Hacker News new | ask | show | jobs
by horsawlarway 1008 days ago
> i.e. that users shouldn't have to depend on someone else's server or run their own just to gather online

I don't understand this. Can you elaborate exactly what you mean?

Because to me... you're now just depending on a whole bunch of other people's machines indirectly, and directly on the community owner's machine which is generating the certs.

It feels like a lot of complexity for something that could just be a small chat server running on the community owner's server (which they will need anyways - unless I'm misunderstanding, which is entirely possible).

---

So since I'm probably missing something - can I get the elevator pitch?

Assume I'm your target market (I want private messaging that I control).

I would likely be a "community owner" as described in your article.

I am already running a self-hosted solution (ex: Zulip/Rocket/Mattermost).

What makes this a compelling offering to me?

2 comments

> I am already running a self-hosted solution (ex: Zulip/Rocket/Mattermost). What makes this a compelling offering to me?

(Quiet founder here) Great question! If you're already happy running your own self-hosted Zulip/Rocket/Mattermost/Matrix and you have no problems with maintenance or downtime, Quiet is just a cool demo and probably not useful!

If you cannot run a server (a minority on HN but a majority of the world) or you do not want to (maybe a slim majority on HN?) and you need a team chat with nice privacy properties, Quiet is being built for you!

The thing that frustrates me about free and open source software that requires servers is: most people don't have servers! And the prevalent model for using others' servers involves a terrible power / dependence relationship. One thing that drives me to build Quiet is that I want to see a world where free software comes "batteries included" with all of its promised freedoms and advantages, for the vast majority who do not have servers.

You aren’t missing anything. The restriction to community fences ensures that each community will have to host the community. There’s no free lunch. Now, someone in that community can be more generous with compute than others. Using Tor to try to be anonymous isn’t going to work either as Tor has been broken.
> Tor has been broken

I think you have to clarify what you mean by that. Citation needed.

Sure thing. Let me know if you need more. Government agencies have been watching for years. Also keep in mind that no one has more admin access to network infrastructure than government agencies do such that the NSA can monitor any computer on the internet.

https://arstechnica.com/tech-policy/2015/01/did-feds-mount-a...

https://www.documentcloud.org/documents/2719591-Farrell-Weds...

https://mice.cs.columbia.edu/getTechreport.php?techreportID=...

https://www.vice.com/en/article/4x3qnj/how-the-nsa-or-anyone...

https://www.techtimes.com/articles/200592/20170307/fbi-drops...

I think it's helpful to have a more layered perspective here. Privacy tools never provide absolute protection in the real world, because the attacker could always have some capability the user doesn't know about.

Network layer privacy is even more layered in this way. A burner HN account is very anonymous for a wide range of threat models. But if you're a terrorist or spy, NSA and GCHQ will see to it that they break anything you use. Users can learn about the properties of different tools and make informed decisions. Nobody should do something they would not otherwise do just because they believe they are protected by Tor. That is a bad idea. But if someone needs to do something sensitive and wants to lower their risk profile, Tor will likely help and it's fairly low-cost to use it.

Another way to look at it is: any naively implemented p2p communication tool will reveal the IP address of all your conversation partners by default. Tor is a big improvement over that, and comes with other benefits, like NAT traversal and peer discovery.

Yup. There's no 100% privacy guarantee on a network, period. Sorry kids.
The first reference is to an attack from 2015 that was fixed. So wording is important here. What is meant is that TOR has been broken in the past.
And will (is) broken in the future (today). This cat and mouse game doesn’t work when they hold the cheese.