📣THREAD: It’s surprising to me that so many people were surprised to learn that Signal runs partly on AWS (something we can do because we use encryption to make sure no one but you–not AWS, not Signal, not anyone–can access your comms).
It’s also concerning. 1/
Meredith Whittaker
in reply to Meredith Whittaker • • •reshared this
Dr Pen, Terence Eden, Oblomov, Erik Jonker e Michał "rysiek" Woźniak · 🇺🇦 reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •reshared this
Chu 朱, RFanciola, Em e khulewampe reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •reshared this
Oblomov e RFanciola reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •reshared this
Oblomov e Erik Jonker reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •Erik Jonker reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •Oblomov reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •Meredith Whittaker
in reply to Meredith Whittaker • • •Meredith Whittaker
in reply to Meredith Whittaker • • •Meredith Whittaker
in reply to Meredith Whittaker • • •reshared this
Timo Ollech, kappazeta, Erik Jonker, Chu 朱, RFanciola, Ruth Mottram, Em, Abolisyonista e Clockwork ☃️✒️ reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •RFanciola reshared this.
Meredith Whittaker
in reply to Meredith Whittaker • • •Matthew likes this.
reshared this
Timo Ollech, Frederic Jacobs, Chu 朱 e Em reshared this.
Eye
in reply to Meredith Whittaker • • •Éric Freyssinet
in reply to Meredith Whittaker • • •reshared this
Sabrina Web 📎 reshared this.
ImaCrea
in reply to Meredith Whittaker • • •🔜 eth0
in reply to Meredith Whittaker • • •Meredith Whittaker
in reply to 🔜 eth0 • • •🔜 eth0
in reply to Meredith Whittaker • • •With respect Meredith, i’m talking about decentralized protocols and their capability to not depend so heavily on the service providers you’re arguing for. Tor Project has shown how possible it is (i used to work there, and it’s spelled Tor not TOR).
I listened to Moxie’s aversions to decentralization for years. That’s what I keep seeing now, with posts like these. I also understand the value of huge cloud providers, I’ve worked for many companies who use them, and have worked for them, and I understand why you depend on them and how important that is to a high quality service. Thank you for all that you all do.
But what conversations does Signal Foundation actually have on the topics of resiliency through decentralization? How much money could you save by allowing the community to take on aspects of the network? How much resiliency and trust could be gained, without losing performance?
reshared this
zarel, Delta Chat, Nami, adb, Abolisyonista e Joe Vinegar reshared this.
David Penfold
in reply to 🔜 eth0 • • •@yawnbox Tor is basically a glorified network protocol (albeit very smart) so having it distributed by design is less of an issue.
I agree that making Signal more robust through decentralisation would be great, but this sort of thing gets more difficult the higher up the stack you go, especially when it wasn't part of the core design principles.
erebion
in reply to 🔜 eth0 • • •@yawnbox How about a North American Signal, and a European Signal?
Those two could federate and if a government on either continent goes bonkers, it can at least not take down all of Signal.
David Penfold
in reply to 🔜 eth0 • • •ArneBab
in reply to David Penfold • • •@davep You can run video calls over jitsi.
IPv6 was supposed to solve NAT, so fewer servers would be needed. Supposed to.
@yawnbox
The Janx Devil
in reply to ArneBab • • •@ArneBab @davep @yawnbox IPv6 did solve NAT.
What it did not solve is the asymmetric firewalls that drop inbound unsolicited flows by default.
We kept that from IPv4 despite not really needing it for any real security purpose.
Because other reasons. Not technical ones.
Hannah
in reply to ArneBab • • •@ArneBab @davep @yawnbox there's lots of alternatives that don't need the big players - but not for organisations that need to scale like Signal *and* are pretty small themselves.
Signal is and has always been a tradeoff between ease of use, onboarding and security/reliability.
And especially in an activist context both are important. Both are also important in order to provide secure communication to the masses.
