News for hackers. Stuff that matters.
Re:Signal Foundation by jkarneges on Wednesday February 21, 2018 @04:50PM (#16433287)
I think users would prefer federated systems. Who wouldn't? Even though most people have probably never heard the word before, they almost certainly use and appreciate federated systems like phones and email.

Do people want federation enough to have to take a principled stance in order to force change? Heck no. And that's the problem: there's no reasonable way for their desire to impact the producer side of the market. Can't vote with your wallet since public IM service is universally free, plus network effects are strong.

Users are being worn down, too. I remember when Pidgin, Adium, Trillian, etc were rather popular. Now most people don't even use those kinds of consolidation apps either, and resign themselves to literally running many separate apps.

This is a crazy mess we got ourselves in, and there is no easy fix. Time machine to 1980 to get a standard out before ICQ, maybe.

Re:Signal Foundation by chme on Wednesday February 21, 2018 @05:02PM (#16433397)
> Now most people don't even use those kinds of consolidation apps either, and resign themselves to literally running many separate apps.

IMO that is really one personal hell for me. I blame android and apple for this. I was happy with my N900 where you got one chat application that supported SMS, Skype, XMPP, AIM, ICQ, whatever. The world was so simple back then. Now everything has to be a separate "app", where previous there where just plugins. Such a decline in usability.

Re:Signal Foundation by Fnoord on Thursday February 22, 2018 @12:42PM (#16439464)
Pidgin (formerly known as GAIM) and its subproject libpurple is the one to thank for. Telepathy [1] and Bitlbee [2] are based on that. I used all of these throughout the '00s. Before the Nokia N900, I used a Nokia E71 with Nimbuzz (basically proprietary but it runs something like Bitlbee under the hood on their servers).

Some of these protocols are open, some are reverse engineered. Problem with the current generation is that they're focussed much more on security features such as E2EE. Although before GAIM, we had other applications which did multiple protocols we also had loads of single purpose applications for all these protocols you mentioned and a whole lot more. Back in the end of '90s if you wanted to run MSN and ICQ and AIM on Windows, you had to use a client for each of these. Its basically a cat and mouse game. Look at the history of the Skype support for an example of that.

[1] https://telepathy.freedesktop.org/

[2] https://www.bitlbee.org

Re:Signal Foundation by distances on Thursday February 22, 2018 @04:25AM (#16436361)
As a former user of N900 I get your point, but frankly I don't mind at all. For me it makes no difference if I need to open one app or another, it's the same amount of tapping. So I'm in the camp who wouldn't mind federation, but won't bother to lift a finger for it either.
Re:Signal Foundation by sneak on Wednesday February 21, 2018 @08:49PM (#16434567)
> I think users would prefer federated systems. Who wouldn't? Even though most people have probably never heard the word before, they almost certainly use and appreciate federated systems like phones and email.

Except that they don't; they mostly use Facebook Messenger, iMessage, and Whatsapp. Those that do use email use gmail, which barely federates (most gmail users never see messages from my personal email address, because google routes them to spam despite my IP never having spammed).

Re:Signal Foundation by kbenson on Wednesday February 21, 2018 @11:31PM (#16435160)
What we've seen isn't users showing how they feel about federated systems, it's users being forced into walled gardens as closed systems added support for open systems, but open systems could not reciprocate, and the market adjusted.

If your choice as a user is to buy an iPhone that can communicate with your Apple friends over imessage and Android friends over hangouts, or buy an android phone and not access anyone through imessage, there's an advantage to Apple there. Google just decided to level the playing field (if slightly) by privatizing the hangouts protocol, and we all lost out a bit because of it.

Federation isn't something most people even experienced throughout all that, so it's hard to think it was factored in, even a few times removed, from their decision.

Re:Signal Foundation by nickpsecurity on Thursday February 22, 2018 @01:03PM (#16439707)
" it's users being forced into walled gardens as closed systems added support for open systems, but open systems could not reciprocate, and the market adjusted."

