The Signal Server repository hasn’t been updated since April 2020. There are a bunch of links about this here but I found this thread the most interesting.

To me, this is unforgivable behaviour. Signal always positioned themselves as “open source”, and the Server itself is under the best license for server software (AGPLv3 – which raises questions about the legality of this situation).

Signal’s whole approach to open source has constantly been underwhelming to say the least. Their budget-Apple attitude (secrecy, i.e. “we can never engage the community directly”, “we will never merge/accept PRs”, etc) has lead to its logical conclusion here, I guess. I have been somewhat of a “Signal apologist” thus far (I almost always defend them & I think a lot of criticism they get it very unfair) but yeah I’m over Signal now.

@yogthos
link
327M

Another big problem with Signal is the fact that it’s centralized with the server being located in US. Even if the protocol itself is secure with the server not having access user data, this presents a huge risk since US government can simply force Signal to shut down the service at any time. The server can also potentially collect metadata about the users providing US security agencies with user connection graphs.

I think that Matrix approach is much more sound, and would always recommend it over Signal.

@Seirdy
link
46M

I wrote about both issues, and why Matrix isn’t a perfect solution, previously: part 1, part 2. Starring WhatsApp, Firefox, Signal, XMPP, Email, and Matrix.

Also discussed on Lemmy: part 1, part 2.

Signal’s problem is being a closed platform; Matrix suffers primarily from complexity. Both enable dependence on a single small group, and therefore enable user domestication. That being said, Matrix is considerably less bad than Signal.

For large public rooms, IRC continues to be the best option. All its issues are client-side; IRCv3 supports history, multiple devices, authentication without NickServ, and even typing notifications. All these features are supported on Oragono. For small, private E2EE rooms, all existing solutions have major trade-offs.

@yogthos
link
16M

yeah completely agree with all that

@roastpotatothief
link
-37M

All these discussions tend to ignore Wire. It is similar to Signal but has none of these drawbacks and even some extra good features.

sseneca
creator
link
107M

Wire was mentioned in this thread. It transferred ownership (which in itself was shady) and its new owners are shady too.

@roastpotatothief
link
25M

What do you mean about its new owners?

@lorabe
link
317M

Let’s be honest, Signal was never an option.

Rather than being free software, signal is more like museum software, you can see, but you cannot touch.

sseneca
creator
link
167M

A few years ago (2017?) I decided I would move messenger apps. The aim (and what I’ve achieved) was all my messaging going through a secure, private app.

Signal was never an option.

In 2017, Signal really was the only option. Element (Riot, back then) was really bad and didn’t feature e2ee (which only got enabled by default last year!). XMPP was and remains difficult to use (not even many people here use it, how could I expect “normal people” to use it?)

I made the choice to use Signal, and I don’t regret it. I only regret that it has taken until now that we are starting to see a glimmer of a real competitor, in the form of Matrix. But a really competitor to Whatsapp and the like, back in 2017, just didn’t exist outside of Signal.

poVoq
link
5
edit-2
7M

I don’t quite get why you think XMPP is harder to use than Matrix. The only way this seems true is if you use the main matrix.org instance and then you are pretty much back at a centralized service based in a five eyes country (UK).

sseneca
creator
link
77M

It’s not about instances, they’re pretty much equal in that regard. There are two main issues with XMPP:

  1. Clients. There is no “default” or “reference” client for XMPP, whereas there is a cross-platform one for Matrix (in the form of Element). This has several implications, but the most important is that for the non-technically aware (which is the vast majority of people I talk to), it is easier and reassuring to use “the” Matrix client. The more important implication to me is on e2ee. Conversations started in Element now enable e2ee by default. In contrast, every XMPP client I’ve tried (on Linux & iOS) does not.
  2. Message history. Matrix and XMPP differ a lot here, and it’s why the Matrix homeservers are much more resource hungry than XMPP servers. When I use Matrix, I get message history on each device. This is a critical feature for those I want to move from Whatsapp and the like. This is not the case with XMPP.
poVoq
link
5
edit-2
7M

I disagree on the default client idea, especially if it is such a badly done web-based one as element/riot. In the end clients are always platform specific, and there are easy to find “best” XMPP clients for each platform. At most it is a branding/marketing problem (see Snikket.org for that).

As for the other two points: that is both false and outdated. e2ee has been supported and the default in XMPP for longer than in Matrix and message history (as much as the e2ee double ratchet algorithm used both in OMEMO and OLM permits) is working perfectly in XMPP across clients if the server has MAM enabled (pretty much all have).

sseneca
creator
link
27M

You say you disagree with the default clients idea, but why?