But yes, it's also advisable for communities with any tech and org skills to create backup communication because centralisation always also creates power imbalances and threats.
But currently I'm happy if I can activists off Telegram and Discord 🙄
ArneBab
in reply to Hannah • • •@scatty_hannah I fully agree.
I’m always happy when parent’s groups at school use #Signal, because then we at least have reliable encryption and communicate outside the Meta/MS/Apple/Google walls.
And I have Signal Desktop, so I can actually contribute from the device I’m most comfortable with.
@davep @yawnbox
CC @Mer__edith to say: THANK YOU!
reshared this
la_r_go* reshared this.
DrYak
in reply to David Penfold • • •@davep @yawnbox Regarding Tor: instant messaging (if you stretch "instant" to cover several seconds which is acceptable in practice) have been successfully ran over Tor and other distributed settings.
Regarding video not relying on a centralized infra: Skype during its Kazaa-/pre-Microsoft- era and its "Super nodes" has been a widely successful example of a video calling software that doesn't rely that much on centralisation (but of course with a completely different security model)
DrYak
in reply to DrYak • • •Preston Maness ☭
in reply to DrYak • • •reshared this
la_r_go* reshared this.
System Adminihater
in reply to Meredith Whittaker • • •prom™️
in reply to Meredith Whittaker • • •khm
in reply to Meredith Whittaker • • •Nik | Klampfradler 🎸🚲
in reply to Meredith Whittaker • • •That's not entirely true.
First and foremost, Signal chose to be a centralised walled garden globally operated by one monolithic company. It then required a hyperscaler as a consequence of this design decision.
Jan Vlug
in reply to Meredith Whittaker • • •I've been using #Signal from the very beginning (TextSecure times), and I've been advocating Signal a lot.
But the centralized architecture, instead of a federated decentralized approach is something I never liked. Also the focus on BigTech platforms (IOS, Android) is something I do not like. I'm using a #Librem5 #Linux phone, but there is no official primary client for Linux.
Still, I'm donating, but I would appreciate addressing centralism and #BigTech dependency.
#MobileLinux
David Chisnall (*Now with 50% more sarcasm!*)
in reply to Jan Vlug • • •I don’t believe federation is possible without leaking a huge amount of metadata, but I believe decentralisation is. It would be great to see Signal actively investigating the options in the design space that enable it.
The client side is a bigger problem. The choice of license has two major impacts:
It is very rare for a protocol to become ubiquitous without a permissively licensed reference implementation.
flossifatal598
in reply to Jan Vlug • • •@janvlug Linux mobile userspace APIs is almost non-existant: no standardized push notification, no app lifecycle, no background app policy, no clear sleep/standby/dose policy, no call/ring system, no modern mobile-like audio routing system, etc.
We absolutely need Mobile Linux to succeed but we first need a working modern userspace before we can ask anyone to make apps for it (especially apps as complex as Signal with call, notif, background activity, etc.)
Chris Vogel
in reply to Meredith Whittaker • • •The problem is that signal is not running as a federated service. This makes you dependend on services like AWS and the like.
And there's another AWS/(any evil hosting service): As I understood #signal hashes phone numbers before uploading them to let accounts discover each other. The number space of phone numbers is not really big and having computing power and storage space at hand it shouldn't be too complicated to make a database to quickly access any phone number by its hash.
This information - using default signal settings - is exposed to super computing companies. This information allows to recreate the topology of the social network that is made of the millions of signal accounts.
Felix
in reply to Chris Vogel • • •@me
You might want to refresh your understanding about this, because that is not how signal has done it for years.
They have an article about "Private Contact Discovery" on their site.
Chris Vogel
in reply to Felix • • •Are you referring to the use of SGX?
My failure in understanding probably is that I do not understand how I could be certain an enclave really is what it looks like - remotely.
Bernd Paysan R.I.P Natenom 🕯️
in reply to Meredith Whittaker • • •Signal on desktop also runs on Linux, which sounds quite right from the first look, BUT Signal on desktop is just a remote control of the phone-installed Signal app!
