Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Privacy versus Freedom

matrix.org

Post reply on HN
Print view View original

91–100 of 209 posts

Re: On Privacy versus Freedom

#91

Post by amluto »

tzs wrote: post #50
nirs wrote: post #24

Earlier quoted context omitted.

Can you explain how GPL prohibits distribution via app stores?

Generally, the way app stores work is that the developer uploads a copy of the app to the app store, and then the app store makes and distributes copies of that for people that request the app. Note that since it is the app store making those copies for end users, the app store needs permission of the copyright owner to do so. There will be something in the agreement between the app developer and the app store that s…

IMO this is pure laziness on the part of the app store. Any store could just say “this app is licensed to you under the GPL — download source here.”

Even ignoring licensing, I think app stores could add considerable value by offering reproducible builds. Let developers upload source, verify the has (git tree hash or plain sha256sum), and rebuild in a sandbox server-side. Reject the submission unless the binary’s hash matches the developer’s.

Now stick a badge on it: “verified open-source build”. And give it a small bonus in ranking relative to other apps.

Re: On Privacy versus Freedom

#92

Post by tialaramex »

alerighi wrote: post #65
tialaramex wrote: post #2

I think the timing makes Moxie's point very well without him saying a thing. All these years later Matrix only has... The ambition to some day try to offer the core privacy features Signal already delivered back then. Some of the most basic stuff is, you believe, almost kinda sorta done. This is, to be clear, much better than just sitting back insisting you were right but not lifting a finger. But for an actual user…

Talking about privacy of a system that requires you to sign up with a phone number, that in my country (and in most other European countries as far as I know, and without talking about non democratic regimes) is required to be associated with your ID (it's illegal to buy a SIM without registration) is nonsense. And you know another thing? Email works great to me, and it's decentralized. I have my email server, with m…

> I can even send encrypted emails with GnuPG without any problem, and it's as secure as Signal, if not better.

Alas this requires a fairly contorted definition of "secure" to be true. The cryptography in GnuPG has plenty of problems even if you insist on manually doing everything from your own CLI tools which maybe don't suffer the problems from EFail.

Mostly it's just kinda old, AEAD hadn't been conceived when Phil wrote PGP you know. That's a big foundational idea for modern crypto and instead PGP had to kind of fudge a separate MAC into the design and hope that's good enough.

When you send your GnuPG encrypted mail, how do you decide which cryptographic primitives to use? With Signal the whole _point_ of Moxie's decision is that Signal gets to insist on all clients having whatever the best option is, so that's always used. But in GnuPG you've got to guess, what might the other participant's client be able to handle? If you guess wrong then your email is unreadable, or, worse, bad guys might be able to read it more easily.

> in most other European countries as far as I know

In England at least SIMs are available in the pound shop. You buy a SIM with cash (a single bright coin) and it comes with a phone number. British people do not carry any ID as a habit, and I make a point of never having ID unless I've been specifically asked to bring it for a good reason (e.g. to leave the country or when I got a job that required security clearance).

Re: On Privacy versus Freedom

#93

Post by Arathorn »

tptacek wrote: post #83
StudentStuff wrote: post #4

Earlier quoted context omitted.

>All these years later Matrix only has... The ambition to some day try to offer the core privacy features Signal already delivered back then. E2E on Matrix works, plus key verification is easier than on Signal. Managing metadata is hard, but my Matrix homeserver doesn't have my phone number (unlike Signal) and does not require Google Cloud Messaging. I can even run it on a PinePhone or Pocket CHIP! >But for an actual…

E2E in Matrix "works" with which Matrix clients? The whole point of a decentralized federated messaging protocol is to allow people to build their own clients. Do Matrix clients uniformly and interoperably support E2E today?

Nearly; we’re aiming to force on E2E by default at end of Jan (but it’s getting tight). There are at least 6 complete independent implementations, and once cross-signing lands it’s good to go. For clients/bots/bridges without E2E we have pantalaimon (a clientside daemon which you proxy all the traffic through in order to encrypt it).

Re: On Privacy versus Freedom

#94

Post by JoshuaMulliken »

3xblah wrote: post #86
samth wrote: post #31

One frustrating thing about Moxie's original post is that Signal derives huge amounts of value by piggybacking on an existing distributed federated network: the phone system. If phone numbers weren't an existing working identifiers that people had regardless of what OS, carrier, or messaging app, Signal as designed wouldn't work. People should think harder about how to replicate that experience, instead of how to app…

In his "The Ecosystem is Moving" talk at CCC, he had many presumptuous and dubious "arguments" but one regarding privacy of phone numbers was that a user's APN would be used to determine their phone number, so there was no point in trying to keep phone numbers private. This fails to account for the possibility of not using the cellular network. With unlocked smartphones, it is possible to remove the SIM card, clear a…

I believe he was speaking of Apple push notifications and google cloud messaging

Re: On Privacy versus Freedom

#95

Post by Klonoar »

3xblah wrote: post #86
samth wrote: post #31

One frustrating thing about Moxie's original post is that Signal derives huge amounts of value by piggybacking on an existing distributed federated network: the phone system. If phone numbers weren't an existing working identifiers that people had regardless of what OS, carrier, or messaging app, Signal as designed wouldn't work. People should think harder about how to replicate that experience, instead of how to app…

In his "The Ecosystem is Moving" talk at CCC, he had many presumptuous and dubious "arguments" but one regarding privacy of phone numbers was that a user's APN would be used to determine their phone number, so there was no point in trying to keep phone numbers private. This fails to account for the possibility of not using the cellular network. With unlocked smartphones, it is possible to remove the SIM card, clear a…

That's not the representative experience for most consumers/users. Most people do have a phone number, though, so it's easy enough to bootstrap with.

