Thank you. Let us not forget what general purpose computing was like.

Following up on this... I was Miranda user. With it I was able to run ICQ, MSN Messenger and other instant messengers with an encrypted layer slapped on top (as long as I was able to talk my friends out of using the official client). Today it's called Miranda NG[1] and it seems alive and kicking[2].

[1] https://www.miranda-ng.org/en/ [2] https://github.com/miranda-ng/miranda-ng

> you pay a monthly fee for someone to man-in-the-middle all your communications.

All Matrix homeservers and bridges are open source. I self host some of them myself. Have been doing that long before Element One was a thing.

How can I verify you're running unmodified, unhooked source in your server if I'm a user?

You don't, you self-host your own server.

My problem with the self-hosted model is that I don't trust myself to get it right and/or keep it updated. My problem with the 3rd-party model is that I don't trust them, either. So, lacking trust in either myself or the third-party, I'm just one of those people you can get only via secure e-mail, clear-text SMS, or whatever well-supported encrypted service happens to be the one with a plurality of users in my friend/family group. Clear-text sucks, but it can be used to negotiate a secure channel.

Unfortunately, the levels of spam in my traditional telephony services have dramatically increased in recent years, and as a tradeoff, I've just gotten harder and harder to get in touch with directly as I increasingly default to ignoring more and more methods of communication. I don't even think I'm someone with anything to hide or anything to fear my communications being in the public, there's just too much information to manage.

I feel the same way, I don't fully trust hosted solutions but don't completely trust myself to host my own -- which is where E2E encryption comes into play, but a malicious host would still have access to loads of metadata (timestamps, IPs, etc.).

Blockchain-based solutions like Status.im appear to do away with these sorts of issues through decentralization -- but you still have to put trust into their network.

Solutions like TLS & OMEMO over Tor for XMPP seem to be a very strong privacy-centered solution outside of blockchain-based applications.

I'm excited about NixOS (/GuixSD) because they would seem to provide a straightforward path to running secure services (self-compiled from publicly reviewable source) while keeping them automatically updated (build rules administered by a third party). I'm not saying this is a good approach for you personally right now, but I can definitely see it becoming popular in several years.

How can you verify what the latest update of Google Play Services is doing on your Android that's running a proprietary WhatsApp client just so you feel happy you have "E2E" encryption?

You can't. You can find a provider you trust or set them up yourself.

How can anyone verify that?

Reproducible builds. https://reproducible-builds.org/

Reproducible builds allow verifying that your build is correct by rebuilding it It doesn't help you verify that the server you're connected to is running the binary you've been given.

Why would I want a man in the middle of my communications?

Because the A-Series round of financiers think that's a great idea.

The real answer is because you want all your conversations to happen in the same app/protocol. You never have to download a shiny new messenger again

I'ved heard that pitch before. It's always true only for some length of time. Protocols change, services evolve, companies transform, products are deprecated and people are fickle.

I've used all-in-one messengers before. They come and go like the wind. You'll be downloading a shiny new all-in-one messenger periodically anyway.

Just trading one kind of inconvenience for another.

Perhaps if we normalized messenger interoperabiltiy, there would be less churn in "all-in-one" clients. That churn exists mostly because platforms actively fight their users on this.

And still, periodically changing an all-in-one messenger is still better than keeping and changing half a dozen messengers.

Unless those official clients have features not available in the all-in-one client. Like encryption, which this one apparently lacks.

The benefit of an all-in-one client is that they can port/shim/polyfill[0] missing features between the backing platforms.

--

[0] - Whatever is the most appropriate webdev word of the day.

And the downside of an all-in-one client is that they are going to have to port/shim/polyfill features from a hostile, proprietary, changing API.

Once again, the problem is not technical, it's political. Until interoperability is enforced by government, I expect companies to keep building their siloes. Network effect and tragic commons and all that.

It's worth remembering again why we don't do this. Even if you fully trust whoever is running the MITM server, being that it's MITMing all of your comms, and it's on a server so it's actually a lot of people's comms, it's a massively tempting target for all sorts of bad actors. Plenty of governments and criminal gangs would just love to compromise that for all sorts of reasons. Odds are one of them will eventually.

For all you know, someone else on the server is a high-value target for somebody, and if they compromise the server to get their comms, they may not be very picky about what happens to the private communications of everyone else on that server.

Can you run Pidgin on your phone and tablet and laptop and move between them?

Depends on the services you connect to.

Meebo was a service that did roughly the same thing as pidgin (leveraging libpurple to do so iirc). It's a shame it was turned down.

It is a service, because the bridge is a software that need to be keep operational 24/24h and sometimes this is not so trivial (if I don't get wrong WA need an Android emulator running).

Pidgin doesn't use a "bridge"... it is just a generic local client that supports plugins for various protocols that are implemented via adversarial interoperability.

And because of that Pidgin is horribly unreliable. Don’t get me wrong, I used it for years, but over time all the plug-ins broke for one reason or another.

Law makers are required here to solve the situation, as platforms themselves refuse to work with each other. If Facebook and Google had to operate a common protocol (just like IMAP), Pidgin would work much better or wouldn't even be needed.

But no, they want to prevent people from talking with each other via other platforms because "we're best" or whatever.

It's probably because they don't want to lose users.

If you have FB, and I have Twitter, and we can chat, why would I ever make a FB profile or you a Twitter profile?

