Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Drawbacks of P2P and a defense of Signal

changelog.complete.org

Post reply on HN
Print view View original

81–90 of 215 posts

Re: Drawbacks of P2P and a defense of Signal

#81

Post by feanaro »

canofbars wrote: post #32
Teever wrote: post #24

Earlier quoted context omitted.

I see this bike-shedding comment about the language choice for the reference Matrix server implementation in every single post about Matrix on Hackernews. Every. Single One. Millions of people use Matrix. It has been adopted by the French civil service, several German states, and the German armed forces. In a previous post I saw someone saying that American Airlines was looking at adopting Matrix for their employees.…

Its a valid comment. I tried to run synapse on a reasonable VM and it was unusably slow. Essentially you either use the main server or you are a large org that can pay for a powerful machine to run it. The average person can not run a matrix server.

> The average person can not run a matrix server.

Please don't repeat falsehoods like this. The average person can not run anything because software is black magic to them. If you meant the average knowledgeable computer engineer (or similar, as opposed to a large org), then you are simply wrong.

I'm running a Synapse instance for ~25 people (friends and family). We are federated and joined to many large rooms. Synapse is using about 400-600M memory (RSS, varies depending on circumstances) and about 8-10% CPU. This is all on a 2 core Hetzner VPS which costs less than 20 USD per month.

Re: Drawbacks of P2P and a defense of Signal

#82

Post by vinay427 »

GNU_James wrote: post #76

All apps that require a phone number are a scam, privacy-wise. Use Matrix.

What does "scam" even mean here? I know what I'm signing up for, privacy-wise, when I provide Signal my phone number and access to some of my contacts, and I clearly get something in exchange.

Re: Drawbacks of P2P and a defense of Signal

#83

Post by oblio »

kiwidrew wrote: post #29

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

Isn't XMPP a horribly designed protocol and not very good for mobile devices, though?

I'm not someone implementing XMPP but I remember reading articles about it back in the day and I recall hearing that the consensus that it's not a good protocol for mobile. Mobile being probably 95% of messaging traffic.

Re: Drawbacks of P2P and a defense of Signal

#84

Post by DyslexicAtheist »

kiwidrew wrote: post #29

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

there are 2 (maybe more?) ways in which matrix/riot (theoretically) could "compete[1]" against Signal, but are an utter failure on both accounts:

1) UE / ease of use for non-tech savvy users

2) a "killer feature" that gets people talking

While 1) is a no-brainer, 2) is a more difficult.

What does matrix offer to users other than "decentralization" (which is great for people on HN who like tinkering, but a usability drawback due to bootstrap time of joining a p2p network, and p2p in itself not offering a __security__ advantage[please ask to see the threat model when there are blanket claims that p2p is more secure]).

Signals claim to fame comes from actual subpoenae that returned no usable metadata. Matrix (so far) has never been tested in adversarial conditions[citation needed]. While matrix's e2ee is an often talked about feature, it is not part of most matrix-implementations. Only riot claims it does e2ee however the claims on voice security are vague. Not clear if p2p or multiparty voice are E2E encrypted. Also you can optionally encrypt text chat rooms (which means it's not the default and so it's either not used by non-tech savvy users and those who rely on it risk getting exposed due to the extra steps it takes).

I'm excited for decentralized technologies[3] but Riot is not in a state (yet) where I'd recommend it to exposed groups or individuals. So if neither e2ee is properly implemented, nor does it offer some radical new feature, nor is it actually more user-friendly - then why should anyone bother with it?

[1] compete = moderate attempt in getting a name for itself considering that Signal is stealing all the attention in comparison to all other "secure" messengers

[2] https://www.documentcloud.org/documents/3120046-Open-Whisper...

[3] cwtch: more bleeding edge than matrix, potentially buggy and certainly not ready for prime-time but they understand that: "your threat-model isn't my threat-model" https://docs.openprivacy.ca/cwtch-security-handbook/risk.htm...

Re: Drawbacks of P2P and a defense of Signal

#85

Post by oblio »

neiman wrote: post #55

A benevolent dictatorship would always be more effective than a democracy, but what happens once it stops being benevolent? Same here. A centralized app (like Signal) is more effective than distributed/decentralized approach. But what would happen if Signal would ever stop being benevolent? Remember the days Google were "do no evil"?

Isn't Signal a non profit? Much different incentives.

Re: Drawbacks of P2P and a defense of Signal

#86

Post by neiman »

oblio wrote: post #85
neiman wrote: post #55

A benevolent dictatorship would always be more effective than a democracy, but what happens once it stops being benevolent? Same here. A centralized app (like Signal) is more effective than distributed/decentralized approach. But what would happen if Signal would ever stop being benevolent? Remember the days Google were "do no evil"?

Isn't Signal a non profit? Much different incentives.

Are all non-profit organizations good? What stops Signal from becoming for-profit in the future?

Re: Drawbacks of P2P and a defense of Signal

#87

Post by kitkat_new »

DyslexicAtheist wrote: post #84
kiwidrew wrote: post #29

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

there are 2 (maybe more?) ways in which matrix/riot (theoretically) could "compete[1]" against Signal, but are an utter failure on both accounts: 1) UE / ease of use for non-tech savvy users 2) a "killer feature" that gets people talking While 1) is a no-brainer, 2) is a more difficult. What does matrix offer to users other than "decentralization" (which is great for people on HN who like tinkering, but a usability d…

your evaluation is really out of date

Re: Drawbacks of P2P and a defense of Signal

#88

Post by apichat »

oblio wrote: post #83
kiwidrew wrote: post #29

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

Isn't XMPP a horribly designed protocol and not very good for mobile devices, though? I'm not someone implementing XMPP but I remember reading articles about it back in the day and I recall hearing that the consensus that it's not a good protocol for mobile. Mobile being probably 95% of messaging traffic.

The mobile problem for XMPP is solved since 2016 :

https://gultsch.de/xmpp_2016.html

Re: Drawbacks of P2P and a defense of Signal

#89

Post by kupfer »

kiwidrew wrote: post #29

Yet another "Matrix isn't mature enough so just give up and use a centralized service" post that completely ignores the fact that XMPP is still alive and kicking. With multiple independent implementations (both client and server) that all work together pretty decently. We're never ever going to tear ourselves away from this death by centralization if we keep inventing excuses for why we don't use the federated/distri…

I'm surprised to hear xmpp on mobile works for people. I tried a few times with a friend. I'm on Android, she has an iPhone. And it always was too unreliable. The worst part is that half of the time messages are not delivered or very late. But there are also problems with attachments. We tried different clients and servers.

Re: Drawbacks of P2P and a defense of Signal

#90

Post by GNU_James »

vinay427 wrote: post #82
GNU_James wrote: post #76

All apps that require a phone number are a scam, privacy-wise. Use Matrix.

What does "scam" even mean here? I know what I'm signing up for, privacy-wise, when I provide Signal my phone number and access to some of my contacts, and I clearly get something in exchange.

Why are you providing your phone number to anyone? Software should be free.
Post reply on HN