So you are still bound to Apple and Google.
That's another bad decision. It relates to the bad decision of using the phone number as ID.
Troed Sångberg
in reply to Meredith Whittaker • • •Agree - if you want to run your service centralized. Neither my Mastodon nor my Matrix-server need anything but my own self-hosting. Of course they won't handle billions of concurrent customers - but a few tens of thousands similar to mine will. Together.
I simply don't think Signal being centralized is a good thing. It's your choice, but alternatives do exist and those do not need hyperscalers.
Meredith Whittaker
in reply to Troed Sångberg • • •Troed Sångberg
in reply to Meredith Whittaker • • •fiery
in reply to Troed Sångberg • • •casey is remote
in reply to fiery • • •fiery
in reply to casey is remote • • •casey is remote
in reply to fiery • • •@fiery
Interesting. I'm not aware of how many #AWS competitors there are so maybe I'm wrong.
That said, I don't disagree with you that #Signal shouldn't be centralized, it's one of the reasons I don't think I've ever used it.
fiery
in reply to casey is remote • • •midway
in reply to casey is remote • • •There certainly are cloud competitors to AWS. How easy it would be to use them would depend on what services Signal uses in AWS. Some will have equivalents, some may not. AWS, being around for so long has a boatload of services and it’s not in their best interest to make them easily movable.
But I absolutely get why something like Signal would use a cloud provider. Could it be done entirely on-prem? Quite probably. However could they do it within a business model that would allow the scale of users to use it as they have today without charging significant fees to use it? I highly doubt it. This would hold true for anyone wanting to build a service like theirs that would operate on the their scale. The bandwidth and other infrastructure would be immense and super expensive to buy and maintain. The only folks able to provide that would be big telco, tech companies.
Could it be all decentralized ala the Fediverse? Sure and such services exist. But, much like the Fediverse, getting user adoption would be much more difficult and tour audience would be those tech savvy enough to use what’s already out there. I mean, for example, Matrix/Element exists. Quite secure, very decentralized. But it’s not for the general public.
fiery
in reply to midway • • •midway
in reply to fiery • • •I didn't mean to put it that way. I mean peer-to-peer is certainly a thing. And we have systems that do that....and they are WAY too complex and cumbersome for the average user to use...see Matrix as a classic example. Quite secure, very decentralized, but not simple enough for most people to use. Heck, even here on the Fediverse, the user base is quite limited because of the decentralized nature is just too much for most folks to grasp..throw real privacy and zero trust encryption on top of it and your app will never take off.
Therefore, if you actually want users, you're going to have some amount of centralization. That means you need to run on something, either your own gear or someone else's. And at the scale that Signal wants to run, cloud makes sense not just for compute and services, but also the sheer amount of bandwidth needed to process the amount of data they want to send.
Can it be done a different way? Sure. Will those methods scale to the reach the average user? I seriously doubt it.
fiery
in reply to midway • • •midway
in reply to fiery • • •Yeah, well the conversation has several branches.
Centralization simplifies how thing work in general, especially for end users. You have one place to go where you set up your account and work from single experience. There's a reason why every successful service our there has some level of centralization. It's just easy to use. Ease of use beings in more users which helps the service survive.
Decentralization has some great advantages. But with that comes complexity and with complexity comes a lack of adoption. The lack of adoption means that there's no money in it. And that's great if you're a hobbyist, but not if you're a company.
An easy example is social media. Look at all of the massive services. They are all centralized. Look at a decentralized system like the Fediverse. Yes, it's very decentralized, but the audience is very limited.
Now let's take this back to Signal which was the whole point of the thread. Yes, it has some centralized services. Those centralized services make the system work well enough that average internet users would actually use it. There are decentralized options out there. They work peer to peer so there's no need for things like cloud infrastructure or a big data center to run them. Matrix/Element comes to mind. Super secure, decentralized messaging. Very few people use it because it's just too complicated for the average or even above average user.
