Comment by fsflover | Hacker News Reader

Comment by fsflover | Hacker News Reader

Parent Full thread

> "the only way things can actually be secure in the long run is for them to be federated the way I want them to be"

I never mentioned any particular kind of federation that I prefer. I also never mentioned word "private", which is mostly tangential to federation.

My point is that, in the long run, only federated systems are sustainable, because nobody is able to fund huge servers with millions of users without infinite money. For example, Signal and Telegram are both struggling with that currently; the latter introduced advertisement recently. On the other hand, Mastodon does not seem to have such problem (you could argue that it's too early though).

I do not want to build my own clients, I'm not even a programmer. I want a sustainable network, which could be achieved by a large number of self-hosted instances federated with (possibly) large servers. It has been working fine with email for decades. Also, the competition of various independent clients improves the user experience (like any other healthy competition elsewhere).

Yeah. How'd that work out for Matrix? Here's a hint: find out when the project was started, and when the network first required end-to-end encryption. Warning: the answer to that entirely vindicates Signal's position on federation; you may not like it.

That doesn't make Matrix bad. It makes Matrix different. Matrix has different goals than Signal, and those goals simply prioritize security and privacy differently than Signal does.

I'll bite: we first created Matrix in 2014; we started implementing E2EE in 2016 and we turned it on by default in 2020. The reason it took so long was because we focused first on getting decentralisation (not federation) correct, and then the protocol started to get prematurely successful and we got sucked into ensuring the implementations (and spec) scaled and the governance was correct... even before E2EE was stable enough to be on by default.

You're completely right that we have different goals to Signal (openness + freedom rather than privacy-at-all-costs), but I'm not sure that blaming federation is the right answer here. We just prioritised building an open standard over having E2EE from day 1, instead choosing to design things so we could add it later.

As I recall, you had false starts getting E2E enabled by default (6 years after the project started)... because popular client software didn't have it working. That's not a problem Signal has or ever will have: when they want to roll out new privacy features (like they just did days ago!), they roll the clients.

Again: I'm not dunking on Matrix. There are things the Matrix approach will do better than Signal can. But protecting individuals is probably never going to be one of them; you're competing with a project that has security and privacy as its overriding goal, and nobody at Signal ever has to ask whether federation --- a protocol complexifier if ever there was one --- merits a security hit.

I don't use Signal for everything (or even most things). I'm completely open to the argument that other messengers are better "overall" than Signal. But on a thread that asks the question of whether Matrix is as secure as Signal (not "secure enough", but rather "at parity with"), there is simply a clear answer.

I don’t think we had any false starts on e2ee by default? We wrote pantalaimon as a local shim to let any unencrypted matrix client do e2ee, and then (eventually) flipped the switch. The thing that stopped us doing so earlier is that we wanted to have optional online keybackup and cross signing and better key verification UX before we forced everyone into it.

> nobody is able to fund huge servers with millions of users without infinite money. For example, Signal and Telegram are both struggling with that currently

I'm willing to believe that this is true for Telegram, since they do pretty much everything on the server. With Signal, though, message databases and most business logic are client-side, so the servers are surprisingly dumb and lean. Signal spends way more on salaries and wages than on its servers. In 2019, Signal paid more to Twilio for SMS verification than it did to AWS for hosting: https://projects.propublica.org/nonprofits/organizations/824...

Dismissing a platform that's solving real problems for real people right now because it might not exist in 5 years is a pretty weird thing to do.

"Sustainability" is arbitrary. Everything burns eventually.

The problem is that such security is unstable due to unstable funding and the single target. You never know when it stops being secure (without a warning) or even available.

I am mostly talking about a use case, where you try to switch all your friends and relatives to a new IM system. If you have to ask them to switch again in a couple of years, you will loose their trust quickly.

You keep alluding to the "instability" of Signal's security, but your argument for that is a non sequitur. Repeating it doesn't make it more compelling.

Reply on news.ycombinator.com