5 ms·

>this also creates a situation where anything said across federation cannot be unsaid, which is an ironic situation for a protocol/system that often comes up wh

>this also creates a situation where anything said across federation cannot be unsaid, which is an ironic situation for a protocol/system that often comes up when talking about privacy. How is it ironic? No protocol in the world can force anyone to delete anything from their own device. Chat apps that implement this function are either proprietary (so you cannot control what they can do) or, if OSS, do it on a pinky-promise-basis.

a3w 11mo ago
Right, but we did have efforts to take over hardware security enclaves to deliver user data, instead of copyrighted company data, to user devices. Tim Berners-Lee tries to make the internet a place where you can choose, what it "forgets". At least that were the news I got from the 2010s and early 2020s. As for how: DRM-like tech in the hands of users should allow for that. So having privacy by design would be nice, and e.g. many messengers try to do "it is inconvenient to copy a message that someone send you that is marked as view-only-once-or-up-to-a-timespan, but of course, you can use an external camera, i.e. make more low-fidelity copies or even exfiltrate data". Even F/LOS software can use/would be forced to use these proprietary enclaves or at least non-user accessible key stores. (As far as I understand hardware level DRM.)
- Almondsetat 11mo ago
  >Tim Berners-Lee tries to make the internet a place where you can choose, what it "forgets". At least that were the news I got from the 2010s and early 2020s. Tim Berners-Lee created the web, not the internet, which is what chat apps use. Also, unless you can provide some direct quotes about it being designed for "forgetting" stuff, I have no idea where these "news" you got came from. >As for how: DRM-like tech in the hands of users should allow for that. If it's in the hands of the users, i.e. open source, it can be disabled at any moment, which is exactly what my reply already addressed.
  - everforward 11mo ago
    I think they're talking about Solid, Tim Berners-Lee's newer venture: https://en.wikipedia.org/wiki/Solid_(web_decentralization_project) https://en.wikipedia.org/wiki/Solid_(web_decentralization_pr...
  - warkdarrior 11mo ago
    >> As for how: DRM-like tech in the hands of users should allow for that. > If it's in the hands of the users, i.e. open source, it can be disabled at any moment, which is exactly what my reply already addressed. The point is that with the help of hardware-backed DRM on the client, the Matrix server could send data only to unmodified clients. You modified your client in a way that does not match what the Matrix server expects? No data for you.
    - Almondsetat 11mo ago
      You're repeating the same thing with more words. If you cannot control your hardware-backed DRM, then Matrix requires proprietary blobs to work.
dust-jacket 11mo ago
Yeah I thought this was a weird take too. Too often people take privacy for "I can do what I like". IMO deleting something you've sent to someone else is not a privacy concern at all.
- bityard 11mo ago
  I don't agree with it myself, but there are people who seem to want to frame "the right to be forgotten" as a privacy issue.
  - Almondsetat 11mo ago
    Even if it were a privacy issue, it would be impossible to enforce it technologically via FOSS software, because, by definition, the user at the other end could run a forked version with remote deletion disabled.
  - rapnie 11mo ago
    Just one example, but trying to get that revenge porn off the web, can be seen as an attempt to restore ones privacy. Where others should not have the right to continue to peek into ones private life.
    - bityard 11mo ago
      That's not quite the kind of thing I was talking about. I think that is generally already covered by current laws in most places? The right-to-be-forgotten advocates argue that everyone should have the right to demand that any trace of their previous online existence be deleted. On social media of course, but also independent web forums, chat logs, git commits, etc.
- tenthirtyam 11mo ago
  IIRC it is possible to have some clever encryption so that the person you sent your message to can prove to their own satisfaction that it came from you, but they cannot prove to anyone else that it came from you. Which gives you plausible deniability; you can always claim that your contact forged the message. Can't remember what the algorithm is called.
deleted 11mo ago
[deleted]
progval 11mo ago
> No protocol in the world can force anyone to delete anything from their own device. But they either do not sign the messages or allow repudiating the signatures. Matrix signs all events forever. Matrix also makes the entire event history (minus message content depending on room configuration) available to servers on join, even if that server's users are not allowed to see it.
- wahern 11mo ago
  These are distinctions without a difference. Events replicated across several independent Matrix servers are not meaningfully different than events broadcast across independent clients in terms of observability or repudiation.
  - progval 11mo ago
    But normally when you join a conversation and are not allowed to see previous messages, you don't see anything about them. A matrix server does.
- Arathorn 11mo ago
  > Matrix also makes the entire event history (minus message content depending on room configuration) available to servers on join The important bit is the bit in brackets: as you say, historical message content is not shared if the room's is configured not to share history.
broken-kebab 11mo ago
A protocol can mandate forced deletion. A particular client implementation may ignore it, or some users may circumvent it, so it would be a weaker kind of feature, but still a feature. And depending on circumstances it can be quite useful.
- Almondsetat 11mo ago
  A protocol can only support, never mandate. If I send you "DELETE MSG #4829" and you do nothing and reply with "200 OK; DELETE MSG #4829", nobody observing the protocol's messages will ever know what happened. Sure, an omniscent being could say "but he internally broke protocol, he didn't delete the message!", but by definition if something cannot be verified inside the protocol, it is outside of protocol.
  - broken-kebab 11mo ago
    I don't know such definition frankly. And to the best of my knowledge there are plenty of things which people call "protocols" strongly prescribing actions non-verifiable in the very sense you used. That said I'm not here for a terminological discussion. We may call it green cheese, but it's still a useful feature.
    - Almondsetat 11mo ago
      Nobody claimed it isn't a useful feature. The only claim I made is that it cannot be mandated with an open protocol, so if you expect 100% adherence in the name of privacy, you're setting yourself up for disappointment.
      - broken-kebab 11mo ago
        Good, nobody claimed any expectation of 100% adherence as well!
      - BrenBarn 11mo ago
        It can be mandated, it's just that the mandate can't be enforced.
thaumasiotes 11mo ago
> How is it ironic? No protocol in the world can force anyone to delete anything from their own device. You may have noticed the constant pushing to remove the user's access to their "own" device. Forcing people to delete things from their own device is the whole concept of the Snapchat protocol, for example. Snapchat fortunately doesn't offer an OS and can't meaningfully be part of this push, but they make a convenient illustration. You can check out Snapchat's bug bounty policy here: https://hackerone.com/snapchat https://hackerone.com/snapchat . On the list of ineligible vulnerabilities is "screenshot detection avoidance". That's not a bug (because there's nothing they can do about it), even though it is their product's selling point. Sometimes stronger companies want similar things, and they try to do something about it.

