Matrix is far closer to being "the email for instant messaging" -- Signal-like double ratchet encryption by default for private rooms, federated in a similar way to email servers (but much simpler to manage as an admin), much nicer group chat UX, simpler identity key verification (it has Signal-like QR codes but it also has emojicode verification which is nice if you're not in the same place when doing verification), has an open specification, multiple client implementations, a couple of still-in-progress alternative server implementations, it even has bridges (which have pretty decent UX) to other social networks like IRC, Slack, Discord, and so on.

Signal is far from an open standard. I use it and am quite happy using it, but with the knowledge that Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough). And it's fine to have that opinion, I just disagree with it and you shouldn't sell Signal as something the lead developer has said they're explicitly against.

For folks saying (read: hoping) that Signal may become federated in the future -- I think it's a much safer bet to just use Matrix since it's already federated and has at least equivalent privacy guarantees (or even larger if you self-host your own server) and hope that Signal will peer with them in the future (which I personally think is about as likely as Signal becoming federated itself -- namely, it's very unlikely either way). But you do you.

> Moxie has publicly said many times that he does not believe in federation or third party clients (and will implement client blocking as well as using trademark suits if the problem gets big enough)

Well that's a shame - I wonder if, given moxie is a member of the HN community, he'd clarify what is meant by that. I had a quick search and didnt find anything.

[1] is Moxie saying that he is against third-party clients using Signal servers (meaning third-party clients cannot communicate with Signal users). [2] is Moxie saying that he is also against federating with other Signal servers (and implies that they use their trademark aggressively to stop the term "Signal" from being used by third-party apps).

Given how explicit he was about this at the time (and the lack of comments to the contrary in the past 5 years), I honestly don't think any clarification is necessary. That's his opinion and while I may disagree with his opinion, we shouldn't pretend that he is likely to change it in the future (or to imply that isn't his opinion on the topic). If you feel strongly that you want decentralised instant messaging, use Matrix (or something like it) rather than hoping Signal will become something Moxie has said he is against it becoming.

[1]: https://github.com/LibreSignal/LibreSignal/issues/37#issueco... [2]: https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Moxie Marlinspike gave a talk at 36C3 about the issues of decentralized systems and why Signal decided to not go that direction.

In short, his argument was largely chat ecosystems are constantly evolving but decentralized protocols tend to ossify. Thus, decentralized protocols will ultimately not be able to keep up with the demands of the users.

https://www.youtube.com/watch?v=Nj3YFprqAr8

Lots of people point to email as an example. I'd like to also point out the phone system and its codecs as another example. Most phone calls behind the scenes are using SIP to handle connectivity. SIP is codec agnostic, you could technically use any kind of codec in the RTSP stream. Its a very decentralized protocol, and highly extensible. And yet it seems like almost every time you try and place a call, the only codec anyone else supports is G.711, a codec released in 1972 and hasn't had a major update since 2000. We're slowly seeing G.722 adoption now that the patents have run out (HD voice on cell phones) but even then this is spotty. Meanwhile every other chat platform out there has moved on to more efficient and higher quality codecs because all it took was the chat platform owner to push one version update out.

The decentralized communications network is only just now finally adopting and rolling out a _33 year old_ codec. Sure sounds like a win for decentralized systems!

Why would Matrix have potentially larger privacy guarantees than Signal when self-hosted? As I understand it, when communicating with a user on a different homeserver, those chats are mirrored to that homeserver.

Because Signal has one (set of) servers which contain all messages sent through the Signal network. With Matrix if you are communicating with only a handful of people that either self-host or otherwise don't use Matrix.org then the largest homeservers don't even have a copy of your (encrypted) message history. In order for Matrix to be equivalent to Signal in this aspect, every single Matrix user would have to use Matrix.org (which isn't the case).

Getting into matrix is kinda hard. The whole website is full with tech jargon. The presentation needs to be MUCH more user friendly.

Right, the homepage definitely isn't built for regular people right now. The process for getting started seems to be:

    go to matrix.org > click "Try Now" > get redirected to element.io > click "Open in your browser" > allow it to use IndexedDB > create an account > start messaging

I have tiny grievances with every step of this process: matrix.org is filled with too much jargon; "try now" sounds like some kind of trial; redirections to totally different websites are scary; the relationship between Matrix and Element isn't clear; the stock photo-ish background on app.element.io is a bit tacky; asking for browser permissions on page load is rude; the account creation page makes the "edit homeserver" button fairly prominent but doesn't tell us what it does in plain language; I should have been told that you can invite people by email before I clicked "send a direct message"; adding an email to invite asynchronously pulls up a "terms of service" dialog.

There's a lot to love about Matrix, so I hope it becomes easier for people to get started with it.

FWIW I just tell most people to try Element. I can tell them about Matrix later. You can link them to https://element.io/get-started which is fairly good and skips a couple of steps.

