Other than matrix, what are some other alternatives or upcomers in the messaging field I should try. Matrix still has a high burden of me setting up my own server and maintaining it. Till their P2P solution doesnt release, they have their own metadata problem.
Moxie Marlinspike has a plan to reclaim our privacy
161–170 of 237 posts
Re: Moxie Marlinspike has a plan to reclaim our privacy
#162Earlier quoted context omitted.
Far from "compromise", Signal implements the only privacy conscious possibility here. Without automatic contact discovery "Signal private messenger" would be forced to default to not-private for all contacts until manual confirmation could occur. Adding UX friction to the primary use case would hinder adoption among non security-enthusiasts. With protection for the casual user eliminated, the truly sensitive communic…
Alternatively, users could be given the option to opt-out of automated contact discovery so that most users have the current behaviour but people who don't want others to find out they've started using Signal (there are dozens of fairly serious situations where this could be very bad -- dismissing them like you did by calling them "elite" betrays you don't actually care about the issue being described). I mean, the f…
I imagine that getting caught using Signal could be dangerous, whether to an "elite user" planning a one way trip from Hawaii to Russia with a layover in HK, or even to a minor with an abusive parent-over-shoulder. In some countries, a single boolean of metadata could put you in jail or worse. A future Signal update (usernames?) may address this use case.
But update or no, it's irresponsible to proffer these scenarios as relevant to the typical westerner, especially given the abysmal privacy of the popular alternatives.
If you're reading this in English, Signal is the most effective tool for private communications available to you.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#163It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…
In general, I agree. However, their decision to force PINs broke Signal for one of my non-technical contacts, to this day (despite them supposedly offering an opt-out now). This person opens Signal, gets some weird confusing modal dialog, and is now stuck. There is supposed to be a way to opt out without having to set and remember a PIN now, but I was unable to guide this person to find it, and I can't exactly travel…
I'm not going to say anything new when I say that this is the other side of the centralization coin.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#164Earlier quoted context omitted.
You mention Signal is fine as an insecure messenger. I'd be very curious if you know of an app that is fine _secure_ messenger. Do you know of one, or is your point that nothing that's made generally available can be considered secure?
If you can convince your contacts to use it, and they're on platforms with good clients, XMPP with OMEMO ticks all the boxes, and has since 4-5 years ago. It's properly federated, with a diversity of client and server implementations (something that will likely never happen with Matrix due to the excessive complexity and poor design of the protocol), servers are easy to deploy and don't need a lot of system resources…
You mention the "excessive complexity" of the matrix protocol, so I am a bit surprised that you advertise XMPP as an alternative. I never have looked at either protocols, but I remember that in the days when jabber looked like the next thing, it was strongly criticised for being overly complex and in particular using xml being unsuitable for a chat protocol. So I'm wondering if something changed and if you can I've examples of what is complex in matrix but easy in XMPP?
Re: Moxie Marlinspike has a plan to reclaim our privacy
#165Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…
In Dutch we have a saying: The best helmsmen stand on the shore. (Those who watch always know better than those who do.)
I also think there is some envy in it. Some people wish they had the same success and only can criticize in envy.
Fact is right now Signal is the only safe option for a messenger that hides your messages and other meta data.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#166It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…
Remember,
Marlinspike is the guy who wrote a protocol with a built in MITM functionality, and had enough chutzpah to call it end-to-end encryption, and said that UI feedback for key changes will "confuse users."
A bad, and weak encryption scheme he wants. It's like the previous discredited idea: "let's put SSL/TLS everywhere, but trust self signed certs because otherwise we will confuse users"
Re: Moxie Marlinspike has a plan to reclaim our privacy
#167The fundamental point is that he's doing this for good reasons, beyond the trivial in issues lists of a git backed repo: he believes in what he is doing. And, he's doing it in ways which cryptographers I respect relate to: its visible work and its open to critique. I have my own kibbitz about stuff down in the weeds, I think the decision to make a cellphone/SMS identity key in the recruitment and to have one device p…
Cryptography is a black, and white field. Either crypto algorithm is deemed 99.9999999999+% physically unbreakable, or anything less, and it doesn't work.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#168Earlier quoted context omitted.
Indeed it's a protocol. A horrendous, reinvent-everything, excessively complex mess of a protocol, that the developers of the reference server have gone on record saying that they don't expect anyone else to be able to successfully implement.
> the developers of the reference server have gone on record saying that they don't expect anyone else to be able to successfully implement. Despite this, there are multiple alternative server implementations. Dendrite is the next gen server from the same core team, though Construct and Conduit are fledgling servers from different groups.
Neither Construct nor Conduit are complete implementations, and may never be. The protocol developers were actively discouraging them at one point too.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#169This old post from Moxie Marlinspike in 2012 about having the worst material possessions made a huge impact on me for some unclear reason. Fun read. https://moxie.org/2012/11/27/the-worst.html
Ahh, I'm from the camp of "the worst". My girlfriend is from that "the best" camp, but doesn't have too much money. So we can't use that little more expensive aluminum foil, because it's for "special occasions". She got upset because I've slightly damaged cheapest workshop vacuum (it's cheapest, but happened to be rather good quality) using it for heavy duty tasks (and saved 50x it's price by doing those tasks myself). Is this the live one should live? To be slave of your possesions? Do you really need the best tools from the start? I've started with cheapest possible ones and if they break too soon, I'll get better ones. But for now, the almost cheapest ones fully earned their worth.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#170Earlier quoted context omitted.
If you can convince your contacts to use it, and they're on platforms with good clients, XMPP with OMEMO ticks all the boxes, and has since 4-5 years ago. It's properly federated, with a diversity of client and server implementations (something that will likely never happen with Matrix due to the excessive complexity and poor design of the protocol), servers are easy to deploy and don't need a lot of system resources…
You mention the "excessive complexity" of the matrix protocol, so I am a bit surprised that you advertise XMPP as an alternative. I never have looked at either protocols, but I remember that in the days when jabber looked like the next thing, it was strongly criticised for being overly complex and in particular using xml being unsuitable for a chat protocol. So I'm wondering if something changed and if you can I've e…
The use of XML is a bit unfortunate, but these days there are a huge range of mature XML libraries for any language, with a variety of different styles of API to suit the programmer / program design, so the use of XML doesn't really affect implementation that much. Not to mention there are decent XMPP libraries for many languages, so only the application-specific logic needs to be implemented.
XMPP has a clear design based around general concepts, that make it useful for a wide variety of messaging-type applications. The criticism I hear often seems to come from people approaching it as an IM protocol, and then being upset that they need to learn some general XMPP concepts to understand how IM is implemented on top of XMPP. The reality is that it's a general protocol, which can be used to implement a variety of different real-time messaging applications. That generality can cause people to think it's overcomplex if they approach it as if it's designed purely for IM.
You'll often find XMPP as the underlying tech for IoT real-time communication, or for signaling/presence (as an alternative to SIP) for videoconferencing (for example, Jitsi Meet uses XMPP for signaling). In this way, XMPP is quite widely used, but often not in a way that people are aware of.
By contrast, Matrix appears to attempt a clean-sheet design without learning any of the lessons of the many protocols that came before it. The protocol is heavy on special cases, has many serious inefficiencies (many coming from an apparent desire to make the protocol "more Web"), and especially on the server side requires a large amount of implementation work simply to get to a basic level of functionality (as opposed to XMPP, where a simple server for a basic set of functionality can be written in a very small amount of code, especially if you make use of an existing XML library).
I've written code for both protocols (as well as many other protocols with similar goals) and will do my best to avoid touching Matrix ever again.