a3w 11mo ago

Right, but we did have efforts to take over hardware security enclaves to deliver user data, instead of copyrighted company data, to user devices. Tim Berners-Lee tries to make the internet a place where you can choose, what it "forgets". At least that were the news I got from the 2010s and early 2020s. As for how: DRM-like tech in the hands of users should allow for that. So having privacy by design would be nice, and e.g. many messengers try to do "it is inconvenient to copy a message that someone send you that is marked as view-only-once-or-up-to-a-timespan, but of course, you can use an external camera, i.e. make more low-fidelity copies or even exfiltrate data". Even F/LOS software can use/would be forced to use these proprietary enclaves or at least non-user accessible key stores. (As far as I understand hardware level DRM.)

Almondsetat 11mo ago
>Tim Berners-Lee tries to make the internet a place where you can choose, what it "forgets". At least that were the news I got from the 2010s and early 2020s. Tim Berners-Lee created the web, not the internet, which is what chat apps use. Also, unless you can provide some direct quotes about it being designed for "forgetting" stuff, I have no idea where these "news" you got came from. >As for how: DRM-like tech in the hands of users should allow for that. If it's in the hands of the users, i.e. open source, it can be disabled at any moment, which is exactly what my reply already addressed.
- everforward 11mo ago
  I think they're talking about Solid, Tim Berners-Lee's newer venture: https://en.wikipedia.org/wiki/Solid_(web_decentralization_project) https://en.wikipedia.org/wiki/Solid_(web_decentralization_pr...
- warkdarrior 11mo ago
  >> As for how: DRM-like tech in the hands of users should allow for that. > If it's in the hands of the users, i.e. open source, it can be disabled at any moment, which is exactly what my reply already addressed. The point is that with the help of hardware-backed DRM on the client, the Matrix server could send data only to unmodified clients. You modified your client in a way that does not match what the Matrix server expects? No data for you.
  - Almondsetat 11mo ago
    You're repeating the same thing with more words. If you cannot control your hardware-backed DRM, then Matrix requires proprietary blobs to work.

