8 ms·

the difference is Signal is NOT federated, and matrix is. Which make it more like email, harder to censor.

walrus01 6y ago
Not necessarily, I run a non-federated synapse (matrix protocol) server for intranet type use. It's in an environment where it has no connection to the wider internet at all. The default matrix.org servers are federated. In terms of what the default Element install presents to the user upon launch in its GUI, I think it does offer the 'official' matrix.org servers as a place to create an account and sign in, start browsing 'rooms'.
- est31 6y ago
  Your users still benefit from less centralization. The main matrix.org instance might ban them for whatever reason, but their access to your internal server is not touched. It's different if all of you used Signal or Discord and their account got banned e.g. for using an alternative client.
  - o-__-o 6y ago
    Signal is open source you can run your own non-federated signal server. You can use a custom signal client against the federated network too. https://www.vice.com/en/article/n7vq4k/thousands-of-users-unknowingly-joined-signal-because-of-12-year-olds-app https://www.vice.com/en/article/n7vq4k/thousands-of-users-un...
    - est31 6y ago
      Moxie is not friendly towards such third party clients that connect to the main network. Also, I only used it as an example. There might be other reasons for a ban. The point is that you don't depend on them.
    - rglullis 6y ago
      Signal Server has not seen updates for over 9 months. Moxie openly states that is not part of Signal's core values to support federation in the network. IOW, even though they say they don't want to control your conversation, they do want you in their hands.
      - o-__-o 6y ago
        But. The point is still that you can run your own non-federated signal server or connect your own client to their federated network.
        rglullis 6y ago
        An outdated version of the server whose development team has no incentive whatsoever of supporting for your use case. Can you run it? Sure. Should you?
        o-__-o 6y ago
        Why does any source code exist then? What is the point of GitHub with codebases that are 7+ years old? Would mass adoption of the outdated server force updates or god forbid a fork of the code base? Please excuse me for being direct, I do not accept your defeatist attitude on this one. You won’t have stickers, such a shame, but you would have the ability to create your own signal service
        rglullis 6y ago
        If Signal was the only alternative to have an internal messaging tool, sure, it would make sense to invest time and money on it to keep it up. But it doesn't. There are options. If I had to choose, I would rather invest this time and money to collaborate on the existing protocols that do have the goal of being fully open. Matrix and XMPP can do the things that I want and there are plenty of people working on them to overcome the present issues and challenges for mass adoption. Why should I swim upstream by myself if there is no special reward for this kind of effort?
johnisgood 6y ago
And for the love of God, people should stop calling Signal secure as long as it is tied to a phone number. You cannot get a SIM card in my country without not having it tied to your ID card number, address, and so forth. You are not anonymous on Signal.
- mickotron 6y ago
  They can tell that you got a phone number and use signal. Apart from when you first and last used signal (timestamp), as in sent messages, that's about all the info signal has on you, and can provide. That sounds pretty good. Even if it is tied to a physical identity. The fact that your content is sufficiently encrypted and cannot be tied to your identity, even by signal, means what you say is anonymized.
- majewsky 6y ago
  > people should stop calling Signal secure as long as it is tied to a phone number. Like nearly everything, "secure" is a spectrum and not binary. On that spectrum, Signal is overwhelmingly more secure than most messenger apps people actually use.
  - johnisgood 6y ago
    You are right, although as long as it is tied to me, it is not secure according to my definition, but sure, it is more secure than most instant messaging apps. I do not think it is a good thing to have my phone number, or even my e-mail tied to it when you can easily do it in another way. With e-mails the problem is that most have a thing against throwaway e-mails, and non-throwaway ones are difficult to sign up for using a VPN, let alone Tor, for example. It is still pretty much tied to you. There are so many ways to do it without using either of those. I suppose they may use those things as an anti-spam mechanism or something, but see below for an instant messaging app that does not require these and where DDoS attacks or spamming is not much of a concern. For the record, in Ricochet you got random IDs in the form of "ricochet:xxxxxxxxxxxxxxx". You share your Ricochet ID to be able to get a connection request. To me, Ricochet is the most secure instant messaging app for desktop. It would be even better were it to use Onion v3, and if it were available on Android, but then again, I do not really consider my phone secure by default with all the Google crapware. I disabled the default Google keyboard and downloaded one that does not require Internet connection and that is not related to Google in any way. It is so silly that I cannot even delete any apps that came with my phone. So they say its storage capacity is 32 GB. Half of that is spent on crap that came with the phone, splendid. In any case, I am going off-topic here so... :)

