7 ms·

One enormous advantage of federated systems is that they can route around this idiocy. For example, I host a Mastodon server in California. There was zero chanc

One enormous advantage of federated systems is that they can route around this idiocy. For example, I host a Mastodon server in California. There was zero chance I’d comply with EU’s law, any more than I would PRC’s. That’s their little policy, not mine.

noirscape 2y ago
Most federated systems likely wouldn't be affected by the proposal as-is. Since most of them are non-commercial, they'd be exempt from chat control as I understand it due to a resolution vote done in the European Parliament.
- kstrauser 2y ago
  None of them outside the EU, even the commercial ones, would be affected by it.
Zak 2y ago
You would avoid it. The criminals it's ostensibly meant to target will avoid it. Who won't avoid it is the hundreds of millions of Europeans who use WhatsApp as their primary means of telecommunication, many of whom don't even know what "end to end encryption" means, but effortlessly gain resistance to mass surveillance.
- kstrauser 2y ago
  That’s all true. It’s also why we should have smaller networks that are resistant to a given jurisdiction’s laws. WhatsApp has offices and business presences all over the world and now they’re stuck complying with everyone’s laws. That’s a bad situation for us to be in.
  - Zak 2y ago
    I won't argue with that, and I would certainly like for Matrix to get good enough to use as a primary messaging system. Right now, I think if I tried to convince non-technical people to use it, they would find the experience unsatisfactory.
    - kstrauser 2y ago
      Very true. I like it. I wouldn’t want to explain to my extended family how to contact me through it. I really really wish Mastodon had E2E messaging. Non-techies are using it today. I’d much rather get my sibling set up on that.
      - _lvbh 2y ago
        That’s the opposite of my experience. I’ve gotten most of my (very non-technical) family to use matrix through my home server. It’s a simple sign up and tell me your username type of thing and that’s it. One major advantage is that it works perfectly fine even in China which means there is one platform that everyone can use (WeChat is invite only, WhatsApp is blocked).
        Zak 2y ago
        I find the barrier isn't usually lack of technical skill, but lack of interest and patience. The average American can reach everyone they know by SMS and it's hard to convince them to use Signal or WhatsApp, which take under a minute to set up, are fast and reliable, and have almost no learning curve for people already used to SMS. You describe a situation where people can't reach everyone all of their family members in the popular ways, and Matrix offers a way to keep in touch you can guide them through and admin for them. I've had speed and reliability issues with Matrix myself, so I wouldn't try to talk people into using it.
        Arathorn 2y ago
        historically matrix has had perf problems for sure; we are in the final stages of fixing that tho. to quote someone earlier today in one of the community rooms: > just downloaded element x from f-droid and wowza it just.. loads instantly? can't believe i now live in the age of element being faster than discord
        _lvbh 2y ago
        I think federation is currently the biggest tax on performance. Joining even medium sized groups with only a hundred users takes a few minutes and eats up a ton of resources on the server. It got so bad that I had to turn federation off completely. That said, I only have ~1GB of RAM.
pantalaimon 2y ago
The legislation was about the client, not the server side.
- kstrauser 2y ago
  Mastodon ships with a web client that’s enabled be default.
  - pantalaimon 2y ago
    The scanning would then have to be added to the file upload functionality of the browser.
chgs 2y ago
Of course some counties decide their laws are to be applied globally. Ask Dimitri Skylarov. Or Kim Dotcom.
- kstrauser 2y ago
  We can and should protest those abuses, not use them as precedence to defend others doing the same thing.
  - chgs 2y ago
    I don’t believe the eu has ever tried to enforce EU laws outside the EU. Only the US and some dictatorships seem to do that.
    - kstrauser 2y ago
      A big chunk of this conversation is an assertion that the GDPR applies to Americans.
      - chgs 2y ago
        Could you point to an example of the eu enforcing its laws on a non eu entity? If google don’t want to be subject to the gdpr they don’t have to do business in europe. Howver their business is abusing the data of eu citizens, while getting other eu citizens to pay them for it.
deleted 2y ago
[deleted]
izacus 2y ago
Thinking that potential CSAM hosting server (as defined by EU) isn't going to get persecuted in US is a new level of naivete. US and EU have broad spanning contracts of cooperation between their respective law enforcement offices when it comes to these cases.
- kstrauser 2y ago
  It was never about CSAM. It's about power. From https://www.theverge.com/2024/6/19/24181214/eu-chat-control-law-propose-scanning-encrypted-messages-csam https://www.theverge.com/2024/6/19/24181214/eu-chat-control-...: > Each service required to install this “vetted” monitoring technology must also ask permission to scan your messages. If you don’t agree, you won’t be able to share images or URLs. > As if this doesn’t seem wild enough, the proposed legislation appears to endorse and reject end-to-end encryption at the same time. I absolutely will not run someone's server-side malware to look at the contents of all the messages my people transmit. I have zero tolerance for CSAM. I can report, have reported, and will continue to report instances of it that I stumble across as part of my job moderating the server I host. Damned if I'm running EU's "vetted" software though. There's also approximately nil chance of American authorities attempting to force American entities to run EU software on their US-hosted servers. My doctor's office has an encrypted chat where I can ask my doctor questions. You think anyone's going to make them filter those HIPAA-covered messages through the EU?
  - izacus 2y ago
