6 ms·

Centralised service is weaker against surveillance than decentralised solutions. Signal should adopt selfhosting and federation.

slt2021 2y ago
jabber/xmpp is open standard and supports e2e encryption and can be self-hosted, has mobile clients
- rocqua 2y ago
  How does it support e2e?
  - rakel_rakel 2y ago
    By clients having support and/or plugins for things like OMEMO and OTR.
- Hoodedcrow 2y ago
  I use XMPP with OMEMO for my main encrypted messaging, and I don't get why Matrix got popular instead of XMPP (aside from a big marketing budget). Even a lighter server implementation takes up several times more resources than an XMPP server, plus the concerns about the enormous central instance. XMPP FTW.
  - zx8080 2y ago
    Last time I checked (2018) the support for media&file sharing was in a quite bad shape in all available Android clients. Even without e2e encryption enabled. Is it good now?
    - Hoodedcrow 2y ago
      For Android - Conversations is in a very good shape now.
- lifty 2y ago
  Matrix supports e2e encryption, so it would be a good candidate for self hosting. I already do.
  - nsvd 2y ago
    My only complaint with self-hosting matrix is that the canonical python implementation is quite resource-heavy. I was unable to run it on a cheap VPS. I hope that the ecosystem will improve in the future.
    - ptman 2y ago
      When did you test it? It has improved very much in the past five years.
    - lifty 2y ago
      I agree. I really prefer Dendrite, their Go server, but development has slowed down lately. Also, because of the financial issues they have been having, I don't have a lot of hope that Dendrite will get a lot of attention. Maybe Conduit(https://conduit.rs https://conduit.rs) will become more viable instead of Dendrite. We really need a small efficient build with no moving parts, for the self hosters community.
  - Aerbil313 2y ago
    Matrix has shady foundations, being born out of a Israeli company with alleged ties to Israeli intelligence. See https://hackea.org/notas/matrix.html https://hackea.org/notas/matrix.html
    - Arathorn 2y ago
      sigh. If you want to play project pedigree games; Matrix was actually the result of two existing teams - one in the UK and one in France, which happened to get acquired by Amdocs and then subsequently spun out once we'd created Matrix. That page in particular is a pile of FUD; it keeps banging on about "impressive collection of private data being sent to Matrix central servers, even when you use your own instance" which is simply categorically untrue; it looks like they misread the privacy policy of the Matrix.org server at https://github.com/element-hq/policies/blob/master/docs/matrix-org/privacy_notice.md https://github.com/element-hq/policies/blob/master/docs/matr... and somehow assumed it applied to everyone's server instances. It doesn't, any more than https://www.w3.org/policies/privacy https://www.w3.org/policies/privacy applies to a given random webserver on the internet :|
- jamesponddotco 2y ago
  Another vote for XMPP with OMEMO here. I use it my wife, family, and a few friends and haven't heard any complaints yet[1] (aside from the lack of stickers, which are apparently important). [1]: But like I said in another thread, who knows if they would directly complain to me.
growse 2y ago
Making this argument whilst ignoring the trade-offs of federation (that Signal has historically addressed) is somewhat disingenuous and a little fundamentalist.
- wuiheerfoj 2y ago
  do you have any breakdown on the trade-offs? Most HN commentary focuses on FUD around the signal founder rather than technical reasons why it shouldn’t be federated and would love to understand them better
  - jmprspret 2y ago
    Moxie wrote an extensive blog post outlining the reasons they were not going to make use of a decentralised system. I believe its this post here, but someone correct me if this is the incorrect link: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
vaylian 2y ago
This ignores the problem of client-side scanning of private messages.
- t0bia_s 2y ago
  Your hosting, your rules.
  - MarcScott 2y ago
    Most of my family use my brother's Matrix server, but it's the Element app that makes it appealing to us all. Client side scanning could be enforced in the app, regardless of the server's protections.
    - xorcist 2y ago
      However there is a whole ecosystem of clients, and they can't all be back doored. You are also free with write your own client, and many do (which is why we have so many in the first place). Protocols, not platforms, people!
      - tcfhgj 2y ago
        But if in a group only one person uses a compromised client, all communication is compromised, isn't it?
        hellojesus 2y ago
        Potentially, yes. But that's where Signal's protocol helps. It includes plausible deniability. Therefore even if your chat log is leaked by one member, it isn't possible to probe person A sent the message. If person B was the leaker, anyone that person B has ever communicated with on Signal could have sent the message appearing to be from person A.
      - immibis 2y ago
        Not in the Matrix ecosystem. The protocol is so brittle there's only one real server and one real client, probably intentional, since the designers of the protocol make money from that server and that client.
sneak 2y ago
On iOS app distribution and censorship is and will remain centralized. It doesn’t matter if the relay service is centralized or federated. Apple can ban apps that don’t comply with the new law. Even self-distributed apps under the new sideloading provisions of the DMA can be censored by Apple by revoking the notarization.

