Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We can do better than Signal

icyphox.sh

Post reply on HN
Print view View original

131–140 of 290 posts

Re: We can do better than Signal

#131

Post by walrus01 »

stavros wrote: post #126
randoramax wrote: post #122

Earlier quoted context omitted.

We need to think of ways to run the various Matrix, Mastodon, peertube etc in tiny boxes in our homes! There is no real reason for not promoting self hosting. The same way i buy a small Nas or an amazon firetv stick, with apps, I would buy a small box with pihole, mastodon and matrix.

Have you tried running Mastodon and Matrix on a Pi? I'm not so confident it'd work, these aren't lean servers. I would love a tiny server I can run on my home server (for my tiny message volume), but Mastodon and Synapse are optimized for large servers.

synapse is actually quite tiny, but its use of an sqlite db on disk and other disk-write related activities, over a long term of months or years, seems quite likely to destroy a raspberry pi microsd card in much the same way that ordinary logging will destroy a microsd card. yes the rpi4 can boot from a USB-connected 'real' sata device now, which is an improvement.

Re: We can do better than Signal

#132

Post by codeulike »

BillyTheKing wrote: post #52
Ericson2314 wrote: post #13

As I wrote in https://news.ycombinator.com/item?id=25795575 - WhatsApp: Oh wait, SMS etc. is completely insecure - Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy - Matrix: Oh wait, even benevolent centralization is an unnecessary risk It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a pu…

In fairness, I think WhatsApp's value proposition is and was as little more than 'just' oh wait, sms etc. is completely insecure. I don't think the majority really cared about that (especially since end-to-end encryption was a later addition). I think most people primarily started using WhatsApp because a) it was (is) free b) cross-platform c) worked very reliably

Simple Groups and painless multimedia was what gave WhatsApp the edge in the early days

Re: We can do better than Signal

#133

Post by Evidlo »

stavros wrote: post #10

I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…

These are all complaints about the app's UI, not Matrix or federated networks.

> If we could do better, we would have done better by now.

I'm guessing you might have said something similar about a non-profit running a massively popular chat application 5 years ago.

The only pieces missing now are interoperability and community involvement.

Re: We can do better than Signal

#134

Post by StavrosK »

walrus01 wrote: post #131
stavros wrote: post #126

Earlier quoted context omitted.

Have you tried running Mastodon and Matrix on a Pi? I'm not so confident it'd work, these aren't lean servers. I would love a tiny server I can run on my home server (for my tiny message volume), but Mastodon and Synapse are optimized for large servers.

synapse is actually quite tiny, but its use of an sqlite db on disk and other disk-write related activities, over a long term of months or years, seems quite likely to destroy a raspberry pi microsd card in much the same way that ordinary logging will destroy a microsd card. yes the rpi4 can boot from a USB-connected 'real' sata device now, which is an improvement.

> synapse is actually quite tiny

Hmm, is it really? My server has a SSD so I don't care about writes, I just want it to be low on CPU and memory requirements.

Re: We can do better than Signal

#135

Post by tailspin2019 »

solstice wrote: post #129
tailspin2019 wrote: post #23

Earlier quoted context omitted.

Care to educate those of us who are confused by this?

See my other reply here: https://news.ycombinator.com/item?id=25812853

Thanks, wasn’t sure if you were saying that it was untrue that there were no changes or that it was not an issue that there weren’t.

Even so, I’ve yet to come across a software project in my career that didn’t have a fully stocked backlog of bugs, performance optimisations, security improvements etc.

In most cases if I find a project on GitHub that hasn’t been updated in 6 months, it’s usually a sign that it might be dead or languishing. Not saying that’s the case here, but the question seems valid.

Also not making a value judgement. Signal is free and open source, and the guys are rockstars.

But it does make me wonder if what’s running in production is a 6 month old build of that code, or is there more to it...

Re: We can do better than Signal

#136

Post by Arathorn »

tombert wrote: post #57
stavros wrote: post #10

I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…

I had a similar experience with Matrix/Element. I was using the desktop app to chat with a friend, and while we were able to get some end-to-end encryption working, it was a huge pain the butt, and if two software engineers struggled this much to get the damn thing working, there's no way in hell that I'm convincing my parents to use it. To me, we have to accept the incremental wins where we can get them; getting my…

Speaking as project lead for Matrix (and Element), I'm trying to understand the mixed feedback we've had this week, and somehow channel all the negativity into improving things. While some folks are clearly using it successfully and seem to like it, another bunch of people say "it was a huge pain in the butt to get E2EE working, and if it two software engineers struggled this much..." etc.

