My family tests this type of software often enough. I know my daughter, [[j3d1h]], desperately hopes for a secure replacement to Discord for her [[friend]] groups. She's sitting on the couch with me right now writing up what she's missing most in your software. Here is what she said:
```
just my opinion, man
-how are profiles going to work? do you have an individual username for each community, or will your profile eventually be the same across all the communities you're in?
-profiles you can customize to servers *can be* useful, so long as you can still trace them back to the user's actual profile. otherwise that might enable masquerading as other users
-users able to mark as invisible (appearing offline without actually being so)? good to have in many situations imo, obscuring information from people who may be a danger to you
-how is name collision handled? in a large community, you're bound to have a few people who want the same name (and i get it, your screen name can be very personal)
-discord's old solution, a username and 4 digit id (e.g. felix#1234), seemed convenient and effective to me, but there must be tons of solutions; i like having a way to easily distinguish two users with the same screen name
-personally blocking users you are uncomfortable interacting with, kicking users from communities vs. banning repeat offenders in a more permanent way, temporarily muting a spamming user?
-kicking vs. banning can be an important distinction; i'd rather kick you if you're just inactive all the time, you're free to rejoin whenever you like
-i like keeping it very, very clear what does (or does not) happen when you block, kick, ban, etc; a user shouldn't have to "test" features like these
-important to keep in mind that you rarely (or never) want a user to completely disappear; i always want to leave the option to get back in touch, unban, unmute, etc.
-a friends system is useful for this; maybe i don't want anyone i haven't marked as a friend to DM me
-selectively muting different portions of the app (e.g. i *only* want to be notified of a DM or @ mention, or *only* notifications from *this* community, or no notifications from this channel except @ mentions)
-what if i want to be notified whenever this phrase pops up in a community? might be a question of how easily you can build your own scripts *on top of* Quiet (which i would quite like to do)
-are voice and/or video planned, both in communities as well as dms?
-muting + deafening + turning off camera, nothing in a voice/video chat should be mandatory (owners shouldn't be able to *un*mute someone, but owners muting others can be useful)
-maybe i want to mute that user, but allow everyone else to hear them? turn this one up and that one down on my end?
-audio controls that make sense. if there's a layer of noise cancellation, leave the option to turn it off in case it messes with your audio, etc.
-taking microphone input as it is works just fine, though i can see some users disliking that (mostly people who don't know how/can't modify their settings *outside* of Quiet)
-i've seen many communities in other applications where multiple "owners" existed, as it can make a more safe/welcoming community
-if one owner in any way becomes untrustworthy, having someone with equal permissions in place to get rid of them and undo damage can help; whether they can remove each other or not seems like an important decision
-question about the threat model; members are not capable of sending messages that appear to be from another member, which implies that owners *are* capable of this? that could become a serious issue if true
-user discovery outside of communities, preferably just typing in a username they send you elsewhere?
-will it be possible to delete an entire community? can an owner do this in situations where members don't agree?
-searching channels (and more advanced searches; sent by this user, with an image attached, in this channel; hopefully accessible to users even if they can't do regex on the fly, lol)
-i've found it frustrating not to be able to search every community i'm in at once for something i said; is that feasible?
-any distinction between a community and a DM with 3+ users in it?
-i don't personally see the point, but some apps have this
nitpicky, visual polish, further off details
-dark mode, and in my opinion, ideally a way to customize everything more thoroughly
-if thorough customization, maybe a way to save/export those settings to share?
-maybe the ability to see separate messages sent in a row - is that a message in 3 lines, or 3 messages? just hovering and seeing one line highlighted (and the timestamp for just that line)?
-embedding video and audio files in a convenient manner?
-replying to messages, pinning them to channels (so they can be easily found again) seem very useful
-channel organization and categories; i don't always want the art channels open, i want #announcements at the top, etc.
-messages marked as read/unread can be useful, something to carefully think about
-sometimes i like knowing that someone has read my message; sometimes i like the safety that comes with people *not* being able to know. if i had to pick, it'd be the latter, users can always prove they have read something by responding to it
-client side unread; i'd like to pick up from the last message i read in this channel
-having channels visually marked that there are unread messages is nice
-keyboard navigation beyond pressing tab is super useful; a screen you can reach to describe these shortcuts is equally so
I hope you'll consider adding more control over the keys within the application itself. Ideally, I should be able to generate my own private key from scratch, paste it in, and recover at least a bare identity (this can be bootstrapped further). I should be able to hand someone just a public key for any of the functions we may need; these keys should be easy to copy and paste into and out of the application. Key control pedagogy is not fun, but it's ultimately required for us to own the means of production; I think you've a difficult usability fence to straddle here, and perhaps a ladder to construct.
