Live data from Hacker News

Drawbacks of P2P and a defense of Signal

changelog.complete.org

161–170 of 215 posts

Re: Drawbacks of P2P and a defense of Signal

#161
post #97
post #55

A benevolent dictatorship would always be more effective than a democracy, but what happens once it stops being benevolent? Same here. A centralized app (like Signal) is more effective than distributed/decentralized approach. But what would happen if Signal would ever stop being benevolent? Remember the days Google were "do no evil"?

> But what would happen if Signal would ever stop being benevolent? You fork it.

The harder part is you need to fork the network by convincing all your friends to move to a new "good-Signal" network.

Re: Drawbacks of P2P and a defense of Signal

#162
post #56

Earlier quoted context omitted.

They're working on a Go server impl, "Dendrite" which is supposed to be far faster and use less RAM. I was hoping for Rust, and I think there is a 3rd-party Rust server, but anything's better than Python. Node.js would probably be better than Python.

The 3rd party Rust server is Conduit: https://conduit.rs

> Note: This project is work-in-progress and is still missing some features like joining private rooms over federation

I'm hopeful it will get there somewhere, but I hestitate to recommend it while "easy to get working without issues" is a bar that it doesn't yet reach.

Re: Drawbacks of P2P and a defense of Signal

#163
post #74

Signal needs your phone number and is run by a "former" Twitter person. It just smells funny.

They started Signal "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". Yes, Marlinspike is highly talented and worked on the security at Twitter. I don't see anything bad about that.

Signal started of with not ONLY privacy in mind. In the beginning the app required even Google Play Services, which was dropped because of pushback from the community. It seems that his experience in sillicion valley startups, also reflects on how Signal manages growth and thinks about user adoption of their product. On top of that, they try to apply as much privacy as possible. If they would have started the other way around, they wouldn't have gotten so far. A certain spirit seems to be necessary to give privacy to the masses.

Next to that, they are paving the way to no longer require phone numbers: https://signal.org/blog/signal-pins/

Re: Drawbacks of P2P and a defense of Signal

#164
post #3
post #2

Most of these criticisms are solvable problems. If you make a direct connection to other users, they see your IP address. So use Tor or a VPN. Many P2P lookup systems assign identifiers for routing etc. So assign ephemeral ones for anything that doesn't need a persistent one, and make sure persistent ones aren't suitable for correlation, either by not using the same identifier for multiple services by the same person…

That is however just another layer of complexity when the article already talks about the complexity of running a matrix server.

Running a Matrix server is complex because the software could be better, not from some inherent user-facing complexity.

Encouraging users to use a VPN can be as simple as bundling the WireGuard installer with your software and providing a list of recommended non-shady VPN providers.

This makes things less complicated for the user, because they benefit from having a VPN whether they use your software or not (to hide their current IP address from any centralized services they still use), but now they have someone they trust providing a vetted selection of them to choose from. And on top of that it gives a free software developer the opportunity to fund some development through the use of affiliate links.

Re: Drawbacks of P2P and a defense of Signal

#165
post #35

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

How much of the daily volume of internet chat-type messages do you estimate flow over XMPP versus alternative protocols and proprietary implementations?

I would say XMPP may be the most widely-used chat protocol on the Internet. And it has many more uses, as it's a generic federated PubSub platform. Facebook, Whatsapp and many other popular proprietary solutions use the XMPP protocol. Even games and gaming platforms like League of Legends or Nintendo use XMPP. So do Firebase and others.

I'm not arguing in favor of these corporations. I'm a proponent of non-profit federated networks like the Jabber federation (based on XMPP protocol). Not that XMPP is better than ActivityPub/Matrix in all regards, but it has stable standards, rock-solid implementations with very good scaling stories, and there's a vibrant non-profit community working on:

- better, modern clients for chatting: Conversations, Dino.. - unified branding/UX across platforms with Snikket client/server distribution - social networking: Movim (web), salut-à-toi (multi-platform) - decentralized forging to replace github: salut-à-toi uses it for own development - onboarding people with prosody's mod_invite - federated chat over tor onion services with prosody's mod_onion

Matrix, SMTP and ActivityPub have other strong points going for them, but i could argue most of the Matrix criticism in the article does not apply to the Jabber ecosystem. Disclaimer: i'm a happy Jabber user and contributor to the https://joinjabber.org/ project (a new born in the ecosystem)

Re: Drawbacks of P2P and a defense of Signal

#166

I'm annoyed that the comments here pile on the "ease of use" part, while largely ignoring what is more original here. (I don't know what I expected.) The critiques of p2p identity leaking and big hungry servers are valid and I'm glad they are raised. As a Matrix user, I could respond to the first point that yes, it's a tradeoff depending on your threat model. I think that having a tractable identity is less bad than…

I use Element with some people and the reason they do not like it is that it takes a noticeable amount of time to send a message. It is annoying to me, too. What exactly is the reason for it? Can it be improved? This happens with both the desktop and Android client.

Re: Drawbacks of P2P and a defense of Signal

#167
post #2

Most of these criticisms are solvable problems. If you make a direct connection to other users, they see your IP address. So use Tor or a VPN. Many P2P lookup systems assign identifiers for routing etc. So assign ephemeral ones for anything that doesn't need a persistent one, and make sure persistent ones aren't suitable for correlation, either by not using the same identifier for multiple services by the same person…

The article never claimed they are impossible to solve. It even mentions Tor. You seem to trying to argue something different than what the article is actually about.

