Hacker News Reader

Comment by SavantIdiot | Hacker News Reader

Wait, why do we dislike Signal?

I'm always late to the secure comm party...

EDIT: Got it, Cwtch is decentralized p2p, Signal ain't. Thanks!

Not merely centralized, but also openly hostile to decentralization. Going so far as to hold talks about why decentralization is a bad thing for a chat app. I also never heard a rebuttal to this claim of Wire's:

> Moxie et al have publicly stated that they want wide adoption of the Axolotl [Signal] protocol — but if you do an independent implementation, using the published reference documentation and background knowledge from having seen their code online, you can be accused of copyright infringement and asked to pay a “license fee.”

Or that fiasco with integrating a shitcoin in the application: https://www.stephendiehl.com/blog/signal.html

I'm on Signal because of the network effect and its reliability, and I actively invite people to use it over things like Telegram, but I do wish we had a better alternative. Matrix (Element) is buggy, Threema people need to pay for, Jami and this Tor-based chat app (I forget the name) don't have the features people expect, Wire is a good contestant but also not decentralized (nor does it have fancy things like sealed sender), and of course nobody has the network effect that Signal has... no good alternatives.

You missed from your list of alternatives the whole XMPP network. It's a federated model (similar to email/Matrix), self-hostable and there are also public providers.

The XMPP ecosystem is pretty diverse and predominantly open-source.

Personally I'm working on Snikket, which is aiming to be the easiest way to get a group of people onto XMPP (often that's family groups, but also social).

We published a blog post comparing the Signal approach with XMPP/Snikket: https://snikket.org/blog/products-vs-protocols/

Looks like this Conversations app doesn't do video calling, which kinda makes it a non-competitor compared to all of the alternatives that already exist.

I'm aware of XMPP and tried it out back in the MSN days along with IRC, but then Telegram came along which promised encryption and a much better user experience and until not so long ago I believed that Telegram would 'any day now' come around to implementing encryption proper (as everything ICT, from WhatsApp that sent plaintext messages over tcp/443 to websites around the world after LetsEncrypt, all turned on proper encryption, I didn't think that this self-proclaimed privacy-focused messenger would stay behind). And so I found myself in late 2018 starting to more and more doubt Telegram, but by then there were many competitors and Matrix seemed to be the hot thing that everyone was excited about (and it turned out that it didn't even work properly after you turned on encryption, only the unencrypted form seems to be somewhat reliable). XMPP didn't come to mind as potentially having evolved, perhaps because in the decade since MSN, I don't think I heard of a single person using XMPP for end-to-end encrypted calls. Perhaps it's great but... somehow I doubt that I never heard of a functional free decentralized/federated end-to-end encrypted multi-device user-friendly chat and (video) calling system.

> Looks like this Conversations app doesn't do video calling, which kinda makes it a non-competitor compared to all of the alternatives that already exist.

Actually it does, and it works well!

Ah, because it's not mentioned in the features. Maybe I should have a closer look at it after all then!

I hope that XMPP or matrix wins out and becomes a de-facto standard that everyone uses (like email) over things like slack, signal, whatsapp, telegram, teams and all the rest.

What I don't get about Snikket is why it tries to distance/hide itself from XMPP. The homepage does not mention it, the app page only mentions it by saying that Snikket is "Compatible" with Conversations which is also compatible with XMPP. The server page does not mention it at all. Is Snikket XMPP and a few XEPs? Is it something else? Can I use a XMPP client with Snikket? Can I use a Snikket client with a XMPP server?

That makes me doubt that Snikket cares about interop with XMPP or the wider ecosystem.

I'd hope that the blog post goes some way towards explaining that.

The ultimate reason is that we're not building something for the 1% of people who know what XMPP is. The protocol used is absolutely irrelevant to most people. Feature set and ease of use matter far more.

For the people who do know what a protocol is, it's not hidden information.

The perspective to have is that the use of XMPP adds features (federation, security, interoperability) but it does not (and should not) define everything Snikket is to end users.

I get that making things understandable to non-techie users is good, but even on pages talking about the server (even on the install guide and the github readme for the server: https://github.com/snikket-im/snikket-server) you don't mention XMPP.

