Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Privacy versus Freedom

matrix.org

Post reply on HN
Print view View original

181–190 of 209 posts

Re: On Privacy versus Freedom

#181

Post by Arathorn »

Arathorn wrote: post #162
progval wrote: post #158

Earlier quoted context omitted.

I only have experience with the IRC one, which is ok, but I think it deserves to still be considered Beta (see https://news.ycombinator.com/item?id=21944035 ) Regarding Bifrost, it's the first time I hear about it. I'm glad it exists. Is there an hosted instance that allows me to access Matrix rooms without installing anything other than an XMPP client? I can't find any info about it other than the code repo.

The IRC bridge shouldn’t restart that frequently (and we’re in the process of decoupling the irc connectors from the bridge itself so we can fix bugs in the bridge without bouncing all its connections). Membership should categorically be synced correctly - if you ban a Matrix user on IRC their Matrix side should be kicked out too. If not, it’s a bug and we need to know the details asap. The only scenario I can think…

#matrix#matrix.org@half-shot.uk is the community one (and would take you to matrix from xmpp)

Re: On Privacy versus Freedom

#182

Post by zzo38computer »

I think that protocols that are simple and open should be used, rather than very complicated and messy ones. Text-based also helps since it allows to use without specialized software. IRC is designed like this and I think it is good.

Re: On Privacy versus Freedom

#183

Post by Dddd50000 »

evgen wrote: post #170
hellcow wrote: post #164

Earlier quoted context omitted.

I see you're formerly from FB. It's not up to us to reverse engineer a binary every update to guess if it's secure... It's up to Facebook, which has time and again proven that it is absolutely not trustworthy, to open its code and make builds auditable, inspectable, and reproducible. This is what ANY secure software does. That's the cost of entry. Imagine if OpenSSH were closed and its devs issued the same response y…

Actually it _is_ up to you; put up or shut up is a fairly well-known principle. Find the backdoor and make yourself famous, or continue to whine and listen to everyone laugh. I left FB because it was getting too creepy and I would not trust 99% of FB dev with a single shred of my personal info, but the code is right there for you and people who actually have skills to disassemble and examine. They are under no obliga…

Random people are not in obiligation for Facebook to constantly reverse-engineer their binary code just because they do not want to publish their sources. This is not a criminal trial, but engineering. A mere doubt might be well enough to look for other solutions.

All that money and effort is probably better spent in e. g. developing alternative communication systems.

Re: On Privacy versus Freedom

#184

Post by olah_1 »

tptacek wrote: post #82
novok wrote: post #22

Moxie / signal chooses pragmatism over purity, and is striving towards improve the status quo bit by bit vs a pure perfect solution that never ships, even though that improvement has it's own vital problems. You can see it in his choices, and you can see how they want to eventually deliver improvements like no phone numbers, with them working on things like secure value recovery. I kind of wish he spelled it out full…

I would make the opposite argument: that at pretty much every point along the way, Signal has chosen purity over pragmatism. Which is why they didn't even have user profiles until recently, why they're just now getting group access control for a Slack-y experience, and why it's taking a fairly spectacular amount of engineering to get them off of phone numbers. Signal has a track record of delaying features common to…

I completely agree. Ironically, centralization has not helped them move faster.

They won’t have usable group messaging without proper “mentions only” notifications. I’ve tried to explain so many times on the forum that they don’t need usernames for this. Just allow us to configure our own list of keywords we want to be notified of.

It’s very frustrating to keep up with the development of the apps. I wouldn’t recommend it.

Re: On Privacy versus Freedom

#185

Post by olah_1 »

evgen wrote: post #170
hellcow wrote: post #164

Earlier quoted context omitted.

I see you're formerly from FB. It's not up to us to reverse engineer a binary every update to guess if it's secure... It's up to Facebook, which has time and again proven that it is absolutely not trustworthy, to open its code and make builds auditable, inspectable, and reproducible. This is what ANY secure software does. That's the cost of entry. Imagine if OpenSSH were closed and its devs issued the same response y…

Actually it _is_ up to you; put up or shut up is a fairly well-known principle. Find the backdoor and make yourself famous, or continue to whine and listen to everyone laugh. I left FB because it was getting too creepy and I would not trust 99% of FB dev with a single shred of my personal info, but the code is right there for you and people who actually have skills to disassemble and examine. They are under no obliga…

There’s no obligation for Whatsapp to prove that there is no backdoor? Yeah I guess when a product is too big to fail, they’re not obligated to do anything. True.

Re: On Privacy versus Freedom

#186

Post by tptacek »

olah_1 wrote: post #184
tptacek wrote: post #82

Earlier quoted context omitted.

I would make the opposite argument: that at pretty much every point along the way, Signal has chosen purity over pragmatism. Which is why they didn't even have user profiles until recently, why they're just now getting group access control for a Slack-y experience, and why it's taking a fairly spectacular amount of engineering to get them off of phone numbers. Signal has a track record of delaying features common to…

I completely agree. Ironically, centralization has not helped them move faster. They won’t have usable group messaging without proper “mentions only” notifications. I’ve tried to explain so many times on the forum that they don’t need usernames for this. Just allow us to configure our own list of keywords we want to be notified of. It’s very frustrating to keep up with the development of the apps. I wouldn’t recommen…

You can make this argument about anyone simply by changing the metrics you're judging them by. So if you judge Signal by usability and messaging features, of course centralization isn't paying off. But that's not what Signal is optimizing for. On privacy features, no mainstream messaging app is doing anything resembling what Signal is doing; Signal's "competitors"† obtain their messaging features by storing vast amounts of valuable metadata in plaintext on their servers. Signal gets those features, with privacy assurance and without accumulating the hazmat, by inventing and deploying new high-end cryptography.

