Any tool that calls itself “open source” and uses proprietary encryption that they refuse to let any neutral third party review, should absolutely not be trusted.
Wonder if maybe there could be some organization that could fill that need. Independent, or a collection of industry vets, who look through the code and say if it’s safe or not. With the assumption details won’t be leaked or something to protect anything actually proprietary?
Understandable actually. Server maintenance costs money and if a 3rd party chat app; which significantly has more usage than other forms of social media; is trying to connect to the server, they have to handle that traffic too. Remember, it is not just about data size, but also the sheer volume of connection to handle.
I think the solution is just P2P with each peer acting as a relay to the other too. The protocol needs to be designed in such a way that no-one in the middle can reply to send false acknowledgement so as to prevent sybil attack or other attack where a malicious actor is a part of the network.
Right, the rating list is generic, whereas it should be categorized. For example while iMessage is a walled garden, if the list was sorted by ease of use, it should be first, as it’s nearly zero-configuration for the end user and they get encrypted messaging. Matrix would be first on open access (if we weren’t counting SMS), because it’s available on so many platforms and clients. Signal probably wins on security, though I don’t know enough about it to verify that. So on and so forth
This is an often repeated piece of misinformation. The developer of gurk-rs, a third party Signal client, has even said this himself. The client presents itself with a completely identifiable name to the Signal servers - the Signal devs can see this and could easily block this client from connecting but they don't. This project has existed for at least 3+ years now.
There's a few clients for Signal, nobody is preventing developers from creating apps; there's Molly, gurk-rs, Axolotl, Flare, signal-cli, Pidgin (with the Signal plugin.
The problem is 3rd party clients don't implement all features because it takes a lot of work and they're created/developed by volunteers - just take a look at Matrix and how many clients support all features or even just group end-to-end encryption (E2EE). Last I checked many third party Matrix clients didn't support encrypted group messages, primarily just Element, the reference client built by the matrix developers. So you have the same problem on Signal that you have on Matrix.
In Matrix a direct chat is a group chat with two people.
You're right, I forgot how Matrix handled messages and the current state is that there's are at least 6 other clients that support E2EE - this is awesome.
That said, as soon as you look for a stable client that supports other features like Native 1:1 calls and Threads the only client listed is Element, check here: https://matrix.org/ecosystem/clients/
Side note: Looks like ~3 years ago a Fluffychat dev stated they would not implement E2EE in the app [0], this must have been around the time I was looking at other clients because I recall this one "looking" the best and might be viable for non-techy people to use/recommend. I'm glad they changed their mind and implemented E2EE. Time to take a look at it again.
Do any of these also support SMS? I'll switch back if I can have my encrypted message comingle with my SMS messages. Signal dropping SMS was the primary reason I left.
Meanwhile I can't even get my boomer mom to switch to Google Messages from Samsung Messages because she'd "have to relearn how to use it." Then she just continues to complain that she can't send messages over WiFi, and that when she sends or receives pictures over SMS they get compressed... 💢
I had several friends and family switched over, until they killed SMS support like idiots. I now know maybe one or two people using it, and barely use it anymore.
Oh yeah sorry, I'm really stupid early in the morning. I read something else in this thread about Google Messages and just assumed it was related. I didn't even know Signal had SMS support, that honestly sounds like a good feature
Telegram doesn't default to encryption. All your messages are stored and can be viewed by anyone with enough privileges on Telegram's infrastructure.
Telegram's "secure" 1-1 messages are limited to the point of being useless and not worth using. It's a dark design pattern created to discourage their use, ensuring you give them all your data.
“Fastest workflow” has no bearing here, nobody gives a shit if a task takes exponential time or linear time when the total time is less than three seconds in both cases. You are acting like you are some prodigal graphics designer when the task at hand is the computer artist equivalent of banging two rocks together.
imgflip is purpose-built for the process i am taking. GIMP takes more than 3 seconds to boot up on my device. there is no competition. stop with the toxic behavior and insults. this was a joke. you make the internet miserable.
Rcs isn't a open source but an open standard. Two very different things.
Open standard: anyone can use the standard but could be proprietary/closed source
Open source: anyone can edit/review the code and forket it if they want to.
The issue with RCS currently is that Google won't release the API for it on android and only allows Samsung to use it for their app. Another part is that their encryption is based on signal and released a white paper about it.
Now it's understandable why people would distrust Google. But apple is currently trying to add e2ee to the open standard (google also tried in the past but failed).
XMPP is better despite it's flaws privacy-wise, since so much data gets "hogged back" to matrix.org (tbf it's a similar case with lemmy.world but Lemmy at least didn't receive funding from a company most likely linked to Mosad). Also has more lightweight servers in general.
what data gets hogged back? most stuff can be turned off and are features that would be missing anyway from xmpp, like identity servers or integrations server. also you can selfhost your identity server and add integrations manually
Did people call RCS open source? I'm not a huge follower of the standard, but I don't think I ever heard that said. In fact, I've heard people complain about not just the proprietary encryption but lack of E2E and carrier/Google control.