The UX still isn't "great" or "delightful" but I have had people sign up and find be by email or matrix ID with no problem.

P2P too: https://matrix.org/blog/2020/06/02/introducing-p-2-p-matrix

Matrix is interesting, but what does it have to make it succeed where Jabber failed?

Contracts with the german military and the french government.

> Why should our communication belong to one company? Makes no sense to me. Therefore start using signal

...this would make the problem you identify worse. Signal is one company.

> E-Mail is an open Standard. Instant messaging can be too!

It can be, but Signal definitely isn't.

Email and instant messaging don't actually differ in terms of what they're doing. They differ only in the social perception of what you should use them for. Why not use, say, Delta Chat, which is a messaging app frontend that delivers its messages by email?

They differ a lot. Email is more like a letter and is a killer app unto itself, chat has proven to be a thing that gets bolted on to something else. No chat client to date has ever been able to stand alone, and none of the early leaders ever amounted to anything.

Hell, Yahoo had entire verticals like ocean shipping self organizing around Yahoo Chat back in the day and never figured out how to monetize. Slack is going to be another salesforce widget.

I don't understand what you're saying. They're both asynchronous delivery of written messages. There are no length limits on either. There are no technical differences between them.

And they're both monetized exactly the same way, as part of a more comprehensive suite of office productivity offerings. People don't pay for Yahoo Chat the exact same way they don't pay for Yahoo Mail.

Sure there is. Email is an open standard, enabled by other other open standards. Things like authentication and service location are dictated by implementation. As a user, I can email anyone on the planet and retain those communications. My employer retains some email dating as far back as 1992, in native format.

Chat is almost always a closed loop. There are usually large implementations, and as a user I can only message within one. There are some exceptions to that. Chat always gets kicked around as corporate strategy changes. At work, I’ve probably used a dozen incompatible Microsoft solutions as their strategy meandered around. Jabber was the big attempt to make chat like email, and it failed.

Email still runs the world, despite its many flaws.

Email is a set of standards, sure. Instant messaging is a concept. Email is an implementation of that concept. There is already an open standard for instant messaging; it's email.

Signal is hosted over centralized servers, I don't think it's that much of a break from the status quo in terms of control.

That's not to say it's not the best out there. As a company, Signal is a million times better and more deserving of our trust than almost any other option on the market, but if we want to break out into open communications, the Signal protocol needs better decentralization.

In theory I like the idea of decentralization but in practice I haven't seen it work out well. For example email didn't become prolific until large centralized players became the dominant force. I see federation/decentralization being better as a late feature in software. Through centralization you can move a lot faster, which in the case of Signal is extremely useful. They wouldn't be able to provide the product they have with decentralization. That's why Moxie has been against decentralization. Maybe I'm wrong, but I don't see chat apps as having an unbounded number of features. As I see it once Signal moves into more of maintenance mode then we can talk about federation, by allowing outside servers being able to communicate to the main Signal server. But for now it seems better to focus on getting people to the platform and if we're talking about it from a privacy and security point of view, this is the higher priority. Decentralization doesn't provide much more security while Signal is still trustworthy. There's bigger fish to fry right now.

> For example email didn't become prolific until large centralized players became the dominant force.

What? Email was massively popular before gmail even got into the game. It was popular when Microsoft bought hotmail. It was so popular I remember a dial-up ISP (Juno) offering a free email-only dial-up account.

Email was one of the only easy to convey selling points for early Internet.

Online shopping was a shitty Wild West and most web pages consisted of some basic info and a visitor counter. But being able to send a “love letter” across the country in seconds was amazing!

> It was popular when Microsoft bought hotmail

I'm sorry, but is Hotmail not a large centralized player?

I think the GP was saying that email was already popular before Hotmail entered the picture. I agree with the claim that it didn't need centralized players to become popular.

I don't think this is accurate though. I wouldn't call the internet popular when it was just nerds on it. At least not in the context of what we're discussing (communication clients). That's not popular until the masses join. It is clear that the masses did not join until there were large centralized services like AOL, Netscape, Yahoo, and Hotmail that provided email services. I am fundamentally disagreeing with the premise that email became popular before large centralized players provided the services.

And you’re wrong. Email was the main selling point to get non-nerds online in the late 90s. It was how we got my mother in-law online, my uncles, and my non-techie friends.

For what it's worth I think you are wrong. Decentralization is a complicated technology that needs a lot longer to mature than I think most people realize. But once it is mature - and we're getting close, imo just a few years left - it'll move way faster and more efficiently than the centralized world ever did.

In many ways it feels like decentralization is the same as discovering the internal combustion engine before modern alloys existed. We have to invent a lot of extra stuff to make decentralization practical, and we will, but the vision definitely started many steps ahead of the technological progress.

XMPP was mature enough, Matrix is mature enough.

Technology is ready, what's missing is the goodwill of the biggest actors.