Consider how long it's taken Matrix to get to a point where it's just E2E by default. That's table stakes, Matrix very much wants to get there, and if they're lucky (see downthread) they'll be able to flip that switch in Q1 2020.

If Signal invents some new feature based on Attribute Based Encryption or pairing curves or PQ exchanges or whatever, they'll have it deployed within a week of merging the code into master. You've seen them do things like that repeatedly. That's what centralization buys.

† I'm not sure I accept the premise that it has competitors; the companies you're thinking of are, to my mind, competing more with WhatsApp and Slack than Signal.

Re: On Privacy versus Freedom

#187

Post by Arathorn »

tptacek wrote: post #186
olah_1 wrote: post #184

Earlier quoted context omitted.

I completely agree. Ironically, centralization has not helped them move faster. They won’t have usable group messaging without proper “mentions only” notifications. I’ve tried to explain so many times on the forum that they don’t need usernames for this. Just allow us to configure our own list of keywords we want to be notified of. It’s very frustrating to keep up with the development of the apps. I wouldn’t recommen…

You can make this argument about anyone simply by changing the metrics you're judging them by. So if you judge Signal by usability and messaging features, of course centralization isn't paying off. But that's not what Signal is optimizing for. On privacy features, no mainstream messaging app is doing anything resembling what Signal is doing; Signal's "competitors"† obtain their messaging features by storing vast amou…

The slow bit of Matrix’s E2E by default isn’t the roll-out; we’ll also flip the switch when we get to that point. The problem instead was that we implemented way too many pre-E2E features (serverside search, etc) and have had to reimplement them to force everyone onto E2E.

So yeah, Signal’s approach to only roll out features if they’re privacy preserving is great. But it’s nothing to do with centralisation/decentralisation.

Re: On Privacy versus Freedom

#188

Post by tptacek »

Arathorn wrote: post #187
tptacek wrote: post #186

Earlier quoted context omitted.

You can make this argument about anyone simply by changing the metrics you're judging them by. So if you judge Signal by usability and messaging features, of course centralization isn't paying off. But that's not what Signal is optimizing for. On privacy features, no mainstream messaging app is doing anything resembling what Signal is doing; Signal's "competitors"† obtain their messaging features by storing vast amou…

The slow bit of Matrix’s E2E by default isn’t the roll-out; we’ll also flip the switch when we get to that point. The problem instead was that we implemented way too many pre-E2E features (serverside search, etc) and have had to reimplement them to force everyone onto E2E. So yeah, Signal’s approach to only roll out features if they’re privacy preserving is great. But it’s nothing to do with centralisation/decentrali…

Do all the Matrix clients implement the E2E functionality that exists today, the functionality people talk about when they say Matrix is E2E encrypted? If not: that's decentralization in action.

Downthread, you were explaining that you're waiting to flip a switch to require E2E support for clients, and that there's a "pantalaimon" proxy service that people are going to have to use to retrofit E2E onto clients that don't support it. So I think I know the answer to this.

I'm always going to come across like I'm rooting against Matrix, which isn't what's happening.

Re: On Privacy versus Freedom

#189

Post by mirz23 »

kitd wrote: post #154
blindgeek wrote: post #110

My biggest problem with messaging applications as a whole is that I need so many of them. I have a few contacts who are reachable with Signal, a few more who are reachable on Hangouts or whatever Google is calling its latest thing, and a few more who are reachable with Skype. That's three programs, to communicate with three different subsets of people. I'm sure if I used Facebook Messenger and Whatsapp, I'd have two…

A 'chat' client in the style of eg WhatsApp, but based on S/MIME over SMTP/IMAP, seems perfectly doable, and appropriate for most people's needs, with the obvious advantage of being supported by traditional email clients as a fallback. Additionally, message threading is the feature I most appreciate in a messaging system, but which is painfully lacking in most products (and no, Slack doesn't cut it). SMTP has built-i…

Check out deltachat, it uses autocrypt and pgp for e2ee, smtp for transport and has a UI based on signal. It is compatible with autocrypt-supporting e-mail clients like thunderbird

Re: On Privacy versus Freedom

#190

Post by prophesi »

viro wrote: post #176
sudosysgen wrote: post #173

Earlier quoted context omitted.

That complexity is useful and justified.

https://matrix.org/docs/guides/moderation/#kicking-and-banni... . FFS that is a lot of text just to kick a nazi out of the cybersecurity chat .. who is the mod for that big ass chat? I have't the faintest clue. No easy way for me to tell.

For one, it's a lot of text for the myriad of ways you can moderate your server/chat. It's just a paragraph for kicking "a nazi out of the cybersecurity chat."

And two, "In Riot, Admins are shown in the membership list with a golden shield, and Moderators are shown with a silver shield. Other clients use similar metaphors."

If you actually used Matrix, you'd notice in whatever client that you're using that it's actually very easy to see who the mods are.

Post reply on HN