slt2021 2y ago

jabber/xmpp is open standard and supports e2e encryption and can be self-hosted, has mobile clients

rocqua 2y ago
How does it support e2e?
- rakel_rakel 2y ago
  By clients having support and/or plugins for things like OMEMO and OTR.
Hoodedcrow 2y ago
I use XMPP with OMEMO for my main encrypted messaging, and I don't get why Matrix got popular instead of XMPP (aside from a big marketing budget). Even a lighter server implementation takes up several times more resources than an XMPP server, plus the concerns about the enormous central instance. XMPP FTW.
- zx8080 2y ago
  Last time I checked (2018) the support for media&file sharing was in a quite bad shape in all available Android clients. Even without e2e encryption enabled. Is it good now?
  - Hoodedcrow 2y ago
    For Android - Conversations is in a very good shape now.
lifty 2y ago
Matrix supports e2e encryption, so it would be a good candidate for self hosting. I already do.
- nsvd 2y ago
  My only complaint with self-hosting matrix is that the canonical python implementation is quite resource-heavy. I was unable to run it on a cheap VPS. I hope that the ecosystem will improve in the future.
  - ptman 2y ago
    When did you test it? It has improved very much in the past five years.
  - lifty 2y ago
    I agree. I really prefer Dendrite, their Go server, but development has slowed down lately. Also, because of the financial issues they have been having, I don't have a lot of hope that Dendrite will get a lot of attention. Maybe Conduit(https://conduit.rs https://conduit.rs) will become more viable instead of Dendrite. We really need a small efficient build with no moving parts, for the self hosters community.
- Aerbil313 2y ago
  Matrix has shady foundations, being born out of a Israeli company with alleged ties to Israeli intelligence. See https://hackea.org/notas/matrix.html https://hackea.org/notas/matrix.html
  - Arathorn 2y ago
    sigh. If you want to play project pedigree games; Matrix was actually the result of two existing teams - one in the UK and one in France, which happened to get acquired by Amdocs and then subsequently spun out once we'd created Matrix. That page in particular is a pile of FUD; it keeps banging on about "impressive collection of private data being sent to Matrix central servers, even when you use your own instance" which is simply categorically untrue; it looks like they misread the privacy policy of the Matrix.org server at https://github.com/element-hq/policies/blob/master/docs/matrix-org/privacy_notice.md https://github.com/element-hq/policies/blob/master/docs/matr... and somehow assumed it applied to everyone's server instances. It doesn't, any more than https://www.w3.org/policies/privacy https://www.w3.org/policies/privacy applies to a given random webserver on the internet :|
jamesponddotco 2y ago
Another vote for XMPP with OMEMO here. I use it my wife, family, and a few friends and haven't heard any complaints yet[1] (aside from the lack of stickers, which are apparently important). [1]: But like I said in another thread, who knows if they would directly complain to me.

growse 2y ago

Making this argument whilst ignoring the trade-offs of federation (that Signal has historically addressed) is somewhat disingenuous and a little fundamentalist.

wuiheerfoj 2y ago
do you have any breakdown on the trade-offs? Most HN commentary focuses on FUD around the signal founder rather than technical reasons why it shouldn’t be federated and would love to understand them better
- jmprspret 2y ago
  Moxie wrote an extensive blog post outlining the reasons they were not going to make use of a decentralised system. I believe its this post here, but someone correct me if this is the incorrect link: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

vaylian 2y ago

This ignores the problem of client-side scanning of private messages.

t0bia_s 2y ago
Your hosting, your rules.
- MarcScott 2y ago
  Most of my family use my brother's Matrix server, but it's the Element app that makes it appealing to us all. Client side scanning could be enforced in the app, regardless of the server's protections.
  - xorcist 2y ago
    However there is a whole ecosystem of clients, and they can't all be back doored. You are also free with write your own client, and many do (which is why we have so many in the first place). Protocols, not platforms, people!
    - tcfhgj 2y ago
      But if in a group only one person uses a compromised client, all communication is compromised, isn't it?
      - hellojesus 2y ago
        Potentially, yes. But that's where Signal's protocol helps. It includes plausible deniability. Therefore even if your chat log is leaked by one member, it isn't possible to probe person A sent the message. If person B was the leaker, anyone that person B has ever communicated with on Signal could have sent the message appearing to be from person A.
    - immibis 2y ago
      Not in the Matrix ecosystem. The protocol is so brittle there's only one real server and one real client, probably intentional, since the designers of the protocol make money from that server and that client.

sneak 2y ago

On iOS app distribution and censorship is and will remain centralized. It doesn’t matter if the relay service is centralized or federated. Apple can ban apps that don’t comply with the new law. Even self-distributed apps under the new sideloading provisions of the DMA can be censored by Apple by revoking the notarization.