The Signal Server repository hasn’t been updated since April 2020. There are a bunch of links about this here but I found this thread the most interesting.
To me, this is unforgivable behaviour. Signal always positioned themselves as “open source”, and the Server itself is under the best license for server software (AGPLv3 – which raises questions about the legality of this situation).
Signal’s whole approach to open source has constantly been underwhelming to say the least. Their budget-Apple attitude (secrecy, i.e. “we can never engage the community directly”, “we will never merge/accept PRs”, etc) has lead to its logical conclusion here, I guess. I have been somewhat of a “Signal apologist” thus far (I almost always defend them & I think a lot of criticism they get it very unfair) but yeah I’m over Signal now.
Another big problem with Signal is the fact that it’s centralized with the server being located in US. Even if the protocol itself is secure with the server not having access user data, this presents a huge risk since US government can simply force Signal to shut down the service at any time. The server can also potentially collect metadata about the users providing US security agencies with user connection graphs.
I think that Matrix approach is much more sound, and would always recommend it over Signal.
I wrote about both issues, and why Matrix isn’t a perfect solution, previously: part 1, part 2. Starring WhatsApp, Firefox, Signal, XMPP, Email, and Matrix.
Also discussed on Lemmy: part 1, part 2.
Signal’s problem is being a closed platform; Matrix suffers primarily from complexity. Both enable dependence on a single small group, and therefore enable user domestication. That being said, Matrix is considerably less bad than Signal.
For large public rooms, IRC continues to be the best option. All its issues are client-side; IRCv3 supports history, multiple devices, authentication without NickServ, and even typing notifications. All these features are supported on Oragono. For small, private E2EE rooms, all existing solutions have major trade-offs.
yeah completely agree with all that
All these discussions tend to ignore Wire. It is similar to Signal but has none of these drawbacks and even some extra good features.
Wire was mentioned in this thread. It transferred ownership (which in itself was shady) and its new owners are shady too.
What do you mean about its new owners?
deleted by creator
Same, /r/privacy and /r/privacytoolsio are so completely watered down that I’ve even seen a lot of pro-microsoft / vscode apologia there. The red flags with signal have been there for years, but they choose to ignore it.
I feel like lots of “privacy-oriented” mainstream tech discourse is a psyop designed to direct people to honeypots or even just inferior solutions.
Yes it’s called advertisement and it’s the byproduct of an ego/profit-driven society ;)
Never underestimate how many people are paid to influence product reviews, social media, message boards and so on.
Pro US all the way down. It’s why all the reddit “privacy” subs praise microsoft, apple, signal, etc.
Off-topic, but the US-centrism is what put me off reddit entirely. I just can’t go there anymore because it makes me immediately feel like a foreigner in another country. I sometimes wish there was an internet-wide filter for anything US.
Same.
Unfortunately, you will also find it here, but it manifests to a lesser degree.
vscode is a meh software. Vscodium on the other hand…
They ignore Mozilla’s nonsense too. All though I don’t remember seeing any pro-Microsoft apologia on r/privacytoolsio, any time someone suggested a Microsoft product as an alternative it was shot down saying Microsoft isn’t any better.
We had huge discussions about it here on lemmy.ml a few weeks back. In the end I think the main problem with Signal is that (while surely better than WhatsApp) it does not fundamentally change anything about the dependency on a walled garden with servers and developers based in the US. No amount of Signal apologizing can change that, and we should really strive for something better than such a gradual improvement at best.
deleted by creator
Do you know of a good lightweight client that works well with tor? I’d like to be able to use matrix but Element is just super heavy (and works really bad over tor because of latency).
Fluffychat
Hydrogen, while not stable yet, will hopefully be much more useable over slower networks including Tor: https://github.com/vector-im/hydrogen-web
I hope for the best, but considering it’s yet another Javascript webapp, i find it hard to trust it’ll do anything better. By design it will force me to drop privacy/security features from my browser, and will use considerable resources.
What about Tox?
I had high hopes on Tox, but now a days I no longer do. Its security status hadn’t change for a while: https://github.com/TokTok/c-toxcore See there:
This is an experimental cryptographic network library. It has not been formally audited by an independent third party that specializes in cryptography or cryptanalysis. Use this library at your own risk.
The underlying crypto library NaCl provides reliable encryption, but the security model has not yet been fully specified. See issue 210 for a discussion on developing a threat model. See other issues for known weaknesses (e.g. issue 426 describes what can happen if your secret key is stolen)
And the 2 issues highlighted there are scary:
https://github.com/TokTok/c-toxcore/issues/210
https://github.com/TokTok/c-toxcore/issues/426
To me experimental, as highlighted in the github repo, is not enough, as mentioned in the 2nd issue.
I really had high hopes on Tox, given its peer-to-peer distributed nature (much better to me than just decentralized by self hosting or so) but I don’t see it improving unfortunately…
Briar is similar, but a 3rd party is just adding support for desktops, and as well as Tox, and I’d guess as any peer-to-peer distributed messaging mechanism, it’s really battery hungry, and phones don’t survive even half a day with them active. I don’t like Briar’s reliance on Tor btw: https://briarproject.org/how-it-works
And on such peer-to-peer distributed systems, it seems really hard to get multi-devices support or syncing. But I’d guess there’s no other choice for some people other than Briar. I’m still looking for a distributed peer-to-peer messenger, not consuming the whole battery at least in a day, and that somehow, through mechanisms like the one keybase uses, allow some sync between devices… But the most important thing of course is battery life… Hopefully supporting as well voice/video calls, and some other common stuff to avoid needing other meesengers to support them…
qTox is just a desktop client. The Tox protocol implemented by c-toxcore is the one with security issues. BTW, part of the issue is precisely that the Tox protocol is not an e2ee one, and in one of the issues referred the axolotl protocol is shown as an example… So, no matter the client, the Tox protocol is lagging behind in terms of security.
Oh, I hope it improves. Personally I want my IM client to send and receive e2ee text. Rest should be handled by other programs.
Tox has a terrible security track record. At the same time, developers are still making wild claims that Tox can protect your from nation-state sponsored attacks:
Whether it’s corporations or governments, digital surveillance today is widespread. Tox is easy-to-use software that connects you with friends and family without anyone else listening in.
This is not a code problem.
Let’s be honest, Signal was never an option.
Rather than being free software, signal is more like museum software, you can see, but you cannot touch.
A few years ago (2017?) I decided I would move messenger apps. The aim (and what I’ve achieved) was all my messaging going through a secure, private app.
Signal was never an option.
In 2017, Signal really was the only option. Element (Riot, back then) was really bad and didn’t feature e2ee (which only got enabled by default last year!). XMPP was and remains difficult to use (not even many people here use it, how could I expect “normal people” to use it?)
I made the choice to use Signal, and I don’t regret it. I only regret that it has taken until now that we are starting to see a glimmer of a real competitor, in the form of Matrix. But a really competitor to Whatsapp and the like, back in 2017, just didn’t exist outside of Signal.
I don’t quite get why you think XMPP is harder to use than Matrix. The only way this seems true is if you use the main matrix.org instance and then you are pretty much back at a centralized service based in a five eyes country (UK).
It’s not about instances, they’re pretty much equal in that regard. There are two main issues with XMPP:
- Clients. There is no “default” or “reference” client for XMPP, whereas there is a cross-platform one for Matrix (in the form of Element). This has several implications, but the most important is that for the non-technically aware (which is the vast majority of people I talk to), it is easier and reassuring to use “the” Matrix client. The more important implication to me is on e2ee. Conversations started in Element now enable e2ee by default. In contrast, every XMPP client I’ve tried (on Linux & iOS) does not.
- Message history. Matrix and XMPP differ a lot here, and it’s why the Matrix homeservers are much more resource hungry than XMPP servers. When I use Matrix, I get message history on each device. This is a critical feature for those I want to move from Whatsapp and the like. This is not the case with XMPP.
I disagree on the default client idea, especially if it is such a badly done web-based one as element/riot. In the end clients are always platform specific, and there are easy to find “best” XMPP clients for each platform. At most it is a branding/marketing problem (see Snikket.org for that).
As for the other two points: that is both false and outdated. e2ee has been supported and the default in XMPP for longer than in Matrix and message history (as much as the e2ee double ratchet algorithm used both in OMEMO and OLM permits) is working perfectly in XMPP across clients if the server has MAM enabled (pretty much all have).
You say you disagree with the default clients idea, but why?
At most it is a branding/marketing problem
I don’t know why you’re so dismissive of this issue. I feel like you’re framing me as if I’m anti-XMPP when that isn’t the case; on the contrary I use XMPP and am a Prosody server admin. The reality of the situation though, like I’ve said above, is that next to nobody uses XMPP, even in tech communities. At this point “branding/marketing” could end up being the be-all and end-all of the entire protocol.
As for the other two points: that is both false and outdated.
You’ve misinterpreted my comment. I am very well aware XMPP has and has had e2ee support, the issue is that XMPP clients never have this switched on by default, in my experience (which was testing every XMPP iOS client there is, the platform most my friends use).
The situation on iOS for XMPP is uniquely bad (but actually Siskin and Monal are improving a lot lately). It simply is unfair to look at only one tiny and for most people irrelevant (and uniquely bad) platform and extrapolate from that. On all other platforms XMPP works great and most clients have e2ee enabled by default for 1:1 chats (where it makes the most sense).
As for the other topic, sorry I didn’t want to sound so confrontational, but the same argument comes up all the time inside and outside of the XMPP ecosystem and I think it is simply false. There are other problems why XMPP isn’t adopted. Network adoption is driven by network effects. People invite other people to the network and when doing that they typically also recommend a client (& server). The case of a lone person looking for a new messaging system without any network is the rare exception and one that only comes up in the bubble where this discussion usually takes place.
Well there was Wire, which offered e2e encryption, an open protocol and opensource clients and backend, it has been audited, and it was based in Swiss which is times better than the US. I tried to move a lot of people there, but luckily I failed, considering it has been bought by an advertisement company recently
Wire was pretty good, true. I used it a bit, but chose Signal because Wire (similarly to Matrix, for now) doesn’t encrypt any/most metadata, whereas Signal encrypts everything and always has.
And like you said, it’s since been sold to an advertising company. Not sure if that’d even be possible with Signal since it’s owned by a non-profit (admittedly not always the case, I guess it could have been possible when they were still OWS).
In both cases, their centralised nature means changing ownership can be devastating (like in the case of Wire). This is why I believe Matrix is the future. Its community is much healthier and active in the development of the ecosystem (3rd party clients, bridges, they actually accept PRs, etc…)
Signal encrypts everything and always has.
This is not exactly true. Encrypting metadata is most times impossible due to the server needing to know who to deliver messages to (at the very least). “Sealed sender” is now a thing (though i don’t know how strong a protection that is), but to my knowledge Signal continues to aggressively expose users’ phone numbers both to the server (in a hashed formed, for contact discovery) and to other users in public chatrooms. Please correct me if wrong.
it’s owned by a non-profit
A non-profit doesn’t mean you need to do good. Also, it can turn into a for-profit over the years. It’s in fact a conscious strategy of startups in the field of “sharing economy” (remember couchsurfing?)
This is why I believe Matrix is the future.
Matrix is one among others, but i’m not convinced a single solution is going to be the best:
- Matrix really has a startup vibe and introduces a lot of complexity (reinventing quite a few wheels along the way), to the point the current situation is there’s only one bad client/server implementation (really resource-hungry)
- Jabber/XMPP has a much slower but dedicated non-profit ecosystem (let’s not even talk about the commercial branches) and lots of client/server options for all hardware/systems, but the clients don’t have good UX/polishing
- ActivityPub has a vibrant ecosystem but most clients are web-oriented (such a shame) and tailored to a specific use-case (peertube/mastodon/pixelfed)
They all have strong arguments going for/against them. I believe interoperability is the only way to go. These network are doing mostly the same thing, and there’s no reason we can’t talk across networks.
Which brings me to the fact matrix folks really don’t seem to care about interoperability though i hope i’m wrong about this.
That pretty much sums it up. Matrix isn’t bad, but basically over-hyped and reinvents the wheel for most stuff.
As for sealed-sender in Signal: That is in theory a good idea (and should be implemented in XMPP at some point), but in a walled garden with a single server it is snake-oil as the central server can still easily correlate sender based on other metadata.
FluffyChat is a decent alternative client (with E2EE support). If you don’t need e2ee there’s actually a healthy number of clients, and some of them do seem to have it on their roadmap
Point taken on server implementations though
FluffyChat is not an option because it doesn’t support proxies including Tor. If you’re using fluffychat please open an issue there for integrated tor support like Conversations/Gajim does in the Jabber/XMPP world :)
I have a lot of thoughts about this but don’t really have the time to reply.
All I’ll say is that I hope you’re following Element’s progress with Dendrite closely. I host my own Dendrite server and it is much more reasonable in terms of resource usage versus Synapse, and it hasn’t even had any resource optimisation features implemented yet.
While Dendrite is better in many ways, AFAIK it does not solve the fundamental architectural problem of immutable and permanent history room metadata. As a result of that, database storage use is growing indefinitely (easily into the hundreds of gigabytes) and there is no real solution to that anywhere in sight. In addition I think it also is a massive privacy issue, as this immutable and permanent history room state data is synchronized across any server that has a member joining a chat. Yes I am aware that this is a “feature” of matrix, but IMHO a really bad one and resilient federated rooms can also be implemented in different, less over-engineered ways.
massive privacy issue, as this immutable and permanent history room state data is synchronized across any server that has a member joining
This is terrible.
Matrix evolved evolved in a very messy way, starting without encryption and hacking it in later on, and now it’s even trying to become P2P. I expect more serious privacy-breaching “features” to come out over time.
Element’s progress with Dendrite
I’m keeping an eye on Dendrite. I’m not convinced go is the best language for server software, as it suffers many same pain points as Python (eg. GC pauses), but it looks like a neat progress. In fact i’m going to try dendrite very soon when i have some time.
Element on the other hand i would just put in the dumpster because it’s full of everything that’s wrong with web applications. 9MB initial loading just for a simple chat application, seriously? Several seconds of latency just to switch chatrooms? Seriously it’s 2021 folks, how can anyone be happy with such mediocrity and then complain why noone is using Element…
Just found gomuks which appears to be a lot better for desktop/laptops (not mobile). I will try it out and see…
gomuks
So i just tried gomuks and it’s a pleasure to use! Room switching is instant (compared to 5-15s on Element) and it took just a few seconds to compile. Only downside is it was designed for dark theme so contrast is really bad on light background.
Element the client is garbage, I was talking about Element the organisation formally known as New Vector, who develop and maintain the Dendrite homeserver
Not only sold, I used to report bugs to Wire by e-mail and GitHub before of the change.
One day, they just sent me an automated message in which they said they would not going to provide support to the personal edition at all during a time because of the lack of staff while providing support to the business edition.
It passed more than a year and was maintained, I don’t know today but I expect the same.
Edited: I don’t know why I put Signal instead of Wire jajajajajajajaja.
Wire looked nice, but I stopped using it after they persistently dragged their feet on federation.
Once something with federation gains popularity, the discussion may be over, as we won’t have to talk about jumping ship every year. I’m not sure it’s doable yet, but I’m sure that once it takes hold it’ll last, just like email.
This. I sounded the alarm on signal a few months ago: https://lemmy.ml/post/47340
I can’t tell y’all how many friends, family and other peers would just chat with me with WhatsApp if signal didn’t exist. Let’s be real for a moment, these people wouldn’t use Matrix or Jabber instead, because these can seem a little bit unreliable from time to time.
I know the weaknesses of signal, but I don’t think a better solution exists as of today.
You mean like the centralized Signal servers that recently went down half a day? Not a blip on XMPP despite also higher number of users the same time due to the federated nature of the network.
I get that people are annoyed by the latency of the main matrix.org server, but even that improved lately.
yes like that, but my private xmpp groups all have issues with people turning OMEMO off because they can’t get some messages of each other.
Like I wish it was better and I’d totally advertise it to non-technical people over signal, but that’s not the case today. I hope that projects like https://snikket.org/ take off and solve these issues.
tldr: Signal sucks, but it’s the best we have for some scenarios for now.
I doubt it. OMEMO issues basically only come up when some people use some obscure clients on obscure and developer hostile OS (like iOS), and there is really no way around that. People even still insist to use Pidgin which really drives me mad.
But that is a problem between XMPP nerds and not “normal” users that simply all user Conversations and 100% compatible clients and it works great (and is quite comparable to all users using the official Signal client).
I have Conversations, blabber.im, Xabber and Dino (desktop). I use them daily. Turning on encryption is a problem. Conversations is the only decent XMPP client at all, and it has a UI on par with 90s IRC web clients. Not even its own fork blabber.im works with E2EE.
The protocol may be supreme, but polishing UX goes a big longer way than things like privacy, security or anonymity. Normal people treat these secure programs as mission critical, and this (features) is also why Telegram became so popular.
People value UX and features more and rely on obscurity for privacy, security or anonymity.
Hmm, It is true that e2ee works best in Conversations and that turning it on in group-chats is not super intuitive in most other clients (as it has some special requirements).
But I really don’t get the complaints about the Conversations UI. Except for that annoying background image in Telegram/WhatsApp, Conversations is pretty much looking exactly the same, no? In fact I find it quite a bit more usable than WhatsApp for example, which has really horrible work-flow in some details.
Conversations has this super dingy UI that even an old school folk like me has trouble accepting. Atleast make the chat bubble colour and background colour customisable. Let us use any solid colours.
Also even for one to one chats, if both use Conversations for E2EE, then only it works properly. It is ridiculous and the whole point of federation is protocol compatibility across clients.
Conversation UI seems to fall a bit into the uncanny valley of being too modern for old school users and the same time too sober and down to basics for the snap-chat crowd ;)
As for e2ee chats, somehow I don’t have nearly as many problems with it. It mostly just works… no idea why it is different for you.
obscure and developer hostile OS (that 1/3 of people use). I don’t like iOS but I wanna chat with my friends who use it?!
Like what even are you saying? That we didn’t have this problem (we did)? That it doesn’t matter (it does)?
Yes iOS and Apple are incredibly user-hostile and developer-hostile:
- you can’t install applications that are not approved by Apple, so obviously you can’t install a user-friendly app store like F-Droid (i say like because of course F-Droid is specifically for Android, but the fact is something like that cannot exist for iOS without jailbreaking your phone)
- you can’t change your operating system (remove iOS)
- Apple makes it pretty hard for users to interoperate with anything else, by requiring non-standard protocols everywhere (airplay, etc…) to the point where for years iTunes was (maybe still is?) the only way to interact with an iDevice
- you can’t develop for iOS without an iOS device
- you can’t develop for iOS without official, non-free Apple software
- you can’t publish an application on iOS without an official Apple developer certificate
- even if you got all this, you can’t push information to your users without going through Apple’s centralized push notification gateway (they actively suspend background network connections, so you can’t build anything useful on iOS)
- you can’t tear apart your phone without specific tooling
- you can’t even remove the battery without specific tooling (<-- seriously this is fucked up)
- you can’t use a standard micro-USB/USB-C cable because Apple is the only brand going strongly against any form of standard
- you can’t use a standard micro-jack cable for audio because Apple is the only brand going strongly against any form of standard
Should i go on? Seriously if prisons were in fact designed to protect people not businesses, all Apple execs would be rotting in jail by now, along with the collaborating engineers who let that happen. To be clear, i don’t think prison is a solution for anything/anyone, just pointing out that the worst crime-doers in society are also those kept further away from prison.
1/3? Maybe in the US and Japan, more or less everywhere else it is close to non-existent and the few that do use it are complete fools (that only bought it because they think it is an expensive status symbol like a Rolex watch).
I am saying that your problem is very rare and based on special circumstances and that can happen pretty much with any solution. For example Signal is banned in Iran, so if you have some members that live in Iran you can’t really have a group-chat over Signal with them. Not a common issue, but real never the less.
You are arguing in bad faith, I won’t answer any further.
Yes, friends don’t let friends use iOS :p
recently went down half a day
It was more like ~3 days
Telegram is just as good if not better.
Not even close, Telegram is worse than even WhatsApp when it comes to cryptography. In fact, years ago a corrupt politician got his schemes to put Brazil’s ex-president Lula in jail exposed because his messages weren’t E2EE.
Kinda crazy to think, but if he was using the dominant app in the country, WhatsApp, that wouldn’t have happened.
edit: i didn’t mean to say that this post is unimportant, rather that this course of events for signal was somewhat predictable and i’m not terribly surprised that this happened…
Then you should have used this https://en.meming.world/wiki/File:Surprised_Pikachu.jpg (yes, I’m fun at parties)
Signal is the easiest alternative to WhatsApp for now. But we need to be moving to something like Jami.
Try Conversations or Element
Conversations
I like those too, still mostly centralized at the moment though…and no one I know uses them
Why not Jami? (Rather than like Jami?)
Oh, I like Jami, but no one I know uses it
I warned you guys about this: https://lemmy.ml/post/47340
Don’t trust computers, sure. But specifically apps from the US? come on… Most governments have got people on the payroll to defeat cryptography, not just the US. China, Russia, France are not doing ANY better than the USA in this regard.
All governments are psychopaths by nature, and the only way to protect ourselves is to never ever trust a government. (Better yet, burn down all governments and start to live free)
I have always had my doubts about how open and transparent signal is to its community, I so far have resisted the urge to join signal because of how adamant they are to creating yet another walled garden around their platform.
They have times and times again shown their disdain to interacting with their user base (unlike other open source platforms) and answering valid questions and concerns from their community. and them keeping secrecy about what is being worked behind the scenes and their very vague and evasive answers about future features.
To me signal’s attitude is more inline with silicon valley venture startups than with a non-profit who listens to its user base concerns and needs. though they are working hard on switching more whatsapp users and keep growing.
They ignored the most asked feature for years which is the ability to sign-up without the need of a phone number. while they kept rolling meaningless features to privacy like reactions, stickers, backgrounds, group chats… and kept answering that usernames are coming, but didn’t give any details to how that would be implemented.
Hopefully Berty if released could become a viable solution. as to me right now signal isn’t more than a whatsapp clone if they don’t give up reliance on phone numbersPeople seem to float https://getsession.org as an alternative. Are there any details on who’s actually behind that? Personally, I really hope p2p solutions like https://jami.net get better soon.
I won’t promote Session again because of this point:
Convenience again instead of doing something which is in their hand. They are just sold.
Better Jami.
Jami is great, at least from an intention standpoint. It’s backed by the freedom-fanatic FSF so it’s probably impossible they would even consider using proprietary dependencies
session is recently released on fdroid but you need to add their repository… https://fdroid.getsession.org/fdroid/repo?fingerprint=DB0E5297EB65CC22D6BD93C869943BDCFCB6A07DC69A48A0DD8C7BA698EC04E6
Then is not in “F-Droid” (main repo) itself which is what I meant. The repo was mentioned in the thread as is the way to not cleaning the code but allow people using F-Droid client to install it easily.
jami looks nice
Jami does look nice but personally I really like having partial sync. So that only recent data is on my mobile device and the majority of the data can be saved somewhere with more storage available. I think this could be added to Jami by adding per-device automatic deletion of old data and having one device serving as an archive (with the ability to resend messages to other devices if they scroll back or search) but this would be a huge feature and doesn’t really match the current architecture IIUC.
You could have a private server interacting with the Jami network, and connect all your devices to that server
I have tried Jami about more than a year ago, It has its promise. but they need to work on resolving many connectivity issues. I might go back to checking it later.
I find it sad that this app isn’t more advertised and talked about in privacy and security circle it definitely deserves more light. but hey we always flock t champion the winner.
as for session, I don’t like the direction the devs are taking, as they are switching to using Loki net instead of tor. and they will be tying the app more and more with their blockchain and cryptocurrency. this is enough for me to stay clear as I can’t trust projects developed on money insentivesLast time I looked into Session, my conclusion was that its background was shady enough that I’d never use it.
p2p solutions would be great. The team at Matrix have demonstrated p2p over Matrix (using the Dendrite homeserver) so hopefully that also becomes more accessible at some point.
[This comment has been deleted by an automated system]
I recommend Delta Chat, it doesn’t needs to create an account since it is just an email client with a chat interface, it is not a replacement for your fancy chat app but for your email app, everyone have email, so will need an email app anyway, it makes email easy to use and encrypted out of the box without your friends having to know what encryption means.
I like XMPP but UI/UX is really poor, it is surprising that this email client has a much better UI/UX than Conversations, it has swipe to reply, etc. I found Conversations ridiculously “hard” to use, blabber.im improves a lot of small details that have an impact in the users every day workflow
Delta Chat does look really cool. Like you said, it’s client (testing on iOS) is nice. It’s a shame their desktop app is Electron though.
I have tried it and it is fast, but I would also like to avoid Electron, I think they are considering to replace Electron in the future
Well, fast on your computer. I have got continued freezes with its desktop version. I hope it changes Electron by something native.
It is great on mobile.
I’ve been recommending Session over signal for a while. It does what’s signal is supposed to do, and more, with even more anonymity
https://getsession.org/assets/videos/this-is-session/720p.mp4
Strong glowie vibes from this video.
+1 i got all my friends on matrix anyways now.
The thing is, I first thought that it was not updated frequently simply because the server side of Signal is really simple (it’s only role is to forward messages after all), so the code was very rarely touched.
However there seems to be people that have tried to run their own infrastructure that are not able to get some features to work.
Would it be even legal for them to run an updated version of the server without releasing it as FLOSS given the AGPL license?
If you are the sole owner of the copyright of some software you can do whatever you want with it. The license applies to others, not yourself.
Not well versed in this, so this may be inaccurate, but the other issue is that the Server relies on and uses other AGPLv3 software (e.g. storage-service), so if they want to use the latest versions of each they also have to release all the latest changes to the server under AGPLv3 (which is why Google avoid AGPL like the plague).
This is not true. That library appears to be entirely developed by Signal: https://github.com/signalapp/storage-service/graphs/contributors and if that’s the case they don’t have to follow any of the AGPL requirements because they own the copyright on it.
The legality of this is unclear. If their silence on this topic isn’t because they’re trying to do their best Apple role-play (which is most likely, imo), the cynic in me says it’s because they acknowledge they should publish the source ASAP in compliance with the AGPLv3.
do you have any links/more info about the people who had issues running their own infrastructure? ive been following Signal development pretty closely and all features im aware of make sense that they would not require a server code change. I’d love to see any actual technical details over the hysteria in this thread.
This thread linked by OP contains someone talking about attachment not working. I wasn’t able to find where I remember reading about someone not being able to make reactions work.
It actually seems like they have already been criticised in the past for being slow to release the server side code: https://community.signalusers.org/t/where-is-new-signal-server-code-why-not-share-signal/15068/2
I never used Signal. I use P2P apps instead. I wonder why people still use centralized messengers. Theres a lot of P2P messengers available. Theres a few here
Because centralized messengers
- Have better UX than federated ones
- Are more reliable than P2P ones (less battery usage, messages can be sent without the need for both clients to be online at the same time)
- Have been audited by third parties
- Leak less metadata
Edit: Here are a few examples of what metadata Signal protects that Matrix doesn’t:
- Signal has implemented a sealed sender feature, which means that they can’t know anything but the IPs (which can be easily hidden from them via a VPN) of who’s talking to who.
- The Signal client only sends group metadata encrypted , while it seems that Matrix stores it in clear in the server database
Have better UX than federated ones
This is definitely currently the case, and could be factual but I think the fundamental difference is minuscule. People are currently using QR codes or phone numbers to find each other (both supported my Matrix) and regularly use emails. You can probably argue that the @domain.example suffix to IDs is a hurdle to UX but I think it is incredibly minor.
So I hold out hope that UX of decentralized messengers will approach or surpass the centralized ones.
Are more reliable than P2P ones - less battery usage
Maybe for “pure-P2P” but for services that still use servers this isn’t the case. (Like Matrix, and IIUC there are XMPP extensions for using external push services that put battery usage on par with any of the centralized ones)
Are more reliable than P2P ones - messages can be sent without the need for both clients to be online at the same time)
This is also only a concern for “pure-P2P” services. Furthermore many pure-P2P services have solutions to this via distributed buffers and logs. In fact for optimal privacy you don’t want to directly connect to the recipient anyways.
Have been audited by third parties
Some of them. However some open-source ones have also be audited and have research done on them. I would love to see enough funding for some of the open-source messengers to get official audits.
Leak less metadata
citation needed. To be fair signal is very good in this regard. However there are better decentralized options and worse centralized options. I don’t think this claim can be applied to centralized or decentralized messengers in general.
I do agree with most of what you said here but here are a few things:
What I call centralized/federated are things like XMPP/Matrix, which require servers to function but are interoperable. What I call P2P are apps that don’t need any servers (beside a few bootstrap nodes) to function like Tox. As you said, when it comes to battery, Matrix/XMPP work fine with push notifications, and users don’t need their phones to be on all the time.
A lot of UX could be improved in Element, that is completely separate from the fact that it is federated. I have never used XMPP though. The #1 problem is that apps for federated services will always have to present you a screen “what instance are you using ?”, and ask you to do your own research to find a decent one, whereas centralised services can just create your account on the fly.
Some of them. However some open-source ones have also be audited and have research done on them. I would love to see enough funding for some of the open-source messengers to get official audits.
Can you share some sources for that? Last time I checked I failed to find any info on Matrix passing (or not) third party audits. If you have something about another decentralised protocol with audited implementations I’d be happy to have it.
citation needed
That’s fair, I was just lazy in my first post. I don’t think it’s impossible to develop a federated protocol that leaks very little metadata like Signal, but it would be a pain to get different clients/server version to handle it correctly. One aspect is also that with whatever metadata still leaks, you will have to trust two servers (receiving and sending) instead of just one.
Here are a few examples of what metadata Signal protects that Matrix doesn’t:
- Signal has implemented a sealed sender feature, which means that they can’t know anything but the IPs (which can be easily hidden from them via a VPN) of who’s talking to who.
- The Signal client only sends group metadata encrypted , while it seems that Matrix stores it in clear in the server database
decentralised protocol with audited implementations
There haven’t been many, funding for it would be great. But at least some XMPP OTR implementations have been audited: https://www.eff.org/pages/secure-messaging-scorecard. But this isn’t really different between centralized and decentralized, it is just individual. (And usually connected to how much money they have)
a few examples of what metadata Signal protects that Matrix doesn’t
For sure. As I said Signal is a very good protocol. But not because it is centralized, just because it was designed to be very privacy friendly.
Also for what it is worth a lot of that group metadata can be undone because they have some idea who is sending and receiving the messages along with timing. Of course it is still better that they have the sealed sender and encrypted group data but it definitely isn’t perfect.
And yes, Matrix does intentionally leave more of that in the open. Everything is tradeoffs.
Leak less metadata
citation needed. On the contrary, any network observer can perform a timing attack by correlating messages being exchanged to/from clients and servers. Having centralized servers only makes it easier.
Briar, on the other hand, is P2P and uses Tor as transport network making such attack way more difficult.
I edited the comment with citation.
Briar suffers from the problems I mentioned about P2P requiring more battery and not being able to use push notifications. It also has the works UX of the lot, since you can’t even begin communicating with someone without being in having a way to get them a cryptographic identifier/QR code. No way anyone but the most tech savvy will ever use it. Also, it’s still not available on IOs.
To protect users metadata including the type of application, protocol, and timing push notifications cannot be used. Equally, direct connections to centralized servers are not suitable. That’s a reason for Briar to use Tor.
The thread is about centralized vs decentralized. Availability on OSes, polished UIs and so on are besides the point.
The thread is about centralized vs decentralized. Availability on OSes, polished UIs and so on are besides the point.
Yes, your are obviously right. Who cares about the end user? /s
Oh ya “conveniency” again ! 😂😂😂
For 99% of the people that use messaging services, convenience is the number 1 priority.
Then you must teach them ethics. If you see that, it is in your hand try it, so it is a moral obligation.
Ya which is stupid
I hate that they downvoted you for pointing out facts. Convenience is slavery, more you prefer it the lazier you become.
This is such a stupid take. Do you plant your food yourself? No, you buy your rice and potatoes washed without dirt on them?
Also your definition of lazy, lmao
Lol I love how black and white you are XD Someone is either such a lazy loser it effectively lives on a couch and stares at the TV and does nothing else, or a self sufficent superhuman who can satisfy all of it’s needs all by itself! XD You are totally right I’m a lazy POS for not planting my food, building my house, hunting other animals, using my imagination to satisfy my communication needs and walk everywhere. It’s totally the exact same thing as people being too lazy to learn a couple irc commands and using other software for voice and video calls and using the spyware that is Discord instead :D I don’t think I will present you arguments anymore, you wouldn’t get it anyway, it’s best to just ignore it :)
If it is something in your hand and you don’t make it, yes, you are being lazy (in the case here). If not, you are not lazy but a victim.
The metadata part is kinda valid, no?