> it does not (and should not) define everything Snikket is to end users.

Does that mean that interop with XMPP is not a feature one should depend on? Is Snikket a XMPP app, a XMPP service, a XMPP fork or is it not XMPP at all despite being based on XMPP software?

> even on the install guide and the github readme for the server you don't mention XMPP.

Sure, and I don't see a problem with this. It's irrelevant information for an install guide.

It probably should be in the readme (which frankly needs an overhaul). However if someone is looking for an "XMPP server" then there is a good chance that they are not in the target audience for Snikket. I happen to also be a developer of Prosody, the XMPP server software Snikket uses. Prosody is an extremely flexible and customisable XMPP server, and most Prosody users love that about it. But a Snikket server is totally opinionated, preconfigured and exposes minimal controls to the admin.

> Does that mean that interop with XMPP is not a feature one should depend on?

It's a feature you can depend on as much as you can depend on it having e.g. video calls. Removing it would have a negative impact on the project.

Replacing it? If there were alternatives and they were interoperable, sure, maybe. Matrix is probably the only alternative that comes close to that, but it has a way to go before it could meet our needs. I consider a switch from XMPP very unlikely.

> Is Snikket a XMPP app, a XMPP service, a XMPP fork or is it not XMPP at all despite being based on XMPP software?

It's an app and server that implements XMPP. It's not a fork of XMPP (we actively participate in XMPP development).

One final thing to note is that Snikket projects, while using standard XMPP, will focus on pushing XMPP forwards, and prioritise this over backwards compatibility with other projects in the XMPP ecosystem. Example: a couple of XMPP clients don't do encrypted calls yet. Snikket calls are encrypted always. We won't compromise on security or usability in the name of backwards compatibility. Related projects such as modernxmpp.org are part of this mission to keep XMPP moving forwards.

DeltaChat?

Their homepage explains why I never heard of it: it "uses the most massive and diverse open messaging system ever: the existing e-mail server network". That won't work for (video) calling; not an option for me. I might as well just send my mom an email at that point? (Since I self-host mail, it wouldn't even have to leave localhost. Also, guess what I'm debugging right now... what monster even created this thing called sendmail...)

>I was at a talk that had something to do with Unix. Fortunately, I’ve succeeded in repressing all but the speaker’s opening remark:

>I’m rather surprised that the author of sendmail is still walking around alive.

>The thing that gets me is that one of the arguments that landed Robert Morris, author of “the Internet Worm” in jail was all the sysadmins’ time his prank cost. Yet the author of sendmail is still walking around free without even a U (for Unixery) branded on his forehead.

- The Unix Haters Handbook

Signal requires a phone number for contact discovery, which many people have given out about because it's tied to your meatspace identity, so it's harder to be anonymous with Signal.

My understanding is that Signal is centralized, and this is not. That's an important difference.

Signal is centralized, server is closed source last time I checked, smells like a fed op, one of the creators was trying to use it to pump some shitcoin, it requires you to give them your phone number.

> server is closed source last time I checked

Check again. It's been updated for a while now. It's always updated, just sometimes less frequently then some people expect. There's no obligation to publish code every x months.

> smells like a fed op

You clearly have no idea what your talking about if you believe this. Signal is open source, it has been audited, it provides deterministic builds, is using state of the art cryptography, it's protocol is now the defacto secure communication protocol all other serious communication apps use, and is recommended and used by all the leading experts in cryptography and infosec...

> one of the creators was trying to use it to pump some shitcoin

Except there is 0 evidence that any pump and dump is going on. Or that moxie even owns mobilcoin. And calling it a "shitcoin" makes you out to be some cryptobro who shouldn't be taken seriously. There are numerous reasons they used a coin that was designed and optimized for use on a mobile phone. No other coins met their criteria. They also built some cool tech on top of that as well.

You're either seriously uninformed or are trying to spread fud.

Signal is encrypted and likes to show off how little they store, but it is not decentralized. Not being decentralized has many advantages, but a paranoid enough approach does see it as a point of failure for security (I use and love Signal, fyi)

Reply on news.ycombinator.com