    I'm not sure what you're really going on about here - there's a massive amount of proven history of EU/US law enforcement using each other's surveillance technology and legal loopholes to exchange information. War on drugs, CSAM, human trafficking are oft cited reasons. There's pretty much zero chance that US would reject use and insight into private communication if EU puts it into law and forces upon messaging apps. We have literally pile of historical examples where FBI & co. were actively pushing for more of such data sharing programs. - So what exactly is your point? Where did you get an idea that you'll be running "EU software" and that US will defend you if you get into a CSAM suspected database list?
doe_eyes 2y ago
This is the advantage of being small enough to fly under the radar, more than the advantage of federation. It's also why Signal can get away with approaches that would have gotten any Big Tech player testifying in front of the Congress, with parents of kids killed by fentanyl or kidnapped by sex predators sitting right behind. If your service becomes big and important enough, and if politicians hear enough from law enforcement and intelligence agencies that you're a major problem, then all of sudden, your "zero chance" becomes a "non-zero chance" if you ever need to travel to or through the EU, do any business there, etc. Another case in point: cryptocurrencies. They were government-proof until they weren't, because ultimately, there are people running exchanges and mixers, as well as other counterparties, who can be threatened with prison and fines.
- ndriscoll 2y ago
  The advantage of federation is you don't need to become big. XMPP works like email; you set up your DNS records and other servers can talk to yours when someone wants to chat with an address in your domain.
  - toyg 2y ago
    It's all fun and games until you get blocked at the DNS level and effectively shadowbanned by all mainstream ISPs. This already happens today in many, many European countries.
    - anthk 2y ago
      DNS it's trivial to override. Even better, the chat client can provide it's own resolver and IP's.
  - michaelt 2y ago
    Yes and no. Federation certainly helps, in that Americans can run American instances and not worry if the EU dislikes it. However, federation wouldn't help EU users much if the EU state decided to go for full-on Chinese style control, firewalling the foreign-hosted instances, banning the apps from the app stores, blocking access to payment infrastructure, jail for anyone found with the app sideloaded, PR campaign saying this app is used for child porn and encouraging people to turn in anyone they see using it to the cops, and so on.
aloha2436 2y ago
GDPR is also their little policy and I assure you plenty of non-European people are made to care about it.
- kstrauser 2y ago
  The businesses who care about taking money from Europeans care. I worked at an American healthtech company and we weren’t GDPR-compliant because 1) we weren’t targeting Europeans, and 2) GDPR and HIPAA are incompatible so we picked the relevant one. Since my server doesn’t do business in EU, I couldn’t care less about GDPR or other local laws, even the ones I think are good ideas. American law doesn’t apply to someone running a server in Brussels. The converse is also true.
  - mfru 2y ago
    > American law doesn’t apply to someone running a server in Brussels. Except when the one running and renting out the server is Microsoft, Amazon, or some other US entity and the Patriot Act exists.
    - kstrauser 2y ago
      True, regrettable, and irrelevant. Host it in a local data center and it’s out America’s control. I’d have a different opinion about my service if I were hosting my server on Hetzner in Helsinki. Since I’m not, I don’t.
      - mfru 2y ago
        Sorry, but haven't you noticed how many companies and public bodies in Europe are using Azure, AWS and GCP? I'd say that is rather very relevant. The Patriot Act is the foremost frontier in the ongoing dispute about the so-called Privacy Shield.
  - ceejayoz 2y ago
    > GDPR and HIPAA are incompatible so we picked the relevant one. The GDPR explicitly permits "processing [as] necessary for compliance with a legal obligation to which the controller is subject" in Article 6.
atmosx 2y ago
Believing that legislative issues can be solved with technology is one of the most common fallacies among the IT crowd. If those in power decide to push forward by increasing the penalties, eventually running a Mastodon server will become as risky as getting caught for murder. At that point, it would be naive to run a Mastodon server locally, wouldn't it? P.S. Mind you, the average consumer/user doesn't care as long as Facebook, Twitter, Instagram, and TikTok are up and running. Quotes like "they already know everything" and "do you have something to hide from the government?" will become ubiquitous in public discourse.
- kstrauser 2y ago
  If/when American law mirrors it or we sign a treaty, it applies to me. Until then, it doesn’t. The penalty could be “shoot on sight” and it doesn’t matter as long as I’m outside their jurisdiction. I’m kind of fascinated by the often simultaneously held beliefs of “America doesn’t make the world’s rules!” and “…EU does!” Countries can influence each other, sure, but if EU (US or Canada or Brazil) makes a law, it doesn’t apply to people not under those jurisdictions.
  - logifail 2y ago
    > If/when American law mirrors it or we sign a treaty, it applies to me. Until then, it doesn’t. The penalty could be “shoot on sight” and it doesn’t matter as long as I’m outside their jurisdiction. That's great if you never need to|want to travel. What about the time you happen to end up in transit through an airport in a country where they've put you on their watchlist, they grab you airside and hold you for hours while they look at your devices....? https://www.theguardian.com/world/2013/aug/18/glenn-greenwald-guardian-partner-detained-heathrow https://www.theguardian.com/world/2013/aug/18/glenn-greenwal...
    - kstrauser 2y ago
      I’m not going to live my life worried about hypotheticals. What if my plane goes down, I get rescued by North Korea, and they get mad at something I said about Kim Jong Number Un? That’d suck, but the possibility isn’t going to make me self-limit in the mean time. There are enough real concerns on my plate.