> Soon we'll let people recover accounts from their linked devices (e.g. from your computer if your phone is lost) and we may have some social recovery solution within communities for DMs, though that might not be feasible.
What feasibility concerns do you have?
> Phones will need to be given some more limited view of the network for large communities to remain performant, and we will need to add retention limits for messages and images otherwise drive space will be the bottleneck, but there is no reason why we cannot handle very large communities.
Lawd, I'm a preachy sumbitch here. I have yet to find a tool that I think does this really well. It's probably going to be crucial to have not only sane default but strong controls available to users. I am pretty worried you won't escape some elements of federation or at least asking users to rely upon friends or additional devices. Can kids across the planet safely pirate arbitrary files on their phones together? That's the bar, homie. You know whom we serve, and I think you're doing it. I [[hope]] we don't fail.
Do not make the mistake that [[Aether]] did on retention, please. Users must have the opportunity to pin/seed with complete persistence. Any tool (e.g. [[Session|2021.09.25 - Computer Musings: Session Fucked]]) that has forced me to lose my identity or my messages is not a tool I'm going to recommend to anyone again. I understand you may wish to minimize the prices the average person must pay to manage their data, but at some level, there is so substitute for having the user be responsible for it. Joining a room without having to traverse and download an entire graph of content will be important.
Low-end phone performance (not the mobile devices you and I can afford) is such a hard and important problem that I wouldn't be surprised to find that what you're making at the moment is ultimately a prototype. I obviously [[hope]] I'm wildly wrong about that.
> We would love to pursue this if our users ask for it. So far there isn't a strong signal that users need it.
Then please ignore my desire. Your task is already absurdly difficult as it is.
> It's like, docs are an organization's mouth and messaging is an organization's brain. You care more about the privacy of your brain. But technically this would be a fun challenge and I'm sure we could build something great.
It's so interestingly phrased, I feel uniquely qualified to speak on this matter. I probably hold a contrarian position. This is obviously an imperfect way to do it, but I'll leave the tool up for a while; you'll find the link in this room (channel is your handle): ukkmcdhhymxki3plly2w7mkweafijihwhldwnmt6yzwan6rmtuin7zid.
> But technically this would be a fun challenge and I'm sure we could build something great. There are other CRDTs we could use.
Speaking of a narrow challenge, E2EE P2P Tiddlywiki isn't that far off. You might consider hitting [[Sir Jeremy Ruston|2023.08.08 - TW-Community: Hello]] up (TW5-Bob is also dope; and Jed would understand what you're doing well, imho).
> This would probably be straightforward. What's your use case?
I provide access to my constantly updating site (almost exclusively consisting of a single ~60MB html file growing at ~8MB of pure text a year on average) over multiple networks, and few are designed for such a thing (you're already got a foundation for something better than Zeronet and Beaker [both venerable projects, obviously]). I [[share]] mutable directories with many folk, some of whom I cannot [[trust]] (I often have to use Whonix). I need a turnkey multi-platform open-source replacement to Resilio Sync that people are comfortable using. I understand you will be limited by IPFS here as well; I can share 6TB of an evolving curated library using just a couple gigs of RAM on Resilio Sync (with selective syncing on mobile), and I can speedily and efficiently share my `/home/h0p3` (millions of files) across my devices with it as well. I hope to be able to recover identities, contents and all, seeded on these networks. Writing a Discord-killer is already a [[monster]] of a task (bless you), but mutable torrents with a solid chat-based community is where you can walk on water where no one else has.
We're starting with names specific to each community, since that is simplest/cleanest and best for privacy.
> profiles you can customize to servers can be useful, so long as you can still trace them back to the user's actual profile. otherwise that might enable masquerading as other users
There are some decentralization-friendly ways you could link your profile to other profiles, like a Discord or HN account. tlsnotary.org is one example. Would that be good for preventing masquerading?
> users able to mark as invisible (appearing offline without actually being so)? good to have in many situations imo, obscuring information from people who may be a danger to you
we do plan to do this, but it's some complexity to really hide it from a tech-savvy malicious user, so the first version of invisibility will be weak and we'll tell users this. Here's the open issue and there are links to proposed designs in there if you'd like to give feedback! https://github.com/TryQuiet/quiet/issues/1504
> how is name collision handled? in a large community, you're bound to have a few people who want the same name (and i get it, your screen name can be very personal) discord's old solution, a username and 4 digit id (e.g. felix#1234), seemed convenient and effective to me, but there must be tons of solutions; i like having a way to easily distinguish two users with the same screen name
we're not allowing name collisions for registered users. in the coming release there will also be unregistered users who will have a badge until they register with the community owner. if the community owner lets registered users' names collide we treat that as an impersonation attack and warn everyone. since names aren't global you'll usually be able to get the name you want!
