Hacker News Reader

Comment by t0bia_s | Hacker News Reader

Centralised service is weaker against surveillance than decentralised solutions. Signal should adopt selfhosting and federation.

View on HN

jabber/xmpp is open standard and supports e2e encryption and can be self-hosted, has mobile clients

How does it support e2e?

By clients having support and/or plugins for things like OMEMO and OTR.

I use XMPP with OMEMO for my main encrypted messaging, and I don't get why Matrix got popular instead of XMPP (aside from a big marketing budget). Even a lighter server implementation takes up several times more resources than an XMPP server, plus the concerns about the enormous central instance.

XMPP FTW.

Last time I checked (2018) the support for media&file sharing was in a quite bad shape in all available Android clients. Even without e2e encryption enabled. Is it good now?

For Android - Conversations is in a very good shape now.

Matrix supports e2e encryption, so it would be a good candidate for self hosting. I already do.

My only complaint with self-hosting matrix is that the canonical python implementation is quite resource-heavy. I was unable to run it on a cheap VPS. I hope that the ecosystem will improve in the future.

When did you test it? It has improved very much in the past five years.

I agree. I really prefer Dendrite, their Go server, but development has slowed down lately. Also, because of the financial issues they have been having, I don't have a lot of hope that Dendrite will get a lot of attention. Maybe Conduit(https://conduit.rs) will become more viable instead of Dendrite. We really need a small efficient build with no moving parts, for the self hosters community.

Matrix has shady foundations, being born out of a Israeli company with alleged ties to Israeli intelligence. See https://hackea.org/notas/matrix.html

sigh. If you want to play project pedigree games; Matrix was actually the result of two existing teams - one in the UK and one in France, which happened to get acquired by Amdocs and then subsequently spun out once we'd created Matrix.

That page in particular is a pile of FUD; it keeps banging on about "impressive collection of private data being sent to Matrix central servers, even when you use your own instance" which is simply categorically untrue; it looks like they misread the privacy policy of the Matrix.org server at https://github.com/element-hq/policies/blob/master/docs/matr... and somehow assumed it applied to everyone's server instances. It doesn't, any more than https://www.w3.org/policies/privacy applies to a given random webserver on the internet :|

Another vote for XMPP with OMEMO here. I use it my wife, family, and a few friends and haven't heard any complaints yet[1] (aside from the lack of stickers, which are apparently important).

[1]: But like I said in another thread, who knows if they would directly complain to me.

On iOS app distribution and censorship is and will remain centralized.

It doesn’t matter if the relay service is centralized or federated. Apple can ban apps that don’t comply with the new law. Even self-distributed apps under the new sideloading provisions of the DMA can be censored by Apple by revoking the notarization.

This ignores the problem of client-side scanning of private messages.

Your hosting, your rules.

Most of my family use my brother's Matrix server, but it's the Element app that makes it appealing to us all. Client side scanning could be enforced in the app, regardless of the server's protections.

However there is a whole ecosystem of clients, and they can't all be back doored. You are also free with write your own client, and many do (which is why we have so many in the first place).

Protocols, not platforms, people!

But if in a group only one person uses a compromised client, all communication is compromised, isn't it?

Potentially, yes. But that's where Signal's protocol helps. It includes plausible deniability.

Therefore even if your chat log is leaked by one member, it isn't possible to probe person A sent the message. If person B was the leaker, anyone that person B has ever communicated with on Signal could have sent the message appearing to be from person A.

Not in the Matrix ecosystem. The protocol is so brittle there's only one real server and one real client, probably intentional, since the designers of the protocol make money from that server and that client.

There’s three servers I know and like 10 clients.

Not sure when you last looked at the landscape.

Servers: Synapse, dendrite, conduit

Clients: (just off the top of my head)

Element, fluffychat, cinny, neochat, cyphon, nheko, schildichat

Apart from Synapse, server implementations are stuck in permanent beta.

Clients outside mobile OSes are not interesting if you are considering Signal replacements. On mobile, you have element and maybe fluffychat.

It is still a messaging thingie that lacks a decent server implementation, and lacks a good client app.

Current EU politics motivate some to develop more. Where is oppression, there is reaction.

I love Matrix but they do have a bit of a monoculture problem which I hope will get better when the protocol stabilizes. As long as they document their standards we should be fine. Their big commercialization push could turn out to be problematic in the long run, but we have to give them the benefit of the doubt and see.

If you want all the voip bits in place and all the latest features, you have to run a specific combination of synapse, sliding-proxy and element as the client. The xmpp ecosystem has similar problems but it gives a bit more leeway with various combinations of servers and clients that work well.

Matrix has more focus on IRC-like rooms, has a lot more features for that purpose and is much nicer to use than any conference xmpp extension.

https://matrix.org/ecosystem/clients/

https://matrix.org/ecosystem/servers/

The designers of matrix decided to shift more of the burden of the protocol to the server so that clients would be easier to implement. Therefore there are few servers and many clients. e2ee makes the client more complicated, that's why not all clients support e2ee

There are also several element forks. I would imagine there would be a fork without scanning if the main element app was doing scanning.

Not on iOS.

Your choice

An their law.

Making this argument whilst ignoring the trade-offs of federation (that Signal has historically addressed) is somewhat disingenuous and a little fundamentalist.

do you have any breakdown on the trade-offs? Most HN commentary focuses on FUD around the signal founder rather than technical reasons why it shouldn’t be federated and would love to understand them better

Moxie wrote an extensive blog post outlining the reasons they were not going to make use of a decentralised system.

I believe its this post here, but someone correct me if this is the incorrect link: https://signal.org/blog/the-ecosystem-is-moving/

Reply on news.ycombinator.com