Not necessarily, I run a non-federated synapse (matrix protocol) server for intranet type use. It's in an environment where it has no connection to the wider internet at all. The default matrix.org servers are federated. In terms of what the default Element install presents to the user upon launch in its GUI, I think it does offer the 'official' matrix.org servers as a place to create an account and sign in, start browsing 'rooms'.

est31 6y ago
Your users still benefit from less centralization. The main matrix.org instance might ban them for whatever reason, but their access to your internal server is not touched. It's different if all of you used Signal or Discord and their account got banned e.g. for using an alternative client.
- o-__-o 6y ago
  Signal is open source you can run your own non-federated signal server. You can use a custom signal client against the federated network too. https://www.vice.com/en/article/n7vq4k/thousands-of-users-unknowingly-joined-signal-because-of-12-year-olds-app https://www.vice.com/en/article/n7vq4k/thousands-of-users-un...
  - est31 6y ago
    Moxie is not friendly towards such third party clients that connect to the main network. Also, I only used it as an example. There might be other reasons for a ban. The point is that you don't depend on them.
  - rglullis 6y ago
    Signal Server has not seen updates for over 9 months. Moxie openly states that is not part of Signal's core values to support federation in the network. IOW, even though they say they don't want to control your conversation, they do want you in their hands.
    - o-__-o 6y ago
      But. The point is still that you can run your own non-federated signal server or connect your own client to their federated network.
      - rglullis 6y ago
        An outdated version of the server whose development team has no incentive whatsoever of supporting for your use case. Can you run it? Sure. Should you?
        o-__-o 6y ago
        Why does any source code exist then? What is the point of GitHub with codebases that are 7+ years old? Would mass adoption of the outdated server force updates or god forbid a fork of the code base? Please excuse me for being direct, I do not accept your defeatist attitude on this one. You won’t have stickers, such a shame, but you would have the ability to create your own signal service
        rglullis 6y ago
        If Signal was the only alternative to have an internal messaging tool, sure, it would make sense to invest time and money on it to keep it up. But it doesn't. There are options. If I had to choose, I would rather invest this time and money to collaborate on the existing protocols that do have the goal of being fully open. Matrix and XMPP can do the things that I want and there are plenty of people working on them to overcome the present issues and challenges for mass adoption. Why should I swim upstream by myself if there is no special reward for this kind of effort?

johnisgood 6y ago

And for the love of God, people should stop calling Signal secure as long as it is tied to a phone number. You cannot get a SIM card in my country without not having it tied to your ID card number, address, and so forth. You are not anonymous on Signal.

mickotron 6y ago
They can tell that you got a phone number and use signal. Apart from when you first and last used signal (timestamp), as in sent messages, that's about all the info signal has on you, and can provide. That sounds pretty good. Even if it is tied to a physical identity. The fact that your content is sufficiently encrypted and cannot be tied to your identity, even by signal, means what you say is anonymized.
majewsky 6y ago
> people should stop calling Signal secure as long as it is tied to a phone number. Like nearly everything, "secure" is a spectrum and not binary. On that spectrum, Signal is overwhelmingly more secure than most messenger apps people actually use.
- johnisgood 6y ago
  You are right, although as long as it is tied to me, it is not secure according to my definition, but sure, it is more secure than most instant messaging apps. I do not think it is a good thing to have my phone number, or even my e-mail tied to it when you can easily do it in another way. With e-mails the problem is that most have a thing against throwaway e-mails, and non-throwaway ones are difficult to sign up for using a VPN, let alone Tor, for example. It is still pretty much tied to you. There are so many ways to do it without using either of those. I suppose they may use those things as an anti-spam mechanism or something, but see below for an instant messaging app that does not require these and where DDoS attacks or spamming is not much of a concern. For the record, in Ricochet you got random IDs in the form of "ricochet:xxxxxxxxxxxxxxx". You share your Ricochet ID to be able to get a connection request. To me, Ricochet is the most secure instant messaging app for desktop. It would be even better were it to use Onion v3, and if it were available on Android, but then again, I do not really consider my phone secure by default with all the Google crapware. I disabled the default Google keyboard and downloaded one that does not require Internet connection and that is not related to Google in any way. It is so silly that I cannot even delete any apps that came with my phone. So they say its storage capacity is 32 GB. Half of that is spent on crap that came with the phone, splendid. In any case, I am going off-topic here so... :)