Reflections: The ecosystem is moving

In fact, someone already has, so you can just use it: https://fdroid.eutopia.cz/

I will point out that some people are using "federated" and "decentralized" as synonyms, when they are distinct concepts. The Tor network, for example, is decentralized, but not federated. You can run your own Tor node, but that node has to be accepted by the directory authorities in order to become a part of the network. You could conceivably set up your own Tor network, with your own directory authorities, but of course you can also create your own alternative network with Signal, since both the client and server code are free software.

Ricochet, the messenger that uses client-side Tor hidden services to create server-less chat, is also decentralized, but not federated. Ricochet clients talk to other Ricochet clients. There is not IETF RFC out there for Tor or Ricochet, that you can use to build your own implementation and federate into the network.

Moxie's claim that federation inevitably leads to moribund cruft may be over-stated; after all, http is not exactly in trouble. Nevertheless, I think that it's probably true that maintaining a federated protocol that is also an easy, seamless, user-facing piece of software is most likely a tall order.

Also it saddens me that LibreSignal is effectively dead now, along with any future third-party clients. I think forking the Signal server and (later) adding federation could spark a community of free and secure messenger apps for the 21st century.

Even if that means starting with an empty user base. After all, most of my contacts with Signal only ever use it to contact me, it wouldn't be difficult to convince them to change app.

E-mail's biggest problem is that many, many, many people get it wrong either through configuration snafus or a holier-than-thou approach to how it talks to other servers. It's a miracle that it has managed to function as well as it has; and has done so only only out of sheer necessity.

The problems that e-mail face are the problems that Moxie doesn't want to deal with. If other people want to go for a protocol that has interoperability that's fine, but he wants no part in it. He has no obligation to provide a service to clients he doesn't want connecting and he's right to demand that those who use "Signal" in their name cease its use so to not confuse their attempts with his own.

We already saw a revolt when Signal (when it was known as "TextSecure") went away from its SMS model to a client-server one, leading to a version that still relies on SMS. The point of switching away was to further remove metadata that otherwise would have become exposed. This demonstrates that the type of people who want to go against Moxie's wishes are the type that are to get this implemented incorrectly.

> Is it unencrypted? Sure, but it doesn't matter though. Because we are willingly trading that for a capable search engine and a good web interface. Trade secrets aren't communicated over email anyway.

Your username should be enough to tell you that trade secrets are traded over e-mail routinely.

A multitude of inappropriate material that should not be shared via e-mail is done so on a regular basis. If you work at any company that has credit card numbers being used for either expenses or customer details, you'll quickly find that with a search for 16-digit strings within e-mails will give results.

The problem you're neglecting to acknowledge here is that data at rest can be left unencrypted but overall has no business being unencrypted when in transit. If data from party A is meant for party B (and C, D, E, F, and so on) then any party that is not involved has no business knowing about its contents other than where it is destined to--and even that is questionable.

Those who favour convenience over security are part of a huge problem that faces the Internet.

> I think Moxie is missing the point. He's emulating WhatsApp, but you can't beat WhatsApp at their own game. Did WhatsApp really deliver encryption to 1 billion users? Well, those are 1 billion users that probably won't use Signal or chat with Signal users. Oops.

Moxie isn't trying to beat WhatsApp at its game; he in fact went and improved it by incorporating aspects of Signal into it [1]. Signal is meant to be something else and not something to directly compete with WhatsApp on. Signal and WhatsApp cater to different groups and markets.

[1] https://whispersystems.org/blog/whatsapp-complete/

Let's take that punch, roll with it, and redirect its energy. If centralized efforts, much like BDFLs, are looking like a good option for development cycles, okay. How can we wield that knowledge, but also build lifecycles around it that can help us buy back the powers and critical freedoms of federated systems?