So if I'm Signal, a company that wants to build a more secure messaging app, I'm going to make some compromises in order to make it acceptable and palatable to a wide audience so I have a chance to make some money and keep my companhy afloat. Thus, something like AWS makes sense. I can get access to huge resources to handle any user load, but my costs scale in real time with my usage. This is sensible. But there are trade-offs. But i think for what Signal is trying to do, those trade-offs make sense.
fiery
in reply to midway • • •Now another point is that non-centralized does not necessarily means peer-to-peer. One such highly successful example is email, which is federated. Yes, most users will just gravitate to some centralized offering like gmail or hotmail, but the system is still interoperable for folks or companies who want more control or even self host. We have options, based on public standards. In that sense even instagram is being more open than signal, in the sense that they now have threads which talk to the fediverse. Signal is openly against any such federation arrangement, thus reducing the power that users have over their own data. They do not even have good export options, arguing that would reduce security. Yet they require a mobile number to sign-up which in most places already doxx the user.
midway
in reply to fiery • • •If you are defining a centralized service as one that runs in a single system, then this has ceased to be an adult conversation, especially here on the Fediverse.
I get only running in one region is a vulnerability. It could be bad engineering…it could also be because of cost. Resiliency isn’t free or necessarily cheap, especially for a company that relies on donations. It’s great that you donate to Signal but I assure you the vast majority of their traffic is sent and received by people who don’t.
I made the point about running in the cloud or on prem because that was part of the pro original post (at least as I remember it…it’s been a while). The email model is essentially peer to peer. It relies on lots of places agreeing on a standard to send messages. The issue with this is that to make that work requires dumbing down the standard and would likely break the goal of an all like signal. Email is not in any way secure. Quite the opposite in fact. Are there ways to make it more secure? Yes. But there is no agreed to standard to do so and thus this feature has not been widely adopted. The way email has gone is to become more and more centralized every day with a handful of companies providing email whose business models do not want secure email. The email market has decided that free is better than secure. The price of free is the provider reads your email to sell your information. I only went down this rabbit hole because Signal won’t want to adopt this model because doing so kills their entire reason to exist. Their compromise is that they handle and procrss the
fiery
in reply to midway • • •» Beyond distributed and decentralized: what is a federated network?
networkcultures.orgTilman
in reply to Troed Sångberg • • •Leonardo
in reply to Tilman • • •Jade
in reply to Meredith Whittaker • • •Meredith Whittaker
in reply to Jade • • •@JadedBlueEyes @troed I'm sorry if it landed harsh.
First, I don't think not knowing things is inherently bad or shameful--it's where learning starts, etc. Second, there's a misunderstanding here, whoever is expressing it: decentralization at the level of a protocol--ActivityPub or w/e else--is NOT the same thing as decentralization of infra. People running mastodon instances, or Matrix servers, or other fedi systems, are also in most cases leasing infrastructure from hyperscalers to do so.
Jonathan Cremin
in reply to Meredith Whittaker • • •Where is all of the fediverse?
blog.benjojo.co.ukLeonardo reshared this.
gory 🎃
in reply to Jonathan Cremin • • •Troed Sångberg
in reply to gory 🎃 • • •@repeattofade
I don't know if we're having the same discussion. No, you cannot run a centralized service like Signal without doing so - but since no one is claiming that either I'm not sure what your point is.
You can however run something like Signal that's decentralized. We know this, since it exists. It's called Matrix, and many people in the Fediverse also run Matrix instances.
@jonathan @Mer__edith @JadedBlueEyes
gory 🎃
in reply to Troed Sångberg • • •@troed @jonathan @JadedBlueEyes I feel we all understand the landscape, what exists and why
this just feels like a really unproductive, unhelpful thread from foss decentralised self-hosting absolutionists, trying to say they understand how to run signal better than its president
use matrix, by all means; try getting your family and friends to use it too. good luck. “perfect” really can be the enemy of good (or in this case, privacy).