> personally blocking users you are uncomfortable interacting with, kicking users from communities vs. banning repeat offenders in a more permanent way, temporarily muting a spamming user? kicking vs. banning can be an important distinction; i'd rather kick you if you're just inactive all the time, you're free to rejoin whenever you like
we don't have user removal yet but obviously that's a big priority for us.
since we don't have usernames, to ban somebody you would kick them and reset the invite link. blocking and muting and silencing people will all be very straightforward. as will roles and other kinds of moderation, and external identity linking would be helpful for this too. you'd be able to make someone link another profile and approve who you are letting in.
> i like keeping it very, very clear what does (or does not) happen when you block, kick, ban, etc; a user shouldn't have to "test" features like these
this is a great note, thank you!
> important to keep in mind that you rarely (or never) want a user to completely disappear; i always want to leave the option to get back in touch, unban, unmute, etc.
hmmmm. this is an interesting and cool idea I have not run into before. yeah, unban and unmute are possible.
> a friends system is useful for this; maybe i don't want anyone i haven't marked as a friend to DM me
Our first plan is to not allow DMs at all outside a community, but there are some ways we could do this.
> selectively muting different portions of the app (e.g. i only want to be notified of a DM or @ mention, or only notifications from this community, or no notifications from this channel except @ mentions)
this is planned, and thanks for the details! Here's the issue for channel notifications: https://github.com/TryQuiet/quiet/issues/623
> what if i want to be notified whenever this phrase pops up in a community? might be a question of how easily you can build your own scripts on top of Quiet (which i would quite like to do)
i'd love to enable this someday but we have no immediate plans to. but it is one exciting thing about a fully user-controlled app: you can give users a lot of flexibility. Imagine a team chat that was as flexible as Wordpress!
> are voice and/or video planned, both in communities as well as dms?
yes, but I'm not sure if we'll do unlimited group calls for free, since we'll need servers for this piece so it's a natural place for us to charge money (we'll need to). And I don't really have clear plans for how voice or video will work yet, since it's far off.
> i've seen many communities in other applications where multiple "owners" existed, as it can make a more safe/welcoming community. if one owner in any way becomes untrustworthy, having someone with equal permissions in place to get rid of them and undo damage can help; whether they can remove each other or not seems like an important decision
yes, we'll allow multiple owners at some point, though the naming role will belong to one user. https://github.com/TryQuiet/quiet/issues/1758
> question about the threat model; members are not capable of sending messages that appear to be from another member, which implies that owners are capable of this? that could become a serious issue if true
this is an issue right now yeah. what we can and will do very soon is show an aggressive warning almost immediately in most circumstances if this happens. see: https://github.com/TryQuiet/quiet/issues/119. but there are edge cases where spoofing could happen that are hard to reason about or convey, so it's unlikely we'll fully address this weakness soon.
> user discovery outside of communities, preferably just typing in a username they send you elsewhere?
Global naming features like this exist in tension with decentralization, unless you make people pay for usernames, which isn't a great experience.
> will it be possible to delete an entire community? can an owner do this in situations where members don't agree?
Yes. A member could block deletion by not going online or by modifying their Quiet app, but deletion is important enough for activists that we want to make it easy. Maybe this is a setting on the community level or user level.
> searching channels (and more advanced searches; sent by this user, with an image attached, in this channel; hopefully accessible to users even if they can't do regex on the fly, lol)
we'll definitely have search but don't yet!
> i've found it frustrating not to be able to search every community i'm in at once for something i said; is that feasible?
yes! it's all on your computer so totally feasible and this is a helpful note! i feel this way about email all the time when using gmail so I get it.
> any distinction between a community and a DM with 3+ users in it?
DMs will exist within a community; a community is at the level of a Discord server, e.g. We're not planning to do the Slack thing of giving ad hoc group chats their own special status, but 1:1 DMs will be special probably.
> dark mode, and in my opinion, ideally a way to customize everything more thoroughly. if thorough customization, maybe a way to save/export those settings to share?
We already have designs for dark mode: https://github.com/TryQuiet/quiet/issues/1502. what app or site does customization great? what approach can we follow, if any?
