4 ms·

> the dude is a furry what do you expect? Some furry bloggers do have pictures throughout their blog posts to split things up and lighten things. Lighten thing

> the dude is a furry what do you expect? Some furry bloggers do have pictures throughout their blog posts to split things up and lighten things. Lighten things? Are you saying that putting images of cartoon characters puking at the logos of your product lightens things and provokes healthy discussion? Don't try to make this into thinking I'm criticizing furriness -- it's definitely not about that. > There is a fair bit of metadata on the server side This is much less critical when the protocol is federated. Even E2EE itself may become second priority rather than first in such an environment. > Without enthusiastic developers that think this thing sounds cool there simply won't be any good software. This is a ridiculous statement.

dngray 2y ago
> This is much less critical when the protocol is federated False. Federated protocols typically have a lot more, as there is routing data between servers. The same goes for things like Matrix. The only thing that Matrix servers can see however realistically is the room id, and other participants. Unlike XMPP where they can copy your roster. In the case of ejabberd debug logs can include your password lol (or at least could in November 2021). I doubt that's changed.
- AshamedCaptain 2y ago
  Routing data between servers and networks you literally control. There is simply no possible discussion on this point. A centralized service doesn't allow that choice. Leaking metadata to a centralized service is simply inevitable by pure physics.
  - dngray 2y ago
    > Routing data between servers and networks you literally control This isn't always the case, not every user is a server admin. Also for group chats other server admins will certainly know what data your requesting. TLDR is that XMPP is not a private protocol, and that was never its intention. It was actually very centralized in it's original usage and the designers clearly envisaged similar usage to email ie $companyA.com employees talking to $companyB.com not some sort of "private messenger" competitor to Matrix or Signal which were meant to be used by the wider general population. > Leaking metadata to a centralized service is simply inevitable by pure physics Not necessarily true https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ Signal has a lot less metadata than XMPP.
    - AshamedCaptain 2y ago
      XMPP largest deployments are in enterprises. I do not disagree with this. To go from there to "it is not designed to be a private protocol" is a stretch. And does that invalidate any of my points? > Not necessarily true https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ Yeah, no. Timing alone is enough to clearly distinguish a sender, and any attempts like these is pure astronaut engineering to obfuscate something that is trivial to recover by a million side channels. There is just No. Way. to eliminate the problem of metadata leaks to a centralized server, other than making it practically distributed/P2P. The more time it takes for people to realize this, the worse society becomes.
      - dngray 2y ago
        > And does that invalidate any of my point Yes it does, because the threat model there is not the server itself. You trust that as it's your employer's server and you're using it for work related purposes. > Timing alone is enough to clearly distinguish a sender It's a lot harder to pull off than doing an MiTM attack with STARTTLS and then just observing the person's roster being sent to them when they connect lol.
        AshamedCaptain 2y ago
        > You trust that as it's your employer's server and you're using it for work related purposes. Yes, that is the point. Or it is my home server sitting at my router serving my family. I have been arguing that if I can trust the server then the discussion about E2EE becomes less relevant. > It's a lot harder to pull off than doing an MiTM attack with STARTTLS and then just observing the person's roster being sent to them when they connect lol. And here you make the dangerous mistake that I most hate. It's not only trivially easy for the server operator to leak metadata, it's actually HARD to avoid it.
        dngray 2y ago
        > Or it is my home server sitting at my router serving my family. That works in your situation, but not for most people who don't want to have to maintain a moving part. Also hosting in general on a residential connection can depend on the provider and even availability of good internet. For a lot of people it wouldn't even be possible if they wanted to and that's not getting into the technical investment they would have to make in knowing how to do such a thing in the first place. > And here you make the dangerous mistake that I most hate. It's not only trivially easy for the server operator to leak metadata, it's actually HARD to avoid it. It's a lot easier than simply not having that data server side in the first place like Signal for example.
some_furry 2y ago
> Are you saying that putting images of cartoon characters puking at the logos of your product lightens things and provokes healthy discussion? The image in question does not contain puking. That's a tongue, not vomit. https://bunnypa.ws/sticker/CAACAgEAAxUAAWByYjqChwgli1QKv81ywL1ywGCfAALQAAObhkBHWXRcVVs78NEeBA https://bunnypa.ws/sticker/CAACAgEAAxUAAWByYjqChwgli1QKv81yw... Here's another from the same artist: https://bunnypa.ws/sticker/CAACAgEAAxUAAV91eRTulCrBXcKzxCrPYXstM5OEAAJlAANXPJkORUwS0091ZBobBA https://bunnypa.ws/sticker/CAACAgEAAxUAAV91eRTulCrBXcKzxCrPY... It contains a disgusted reaction. The logos in question are visually "muddying the waters", too.