At most it is a branding/marketing problem

I don’t know why you’re so dismissive of this issue. I feel like you’re framing me as if I’m anti-XMPP when that isn’t the case; on the contrary I use XMPP and am a Prosody server admin. The reality of the situation though, like I’ve said above, is that next to nobody uses XMPP, even in tech communities. At this point “branding/marketing” could end up being the be-all and end-all of the entire protocol.

As for the other two points: that is both false and outdated.

You’ve misinterpreted my comment. I am very well aware XMPP has and has had e2ee support, the issue is that XMPP clients never have this switched on by default, in my experience (which was testing every XMPP iOS client there is, the platform most my friends use).

poVoq
link
67M

The situation on iOS for XMPP is uniquely bad (but actually Siskin and Monal are improving a lot lately). It simply is unfair to look at only one tiny and for most people irrelevant (and uniquely bad) platform and extrapolate from that. On all other platforms XMPP works great and most clients have e2ee enabled by default for 1:1 chats (where it makes the most sense).

As for the other topic, sorry I didn’t want to sound so confrontational, but the same argument comes up all the time inside and outside of the XMPP ecosystem and I think it is simply false. There are other problems why XMPP isn’t adopted. Network adoption is driven by network effects. People invite other people to the network and when doing that they typically also recommend a client (& server). The case of a lone person looking for a new messaging system without any network is the rare exception and one that only comes up in the bubble where this discussion usually takes place.

riccardo
link
4
edit-2
7M

Well there was Wire, which offered e2e encryption, an open protocol and opensource clients and backend, it has been audited, and it was based in Swiss which is times better than the US. I tried to move a lot of people there, but luckily I failed, considering it has been bought by an advertisement company recently

@Ghast
link
37M

Wire looked nice, but I stopped using it after they persistently dragged their feet on federation.

Git discussion

Once something with federation gains popularity, the discussion may be over, as we won’t have to talk about jumping ship every year. I’m not sure it’s doable yet, but I’m sure that once it takes hold it’ll last, just like email.

sseneca
creator
link
37M

Wire was pretty good, true. I used it a bit, but chose Signal because Wire (similarly to Matrix, for now) doesn’t encrypt any/most metadata, whereas Signal encrypts everything and always has.

And like you said, it’s since been sold to an advertising company. Not sure if that’d even be possible with Signal since it’s owned by a non-profit (admittedly not always the case, I guess it could have been possible when they were still OWS).

In both cases, their centralised nature means changing ownership can be devastating (like in the case of Wire). This is why I believe Matrix is the future. Its community is much healthier and active in the development of the ecosystem (3rd party clients, bridges, they actually accept PRs, etc…)

@southerntofu
link
87M

Signal encrypts everything and always has.

This is not exactly true. Encrypting metadata is most times impossible due to the server needing to know who to deliver messages to (at the very least). “Sealed sender” is now a thing (though i don’t know how strong a protection that is), but to my knowledge Signal continues to aggressively expose users’ phone numbers both to the server (in a hashed formed, for contact discovery) and to other users in public chatrooms. Please correct me if wrong.

it’s owned by a non-profit

A non-profit doesn’t mean you need to do good. Also, it can turn into a for-profit over the years. It’s in fact a conscious strategy of startups in the field of “sharing economy” (remember couchsurfing?)

This is why I believe Matrix is the future.

Matrix is one among others, but i’m not convinced a single solution is going to be the best:

  • Matrix really has a startup vibe and introduces a lot of complexity (reinventing quite a few wheels along the way), to the point the current situation is there’s only one bad client/server implementation (really resource-hungry)
  • Jabber/XMPP has a much slower but dedicated non-profit ecosystem (let’s not even talk about the commercial branches) and lots of client/server options for all hardware/systems, but the clients don’t have good UX/polishing
  • ActivityPub has a vibrant ecosystem but most clients are web-oriented (such a shame) and tailored to a specific use-case (peertube/mastodon/pixelfed)

They all have strong arguments going for/against them. I believe interoperability is the only way to go. These network are doing mostly the same thing, and there’s no reason we can’t talk across networks.

Which brings me to the fact matrix folks really don’t seem to care about interoperability though i hope i’m wrong about this.

@michel
link
37M

FluffyChat is a decent alternative client (with E2EE support). If you don’t need e2ee there’s actually a healthy number of clients, and some of them do seem to have it on their roadmap

https://matrix.org/clients/

Point taken on server implementations though

@southerntofu
link
27M

FluffyChat is not an option because it doesn’t support proxies including Tor. If you’re using fluffychat please open an issue there for integrated tor support like Conversations/Gajim does in the Jabber/XMPP world :)

sseneca
creator
link
37M

I have a lot of thoughts about this but don’t really have the time to reply.

All I’ll say is that I hope you’re following Element’s progress with Dendrite closely. I host my own Dendrite server and it is much more reasonable in terms of resource usage versus Synapse, and it hasn’t even had any resource optimisation features implemented yet.

poVoq