> maybe the ability to see separate messages sent in a row - is that a message in 3 lines, or 3 messages? just hovering and seeing one line highlighted (and the timestamp for just that line)?
these two things drive me crazy too! See: https://github.com/TryQuiet/quiet/issues/505 & https://github.com/TryQuiet/quiet/issues/1403
> embedding video and audio files in a convenient manner? replying to messages, pinning them to channels (so they can be easily found again) seem very useful
we'll definitely do this!
> channel organization and categories; i don't always want the art channels open, i want #announcements at the top, etc.
Cool, I'll make an issue for this!
> messages marked as read/unread can be useful, something to carefully think about. client side unread; i'd like to pick up from the last message i read in this channel
we have a floating "unread" notification but there's more on this to do!
> sometimes i like knowing that someone has read my message; sometimes i like the safety that comes with people not being able to know. if i had to pick, it'd be the latter, users can always prove they have read something by responding to it
We can do either but now we don't show who has read your messages, with the same caveats as above about strict invisibility of your online status being tricky.
> keyboard navigation beyond pressing tab is super useful; a screen you can reach to describe these shortcuts is equally so
Yeah! Ctrl-K works right now for jumping to channels but we don't make it discoverable enough.
I can see that. Your roadmap makes sense to me. My wife (without having seen your roadmap) picked out many of the same points as reasons she must wait to use it for her library staff. I appreciate how you must triage with the resources you have. Most of what I have to say isn't going to be as important to the non-poweruserbase you are trying to capture (and rightfully so!), so please take what I have to say with a grain of salt. You obviously know what you are doing. Reading through your account, I think you already know what I have to say here.
> Would desktop-only i2p support be useful to you?
Yes, and not just because I think it's important to contribute back to the network as a regular user. It would be especially nice command-line tooling, and you can pickup UDP support. I've encountered plenty of failures on Tor (and you have too), and there are many I've encountered who I believe are rational in their desire not to be so reliant upon that network. I'd also be happy to use i2p on a mobile device just in case I had somewhat convenient control over when that occurred. If you provide logical accounts (where my decentralized identity can be wielded by multiple devices), then i2p becomes even better. Retroshare's use of both Tor and i2p have demonstrated the value of diversity here to my eyes as well. I'll add that something like multiplexing over multiple Tor or i2p tunnels could significantly improve throughput performance (a difficult place where you might be able deliver in some cases where no one has).
However, I think your focus on mobile is more important (and I say that with a deep-seated grudge against phones). You serve the poorest on the planet by targeting mobile first. That isn't to say that you don't have any use for desktop users to assist on this network, but I can see why i2p, among many of my suggestions, should take a backseat. `/nod`.
> It would be awesome to have a p2p github alternative that could ship builds over BitTorrent or IPFS
I understand you've been around the block, so please ignore my gibberish. To my eyes, you've also a serious competitor to [[P2P Matrix|2021.11.17 - HN Log: Arathorn & P2P Matrix]], which is still under development. I'll mention that Radicle may be worth your consideration. The functionality of [[DarkMX]] is worth your time as well (it is closed source, but its creator is one of the few with the right to ask us to trust him [even if I stand in disagreement]). I know some, like [[Ian Clarke]], will claim it is better not to "focus too much on competitors, better to focus on the needs of users," however, given the specialization of this tool, I think there's something to be said for having tasted the alternatives. [[Aether]] may be a direction you could eventually go, but I understand that isn't your immediate target; I don't know if protocol design decisions now might affect the future of such a thing.
> Beyond participating in Tor, Quiet does not allow you to help any network you're not a member of
`/nod`. I wonder if it is feasible for Quiet to have something like the Encrypted Key option like Resilio Sync, enabling one to seed in swarms without knowing the contents. There are some cases where it's useful, though there are tradeoffs.
There may come a time where you've decentralized to the point where it hurts too much, and you'll have to centralize until it works. I wonder if there are cases in which randos must hold at least metadata for others or act as proxies (I understand that Tor solves many problems for you). [[Tox|Toxcore]] is an exemplary tool in part of this space you're solving, and even they haven't solved some of these problems. Multidevice and offline messaging are dealbreakers for many people.
> If you have access to a large number of machines, rigorous performance testing with hundreds of nodes could possibly be helpful?... manual and automated testing on many diverse Android devices; that would be helpful!
I'll be thinking about that then. NixOS with solid orchestration on a beefy machine (I'm not sure if zswap would assist here, but memory seems a serious bottleneck) may be able to push hard. There's probably no way around using a lot of machines unless a much thinner client were feasible. The nice part is that donations might allow you to control the machines remotely while dogfooding.