> The article never claimed they are impossible to solve.

If they aren't impossible to solve then why should we not just solve them instead of abandoning decentralization?

Re: Drawbacks of P2P and a defense of Signal

#168
post #152
post #81

Earlier quoted context omitted.

> The average person can not run a matrix server. Please don't repeat falsehoods like this. The average person can not run anything because software is black magic to them. If you meant the average knowledgeable computer engineer (or similar, as opposed to a large org), then you are simply wrong. I'm running a Synapse instance for ~25 people (friends and family). We are federated and joined to many large rooms. Synap…

“Please don't repeat falsehoods like this.” You accuse the parent commenter of making a falsehood, but then you go on to confirm their statement as true.

> Essentially you either use the main server or you are a large org that can pay for a powerful machine to run it.

To be perfectly clear, the above was the original statement I was referring to and it is completely false.

Re: Drawbacks of P2P and a defense of Signal

#169
post #94

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

>Yet another [...] post that completely ignores the fact that XMPP is still alive and kicking I didn't downvote but your comment doesn't help me because it's what I call "generic & enthusiastic evangelism" that does not actually engage any of the concrete arguments in the blog post . An example of another comment that does try to address the author's issues is the one from arathorn[1] and I hope that one gets upvoted…

I'm happy to answer the technical criticism expressed in the blogpost relative to Jabber. Disclaimer, i'm a Jabber user and i'm a volunteer for the newborn https://joinjabber.org/ project.

> server implementation

In the Jabber ecosystem, there's a bunch of servers. Prosody and ejabberd are the most popular ones with easy configuration and extensibility, high reliability, support of all modern features (XMPP Compliance Suite 202X), and packaging for all distros. There's a lot more servers, but they may not be as reliable/complete.

> use matrix.org (...) or (...) will it be up (...) ?

There is no equivalent in the Jabber ecosystem, on purpose. Nobody wants to centralize all accounts, or wants to advertise services which may disappear some day. Jabber services, like web hosting and emails, is meant to be provided by hosting providers which will still be here decades from now. As with any protocol, you should never trust a provider of a single service (who doesn't deal with other protocols), unless they're the person developing this service and you want to support them. More often than not, these single services hosts are run by inexperienced volunteers who cannot guarantee they'll still have time and motivation to maintain the services years from now.

Some non-profits have been serving Jabber accounts for their members for more than a decade, like JabberFR here in France since at least 2005. And these "small" servers (JabberFR has ~700 parallel users and 2-3K servers federated with) take very limited resources and have much better uptime than most commercial messengers.

> Voice and video

This has been a long problem in the Jabber ecosystem because little people were working on it. Nowadays, 1-on-1 audio/video works perfectly across Conversations (mobile) and Gajim (desktop) and group AV works perfectly with Jitsi.

> Matrix is so hard to set up on a server

Jabber is really easy to setup on any server.

> Encryption isn’t mandatory in Matrix

Encryption isn't mandatory across the Jabber ecosystem, though some clients strongly encourage and facilitate it. This is the only criticism of matrix in this blogpost that equally applies to Jabber.

> How does the average person curate your list and avoid choosing a server that will be offline pink in the future?

That's a fair question. Registering with a hosting cooperative (not private corporation) which has a good track record is a good start. This is one of the reason we started the joinjabber.org project. Though we don't have a lot of servers recommended there just yet, we intend to curate services according to public criteria in the future.

> directing friends & family towards Signal is less of a cognitive burden

Not in my experience. This leads to questions like how can i talk to someone who doesn't have a phone number (you can't). Why is the service not working sometimes (smaller hosts have better uptimes). Why am i receiving phone calls from weirdos who took it from a groupchat i joined, i thought signal stood up for privacy. And hypothetically, in the future: why is Signal actively cooperating with law enforcement in my country. Why was Signal sold to a data-mining private corporation. Why is Signal going bankrupt and closing all services and where can i go...

I'd much rather take 5 minutes to explain to someone that Jabber is like email and they need to find a trustworthy, reliable provider, than spend hours and hours dealing with the mess and pain a centralized approach like Signal creates. Source: most of my friends and relatives are on Jabber; some have some moderate complaints about UX but it "just works".

Re: Drawbacks of P2P and a defense of Signal

#170
post #131

Earlier quoted context omitted.

Without the optimizations added since 2016, it is not a great protocol for mobile devices, but only because mobile devices are stupid and equate a background TCP connection with something bad and battery-heavy. That means they make it much more difficult (or impossible re: iOS) to do so. That means apple & google are effectively dictating how you can use TCP (i.e. not outside of HTTP and friends), and everything is n…

> That means apple & google are effectively dictating how you can use TCP (i.e. not outside of HTTP and friends), and everything is now terrible. Ok, but this is our reality. Windows has been the dominant desktop OS since 1995 or so (and MS-DOS was the one from 1985 until 1995 or so, from the same company). Linux has been dominating the server space since about 2005 or so. iOS and Android have dominated the mobile si…

I am not holding my breath either, and as I said, there are plenty of protocol optimizations which have been made to fit into that terrible state of things. To the point that Conversations, my Android XMPP client, uses less battery than Signal, despite seeing a lot more activity.
Post reply on HN