Hacker News new | past | comments | ask | show | jobs | submit login

> Show me an example of an "open source server".

XMPP and Matrix services run open source software such as ejabberd




Running open source software != "Open source server"


If you bothered to look, you would find that both of the examples given are open-source servers. You might then deduce that you misunderstood the comment to which you replied.


You cannot audit the system/service logs for those servers, neither can you audit the hardware running those servers, nor the internet providers who can snoop on the traffic et al... That's the argument behind "Open source server" in case it wasn't clear.


This might be where the misunderstanding is. This software is indeed server software that anyone can run, and the global network consists of servers run by many independent entities, in many cases with full control of the hardware. One of these entities can be you, and it is completely possible to run from home.

The integrity of your conversation with someone would then depend on both your endpoints, clients, and the respective server.

Just like email, but for chat. There is no single gatekeeper who is allowed to use the network.


No misunderstanding at all. The argument is very clear.

> global network consists of servers run by many independent entities

This is not the case for all the popular chat apps including Signal which uses centralized servers which they run themselves. They clearly see little benefit from this distributed independent server model.

And even that doesn't mean the server is open source.

As I explained earlier if you cannot audit the physical server you are connected to, claiming it's open source is useless. FYI that's literally how the term open source was used in this context!

> The integrity of your conversation with someone would then depend on both your endpoints, clients, and the respective server.

Client to client verification simply works and eliminates the need to also "verify" the server which if compromised introduces an even higher risk of contamination in the trust model (too many co-dependent functions are delegated to the server), not to mention collusion in establishing integrity of yet another device that we need to trust.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: