Hacker News Reader

I think this post misses one of the points in the original essay, which is that federation is less important for user-level protocols because the network layer beneath it is open. That tilts the slow-moving-federated-service vs. fast-moving-centralized-service tradeoff towards fast-moving-centralized-service, which is why we see the landscape we see today.

His argument applies for any centralized top-layer services built on top of open substrates. Because the substrates are open, users can relatively easily switch between centralized services, which lowers the badness of centralization, which in turn makes centralization a more reasonable tradeoff to make.

The question he didn't address, I think, is what happens in the case where you have centralized services emerging on top of another centralized service. In that case users might be able to switch their top-level service providers, but it would be much harder to switch the lower-level provider.

But then again, that's exactly the lesson that everyone in the software industry learned with the dominance of Windows as a platform in the '90s and early '00s, and I think that's why you see so many companies building proprietary layers on top of open source components, and the current growth of cross-cloud compatibility libraries. The user-facing service providers want to make sure they can never be hurt by a centralized platform underneath them. And that's the dynamic that I hope will end up protecting users as well.

"what happens in the case where you have centralized services emerging on top of another centralized service"

It is too shaky ground. Both Facebook and Twitter had a chance to be a platform for 3rd party apps, and they both chose to leave the developers in the cold.

> Because the substrates are open, users can relatively easily switch between centralized services,

How is it easier for me to switch from Facebook to something else, if it's carried over the Internet as opposed to something proprietary like their own modem pools for example?

I can't think of a single service for which that is true. Facebook is the lock in, just as Microsoft is the lock in for office PCs even if the underlying technology is somewhat open.

I hesitate to get all Clay Shirkey here, but I think this is fundamentally different from media conglomerates and Bell Systems, given that now anyone has the ability to build their own overlay service with relatively minimal investment.

Part of what I've been noticing is that we have these "walled gardens" today that people consider to be synonymous with "lock in," but it's actually easier for people to move from Viber to WhatsApp to Telegram to Signal today than it is for people to move from gmail to yahoo mail.

In a sense there's less lock-in with centralized messaging services than there is with the federated ones, due in part to the move towards user-owned identifiers like phone numbers.

I get what you are saying about it being easier to move from one walled garden to another (based on the evidence that those moves happen more often than moves from between email providers)... but there is such a huge caveat that those moves are never a move chosen by an individual.

I cannot, as an individual, choose to move from one walled garden messenger app to another - if I do, I cannot message those people that don't. I am stuck going along with the group. This is ok in a lot cases (when the group's priorities line up with mine), but sometimes the things that are important to the group are different than the things that are important to me. For example, I might prioritize security over ease of use, but since the group doesn't, I will never get my wish, and I am stuck on a service that sacrifices security for ease of use.

Wouldn't you still have that problem with a federated system? You could roll your own uber-secure decentralized messaging protocol right now, if you wanted, but if nobody else adopts it then you're basically SOL.

The difference, I think, is that with federated system you can have a partial state where you communicate securely with those that have also adopted the security extensions, while making insecure connections with those who didn't, all within the same application/protocol (by using protocol extensions). Therefore, such features can be gradually adopted by an increasing amount of users.

If the system is centralized and it doesn't support security, it's all or nothing; to enable secure protocols, both you and the other party must change to a different app, and you'd have to support both systems in order to communicate with secure and insecure users.

Part of what I've been noticing is that we have these "walled gardens" today that people consider to be synonymous with "lock in," but it's actually easier for people to move from Viber to WhatsApp to Telegram to Signal today than it is for people to move from gmail to yahoo mail.

I wonder how much of this is specific to messaging services, though:

After all, messagers are both real-time and strongly biased towards current information. This means it's both very easy no notify people of a new account and relatively painless to close down an old one - you rarely have valuable archieved Whatsapp messages that you can't afford to lose.

Finally, thanks to platform notification APIs, it's very easy to run different messengers at once, so if your social network is split between different services, that's usually not a problem.

I don't see how those qualities are present in other services which have become more centralized - e.g. email, cloud storage, more persistent social networks or publishing. If I'd like to shut down my Facebook account and switch to some other hypothetical network, without losing all my contacts, that's going to be a lot more difficult than switching messengers.

Also note that smartphone apps are pretty much "walled gardens within a walled garden" as of now: Yes, it's easy to port my contacts from one android app to another android app or to run different messenger apps in parallel. But that's because I'm actually just giving different apps permission to the same underlying APIs and database. Shutting down my Google account and migrating to a cempletely open alternative: not so easy.

I do agree with the post that centralized services de facto are more sucessful than federation in the current ecosystem. But I'd argue that centralized services still have a lot of disadvantages for their users. So maybe we should start analyzing why this is the case instead of just shrugging and saying this is how the works works.

> it's actually easier for people to move from Viber to WhatsApp to Telegram to Signal today than it is for people to move from gmail to yahoo mail.

That's only because those apps aren't used for anything complex, while email goes in all kinds of automation and long term storage.

Ant that's only because email is some stable technology that you can count on working without "staying in contact", or "checking you got it". (Even if many people will do those things.)

Okay, I guess I see some value there. The problem is that my motivation is fundamentally political, and centralized services are basically autocracies. I suppose it's a good thing that people can emigrate more easily now, thereby forcing dictators to compete with each other to attract subjects - but I wasn't looking for a benevolent dictatorship, I wanted us to kick the whole hierarchy over and use our shiny new communication tools to organize a happy self-regulating democracy. What frustrates me about your article is not that I think you're wrong, because I don't have sufficient knowledge to make such a claim: what bugs me is the fear that you're right, which would mean that we failed to get the job done and now the window of opportunity has closed. I guess a more benevolent dictatorship is an improvement, but it's a sufficiently small improvement that it leaves me feeling like the last 15 or so years of Internet development were basically a waste of time.

