[remirk]

Signal says it's harder to innovate in a federated system. [1]

[1] https://signal.org/blog/the-ecosystem-is-moving/

[tptacek]

It clearly is harder to innovate in a federated system. Look at what happened with Matrix, and how much time passed between them standardizing E2E encryption and getting E2E encryption universally deployed (I think that switch just flipped last year?). Not everything Moxie Marlinspike writes is correct, but he's been pretty well vindicated on that.

Use whichever secure messenger you like, though.

[rytor718]

I missed this, very interesting read. He's not entirely wrong.

But why are these protocols frozen? I've never developed one so I may just be ignorant of the challenges there, but if, for example, I wanted the XMPP protocol to be able to work with rich media, what's stopping me from updating said protocol to work with rich media instead of relying on optional extensions? In my mind, users of the protocol will receive the update (if they choose of course), thereby making the feature a default for the protocol that isn't reliant on extensions.

I admit I don't fully understand why protocols are frozen in this way, even though I agree with the author that the ones we currently have are definitely frozen. Any insights appreciated!

[MattJ100]

> But why are these protocols frozen?

They're not "frozen". As mentioned in a sibling comment I wrote a blog post about this very topic - https://snikket.org/blog/products-vs-protocols/

Your point about optional extensions vs a protocol update isn't really as clear-cut as people think it is. To add a non-optional change to an open protocol in a decentralized network would necessitate blocking people from the network when you roll it out. That's not going to make for a good communication network.

The alternative is what XMPP does. The protocol evolves by adding new extensions, and deprecating old ones. Each extension generally has fallback considerations.

For example when group/offline media sharing was added many years ago, it was designed such that clients implementing the extension could render the media. Older clients, or clients that can't render media (e.g. terminal clients) simply display a URL.

The XMPP Standards Foundation annually publishes its "compliance suites", which (versioned by year) guides implementations on what they need to support. https://xmpp.org/about/compliance-suites.html

[SV_BubbleTime]

Understood, and that makes sense. But do I want innovation? Or do I want encrypted email 2.0?

They didn’t want to make it, good to go there, but why hasn’t anyone else wanted to make it?

[MattJ100]

Many people, including myself, disagree with Moxie's stance towards decentralization.

I wrote a blog post comparing Signal's approach to the approach taken by many decentralized networks: https://snikket.org/blog/products-vs-protocols/

And others have written their own:

- An Objection to "The Ecosystem is Moving": https://gultsch.de/objection.html

- "Have you considered the alternative?" https://homebrewserver.club/have-you-considered-the-alternat...

- "Re. The Ecosystem is Moving": https://blog.jabberhead.tk/2019/12/29/re-the-ecosystem-is-mo...

Decentralized networks can certainly move. They may not usually move as fast as a centralized one can, but that does not make reliance on a central entity a good alternative.

[cwyers]

Okay, but Moxie has actually produced a secure and usable messaging system, based on his stance. Have any of the people who disagree with him gone ahead and produced something that proves their viewpoint?

[a-dub]

very interesting. lots to think about!