dngray 2y ago

> This is much less critical when the protocol is federated False. Federated protocols typically have a lot more, as there is routing data between servers. The same goes for things like Matrix. The only thing that Matrix servers can see however realistically is the room id, and other participants. Unlike XMPP where they can copy your roster. In the case of ejabberd debug logs can include your password lol (or at least could in November 2021). I doubt that's changed.

AshamedCaptain 2y ago
Routing data between servers and networks you literally control. There is simply no possible discussion on this point. A centralized service doesn't allow that choice. Leaking metadata to a centralized service is simply inevitable by pure physics.
- dngray 2y ago
  > Routing data between servers and networks you literally control This isn't always the case, not every user is a server admin. Also for group chats other server admins will certainly know what data your requesting. TLDR is that XMPP is not a private protocol, and that was never its intention. It was actually very centralized in it's original usage and the designers clearly envisaged similar usage to email ie $companyA.com employees talking to $companyB.com not some sort of "private messenger" competitor to Matrix or Signal which were meant to be used by the wider general population. > Leaking metadata to a centralized service is simply inevitable by pure physics Not necessarily true https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ Signal has a lot less metadata than XMPP.
  - AshamedCaptain 2y ago
    XMPP largest deployments are in enterprises. I do not disagree with this. To go from there to "it is not designed to be a private protocol" is a stretch. And does that invalidate any of my points? > Not necessarily true https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ Yeah, no. Timing alone is enough to clearly distinguish a sender, and any attempts like these is pure astronaut engineering to obfuscate something that is trivial to recover by a million side channels. There is just No. Way. to eliminate the problem of metadata leaks to a centralized server, other than making it practically distributed/P2P. The more time it takes for people to realize this, the worse society becomes.
    - dngray 2y ago
      > And does that invalidate any of my point Yes it does, because the threat model there is not the server itself. You trust that as it's your employer's server and you're using it for work related purposes. > Timing alone is enough to clearly distinguish a sender It's a lot harder to pull off than doing an MiTM attack with STARTTLS and then just observing the person's roster being sent to them when they connect lol.
      - AshamedCaptain 2y ago
        > You trust that as it's your employer's server and you're using it for work related purposes. Yes, that is the point. Or it is my home server sitting at my router serving my family. I have been arguing that if I can trust the server then the discussion about E2EE becomes less relevant. > It's a lot harder to pull off than doing an MiTM attack with STARTTLS and then just observing the person's roster being sent to them when they connect lol. And here you make the dangerous mistake that I most hate. It's not only trivially easy for the server operator to leak metadata, it's actually HARD to avoid it.
        dngray 2y ago
        > Or it is my home server sitting at my router serving my family. That works in your situation, but not for most people who don't want to have to maintain a moving part. Also hosting in general on a residential connection can depend on the provider and even availability of good internet. For a lot of people it wouldn't even be possible if they wanted to and that's not getting into the technical investment they would have to make in knowing how to do such a thing in the first place. > And here you make the dangerous mistake that I most hate. It's not only trivially easy for the server operator to leak metadata, it's actually HARD to avoid it. It's a lot easier than simply not having that data server side in the first place like Signal for example.

some_furry 2y ago

> Are you saying that putting images of cartoon characters puking at the logos of your product lightens things and provokes healthy discussion? The image in question does not contain puking. That's a tongue, not vomit. https://bunnypa.ws/sticker/CAACAgEAAxUAAWByYjqChwgli1QKv81ywL1ywGCfAALQAAObhkBHWXRcVVs78NEeBA https://bunnypa.ws/sticker/CAACAgEAAxUAAWByYjqChwgli1QKv81yw... Here's another from the same artist: https://bunnypa.ws/sticker/CAACAgEAAxUAAV91eRTulCrBXcKzxCrPYXstM5OEAAJlAANXPJkORUwS0091ZBobBA https://bunnypa.ws/sticker/CAACAgEAAxUAAV91eRTulCrBXcKzxCrPY... It contains a disgusted reaction. The logos in question are visually "muddying the waters", too.