noirscape 2y ago

Most federated systems likely wouldn't be affected by the proposal as-is. Since most of them are non-commercial, they'd be exempt from chat control as I understand it due to a resolution vote done in the European Parliament.

kstrauser 2y ago
None of them outside the EU, even the commercial ones, would be affected by it.

Zak 2y ago

You would avoid it. The criminals it's ostensibly meant to target will avoid it. Who won't avoid it is the hundreds of millions of Europeans who use WhatsApp as their primary means of telecommunication, many of whom don't even know what "end to end encryption" means, but effortlessly gain resistance to mass surveillance.

kstrauser 2y ago
That’s all true. It’s also why we should have smaller networks that are resistant to a given jurisdiction’s laws. WhatsApp has offices and business presences all over the world and now they’re stuck complying with everyone’s laws. That’s a bad situation for us to be in.
- Zak 2y ago
  I won't argue with that, and I would certainly like for Matrix to get good enough to use as a primary messaging system. Right now, I think if I tried to convince non-technical people to use it, they would find the experience unsatisfactory.
  - kstrauser 2y ago
    Very true. I like it. I wouldn’t want to explain to my extended family how to contact me through it. I really really wish Mastodon had E2E messaging. Non-techies are using it today. I’d much rather get my sibling set up on that.
    - _lvbh 2y ago
      That’s the opposite of my experience. I’ve gotten most of my (very non-technical) family to use matrix through my home server. It’s a simple sign up and tell me your username type of thing and that’s it. One major advantage is that it works perfectly fine even in China which means there is one platform that everyone can use (WeChat is invite only, WhatsApp is blocked).
      - Zak 2y ago
        I find the barrier isn't usually lack of technical skill, but lack of interest and patience. The average American can reach everyone they know by SMS and it's hard to convince them to use Signal or WhatsApp, which take under a minute to set up, are fast and reliable, and have almost no learning curve for people already used to SMS. You describe a situation where people can't reach everyone all of their family members in the popular ways, and Matrix offers a way to keep in touch you can guide them through and admin for them. I've had speed and reliability issues with Matrix myself, so I wouldn't try to talk people into using it.
        Arathorn 2y ago
        historically matrix has had perf problems for sure; we are in the final stages of fixing that tho. to quote someone earlier today in one of the community rooms: > just downloaded element x from f-droid and wowza it just.. loads instantly? can't believe i now live in the age of element being faster than discord
        _lvbh 2y ago
        I think federation is currently the biggest tax on performance. Joining even medium sized groups with only a hundred users takes a few minutes and eats up a ton of resources on the server. It got so bad that I had to turn federation off completely. That said, I only have ~1GB of RAM.