We haven't seen users forced to do much of anything. In general, there's multiple ways of achieving their goals. They almost always pick either a proprietary company that likes lock-in or a free, ad-driven solution that sells them out. They neither take time to understand the consequences of that ahead of time nor cared enough to switch in the years I've explained it to hundreds (thousands?) of them. Very, very few would switch. And for social media, it's usually a network effect they're joining where stadiums worth of people would have to switch at once or close together to avoid chicken-and-egg problem. They could collectively use open standards to communicate like open-source IM and buddy lists but most don't given they'll sacrifice control of their data and privacy for convenience.

There is a market effect like you describe where the suppliers benefit from lock-in. That's been steady a long time with even the open standards often intended to catch new customers in lock-in in other ways. On the demand side, though, the masses haven't used open-source as a factor in their purchasing much at all. So, it's not even a differentiator on their end for most suppliers to target. The market didn't even adjust: it defaulted on lock-in strategies for owners' benefit with companies occasionally experimenting with other methods they sometimes reversed.

Re:Signal Foundation by kbenson on Thursday February 22, 2018 @02:17PM (#16440495)
> We haven't seen users forced to do much of anything.

Well, it depends on how you want to interpret forced. Sure, they aren't required to use a product, but if you've been using Gtalk for years, and that's how everyone knows to get hold of you and how you get hold of people, and it's an open protocol (XMPP) which you can and do use through a third party client (e.g. Pidgin), when they switch to Hangouts you are forced to use their proprietary client and protocol if you want to keep the same contact list without making everyone switch. It's not strictly "forcing", but Google is exerting force to drive customers to a different usage.

I'm not sure any centralized IM service that expected to compete would have done different and survived with any appreciable market share, but that the ones that existed switched is notable.

> On the demand side, though, the masses haven't used open-source as a factor in their purchasing much at all.

The benefits of an open system aren't readily apparent to many people until they start experiencing the problems of a closed system. Closed systems have numerous benefits at the starting stage the open systems don't (for example, a clear way to monetize that works in line with people's expectations and human nature). We were lucky with the internet because it was federated by design (and necessity, pretty much), and grew to the point that it would be too costly to close the protocol before gaining too much popularity. Even so, we're seeing pushes to in that direction. Maybe when the problems of the closed IM systems become apparent enough, we'll actually have some more widespread adoption of open systems. WRT human nature and systems such as these, I'm not sure we've even seen full cycles of how people perceive and deal with the systems (we're only now really having a sizable group of adults that have always had the internet WRT the population as a whole), so a lot of how people deal with open/closed systems over time is still in flux.

P.S. Long time no see/read. Nice to have a conversation with you again. :)

Re:Signal Foundation by nickpsecurity on Thursday February 22, 2018 @06:38PM (#16442658)
" Sure, they aren't required to use a product, but if you've been using Gtalk for years, and that's how everyone knows to get hold of you and how you get hold of people"

There's the problem right there. They created a dependency on a single provider that could turn on them at any time. Many providers have gone out of business or done unscrupulous things. One should always have alternatives if anything is really important. In this case, they usually solely rely on one provider for convenience when not also cost (sometimes trivial cost). Still true for things like Facebook.

They walked right into a big problem because convenience or apathy about risks trumped everything. From there, they can be forced in the way you describe to go along with what vendor wants. At that point, they might also start switching and/or avoid doing that sort of thing in the future. In many cases, they avoid the switching cost and do the same kinds of things in other services. Their very nature is to willingly create opportunities for suppliers to cause them problems.

Even as they do this, there's a small subset of the market doing either the opposite or taking steps to limit the damage which make me think this is more willing than forced. If anything, history has shown we have to use things like regulations to force market participants to behave more safely on average. They usually don't do it on their own because they don't want to or don't care. Seatbelts when driving are the classic example.

"The benefits of an open system aren't readily apparent to many people until they start experiencing the problems of a closed system."