I might not agree with the phone number thing, but I recognize the tradeoff being made and am willing to begrudgingly accept that for right now, Signal/Moxie are probably making the right call. It's not like they're not moving to fix it anyway.

Also, unless I misunderstood him, the APN bit is referencing push notifications, and he's right - if that's out there, it could identify you not just by phone but by Apple account in general. You realistically can't use Signal without an Apple ID, as you couldn't get it from the store otherwise.

Re: On Privacy versus Freedom

#96

Post by haffenloher »

3xblah wrote: post #86
samth wrote: post #31

One frustrating thing about Moxie's original post is that Signal derives huge amounts of value by piggybacking on an existing distributed federated network: the phone system. If phone numbers weren't an existing working identifiers that people had regardless of what OS, carrier, or messaging app, Signal as designed wouldn't work. People should think harder about how to replicate that experience, instead of how to app…

In his "The Ecosystem is Moving" talk at CCC, he had many presumptuous and dubious "arguments" but one regarding privacy of phone numbers was that a user's APN would be used to determine their phone number, so there was no point in trying to keep phone numbers private. This fails to account for the possibility of not using the cellular network. With unlocked smartphones, it is possible to remove the SIM card, clear a…

In the context of this talk, APN means "Apple Push Network", I think. The concern is that even if the service doesn't ask for a phone number directly, it does still have an APN or GCM/FCM push token. Through the push provider, that token can probably be linked to the user's phone number.

> With unlocked smartphones, it is possible to remove the SIM card, clear any APN settings and access WiFi.

If you're willing to do all that, I suppose getting some free VoIP number for registering with Signal (e.g. through Textnow) won't be too much of a hassle?

Re: On Privacy versus Freedom

#97

Post by salawat »

tzs wrote: post #57
slipheen wrote: post #39

Earlier quoted context omitted.

Some people argue that the GPL2's clause "You may not impose any further restrictions on the recipients' exercise of the rights granted herein." is violated because you need to agree to additional terms from Apple to use the apps. https://www.fsf.org/news/2010-05-app-store-compliance In this case however, the code is under the GPLv3, which is far more problematic. It contains a "anti-tivoization" clause, which says y…

> In this case however, the code is under the GPLv3, which is far more problematic. It contains a "anti-tivoization" clause, which says you cannot require any "methods, procedures, authorization keys, or other information required to install and execute modified versions". That doesn't actually apply to the Apple app store. The "anti-tivoization" clause is narrowly written to only cover what Tivo did. Namely, providi…

>anything designed or sold for incorporation into a dwelling.

I'd be willing to make the argument that a program integrated into a previously owned computing device is a totally valid case for this clause to trigger under. Your computer is part of, and is increasingly integrated into your dwelling. The program being pulled down is just another module for it.

Re: On Privacy versus Freedom

#98

Post by goatsi »

alerighi wrote: post #65
tialaramex wrote: post #2

I think the timing makes Moxie's point very well without him saying a thing. All these years later Matrix only has... The ambition to some day try to offer the core privacy features Signal already delivered back then. Some of the most basic stuff is, you believe, almost kinda sorta done. This is, to be clear, much better than just sitting back insisting you were right but not lifting a finger. But for an actual user…

Talking about privacy of a system that requires you to sign up with a phone number, that in my country (and in most other European countries as far as I know, and without talking about non democratic regimes) is required to be associated with your ID (it's illegal to buy a SIM without registration) is nonsense. And you know another thing? Email works great to me, and it's decentralized. I have my email server, with m…

>I need a chat application where I can have a client that I can use in my terminal, and Signal doesn't do that

Have you looked at signald or Signal-CLI?

https://gitlab.com/thefinn93/signald https://github.com/AsamK/signal-cli

Re: On Privacy versus Freedom

#99

Post by skybrian »

tialaramex wrote: post #2

I think the timing makes Moxie's point very well without him saying a thing. All these years later Matrix only has... The ambition to some day try to offer the core privacy features Signal already delivered back then. Some of the most basic stuff is, you believe, almost kinda sorta done. This is, to be clear, much better than just sitting back insisting you were right but not lifting a finger. But for an actual user…

It seems like they are both right based on their values? Signal put privacy and security first, and Matrix put federation first.

They are both idealistic in their own way.

Re: On Privacy versus Freedom

#100

Post by upofadown »

thesorrow wrote: post #3

Email is flawed and will become a one way protocol to receive spam, newsletters and invoices just like paper mail. I think Matrix is our second chance to build a secure federated communication suite. So far it's going in the right direction...

If we didn't have email we would immediately have to invent something that did the same thing. The world needs non-real time text messaging way more than it needs real time text messaging. After all, we still have phones which work well real time. They don't work well at all for non-real time messaging. That is why we went to all that trouble to invent and use things like teletypes.
Post reply on HN