pantalaimon 2y ago

The legislation was about the client, not the server side.

kstrauser 2y ago
Mastodon ships with a web client that’s enabled be default.
- pantalaimon 2y ago
  The scanning would then have to be added to the file upload functionality of the browser.

chgs 2y ago

Of course some counties decide their laws are to be applied globally. Ask Dimitri Skylarov. Or Kim Dotcom.

kstrauser 2y ago
We can and should protest those abuses, not use them as precedence to defend others doing the same thing.
- chgs 2y ago
  I don’t believe the eu has ever tried to enforce EU laws outside the EU. Only the US and some dictatorships seem to do that.
  - kstrauser 2y ago
    A big chunk of this conversation is an assertion that the GDPR applies to Americans.
    - chgs 2y ago
      Could you point to an example of the eu enforcing its laws on a non eu entity? If google don’t want to be subject to the gdpr they don’t have to do business in europe. Howver their business is abusing the data of eu citizens, while getting other eu citizens to pay them for it.

deleted 2y ago

[deleted]

izacus 2y ago

Thinking that potential CSAM hosting server (as defined by EU) isn't going to get persecuted in US is a new level of naivete. US and EU have broad spanning contracts of cooperation between their respective law enforcement offices when it comes to these cases.

kstrauser 2y ago
It was never about CSAM. It's about power. From https://www.theverge.com/2024/6/19/24181214/eu-chat-control-law-propose-scanning-encrypted-messages-csam https://www.theverge.com/2024/6/19/24181214/eu-chat-control-...: > Each service required to install this “vetted” monitoring technology must also ask permission to scan your messages. If you don’t agree, you won’t be able to share images or URLs. > As if this doesn’t seem wild enough, the proposed legislation appears to endorse and reject end-to-end encryption at the same time. I absolutely will not run someone's server-side malware to look at the contents of all the messages my people transmit. I have zero tolerance for CSAM. I can report, have reported, and will continue to report instances of it that I stumble across as part of my job moderating the server I host. Damned if I'm running EU's "vetted" software though. There's also approximately nil chance of American authorities attempting to force American entities to run EU software on their US-hosted servers. My doctor's office has an encrypted chat where I can ask my doctor questions. You think anyone's going to make them filter those HIPAA-covered messages through the EU?
- izacus 2y ago
  I'm not sure what you're really going on about here - there's a massive amount of proven history of EU/US law enforcement using each other's surveillance technology and legal loopholes to exchange information. War on drugs, CSAM, human trafficking are oft cited reasons. There's pretty much zero chance that US would reject use and insight into private communication if EU puts it into law and forces upon messaging apps. We have literally pile of historical examples where FBI & co. were actively pushing for more of such data sharing programs. - So what exactly is your point? Where did you get an idea that you'll be running "EU software" and that US will defend you if you get into a CSAM suspected database list?

doe_eyes 2y ago

This is the advantage of being small enough to fly under the radar, more than the advantage of federation. It's also why Signal can get away with approaches that would have gotten any Big Tech player testifying in front of the Congress, with parents of kids killed by fentanyl or kidnapped by sex predators sitting right behind. If your service becomes big and important enough, and if politicians hear enough from law enforcement and intelligence agencies that you're a major problem, then all of sudden, your "zero chance" becomes a "non-zero chance" if you ever need to travel to or through the EU, do any business there, etc. Another case in point: cryptocurrencies. They were government-proof until they weren't, because ultimately, there are people running exchanges and mixers, as well as other counterparties, who can be threatened with prison and fines.