There's an old quote from Arthur C. Clarke that I think is relevant here:

"When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong."

(Apologies to moxie for the whole "elderly" bit!)

"It's precisely the fact that Moxie is so credible on this topic that makes his post so frustrating."

Exactly. He's right. And it sucks.

It's especially annoying for messaging. There are now all these messaging apps that don't interoperate. If you're on WhatsApp and the other party is on Telegram, the message doesn't get through. It's like the early days when MCIMail and CompuServ didn't talk. But if you don't have a walled garden with broken glass on top of the walls, you can't monetize messaging.

The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in. No one is making money from Signal, and anyone who uses Signal can switch to any of ten different (less secure) apps in five minutes. And if Signal goes away or whatever, we can build our own! The only thing stopping us is that we are a lot worse at designing crypto than Moxie and Trevor ;)

I was using Signal, too. One day it phoned home, got some new instructions from its creators, refused to work any longer, and demanded that I download an upgrade. I was not excited about this, since upgrades generally break things, but after a few days of grumbling I knuckled under. Sure enough, the upgrade is broken: it insists that I have to upgrade Google Play Services, which I can't do, because I deleted it along with the rest of the Google code I don't want to use.

I can't use Signal anymore, by Open Whispersystems' choice, which means I can't easily communicate with a fair number of my friends anymore, and that's apparently just the way it is. Open Whispersystems demands that I let Google have a level of access to my phone I don't want them to have, or they won't let me use Signal. Their proprietary Signal software is the only way to use the Signal service, so I can't just switch to an app whose privacy characteristics might be a better fit for my needs, as no other apps exist.

Am I going to convince everyone I want to communicate with that they should stop using Signal and start using something else? No, I am not, because why would they do that? They're all happily using Signal now, and I'm the odd one out, so I lose. Sure feels a lot like lock-in; I have no good choices here.

I guess at the end of the day, that exactly my concern too.

Signal is awesome, which is why we want to use it, but then suddenly the user finds they're now inextricably tied to Google or Facebook collecting their metadata - while we know Google themselves have been compromised (technically & legally) and are forced to hand that data over. Notably, to an NSA that has lied to Congress about it's operations, without consequence, and hence is now beyond oversight and reach of regulators too.

Also that the iOS code, which appeared to be free & open, is actually not, because other projects are denied permission to use in a way that's compatible with iOS's App Store). Ironically because the libraries are under GPL. Hey, blame Apple I know, or ourselves for not reading all Apple's T&Cs before promoting Signal, but it's disappointing none-the-less (while also still being OWS's right).

From all their history, the OWS guys seem to really want and be trying to do the right things, within the constraints and trade-offs available to them. The answers aren't trivial, but something about where it's all ended up leaves a very uncomfortable feeling.

Wisper's arguement here is basicly: you don't matter, and we arn't going to do anything to help you.

And due to their walled garden, you can't do anything to help yourself either.

so much for "open source infrastructure for a centralized network now provides almost the same level of control as federated protocols"

Unless you mean control for Google.

I see where you're coming from but I think you're being too harsh. I don't know Moxie personally, but he's been out there fighting the good fight since the '90s - I have a vague and possibly erroneous memory of having encountered him on the old cypherpunks list, back during the dawn of time. While I have had a frustrating experience with Signal, I have nothing but respect for Moxie's skill and his commitment to secure, private communication. Engineering is hard, everything is a tradeoff; I'm certain that nobody involved with Signal has any intention whatsoever of trying to sell us out to Google. They're undoubtedly looking at a complicated problem and trying to do a good job with it. It just happens that their particular choices aren't working for me.

Signal is open source, so you can just fork it to remove the dependency on GCM.

In fact, someone already has, so you can just use it: https://fdroid.eutopia.cz/

Open Whisper Systems have asked LibreSignal to stop using their servers and may decide to shut it out.

See https://github.com/LibreSignal/LibreSignal/issues/37 and discussion upthread.

You cannot use it with EVERYONE though, can you? Signal requires Google Play Services and is refusing to remove that dependency - leaving out all those users who cannot install Google Play Services, either for privacy reasons (as moxie calls them: "cryptonerds") or because they live in countries where Google is banned (all of China for example).

LibreSignal folks are willing to do the work for removing that dependency on GCM but Signal won't federate with them.

OTOH, moxie does have a point. They've tried federation with Cyanogen and the experience was painful.

I'm an outsider, so I'd like to make sure I understand this...

So moxie here is claiming to offer the superlative encrypted communication service. On the other hand, he's insisting on a hard dependency that not only compromises privacy, but locks out one of the biggest emerging markets?

His reply here may be relevant: https://news.ycombinator.com/item?id=10665520

> Signal exists

Only if you have an Android device with a mobile phone number.

Signal does not require an Android device.

So how can I run it?

Difficulty: the only hardware I own is my desktop that runs a custom Linux.

You aren't in the target audience; normal people who make up mainstream society.

What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction.

If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.

I'm not moxie, but that is his stated goal; the majority not everyone. Especially not people who have heard of OpenPGP.

Source for that last quip:

http://www.thoughtcrime.org/blog/gpg-and-me/

> The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in.

???? This does not even start to make sense to me. The fact you could chat with your friends on ICQ/MSN/FacebookChat/Compuserve/AIM/Yahoo! IM/Prodigy meant you were not locked in?

Centralisation and federation must die, bring on peer-to-peer networks.