71–80 of 290 posts
Earlier quoted context omitted.
The solution is simple. Make the decentralized systems social, with reputation.
And that then is extremely easy to abuse as soon as you have enough people with high rank enough deciding to start to misbehave.
Lots of FUD in the opening paragraphs ("no changes to server code since April!!1!"). I stopped reading after that
I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…
I had a similar experience with Matrix/Element. I was using the desktop app to chat with a friend, and while we were able to get some end-to-end encryption working, it was a huge pain the butt, and if two software engineers struggled this much to get the damn thing working, there's no way in hell that I'm convincing my parents to use it. To me, we have to accept the incremental wins where we can get them; getting my…
The killer app for Matrix for most people won't be ability to run your own home server, but the easy generalization of Matrix to things like Reddit/HN with good integration with 1-1 chat someday will be. Also organizational usage. That of course is way cooler than Signal "not being facebook". So biding our time is fine.
When the time does come, we should probably campaign for HN to be officially bridged with Matrix too :D.
Earlier quoted context omitted.
Do we have a way to verify that the App Store apps are actually running the open source (as published) code?
Builds on Android have been (mostly) reproducible since 2016: https://signal.org/blog/reproducible-android/ Looks like the situation is more complicated and still unresolved for iOS: https://github.com/signalapp/Signal-iOS/issues/641
I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…
"While that is somewhat true — at least by the metric of “secure messengers your granny can use”, there are some promising alternatives who are especially focused on decentralizing E2EE communications.
Nobody's saying there's a better alternative already, which seems to be your main gripe. The point is that Signal's model is still imperfect, and it's worth improving upon.
>If we could do better, we would have done better by now.
To claim this regarding tech, of all fields? I seriously can't imagine what would have to happen to make me think that everything has already been invented, and what we've got now is the best we'll ever get.
As I wrote in https://news.ycombinator.com/item?id=25795575 - WhatsApp: Oh wait, SMS etc. is completely insecure - Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy - Matrix: Oh wait, even benevolent centralization is an unnecessary risk It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a pu…
In fairness, I think WhatsApp's value proposition is and was as little more than 'just' oh wait, sms etc. is completely insecure. I don't think the majority really cared about that (especially since end-to-end encryption was a later addition). I think most people primarily started using WhatsApp because a) it was (is) free b) cross-platform c) worked very reliably
As I wrote in https://news.ycombinator.com/item?id=25795575 - WhatsApp: Oh wait, SMS etc. is completely insecure - Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy - Matrix: Oh wait, even benevolent centralization is an unnecessary risk It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a pu…
One thing that I think will always give Signal and WhatsApp an edge over something like Matrix is that it's simply tied to a phone number. You don't "make an account" and have to memorize a password or anything, it just falls into place like any other texting app. The barrier to entry is about as close to frictionless as possible.
Earlier quoted context omitted.
The solution is simple. Make the decentralized systems social, with reputation.
Will the arbiter of reputations be central or decentralized?
For the longest time, Signal wouldn’t work without Google Play Services, but Moxie (the founder of Open Whisper Systems and maintainer of Signal) finally fixed this in 2017. There was also a long time when Signal was only available on the Google Play Store. Why do I make a big deal out of Google Play and Google Play Services? Well, some people might trust Google, the company. But up against nation states, it’s no con…
Lots of FUD in the opening paragraphs ("no changes to server code since April!!1!"). I stopped reading after that
https://github.com/signalapp/Signal-Server
If you go here https://github.com/signalapp you can see there were changes 8 hours ago.
So yes no public changes have been pushed, but changes are happening. It is fair to ask what changes are being pushed given their push for privacy.
How much do you want to trust here?