Live data from Hacker News

Drawbacks of P2P and a defense of Signal

changelog.complete.org

181–190 of 215 posts

Re: Drawbacks of P2P and a defense of Signal

#181
post #94

Earlier quoted context omitted.

>Yet another [...] post that completely ignores the fact that XMPP is still alive and kicking I didn't downvote but your comment doesn't help me because it's what I call "generic & enthusiastic evangelism" that does not actually engage any of the concrete arguments in the blog post . An example of another comment that does try to address the author's issues is the one from arathorn[1] and I hope that one gets upvoted…

Hmm.. I couldn't send "my car broke down" on Signal because it's one service was down for reasons entirely unrelated to my use. One can use email and have an address at Google and one at work, and know these data points for a friend. One can use a phone and have multiple service providers (in some countries multiple sims for costs, in others legacy landlines.) One can use WhatsApp, Signal or Slack and then you need t…

> Hmm.. I couldn't send "my car broke down" on Signal because it's one service was down for reasons entirely unrelated to my use.

This happened to gmail recently, too, and my realtor couldn't send me contracts during a bidding war. In the case of gmail, it was an accidental reduction of provisioning to an internal service (perhaps easy to predict if you ignore the enormous complexity of the googleverse). In the case of Signal, it was a result of a scaling suddenly and faster than they could be expected to predict (perhaps easy to predict, but not a certainty; a risk in any case for a small operation like Signal).

Re: Drawbacks of P2P and a defense of Signal

#182
post #148

Earlier quoted context omitted.

Only one branch: master Last updated: 9 months ago Unless I am missing something obvious in GitHub UI.

They don't actually develop on github, but code goes there every now and then. Not ideal, but better than nothing imo

And who knows if it's actually the software they deploy too.

Re: Drawbacks of P2P and a defense of Signal

#183
post #148

Earlier quoted context omitted.

They don't actually develop on github, but code goes there every now and then. Not ideal, but better than nothing imo

And who knows if it's actually the software they deploy too.

> And who knows if it's actually the software they deploy too.

The whole literal point of the protocol is so that you don't have to trust the server, assuming you trust the client and protocol.

Re: Drawbacks of P2P and a defense of Signal

#185
post #25

Earlier quoted context omitted.

> Signal would grow immensely in my eyes if they made the server code open source [SEE EDIT], and allowed an easy way to set the centralised server address in the Signal app. The current server would be the default, and perhaps changing the server would be hidden in Advanced Options for now. I feel like this misses the point of what Signal is. It's not just software, it is the network as well . The client is a client…

> People seem to have an expectation that Signal server API is public, and that it should allow any compatible client to connect That's because people have a reasonable assumption that a single actor (however good it is) should not have power over all of our communications. That's why we had federated networks in the first place (HTTP, SMTP, XMPP, DNS). Avoiding vendor lock-in is an important feature for most people.

Do people not realise that lots of single actors have power over all their communications°? Their ISP, for instance.

° Let's gloss over the fact that all here is hyperbole, unless you use a single mechanism / medium for communicating with everyone.

Re: Drawbacks of P2P and a defense of Signal

#186
post #160

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

Can XMPP do encrypted group chat yet? I ran a medium-small sized XMPP community for many years, and eventually the community abandoned it and went back to IRC because it had better client/bot support. Matrix has a really good solution for end to end encrypted group chat, so I haven't seriously looked back at XMPP since then. They were the first ones with a decent solution to the most important feature I needed in dec…

> Matrix has a really good solution for end to end encrypted group chat

It's basically the same encryption scheme as Jabber/XMPP uses with OMEMO. The two were developed around the same time. On Jabber existing rooms need to be set to "members only" and "non-anonymous" for encrypted groupchat to take place because Jabber multi-user chats enable using nicknames (only the MUC operators know your address) which prevents clients from querying each other's key.

> I had to bundle something like 30 megs of jar files for a simple hello world app.

That sounds horrible. There's pretty good XMPP libraries around nowadays, like slixmpp if python is your thing. There's also a WIP Rust xmpp library if you'd rather.

> Also some silly things like ejabberd refusing to hash passwords

That sounds creepy. However, prosody does that very well though. And it seems ejabberd supports SCRAM authentication since 2007?

