Comment by purpleidea

That's a defeatist take that's been vastly debunked, someone linked the Matrix version and here is the XMPP one: https://gultsch.de/posts/objection/

In short, yes, building a standard takes some effort, but that serves your users and to future-proof your solution. Moxie's post boils down to "1- I know better than my users and I don't need input to protocol-design, 2- I'm not willing to put in the effort to standardize and document, 3- I reserve the right to change the deal for whatever reason if I ever feel the need" which is not a good look

> "Federation freezes the technology" https://signal.org/blog/the-ecosystem-is-moving/

I didn't say it needed to be federated, I said the infra automation code needs to be opened.

The answer from Matrix is here: https://news.ycombinator.com/item?id=35141223

I've attended the eponymous CCC talk and I've never seen any other talk there where the Q&A section has just immediately turned into nearly everyone almost dunking on the presented ideas. It's a rather poor take (or at least "controversial" if you will).

Are you a LLM? In this context, a third party client clearly refers to "a Signal app/client software that's not distributed by Signal",

The point I was making is that this goes against Signal's terms of service, and can get your user account terminated. That's a very oppressive clause in practice, you may want to use a non-signal client for all kinds of legitimate reasons (porting to a non supported platform, to adapt for accessibility needs, for privacy, for compliance, to remove nagging and dark patterns, etc). Signal don't want that, they want to control your user experience, even if this makes it worse for their user.

Realistically nothing is ever perfect, but XMPP comes very close. You've got Signal-introduced double-ratchet encryption if forward secrecy is your jam (so it's as "E2E-secure" in practical terms) and you've got a healthy ecosystem of independent client and server implementers, and service providers to choose from.

> 100% e2ee encrypted and decentralized and open

https://getsession.org

https://docs.getsession.org/contribute-to-the-session-networ...

XMPP. Run your own (federated) server, chat with anyone outside it, with e2e encryption.

Is there a messenger that allows anonymous group chats, i.e. for union organizing in a company?

As far as I can see, you can invote people to a group chat using QR flyers, but your Signal profile is visible to everyone in a chat, so everyone knows what Tina in marketing thinks about it.

Because nobody is going to have a burner phone with a data plan for a separate Signal identitiy.

Depending on your needs, XMPP or Matrix are probably your best bet. Both have different clients of varying usability and quality on different platforms, so you have to pick your poison. If E2EE is important, you also need to determine how encrypted you want your messages to be (as both XMPP and Matrix carry quite a bit of identifying metadata in its unencrypted headers).

For most people and use cases, either will probably do, but if you're a human rights activist or journalist in an oppressive country, I'd stick to Signal.

Not decentralized (just like Signal), but open and 100% E2EE:

SimpleX, Delta Chat, Matrix

> Does the perfect messaging tool exist (100% e2ee encrypted and decentralized and open)?

(Note that I don't care about cryptocurrencies except for the cryptography behind it)

There are fully anonymous cryptocurrencies using ZKP where it's not possible to tell if a transaction sent is a transfer of the cryptocurrency itself or a message. It's decentralized and it's also impossible to tell who the transaction is made for (anyone with a copy of the chain can potentially be the recipient of either the money transfer or the encrypted message).

If people were really serious about privacy and secure messaging they'd look into this instead of constantly attacking the concept.

But then of course there are entire armies of shills who have a vested interest in pushing a narrative explaining that services, at best, collecting metadata and, at worst, being backdoored are offering "secure messaging".

I'm only using Telegram and I don't believe for a second it's secure and private (it's got, supposedly, "one on one" E2EE but not for groups). But at least they're not posturing as the most secure and private messenger on earth.

https://matrix.org is used by public agents of France's central administration, Germany's national healthcare system, Germany's armed forces, the Swedish Social Insurance Agency and more: https://en.wikipedia.org/wiki/Matrix_messaging

Perhaps it shouldn't necessitate it, but I can't think of a good reason why not.

If it were expensive to release it, that would be a reason. But it costs roughly zero dollars to create a public repo on GitHub and a cron job to push to it once a day.

Making the system public potentially increases the likelihood of a hack, which would be bad for Signal users. But relying on this argument to keep the source secret is, I think, a confession that your security is below par. Or to put it the other way round: A secure software system remains secure even if its source code is public, so making your source public is a strong signal that you are confident in your security measures. Security isn't something I expect all non-profits to focus on, but I think it would be telling for Signal to hide behind this reason.

What other reasons are there?

> Non profit doesn't necessitate open sourcing their whole product. If you don't like that, don't donate. As long as they are transparent about their decisions that is the only obligation they have.

Actually you're mistaken. Under the 501(c)(3) tax code rules, they are required to act in the public good. Nobody has sued them to enforce this though, but I'd at least like them to acknowledge the game they're playing by ghosting us all on this.

    > OpenAI is a 501c4 not a 501c3

This is incorrect. OpenAI is actually registered as a 501(c)(3) public charity, not a 501(c)(4) social welfare organization. (Source: Bloomberg Law)

    > Also the structure is much more complicated for OpenAI.

However, this is correct. Their corporate structure is very complex. Here is a screenshot from OpenAI's corporate structure explanation page (now taken down): https://images.axios.com/fbMDxci4KDAoYxM_v61sPi9jSVs=/0x0:19...

Apple should make their products edible as well.

'"open" is literally in the name, so yes'

Just because someone calls themselves something doesn't mean it is.

"Open" is a name that George Soros uses for a lot of the things he puts his billions into e.g. the Open Democracy blog.

I'll leave you to decide whether Soros' enterprises are really open.

Some people believe that there's the CIA is behind Signal.

I'm being cheeky and implying that the reason signal's active backend is not disclosed as hoped for in a prior poster's comment is because the CIA (or other intelligence) is involved in it.