dust-jacket 11mo ago

Yeah I thought this was a weird take too. Too often people take privacy for "I can do what I like". IMO deleting something you've sent to someone else is not a privacy concern at all.

bityard 11mo ago
I don't agree with it myself, but there are people who seem to want to frame "the right to be forgotten" as a privacy issue.
- Almondsetat 11mo ago
  Even if it were a privacy issue, it would be impossible to enforce it technologically via FOSS software, because, by definition, the user at the other end could run a forked version with remote deletion disabled.
- rapnie 11mo ago
  Just one example, but trying to get that revenge porn off the web, can be seen as an attempt to restore ones privacy. Where others should not have the right to continue to peek into ones private life.
  - bityard 11mo ago
    That's not quite the kind of thing I was talking about. I think that is generally already covered by current laws in most places? The right-to-be-forgotten advocates argue that everyone should have the right to demand that any trace of their previous online existence be deleted. On social media of course, but also independent web forums, chat logs, git commits, etc.
tenthirtyam 11mo ago
IIRC it is possible to have some clever encryption so that the person you sent your message to can prove to their own satisfaction that it came from you, but they cannot prove to anyone else that it came from you. Which gives you plausible deniability; you can always claim that your contact forged the message. Can't remember what the algorithm is called.

deleted 11mo ago

[deleted]

progval 11mo ago

> No protocol in the world can force anyone to delete anything from their own device. But they either do not sign the messages or allow repudiating the signatures. Matrix signs all events forever. Matrix also makes the entire event history (minus message content depending on room configuration) available to servers on join, even if that server's users are not allowed to see it.

wahern 11mo ago
These are distinctions without a difference. Events replicated across several independent Matrix servers are not meaningfully different than events broadcast across independent clients in terms of observability or repudiation.
- progval 11mo ago
  But normally when you join a conversation and are not allowed to see previous messages, you don't see anything about them. A matrix server does.
Arathorn 11mo ago
> Matrix also makes the entire event history (minus message content depending on room configuration) available to servers on join The important bit is the bit in brackets: as you say, historical message content is not shared if the room's is configured not to share history.

broken-kebab 11mo ago

A protocol can mandate forced deletion. A particular client implementation may ignore it, or some users may circumvent it, so it would be a weaker kind of feature, but still a feature. And depending on circumstances it can be quite useful.

Almondsetat 11mo ago
A protocol can only support, never mandate. If I send you "DELETE MSG #4829" and you do nothing and reply with "200 OK; DELETE MSG #4829", nobody observing the protocol's messages will ever know what happened. Sure, an omniscent being could say "but he internally broke protocol, he didn't delete the message!", but by definition if something cannot be verified inside the protocol, it is outside of protocol.
- broken-kebab 11mo ago
  I don't know such definition frankly. And to the best of my knowledge there are plenty of things which people call "protocols" strongly prescribing actions non-verifiable in the very sense you used. That said I'm not here for a terminological discussion. We may call it green cheese, but it's still a useful feature.
  - Almondsetat 11mo ago
    Nobody claimed it isn't a useful feature. The only claim I made is that it cannot be mandated with an open protocol, so if you expect 100% adherence in the name of privacy, you're setting yourself up for disappointment.
    - broken-kebab 11mo ago
      Good, nobody claimed any expectation of 100% adherence as well!
    - BrenBarn 11mo ago
      It can be mandated, it's just that the mandate can't be enforced.

thaumasiotes 11mo ago

> How is it ironic? No protocol in the world can force anyone to delete anything from their own device. You may have noticed the constant pushing to remove the user's access to their "own" device. Forcing people to delete things from their own device is the whole concept of the Snapchat protocol, for example. Snapchat fortunately doesn't offer an OS and can't meaningfully be part of this push, but they make a convenient illustration. You can check out Snapchat's bug bounty policy here: https://hackerone.com/snapchat https://hackerone.com/snapchat . On the list of ineligible vulnerabilities is "screenshot detection avoidance". That's not a bug (because there's nothing they can do about it), even though it is their product's selling point. Sometimes stronger companies want similar things, and they try to do something about it.