Hacker News Reader

Comment by xt00 | Hacker News Reader

I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own server, where that server runs a VM that you configure and setup on your own PC locally then upload to AWS or something and has some facility to constantly report to you the hash of the memory and disk contents, along with some contract from AWS that states that Amazon cannot alter the results of the hash function results sent to you under any circumstances. Plus there would be some facility to validate the contents of what runs in that VM at any instant in time. Basically the idea is you can’t trust anybody at all. I guess pgp would maybe solve this for direct messaging?

View on HN

I think something like Ricochet (if it were still actively maintained) could be a good solution.

https://github.com/ricochet-im/ricochet

Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

Briar https://briarproject.org/ is similar, plus, AFAIK, it's using E2E on top of Tor service. However, looking at massively caught Tor services, I believe, to keep it truly secure, you have to rotate your service address, aka reinstall the app, losing all your history of communication.

You could still have holes in a self hosted setup. The self hosted version could forward stuff on to someone else… so you could setup a firewall. But is it really blocking everything or is it just telling you it’s blocking things. This can go on forever, it all depends on the threat model and how far down the rabbit hole you have time to go.

There’s plenty of that stuff. Jabber and XMPP. And also more up to date is Matrix.org which nobody seems to want to use and I’m not sure why.

The problem though is that you’re still trusting the code. Nothing stops self hosted from rotting on you unless you look and read the code yourself.

In case anyone is in doubt after reading your comment, I want to clarify that XMPP is "up to date" and has an active community and ecosystem of software projects, open-source and commercial.

Matrix is similar in many ways, and certainly younger, but also has a vastly different design at the protocol layer. It's more akin to a distributed JSON database/log, while XMPP is more focused on message routing and synchronization. Therefore each has different strengths/weaknesses for different use cases.

Despite these differences, both protocols indeed have IM apps and a whole lot of other software built on top of them.

> Matrix.org which nobody seems to want to use and I’m not sure why

Lots of people are using it (and probably more every day), but there are also some quite vocal haters. Of course it has its share of problems (availability of non-Electron clients and different servers among then), but many of them constantly improve as the ecosystem grows.

It's pretty easy to host your own chat server. https://twitter.com/inputmice/status/1170651869359804416

We're basically working on this at Comm: https://github.com/CommE2E/comm

Reply on news.ycombinator.com