XMPP is mature. I think that the downfall is the complexity coming from having almost everything defined as an optional feature on a protocol level, and at a very fine granularity at that. So an implementation has to cope with situations where any other party it wants to communicate with may have an oddball collection of supported features. Plus, some server operators added their own peculiarities on top, like wanting to federate with some servers and not others and so on. The user facing result was a user experience with seemingly random inconsistencies. For example, user A can send a message to user B while user B is offline, but not to user C because C's server doesn't support offline message storage.

> For what it's worth I think you are wrong.

I'm happy for disagreeing opinions.

> But once it is mature

You may be right, and if it turns out that you are I'll happily change my opinion. But it seems like you agree that currently centralization is the way to go for an app like Signal. Honestly I'd love to see Signal decentralized, but I don't think it is the right move right now or in the near future. But given what you said I still don't think it means it is the right time to call for decentralization. Signal doesn't have to be the leader in advancing decentralization technology. They are already leading in secure and private communication and I don't think such a small group can be experts in too many things. They got their niche and I'm happy someone is doing it.

I'm curious though, why do you think decentralization will move faster in the future? What advantage do you see in that? I've always seen decentralization as lagging in updates because it is more difficult to get users to update and software can't exist in isolation (software rots).

Open data models allow for faster innovation and stronger collaboration. That's basically the meat of it.

Right now the cost outweighs the benefit but the cost is decreasing and the benefit remains.

Sure, you can potentially innovate faster, but unless you've got a good way of enforcing your changes on the whole network, one of two things happen. Either you either end up forking the network into multiple islands or building some crazy complex "negotiation" mechanism where two random clients need to agree on what features they support before they communicate.

We saw incompatible islands appear in decentralised systems before (this tends to not be good for users), and we've also seen how any implementation of "protocol/feature negotiation" is basically a disaster for security. I don't currently see how any truly decentralised system is lowering either of these costs.

WhatsApp never used to be e2e for everyone, but they were able to make it universal relatively quickly because it's centralised. All of the poster child decentralised protocols (SMTP, XMPP etc.) are still not e2e for everyone despite decades of effort.

I think in practice it won't be so much about agreeing on a protocol but rather new apps just parasiting off of the data models of the most popular and successful apps.

The thing about decentralization is that it forces the data to be available. So for example Facebook can't stop an alternative app from having full access to Facebook groups even if they want to.

So the big successful apps most likely end up deciding the data model and feature set, and everyone else just borrows that, and if they extend or add features those features won't appear on every interface. Which is okay as long as the common core (determined by the big app) is all there.

Lol. Email was the internet for most people when you were in diapers. It attracted federal regulation as early as 1986.

Decentralization is hard to build a business around.

I have an idea!

An app that aggregates all of your different social networking apps (think AIM, but for social networks). When you talk with your friends, each of your messages get sent to different social networks -round robin style- this only gives each social network a portion of the conversation. Your friends must, of course, also use the same tool to stitch the conversation back together.

There used to exist applications like this, at the time (i.e. the 90s) when apps didn't have automatic updates. What happens now is that the same company that runs the server and makes the official app updates them both at the same time to change the protocol, causing the app that supports all of them to break until they update it to support the new secret protocol. Then people stop using it because it's breaking all the time.

Social media aggregators intended to post messages to many clients have been tried before, but they have consistently failed because the social media companies, notably Twitter, changed their APIs to frustrate the possibility.

Seems similar to spread spectrum radio signals, also known as frequency-hopping. By hopping from frequency to frequency in a way that only the sender and the receiver know, you can avoid both obstacles and eavesdropping.

I have really bad news about how federated email is in practice. It turns out if gmail rejects you as a source of “spam”, you’re dead as an email provider.

email is federated, Signal is not, it may not be a company but it still is one entity that is pretty much in control of the communication and contact discovery...

Most of my instant message communication is still i.r.c., followed by XMPP.

I've read many times that the former is very much dying but I'm not seeing it in the channels I frequent.

> Therefore start using signal and try to spread the word. E-Mail is an open Standard. Instant messaging can be too!

Is Signal even open source? Where is the server code for this patch: https://news.ycombinator.com/item?id=25803010 ?

Isn't [1] (one of) the patches fixing the issue? The solution doesn't need to be a server patch, in fact it appears it was a client-side patch to handle 508 errors properly as well as doing exponential backoff.

[1]: https://github.com/signalapp/Signal-Android/commit/c95f0fce6...

Does it mean that I can create a malicious client without that patch and break the server again?

The reason it was a DDoS was that every single Android Signal client in the world was retrying the API without an exponential backoff. If you intentionally try to DDoS the API yourself, then that's just a DDoS and you don't need a custom Signal client for that.

Email and (XMPP or Matrix ) Signal is also centralized, even if it's open.

No one is forcing to use you WhatsApp or the others. You have free will. These apps come and go and you can even come up with your own app and make others use it. Free market for you my friend.