I agree. We probably need a way to quickly present that when they make these choices. Enough of the market making an informed choice might sustain more alternatives that are better. This already happens with at least some of the FOSS market where the buyers specifically liked the benefits of open source. The wider, long-term effects you describe will also be interesting to watch. We might see some of the FOSS-friendly decisions on consumer side as they see the benefits or experience the detriments.

"Long time no see/read. Nice to have a conversation with you again. :)"

Likewise, buddy. Although I comment less, I've read plenty of yours. Usually insightful and enjoyable. :)

Re:Signal Foundation by kbenson on Friday February 23, 2018 @12:44AM (#16444497)
> They walked right into a big problem because convenience or apathy about risks trumped everything.

Well, or just lack of knowledge, and lack of knowledge about lack of knowledge. I think from our positions it's easy to overlook that. Sure, it seems like people are becoming more technically literate, and they are, but I think when it comes to knowing what you can do, and knowing what you should do, the latter comes well after the forming in almost all exploratory loarning (which internet usage mostly is). We've heard the historical stories (myths), that impart this knowledge. Usually we've lived a few cases of it as well. Even then, it doesn't always take right away, or we get caught out not heeding our own advice. I can't fault a largely novice internet populace for not having had the same conditioning we have.

That doesn't mean they are off the hook though. You're right, there's a shitload of ignoring the signs in favor of convenience and general apathy, it's just not the entire story.

> If anything, history has shown we have to use things like regulations to force market participants to behave more safely on average.

I agree with regulations. I just vastly prefer them to target the specific problems and not try to get too complex with mechanics. Sometimes that requires really looking into the problem, and it can be a hard sell if the general audience for choosing/voting the implementation doesn't have enough knowledge. In this case, I think a lot of the problem all stems from using personal information as currency. Strong regulations on the collection, notification, maintenance, and ability to force removal of personal information by remote entities would make what the real cost is of the systems obvious (you know what they collect and how it's used, or in some cases you know what actual money you pay since that will become a much more viable model again). Open source cometes well in that market, because the actual costs are all apparent instead of hidden.

> We probably need a way to quickly present that when they make these choices.

I have hope this is a problem that will be mostly solved through the normal way societal best practices are passed down, from mentors (parents, teachers, trusted authorities). We just need to get to a point where the mentors actually know this stuff, which requires time and them being bitten by it and learning the hard way, or reading about those stories, or eventually learning it from their mentors. When your Mom or Dad is usually the one that cautions you at an early age to beware any free service that might be trading on your personal info, we've reached a good equilibrium (but we'll still have issues with those that don't have as much access to mentors, which is a constant societal problem).

Re:Signal Foundation by dzamo_norton on Monday February 26, 2018 @05:43AM (#16464417)
> most gmail users never see messages from my personal email address, because google routes them to spam despite my IP never having spammed

This is off topic but very briefly: implement SPF and DKIM and get a number of Gmail users (I'm not sure what this number is, but it is order of magnitude 10) to mark your emails as "Not Spam". Eventually Gmail will come to accept emails from your self-hosted server.

Re:Signal Foundation by jameshart on Wednesday February 21, 2018 @06:25PM (#16433880)
“they almost certainly use and appreciate federated systems like phones and email”

Two channels which have become saturated with spam and junk once the federated network starts to include players who are willing to permit bad actors to access the network in exchange for money.

People enjoy federated networks of regulated, good faith players; wide open federated networks tend towards anarchy.

Re:Signal Foundation by lsc on Thursday February 22, 2018 @12:57AM (#16435437)
>People enjoy federated networks of regulated, good faith players; wide open federated networks tend towards anarchy.

Like... email and the phone system? both of those have huge amounts of bad actors and spam, and people still use them as primary means of communication. Email and phone are generally expected to be more reliable, I think, than any of the walled garden communication protocols.

(Speaking of, if you have ideas about curbing phone spam other than keeping the number secret, do let me know.)

Re:Signal Foundation by jameshart on Thursday February 22, 2018 @09:38AM (#16437793)
I'm explicitly questioning "people still use them as primary means of communication"

Really? Even internal company phone systems have largely switched over to walled garden voip or videocalling systems in most places I've seen. Nobody calls anybody any more - the only use of phones I see is for dialling in to conference bridges. Email is used internally within businesses.