Troed Sångberg
in reply to gory 🎃 • • •@repeattofade
So far it seems Meredith does not know how decentralized service like the Fediverse and Matrix work (the claims that most use hyperscalers). No one is however claiming that we know how to run _the centralized service Signal_ better. We're saying maybe don't be centralized.
"try getting your family and friends to use [Matrix] too. good luck."
Thanks, yeah, the whole family does - including my elderly parents. It seems you might not know the subject you're having opinions on?
@jonathan @Mer__edith @JadedBlueEyes
Jonathan Cremin
in reply to gory 🎃 • • •@repeattofade @troed @JadedBlueEyes those are great arguments, but the one Meredith is taking on this thread is "look, Mastodon can't/doesn't do distributed infra" when the data says that actually yes it does.
I actually don't have a strong view on the centralisation of Signal, but seeing Meredith talk down to people (see replies on this and other threads) and then be wrong on the facts is pretty galling.
gory 🎃
in reply to Jonathan Cremin • • •@jonathan @troed @JadedBlueEyes i’m not sure I’d class either cloudflare or fastly as decentralised providers, and I’d consider them as hyperscalers in their own right (albeit distributed PoPs)
while I do believe most mastodon servers are self-hosted, i find the metrics from that site entirely questionable and seem to be based off who owns the IP that responds to requests (including pass-through CDNs) rather than any actual realistic numbers for where the server lives
Jonathan Cremin
in reply to gory 🎃 • • •@repeattofade when ActivityPub instances call out to other nodes, you can see their real IP. The 2024 blog post I linked uses that to break down the otherwise masked instances. I've attached the relevant graph here.
Cloudflare and Fastly aren't considered Hyperscalers, and certainly not in this context where they may serve but don't host the data.
@troed @Mer__edith @JadedBlueEyes
gory 🎃
in reply to Jonathan Cremin • • •Jonathan Cremin
in reply to gory 🎃 • • •@repeattofade yes. Though some may be using gateways to also mask outbound traffic, I expect that to be a really small number.
The original argument wasn't about how many people were hosting at home though, it was that "most" people use Hyperscalers therefore you can't expect Signal to not use them.
The largest instance on the Fediverse (mastodon.social) is hosted on Hetzner, which while large in scale does not have the sophistication of a Hyperscaler.
gory 🎃
in reply to Jonathan Cremin • • •@jonathan i feel like this thread has diverged into which companies we considered to be hyperscalers or not which isn’t really the intent or the point. I read her post as meaning “managed datacenter”.
the sad reality is that whether you’re hosting a small server for your friends or trying to run a service used by millions, realistically you can’t run the infrastructure yourself reliably or effectively, which endangers the internet and its future in general
datum (n=1)
in reply to Meredith Whittaker • • •Mastodon doesn't, though?
There certainly will be servers hosted on AWS but when AWS went down, most Mastodon instances stayed up, and people were cracking jokes at more centralized platforms.
Meredith Whittaker
in reply to datum (n=1) • • •@datum Mastodon is distributed at the level of the protocol, not infrastructure. Sure, some people use a server in their closet, but most license hyperscaler infra to host their mastodon instance.
Meta note, we seem to be dealing with a confusion in what the term "distributed" means in this context.
Daniel Gultsch
in reply to Meredith Whittaker • • •Third spruce tree on the left
in reply to Daniel Gultsch • • •Elena ``of Valhalla''
in reply to Third spruce tree on the left • • •@Third spruce tree on the left @Daniel Gultsch @Meredith Whittaker I'm quite sure that I have more physical access control to the xmpp server that I hope to have running in my office at home in a few weeks than to any AWS node, so that would already be an improvement.
also, if somebody is willing to break into my home to get access to the updates on how often the neighborhood cat has been fed, I want to congratulate them on their priorities.
unless it's the cat himself. in that case “get out, you're not allowed in this room, because it's not cat safe, and *how* did you even manage to get in?”
Third spruce tree on the left
in reply to Elena ``of Valhalla'' • • •@valhalla @daniel
<cat hair clogs server fan filter; crash> MENDOZA!!!!! <shakes fist>
Elena ``of Valhalla''
in reply to Third spruce tree on the left • • •william.maggos
in reply to Meredith Whittaker • • •looking at your replies to replies here that seem to make sense to me (especially re decentralization), you're telling them they don't know what they are talking about. well I definitely don't.
like with debates re #ATproto and #ActivityPub, I have thoughts but I know that we really need to see the experts debate each other more somehow. I don't think it happens enough. so I'd say the same re #signal and #matrix etc.
xyhhx 🔻
in reply to william.maggos • • •@wjmaggos meredith gets a lot of replies that could be answered with a little bit of research or could be answered by anybody, which may explain the short replies; but i can try to answer you
@Mer__edith
xyhhx 🔻
in reply to xyhhx 🔻 • • •@wjmaggos what meredith is explaining is the scope of the infrastructure that signal absolutely needs in order to provide the service it does at the quality it requires, and that there are extremely few options that satisfy those needs
to say building their own infra would be prohibitively expensive wouldn't begin to describe it
@Mer__edith
xyhhx 🔻
in reply to xyhhx 🔻 • • •@wjmaggos signals threat model and security guarantees can't be met with decentralization like matrix, fedi, or atproto, either. when disparate servers communicate, they have to know how to relay messages between each other, which leads to a lot of metadata leakage (as is the case with matrix)
tor likewise has mitigations for time based correlation attacks, which are great for its use case; but would cripple signals quality
@Mer__edith
zaire arcana
in reply to xyhhx 🔻 • • •xyhhx 🔻
in reply to zaire arcana • • •@soop noooo 😭😭
@wjmaggos @Mer__edith
william.maggos
in reply to xyhhx 🔻 • • •@xyhhx @soop
I appreciate your replies and am annoyed at the trolls replying to you.
but there's no substitute for knowledgeable people on different sides going back and forth on a subject, in good faith. hopefully not just in text, with questions and fair moderators.
xyhhx 🔻
in reply to william.maggos • • •i don't mind a little trolling 😌 i thought it was funni
@soop @Mer__edith
Ra
in reply to william.maggos • • •Kristin (vis.social Admin)
in reply to Meredith Whittaker • • •not so surprising, as it's very difficult to do anything at any scale online and avoid AWS entirely.
The surprise shouldn't be about Signal, it should be a rallying cry to build diverse infrastructure.
Thijs Lucas
in reply to Meredith Whittaker • • •Richie McCoy aka Dr Deej
Unknown parent • • •DrYak
Unknown parent • • •@debacle @davep @yawnbox The Signal client I use is specific to #SailfishOS , it's WhisperFish:
openrepos.net/content/rubdos/w…
(I don't know about other Linux mobile distributions).
Whisperfish | OpenRepos.net — Community Repository System
openrepos.netDrYak
Unknown parent • • •@debacle @davep @yawnbox There's a list here:
github.com/exquo/signal-soft/w…
Gurk uses the same rust library as WhisperFish.
Also, the multi-protocol Pidgin has plugin for Signal.
(Then there's also a bridge for the Matrix protocol.)
Software list
GitHubJoe Vinegar reshared this.
Richie McCoy aka Dr Deej
Unknown parent • • •DrYak
Unknown parent • • •@debacle @davep @yawnbox I am rather happy with it (though there are occasional hiccups -- my account got accidentally deleted, I need to re-create it). I only use it for messaging, I have no idea how far Rubdos got with the implementation of calls.
I would recommend if you happen to run SailfishOS on your phone and if you too are mostly interested in messaging.
Joe Vinegar reshared this.
Nicoco
Unknown parent • • •