When did this E2EE failure happen (so I know if these are current bugs or ones fixed months/years ago)? What platforms was this (web, iOS & Android are entirely separate codebases)? What actually went wrong? The simple case of signing up and DMing someone should just work, and the E2EE should be transparent.

The main possible failure modes I'm aware of right now are:

* Risk of undecryptable messages during federation outages (due to messages being shared separately from their keys)

* Risk of verifying another user getting stuck if there are weird failures/edge cases we haven't spotted yet

* Verifying yourself when you log in on a new device has confusing UX, and there's a known bug that can stop keys being synced to the new login even once verified.

If anyone in the "I tried Matrix and it was awful" camp could give detailed feedback (either here, or on github.com/vector-im/element-{web,ios,android}/issues) then it would be genuinely useful for prioritising our work. At the moment the vast majority of negative feedback on HN has been "it sucked" without giving a hint of what actually went wrong.

Re: We can do better than Signal

#137

Post by kd913 »

alerighi wrote: post #86
stavros wrote: post #10

I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…

Nobody thinks about it but the most professionally used communication medium is the email, and part if not all of its success if not all its success is that is decentralized. A company cannot afford to use a service that can be closed and loose all the communications. Centralized services are single point of failure, and in that regard Signal is no better than WhatsApp, because yes, in theory you can run your own ser…

On the other hand, email is the single largest causes of cyber attacks.

The communication is not E2E encrypted (apart from a few GPG/SMIME users), no forward secrecy and barely any signature checks. Even if outlook, thunderbird maybe supports it, goodluck getting all the mobile versions to support it too.

The clients used to view emails suffer from the same problem with browsers so are subject to all the HTML/JS/CSS privacy attacks.

I wish all companies would move to something centralized solution where communication is guaranteed to only come from those within the same service. This way Sharon from HR won't open every link, download every crypto/ransomeware.

Maybe my IT could also save 150k a year by not having to send me phishing 'training' emails and instead deal with some decent forms of signature checking. Heck billions of dollars a year are wasted because of phishing, spam, crypto attacks because of email.

From my perspective, email is a shitty legacy tech from 1990s that should be moved to a modern solution that enables E2E encryption or signature checks at a minimum.

Re: We can do better than Signal

#138

Post by walrus01 »

StavrosK wrote: post #134
walrus01 wrote: post #131

Earlier quoted context omitted.

synapse is actually quite tiny, but its use of an sqlite db on disk and other disk-write related activities, over a long term of months or years, seems quite likely to destroy a raspberry pi microsd card in much the same way that ordinary logging will destroy a microsd card. yes the rpi4 can boot from a USB-connected 'real' sata device now, which is an improvement.

> synapse is actually quite tiny Hmm, is it really? My server has a SSD so I don't care about writes, I just want it to be low on CPU and memory requirements.

an entire synapse with its python environment is about 150MB of disk space occupied, before any user data starts getting written to the database.

chat for a group of about twenty people runs fine on a VM with 512MB of RAM. After boot about 300MB of the system RAM is occupied by the base minimal debian OS and other daemons (snmpd, etc), leaving plenty for python3.

this same machine also has a minimal nginx setup as the standard reverse proxy configuration for TLS1.2/TLS1.3 in front of the synapse daemon, which isn't set up for any crypto and only listens on localhost.

Re: We can do better than Signal

#139

Post by Evidlo »

lukevp wrote: post #42
CuriouslyC wrote: post #38

Earlier quoted context omitted.

The solution is simple. Make the decentralized systems social, with reputation.

How do you prevent bots giving each other reputation?

I can't believe I'm suggesting this, but maybe trade it through cryptocurrency. Pay a few bucks to create an account. It might get expensive to start a server and have others agree to federate with you though.

Could also just use regular money.

Re: We can do better than Signal

#140

Post by humanrebar »

codeulike wrote: post #132
BillyTheKing wrote: post #52

Earlier quoted context omitted.

In fairness, I think WhatsApp's value proposition is and was as little more than 'just' oh wait, sms etc. is completely insecure. I don't think the majority really cared about that (especially since end-to-end encryption was a later addition). I think most people primarily started using WhatsApp because a) it was (is) free b) cross-platform c) worked very reliably

Simple Groups and painless multimedia was what gave WhatsApp the edge in the early days

Liked "Simple Groups and painless multimedia was what gave WhatsApp the edge in the early days"

-------

^ That's and ultra low res photo sharing what you get when you group SMS/MMS with folks in the Apple ecosystem. You don't get it in WhatsApp, etc.

Post reply on HN