The Ecosystem Is Moving [video]

The Ecosystem Is Moving [video]
media.ccc.de

While he clearly understands it not only was but still is a very difficult problem to make a centralized service private (as he points out how much work has gone into making some basic aspects of Signal seem usably private), he doesn't want to admit the idea that someone could or should spend commensurate time also working on researching or improving decentralized systems :/. In the process, he ignores attempts to work on what I'd consider the primary problem (something someone thankfully poked him about during the Q&A, though I'd say not hard enough)--transport obfuscation--and thereby goes so far as to claim that decentralized systems are fundamentally less private (using an example involving peer-to-peer video/audio calls on Signal that they decided to instead route through their centralized servers) based on that assumption of non-private transports (as clearly we should all trust Moxie Marlinspike and the handful of people who work at Signal with our metadata over anyone else we might want to be able to choose to trust).

As part of this, he spends a lot of time trying to argue that people don't actually have any useful control in a decentralized system anyway, which is, of course, extremely convenient given how he doesn't really acknowledge that the entire point of his thesis is that he and his centralized organization not only should but in fact must maintain all the control so that he can follow the moving ecosystem :/. Meanwhile, he cites federated systems of the past as clear and unmitigated failures, including specifically IP, a layer upon which he somehow manages to build Signal on top of despite being supposedly fundamentally and horribly flawed due to being a decentralized protocol frozen in time and nearly impossible to change (which isn't even true! IPv6 was insane for actively going out of its way to break transition paths, but as many people have pointed out it didn't have to be that way; and even within IPv4 we have seen a lot of manipulation and progress in the form of protocol extensions. many of his other examples are also clearly flawed if you know anything at all about the protocols involved).

"Finally"--a word I use here both in terms of it being the most repetitively frustrating things about this talk (and so I list it last) but also as it came up again at the very end (thereby closing the video) due to a question from the audience poking him hard on this point (to great applause)--he continues his apologetic rhetoric for the idea that phone numbers are somehow better as an identifier than any other possible alternative--something that is so wrong on the face of it that we can point at ludicrously popular chat systems, such as Kik, that were largely popular because they did not use phone numbers at all, in addition to the vast majority of popular social networks that merely use phone numbers for account password recovery (and while many of them now require phone numbers to sign up, that is entirely unrelated to the service and how you use it, and was usually not the case when the service first came into existence: it was way more common to require an e-mail address than a phone number)--to the point of seriously claiming multiple times that ceding control of identity to the telecom infrastructure (something we know is horribly insecure even if you trusted all of the players, which I don't think anyone does) is one of the things that makes chat fundamentally better than e-mail (?!?).

Really, the best line from the video came from someone in the audience asking a question, leading with: "thanks for the thought provoking talk... you said so many things I disagree with, it is tough to pick a question" :/. For me, that feeling goes well past just this talk and his positions on chat systems: his love for Intel SGX--a technology that has been broken multiple times and whose key feature, Remote Attestation, is just "DRM" by another name--puts him on what I would argue is "the wrong side" of the war over general purpose computing, wanting to rely on user-hostile hardware to protect decentralized cryptocurrencies (such as his MobileCoin) from attack by anyone... other than Intel, obviously, as they can be trusted?... or any governments that can lean on Intel, as maybe we like those governments?... or of course, anyone with a zero-day hardware side channel attack, as we can pretend all of those have been found? :/... essentially, in the end, most of his positions just seem like a way to shill for centralized government control over everything, with metadata being protected only by the security of the memory of his servers (something which was pointed out by yet another question from the audience, and for which he didn't really have a good answer) wherein the best case scenario is that laws like the DMCA end up being what protect us from attackers as opposed to actual math :/.

However, I feel that maybe he isn't considering the downsides of being able to change quickly. Sure WhatsApp was able to add end-to-end encryption with a single update, but they can just as easily remove encryption with another update. Additionally, while I will admit that it sucks that email is not encrypted, knowing how many people and businesses rely on email every day, it should be incredibly difficult to make changes to it. I don't want a single person or company to be able too suddenly decide to change how email works.

One area where I am sympathetic towards Moxie and Signal is requiring phone numbers (mentioned at the end in the Q&A). Personally, I don't see it as being all that big of a deal and it does bring several advantages with it:

* Users get to store/control their own social network in their phones address book

* Users can switch easily between WhatsApp/Signal/etc.

Although I agree that requiring phone numbers does reduce the privacy of Signal users, I think it is a worthwhile trade off for making the app usable by the public.

Also, it seems like usernames might be supported in the future: https://signal.org/blog/secure-value-recovery/

My takeaway is that he highlights that centralization makes moving fast easy (he's not wrong) and prods those who want to develop decentralized systems to be aware of the downsides. He holds up bitcoin OSS as a "fork to evolve" model as something that sortof works but isn't great either. We need something better. Perhaps a stack that solves the fundamentals in a reusable manner (discovery, e2e encryption, hiding metadata, group management, ...) so that people don't have to sink man-years into every new project.

That said, there are also flaws in his arguments such as the "server goes down, everyone has to change identity" example seeming too simplistic since identity does not necessarily have to be tied to a single instance in a distributed environment.