networks?
      - zaik 3y ago
        Only Biboumi for IRC.
- hot_gril 3y ago
  Is it really a wish if it's already come true? I can't name a single person who uses XMPP. If a federated chat protocol ever wins, it'll probably be something more modern like Matrix. At least there's email too.

kaanyalova 3y ago

Both the app and the server is open source https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server There are forks like Session which doesn't require a phone number to sign up https://github.com/oxen-io/session-android https://github.com/oxen-io/session-android

smt88 3y ago
I understand this, but Signal doesn't attempt to tolerate third-party apps on their servers as far as I know. They don't support interoperability.
- godelski 3y ago
  You can run Signal app forks on the Signal server. Molly is a popular one. You just can't create new servers. I wish you could, but I get the reasoning of not wanting honeypots. But that doesn't stop you from running your own network of Signal servers. So I don't see anything stopping anyone. I mean Mullvad runs their own stuff and I don't see half the complaints about them. I've always been curious why Signal is so unique here. If 1/100th the people that made these concerns developed a open community of signal servers, I'm sure we'd have a viable alternative network. What's stopping everyone?
  - AJ007 3y ago
    One of the big lessons from Twitter and Reddit was third party apps are tolerated or even encouraged until they are not. Unlike, for example Discord, I haven't see any indication that third party clients are causing account bans, yet. The status of open source, privacy respecting messaging apps looks really healthy to me, compared to where we've been over the past 30+ years (thinking starting with ICQ.) Signal was a big leap toward getting average people using much more secure messaging, although it is pretty clear even most 'tech' people don't grasp what is going on or why it is important to be able to use e2ee separate from a combined client+server provider.

Vinnl 3y ago

They've described what they're attempting to be here: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

greyface- 3y ago
The author is no longer CEO, though, and there are a lot of "I" statements in the post. Is it still accurate? Has the current CEO made any comment on it?
- sdenton4 3y ago
  It's a great encapsulation of why Signal is not federated, and, unless you find the current CEO stating otherwise, is unlikely to change. Changes like the one detailed in the link simply wouldn't be possible to roll out efficiently in a federated ecosystem. Signal has consistently focused on helping /most/ users do what they want with the app without sacrificing security. This change - away from requiring phone numbers - helps plug one of the biggest criticisms, both on the security and product side. Nothing about their mission requires federation, so I respect that they haven't sacrificed their mission in order to do it.
fsflover 3y ago
Matrix debunked these arguments: https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom/ https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom...
- bjoli 3y ago
  I tested matrix in 2021 and found the experience pretty darn awful outside the main client. And by a cursory glance the ecosystem is still pretty much controlled by the matrix.org folks. When I was using it there was a lot of accusations that Synapse did not follow the specification and that server implementera had to reverse engineer what Synapse did to be able to federate. And talking about that: does federation work properly yet? I used a third party provider and it made my life miserable. I am all for federation, but in my experience the "federated" part of matrix was a lot worse than the jabber one they want to replace.

WhyNotHugo 3y ago

It's not [attempting to be an open ecosystem]. Their ToS used to forbid using third party clients. I don't think this has changed. They haven't banned anyone for using third party clients (to the best of my knowledge), but they're openly against an open ecosystem. It's private, centralised and the network is closed (e.g.: non-federated), but the source code is public and open source. I think that for the server implementation they do code dumps every once in a while, rather than continuously keep it public.

faiD9Eet 3y ago

> My understanding is that Signal (the app) is private, not anonymous, centralized, and closed. You are right about that. There used to be an open source build called LibreSignal Moxie Marlinspike made clear [1]: You may inspect the code. You are even allowed to compile it. You are not allowed to connect your self compiled client to our message servers. We are not interested in a federated protocol. Make sure your fork creates its own bubble that does not overlap with Open Wisper Systems. Stop using the name Signal. [1] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...