Its only advantages are that it is better than SMS and supported by the carriers, Google and Apple sometime this year.
It's a shitty standard but given how shitty SMS is, I'm willing to hold my nose and jump in.
yes sorry when i called it “open source” that was an overstatement that others have since corrected
“open standard” is correct—nevertheless doesn’t excuse google’s deceptive marketing to force this as industry standard instead of investing in something actually open source and aproprietary
67 replies
Any tool that calls itself “open source” and uses proprietary encryption that they refuse to let any neutral third party review, should absolutely not be trusted.
It's open standard, not open source
but we need to trust them that the standard is actually implemented
Yep. Which is why FOSS development and support of FOSS developers is so important
The definition of words are indeed, critical 👍
Too many people misunderstand open source and free to use.
So can I write my own implementation and talk to other people via rcs? If not, then I don't think it deserves being called an open standard
Wonder if maybe there could be some organization that could fill that need. Independent, or a collection of industry vets, who look through the code and say if it’s safe or not. With the assumption details won’t be leaked or something to protect anything actually proprietary?
there could but it would take cash
or one could make it truly open source for free
Signal > Matrix/Element > RCS > SMS.
iMessage isn't in the equation because it only works on a single platform.
signal protocol is basically the opposite, open source but the company is hostile to 3rd party client development
They can't prevent 3rd party apps, so what's the issue?
From what I understand, they don't want 3rd party apps to use their servers.
Understandable actually. Server maintenance costs money and if a 3rd party chat app; which significantly has more usage than other forms of social media; is trying to connect to the server, they have to handle that traffic too. Remember, it is not just about data size, but also the sheer volume of connection to handle.
I think the solution is just P2P with each peer acting as a relay to the other too. The protocol needs to be designed in such a way that no-one in the middle can reply to send false acknowledgement so as to prevent sybil attack or other attack where a malicious actor is a part of the network.
My point is basically that matrix/element is arguable the much more ethical chat solution because of its openess still with a focus on security.
Right, the rating list is generic, whereas it should be categorized. For example while iMessage is a walled garden, if the list was sorted by ease of use, it should be first, as it’s nearly zero-configuration for the end user and they get encrypted messaging. Matrix would be first on open access (if we weren’t counting SMS), because it’s available on so many platforms and clients. Signal probably wins on security, though I don’t know enough about it to verify that. So on and so forth
Should it, though? It requires the user to buy an Apple device.
This is an often repeated piece of misinformation. The developer of gurk-rs, a third party Signal client, has even said this himself. The client presents itself with a completely identifiable name to the Signal servers - the Signal devs can see this and could easily block this client from connecting but they don't. This project has existed for at least 3+ years now.
There's a few clients for Signal, nobody is preventing developers from creating apps; there's Molly, gurk-rs, Axolotl, Flare, signal-cli, Pidgin (with the Signal plugin.
The problem is 3rd party clients don't implement all features because it takes a lot of work and they're created/developed by volunteers - just take a look at Matrix and how many clients support all features or even just group end-to-end encryption (E2EE). Last I checked many third party Matrix clients didn't support encrypted group messages, primarily just Element, the reference client built by the matrix developers. So you have the same problem on Signal that you have on Matrix.
In Matrix a direct chat is a group chat with two people.
Also I've used several clients and they all supported encryption.
You're right, I forgot how Matrix handled messages and the current state is that there's are at least 6 other clients that support E2EE - this is awesome.
That said, as soon as you look for a stable client that supports other features like Native 1:1 calls and Threads the only client listed is Element, check here: https://matrix.org/ecosystem/clients/
Side note: Looks like ~3 years ago a Fluffychat dev stated they would not implement E2EE in the app [0], this must have been around the time I was looking at other clients because I recall this one "looking" the best and might be viable for non-techy people to use/recommend. I'm glad they changed their mind and implemented E2EE. Time to take a look at it again.
[0] https://gitlab.com/KrilleFear/fluffychat/-/issues/25#note_423061121
There isn't a call feature completely specified as far as I can find. Therefor it isn't really possible to have cross client native calls.
It was introduced two years ago: https://element.io/blog/introducing-native-matrix-voip-with-element-call/
Looks like at least two other clients support 1:1 calls.
Do any of these also support SMS? I'll switch back if I can have my encrypted message comingle with my SMS messages. Signal dropping SMS was the primary reason I left.
Now to convince Grandma to use Signal
We successfully managed. Good times over here.