ndriscoll 2y ago
The advantage of federation is you don't need to become big. XMPP works like email; you set up your DNS records and other servers can talk to yours when someone wants to chat with an address in your domain.
- toyg 2y ago
  It's all fun and games until you get blocked at the DNS level and effectively shadowbanned by all mainstream ISPs. This already happens today in many, many European countries.
  - anthk 2y ago
    DNS it's trivial to override. Even better, the chat client can provide it's own resolver and IP's.
- michaelt 2y ago
  Yes and no. Federation certainly helps, in that Americans can run American instances and not worry if the EU dislikes it. However, federation wouldn't help EU users much if the EU state decided to go for full-on Chinese style control, firewalling the foreign-hosted instances, banning the apps from the app stores, blocking access to payment infrastructure, jail for anyone found with the app sideloaded, PR campaign saying this app is used for child porn and encouraging people to turn in anyone they see using it to the cops, and so on.

aloha2436 2y ago

GDPR is also their little policy and I assure you plenty of non-European people are made to care about it.

kstrauser 2y ago
The businesses who care about taking money from Europeans care. I worked at an American healthtech company and we weren’t GDPR-compliant because 1) we weren’t targeting Europeans, and 2) GDPR and HIPAA are incompatible so we picked the relevant one. Since my server doesn’t do business in EU, I couldn’t care less about GDPR or other local laws, even the ones I think are good ideas. American law doesn’t apply to someone running a server in Brussels. The converse is also true.
- mfru 2y ago
  > American law doesn’t apply to someone running a server in Brussels. Except when the one running and renting out the server is Microsoft, Amazon, or some other US entity and the Patriot Act exists.
  - kstrauser 2y ago
    True, regrettable, and irrelevant. Host it in a local data center and it’s out America’s control. I’d have a different opinion about my service if I were hosting my server on Hetzner in Helsinki. Since I’m not, I don’t.
    - mfru 2y ago
      Sorry, but haven't you noticed how many companies and public bodies in Europe are using Azure, AWS and GCP? I'd say that is rather very relevant. The Patriot Act is the foremost frontier in the ongoing dispute about the so-called Privacy Shield.
- ceejayoz 2y ago
  > GDPR and HIPAA are incompatible so we picked the relevant one. The GDPR explicitly permits "processing [as] necessary for compliance with a legal obligation to which the controller is subject" in Article 6.

atmosx 2y ago

Believing that legislative issues can be solved with technology is one of the most common fallacies among the IT crowd. If those in power decide to push forward by increasing the penalties, eventually running a Mastodon server will become as risky as getting caught for murder. At that point, it would be naive to run a Mastodon server locally, wouldn't it? P.S. Mind you, the average consumer/user doesn't care as long as Facebook, Twitter, Instagram, and TikTok are up and running. Quotes like "they already know everything" and "do you have something to hide from the government?" will become ubiquitous in public discourse.

kstrauser 2y ago
If/when American law mirrors it or we sign a treaty, it applies to me. Until then, it doesn’t. The penalty could be “shoot on sight” and it doesn’t matter as long as I’m outside their jurisdiction. I’m kind of fascinated by the often simultaneously held beliefs of “America doesn’t make the world’s rules!” and “…EU does!” Countries can influence each other, sure, but if EU (US or Canada or Brazil) makes a law, it doesn’t apply to people not under those jurisdictions.
- logifail 2y ago
  > If/when American law mirrors it or we sign a treaty, it applies to me. Until then, it doesn’t. The penalty could be “shoot on sight” and it doesn’t matter as long as I’m outside their jurisdiction. That's great if you never need to|want to travel. What about the time you happen to end up in transit through an airport in a country where they've put you on their watchlist, they grab you airside and hold you for hours while they look at your devices....? https://www.theguardian.com/world/2013/aug/18/glenn-greenwald-guardian-partner-detained-heathrow https://www.theguardian.com/world/2013/aug/18/glenn-greenwal...
  - kstrauser 2y ago
    I’m not going to live my life worried about hypotheticals. What if my plane goes down, I get rescued by North Korea, and they get mad at something I said about Kim Jong Number Un? That’d suck, but the possibility isn’t going to make me self-limit in the mean time. There are enough real concerns on my plate.