> Matrix, with Element (...) If XMPP has anything like that

ConverseJS is a web-based Jabber/XMPP client that does encrypted groupchat. It's supported by other clients as well (such as Conversations on Android). Movim, the more popular Jabber web client (because it has social features) does not support OMEMO yet unfortunately.

ConverseJS may not be as user-friendly as Element though because they don't have (yet?) the $$$$$$ of VC/government money matrix has.

> still working on getting a committee together to form the standards

There is a bureaucratic tendency around the XMPP Standards Foundation, because standardization is very important to avoid lock-in. However client devs have pushed features before/meanwhile publishing specifications and bureaucracy does not seem to be a concern for (some?) devs in practice.

Re: Drawbacks of P2P and a defense of Signal

#188
post #65

Earlier quoted context omitted.

The three servers are federated with each other and the one of them is federated to the broader matrix.org network. I've found that loading the larger rooms from the matrix.org network can cause a bit of lag for the few dozen or so users on my servers but once the rooms have synced up that issue goes away. I don't administer the servers personally so I don't know exactly what the issue is but I have a feeling it's du…

Is seems that this just helps the argument of how inefficient Synapse is. 12GB ram is quite beefy server. the issue is that when you want to federate your server needs to be able to handle similar loads as the server you are federating with.... So not like email where you can have tiny server and still be part if the network.

You're right, let me explain my perspective.

I have an old laptop running a bunch of different services, three of which are matrix servers. The matrix servers generally run fine with the modest amount of ram provisioned to them (2-4GB IIRC) with the exception of hiccups that occur when a user joins large federated rooms (we're talking several thousand users) and these hiccups only last for a few seconds and until the room has finished syncing to my server. The hiccups manifest as "Unable to connect to server" messages on clients which only delays messages from being transmitted to the server by a few seconds.

From my understanding once a single user has joined these rooms and triggered the server side sync these hiccups will not happen again once another user on my server joins the same rooms as the data is already synced on the server. Furthermore there are relatively few rooms that have the number of users necessary (1000s) to trigger the issue one time join issue.

To remedy this issue and for general network reorganization purposes I intend to migrate non-synapse VMs off of the laptop and onto other hardware and then I would simply delegate the old laptop for the matrix servers and scale the three VMs to give them 1/3 of the available ram whether they need it or not. I mispoke last night when I said 12gb by the way, as the laptop only holds 32gb ram so the available ram could be (32 - (ram for hypervisor) / 3)

To bring it all back to the thing I care most about which is the over all cost, if the laptop cost $300USD and I run 3 servers on it my hardware cost per server is $100 which I consider to be trivial. This is 20 cups of fancy coffee and more importantly many hobbyists already have a spare laptop sitting around or can find one for quite an affordable price.

I hope this clarifies my comment.

Re: Drawbacks of P2P and a defense of Signal

#189
post #89

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

I'm surprised to hear xmpp on mobile works for people. I tried a few times with a friend. I'm on Android, she has an iPhone. And it always was too unreliable. The worst part is that half of the time messages are not delivered or very late. But there are also problems with attachments. We tried different clients and servers.

Yes it works, there's a bunch of standards (XEPs) describing how a client/server should handle unreliable connections, push notifications, etc. However, not all servers respect these. If you're setting up your own, it's easy to enable though.

Also a problem is iOS clients. Developing on iOS requires lock-in into the Apple ecosystem and most XMPP folks are free-software people so nobody will bother to buy Apple hardware/software specifically to develop for their closed ecosystem (i.e. unpaid labor for a multi-billion corporation), although i'm sure a lot of folks would be happy to do just that if that was sponsored work (donations, grants).

On Android, Conversations (or its forks Quicksy/Snikket) is the best. ChatSecure on iOS has been buggy for years (every time i tried with someone with an iPhone), but nowadays Siskin appears to be a good iOS client, though i haven't had the hardware/system to try it myself.

Re: Drawbacks of P2P and a defense of Signal

#190
post #86
post #85

Earlier quoted context omitted.

Isn't Signal a non profit? Much different incentives.

Are all non-profit organizations good? What stops Signal from becoming for-profit in the future?

Good point. OpenAI was a non-profit, but then they changed to be for-profit and were acquired by Microsoft. Same could happen to Signal.
Post reply on HN