Meanwhile I can't even get my boomer mom to switch to Google Messages from Samsung Messages because she'd "have to relearn how to use it." Then she just continues to complain that she can't send messages over WiFi, and that when she sends or receives pictures over SMS they get compressed... 💢
Doesn't Samsung messages support RCS? I know it did at one point. You just had to go into the settings and enable the option.
I had several friends and family switched over, until they killed SMS support like idiots. I now know maybe one or two people using it, and barely use it anymore.
They killed SMS support? Maybe not in Germany as an exception, I still use Google messages to recive spam SMS.
Signal killed sms
Oh yeah sorry, I'm really stupid early in the morning. I read something else in this thread about Google Messages and just assumed it was related. I didn't even know Signal had SMS support, that honestly sounds like a good feature
Matrix/element > signal > xmpp > telegram > RCS > SMS
I could settle for this but remove telegram as it's not even E2EE by default. It's basically facebook v2.
Guess what? Neither is matrix/element.
Private messages on Matrix have been end-to-end encryption (E2EE) by default since 2020 - https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here/
For anyone considering Telegram for privacy:
TL;DR - Matrix is more private than Telegram.
Where's the XMPP commenters.. The floodgates will open
What is Signal and how do I use it
https://signal.org/
This is a good start to understand what it is and how to use it: https://mashable.com/article/what-is-signal-app
disclaimer: i barely know what im talking about here so if any of the language in this post is inaccurate feel free to reach out
It's correct, although I'm surprised that there isn't even a FOSS implementation of the unencrypted part.
Hopefully you made this in GIMP
impgflip.com, with full love to the community GIMP is ass at making memes
This meme is just two images and some text, no offense but you could make this using only ffmpeg if you were sufficiently masochistic
"What photo editing app do you use? Photoshop? GIMP? MS Paint?"
"ffmpeg."
"All hail technomancer Joe, wielder of ffmpeg!"
yeah i could use a hex editor if i wanted but turns out the fasted app workflow is often the best
“Fastest workflow” has no bearing here, nobody gives a shit if a task takes exponential time or linear time when the total time is less than three seconds in both cases. You are acting like you are some prodigal graphics designer when the task at hand is the computer artist equivalent of banging two rocks together.
bro ur getting so antagonistic and for what 😭
imgflip is purpose-built for the process i am taking. GIMP takes more than 3 seconds to boot up on my device. there is no competition. stop with the toxic behavior and insults. this was a joke. you make the internet miserable.
yeah I got carried away lmao
I couldn't do this in three seconds even with imgflip. I'd say a minute using normal tools, and probably 20 seconds with imgflip.
The
whatsappsignal image editor is the best meme creating toolMy preferred is Algodoo, a physics sandbox
Rcs isn't a open source but an open standard. Two very different things.
Open standard: anyone can use the standard but could be proprietary/closed source
Open source: anyone can edit/review the code and forket it if they want to.
The issue with RCS currently is that Google won't release the API for it on android and only allows Samsung to use it for their app. Another part is that their encryption is based on signal and released a white paper about it.
Now it's understandable why people would distrust Google. But apple is currently trying to add e2ee to the open standard (google also tried in the past but failed).
Mind you the only reason apple is even implementing RCS is because China is forcing them to. Since any new 5g devices must support rcs to be certified in china.
I hope this helps. Also have a android turtle from the blob!
this true, ty for the clarification
ill leave the meme as is (in quotes) since that was the thrust of the propaganda i saw 18 months ago
seems like a term that is intentionally thrown around to make things sound secure and cool when it’s not.
Np hope you have a great day!
-switches to signal or Matrix-
XMPP is better despite it's flaws privacy-wise, since so much data gets "hogged back" to matrix.org (tbf it's a similar case with lemmy.world but Lemmy at least didn't receive funding from a company most likely linked to Mosad). Also has more lightweight servers in general.
what data gets hogged back? most stuff can be turned off and are features that would be missing anyway from xmpp, like identity servers or integrations server. also you can selfhost your identity server and add integrations manually
Isn't like the entire point of Matrix that it's end to end encrypted, thus rendering any data servers acquire useless?
You could make the metadata argument, but having one node aware of even most transactions is better than having one node aware of all of them.
So it isn't locked down on Google-approved devices?
Did people call RCS open source? I'm not a huge follower of the standard, but I don't think I ever heard that said. In fact, I've heard people complain about not just the proprietary encryption but lack of E2E and carrier/Google control.
Its only advantages are that it is better than SMS and supported by the carriers, Google and Apple sometime this year.
It's a shitty standard but given how shitty SMS is, I'm willing to hold my nose and jump in.
yes sorry when i called it “open source” that was an overstatement that others have since corrected
“open standard” is correct—nevertheless doesn’t excuse google’s deceptive marketing to force this as industry standard instead of investing in something actually open source and aproprietary