What do people really still use public phones and email for?

Re:Signal Foundation by lsc on Friday February 23, 2018 @02:17AM (#16444786)
On a more personal note, I grew up using messenger protocols, icq, aim and yim. Now, I'd use a multi-protocol client, which is a little like federation, but now that doing this is inconvenient? SMS has almost entirely taken over the role of instant messaging in my life.

It's interesting, because I always felt that a SMS was way more 'urgent' than an instant message over AIM, but... most of the adults in my social circle, even those I knew from back when we all used AIM, no longer are on any instant messenger services. They have sms (often, but not always through imessage) and they have email. Then they are on their various social networks, but everyone I know checks email more often than their social network accounts.

Re:Signal Foundation by lsc on Friday February 23, 2018 @01:31AM (#16444644)
>What do people really still use public phones and email for?

My impression is that inter-company communications all go over email and public phone. Intra-company,of course, you use the company's walled garden, if the company is large enough to dream of forcing the world into their garden (as most of the companies I've worked for lately have been.) but even so, interviewing is conducted through public phone systems. In fact, even when I'm interviewing a candidate on behalf of my current employer, half the time the connection between the internal walled garden voice system and POTS is so bad I end up using my personal cellphone. Silicon valley companies are serious about 'dogfooding' to the point where actually doing your job sometimes feels like a secondary concern. Smaller players tend to use existing technologies, and so more often use federated systems.

I have worked at smaller places, earlier in my career; I've even setup VOIP for one of those places, but it was still terminated to a POTS T1; it just used SIP lines and asterisk rather than a wired PBX, and they mostly used public email (I mean, their own email server, but it was federated email) - those are still federated systems.

I'm currently considering going to college; today, I scheduled a bunch of academic stuff, using the phone and email. If I end up locking myself into an institution, of course, then we will probably switch to using their walled garden, because they will have the power to force me to do so, but until that happens? we're communicating via federated systems.

Whenever I'm scheduling a medical appointment outside of my primary hmo? I use the phone.

My impression is that the walled gardens are mostly used in places where the relationship has been established, and one party is big enough to have built a walled garden system, and important enough to force the other party to eat the dogfood in question. Within my primary HMO, I use the proprietary 'secure messaging' application to communicate with my doctor. Within the company, I use the company's messaging system and screen sharing system.

My own conclusion is that forcing you to login and use my communications system is a power move; everyone is still dreaming of replacing email with something more profitable.

Re:Signal Foundation by TuringTest on Thursday February 22, 2018 @01:54AM (#16435731)
At least in my country, incoming call filters do wonders, in particular those which query the incoming number at an online database to show you who's the caller.
Re:Signal Foundation by Kihashi on Thursday February 22, 2018 @09:42AM (#16437813)
Not sure about elsewhere, but in the US, it is possible to spoof phone numbers. The only way to verify that the person you are talking to is actually associated with the number is to hang up and call them back. This is particularly a problem for companies like banks and insurance.

Android actually does provide some amount of filtering[1], but if someone, say, spoofs a seemingly legitimate number, it will come through fine.

[1]: https://www.androidpolice.com/2016/07/25/googles-phone-app-n...

Re:Signal Foundation by lsc on Friday February 23, 2018 @01:35AM (#16444665)
I've seen similar applications for ios, but they all seemed to want permissions I wasn't so happy to give to some rando. If apple provided the service, I'd probably be okay with it, but I'm not super comfortable feeding my entire contact list and all my call metadata to some random third party
Re:Signal Foundation by lsc on Friday February 23, 2018 @01:32AM (#16444646)
Is this something the phone company implements? or that your phone implements?
Re:Signal Foundation by ycmbntrthrwaway on Friday February 23, 2018 @10:56AM (#16447075)
It does not have to be regulated by any third-party, though. Federated networks participants can regulate networks for themselves. Look at Mastodon network. If some server tolerates spamming, it will be blocked by major servers as a whole.