The mutual exclusivity is the competitive advantage. All these companies are competing with one another for your eyes. It wouldn't make sense for them to give that up for no return value.

Exactly! Providing a walled garden just for the sake of keeping users should not be legal, just like abusing any other market position wouldn't be legal.

I get that they want their "network effect" and keep it to themselves, but this is no good for users and the industry doesn't "regulate itself" as we've heard so many times, so time for law makers to step up finally.

My point is that the walled garden is the competitive advantage.

A law like this could regulate businesses out of existence.

Which websites fall under it? Only social? What about forums, etc. What if the companies just rebase to non-US jurisdictions? Even if you make this law, it's unlikely it would actually compel anyone to comply.

> A law like this could regulate businesses out of existence.

Only if they didn't change their business model to something less incredibly antisocial than walling people in and serving them ads.

There are many ways to operate a communications business on-line. That only the bad one is used in practice is a consequence of it being the most profitable of available options. If it weren't available (say, because of being regulated away), companies would pick the next most profitable one.

Yes — this line of argument sounds exactly like the people who very confidently said that the economy couldn’t survive ditching asbestos or CFCs, emissions laws would destroy California, etc.

The key part is having regulations apply the rules evenly so everyone prices it into their decisions. Trying to limit specific companies makes that feedback cycle less effective.

Yes, but what if this is the only way to have a profitable business such as these? Are you okay losing them entirely?

More generally, my view of regulation is that it should only exist if there is some quantifiable harm to an involuntary third party (negative externality). Where is the demonstrative harm here, and who is it impacting? Having one friend on FB and another on MySpace, requiring the user to log into each platform separately isn't harm. The effect is the same as having one friend call you on a phone to communicate and the other only use text.

Every single person using these platforms makes a conscious decision to use them given their limitations. Nobody is forcing anyone to use these platforms. The government still runs a post office. You could use that to communicate with people if you wanted.

Instead of passing legislation to fix your problem, how about you just talk to your friends and get them to agree on using a single platform?

> Yes, but what if this is the only way to have a profitable business such as these? Are you okay losing them entirely?

But it isn't. We know it isn't - exchanging text, audio and video messages wasn't invented by adtech giants. Two prime examples:

1) Telephony and mobile telephony operators have strong businesses to this day, despite being made interoperable by law.

2) Non-adtech e-mail providers exist and make money, despite being interoperable and not subsidized by advertising and personal data misuse.

> Where is the demonstrative harm here, and who is it impacting? Having one friend on FB and another on MySpace, requiring the user to log into each platform separately isn't harm.

In my opinion, there is harm - creating unnecessary burden and confusion for everyone, especially non-tech-savvy people. It is tying people down to services via network effects, and then further harming them by exfiltrating their personal data and exposing them to advertising (either directly or indirectly, making the ads more potent thanks to aforementioned personal information).

> The effect is the same as having one friend call you on a phone to communicate and the other only use text.

No, it isn't. It's just having one friend text you, another friend write you a Messenger message, yet another a WhatsApp message, yet another a Telegram message...

> Every single person using these platforms makes a conscious decision to use them given their limitations. Nobody is forcing anyone to use these platforms.

But that's not true at all. People are coerced to use these services, and coerced to stay with them. That's the literal definition of network effect. I have to use WhatsApp/Facebook/whatever because my mom is there and doesn't want yet another chat app, and my local plumber only communicates through it. I have to stay, because neither my mom nor my plumber will move. The more people are trapped in the net, the stronger its hold.

Contrast that with phone and e-mail service: I can communicate with anyone regardless of the provider they use. I don't even need to know what provider they use. And I can switch my providers at any time, and nobody else has to know, or care.

> Instead of passing legislation to fix your problem, how about you just talk to your friends and get them to agree on using a single platform?

These platforms are as successful as they are exactly because your proposed solution is impossible to implement by most people. Again: network effect.

WA works with a pure go-based bridge. No Android required.

The rest of your comment is true though. Keeping these bridges up 24/7 is quite a bit of work. Most people (even technical ones) probably won’t bother with that.

You need WhatsApp to be installed on a real device or a VM for mautrix-whatapp [1] (the bridge) to work. You also need to connect to that real device using WhatsApp web [2].

I know because I've used the bridge.

[1] https://github.com/mautrix/whatsapp [2] https://docs.mau.fi/bridges/go/whatsapp/authentication.html

Which bridge is it? Mautrix/whatsapp does require an Android instance of whatsapp.

Nah. You can pair it up to an real WhatsApp-account using your phone and from there on, it’s go-code only.

It is not a service, if it's a link to a download and a bunch of community-developed plugins.

When you take away the motivation to mitm all of the users' chats, there's nothing left.

And FB will probably not like running WA in an emulator, and will kill that option as soon as it reaches ~100k users.

how can they kill it?

They have so much money and influence, I trust them to find a way :)

With enough motivation, competitors can reverse their efforts. Reversing (competitors' job) is finding just only one flaw in a system. Hardening (WhatsApp's job) is thinking about all the possible ways it could be flawed. It can be an endless cat and mouse game though I guess.

Of course the protocols Pidgin bridged were only used for real-time communication, rather than for leaving messages which could be attended to (or delivered) later.

No, it wasn't. Yahoo had offline messages. So did many of its other protocols.

Ah you're right, I think I indeed had that for MSN as well. Must've gotten confused.