Conversation

Notices

1. Embed this notice
   Delta Chat (delta@chaos.social)'s status on Friday, 20-Jun-2025 04:36:12 JST Delta Chat

   We are basically doing what #signal and in particular moxie refused to do or declares impossible: federation.

   Both #email and #activitypub ecosystems are all about federation.

   However, #deltachat is vertically centralized in that all UIs use the same #rust core which implements all networking, encryption, chat/group/message logic in a single centralized place. The now 40+ #chatmail mail relay network is driven from centralized code.

   At each level replication and federation is built in.

   • Embed this notice
     feld (feld@friedcheese.us)'s status on Friday, 20-Jun-2025 04:36:10 JST feld

     in reply to

     • Fabrice Desré
     @fabrice @delta honestly people used to say this about libjpeg, libpng, etc because those were juicy vectors for exploits exploited across messengers but we didn't write novel implementations to reduce risk across the userbase
   • Embed this notice
     Fabrice Desré (fabrice@fosstodon.org)'s status on Friday, 20-Jun-2025 04:36:11 JST Fabrice Desré

     in reply to

     @delta Do you agree that having a single implementation is a weakness of deltachat, not a strength? Any 0 day means that 100% of users are vulnerable.

   • Embed this notice
     Delta Chat (delta@chaos.social)'s status on Friday, 20-Jun-2025 07:33:21 JST Delta Chat

     in reply to

     • kill -9

     @kill_9 fyi we have a plan for introducing forward secrecy that works reliably in decentralized, offline-first and multi-device settings. Nothing published about it but it's been conceptually checked from multiple cryptographic experts. We require some funding to do it. We are very aware of vast numbers of people insisting on forward security. But plain device seizure, compromised servers/clients and regional internet blockades and slowdowns are the actual everyday threats for many millions.

   • Embed this notice
     kill -9 (kill_9@ieji.de)'s status on Friday, 20-Jun-2025 07:33:23 JST kill -9

     in reply to

     @delta it is because of the double ratcheting of the signal protocol. But a decentralised infrastructure will be much more resilient in the dystopia that is approaching rapidly. Moreover even though I really like Signal I don’t think they can resist the tremendous pressure they’ll be put under. Delta chat due to its back to the basics design will have a much better chance. I hope the full dystopia never arrives but….

     feld repeated this.
   • Embed this notice
     Lutin Discret (lutindiscret@mastodon.libre-entreprise.com)'s status on Friday, 20-Jun-2025 07:34:13 JST Lutin Discret

     in reply to

     • Fabrice Desré

     @fabrice @delta i think having a single impl may be the main success factor of delta. I really hope delta will keep the single rust core. The alternative is infinite time and headache to fix incompatibilities that kill UX. XMPP failure and matrix are there to remind us the hard truth. Moxxie was right 😞

     feld likes this.
   • Embed this notice
     Fabrice Desré (fabrice@fosstodon.org)'s status on Friday, 20-Jun-2025 07:34:14 JST Fabrice Desré

     in reply to

     @delta It's not a question of having implementations in different languages. Looks at browsers, on some OSes you can switch from Firefox/Chrome/Webkit if one is compromised, even though they are all mostly gigantic C++ codebases.

     Ideally there would be another independent implementation of the protocols used by the DeltaChat clients. And it's not on you!

   • Embed this notice
     Delta Chat (delta@chaos.social)'s status on Friday, 20-Jun-2025 07:34:15 JST Delta Chat

     in reply to

     • Fabrice Desré

     @fabrice having a rust core we consider a big advantage.

     Most everybody else is trying to move their stacks implemented in java, swift, JavaScript at least partially to a shared rust basis. Signal has the cryptographic handling in rust now but otherwise three database-incompatible android/iOS/desktop impls of networking, parsing, chat/group/message logic.

     One platform having flaws affects security of all chat groups so it's hardly a strength to have to care for three impls in three languages

   • Embed this notice
     Delta Chat (delta@chaos.social)'s status on Friday, 20-Jun-2025 07:34:34 JST Delta Chat

     in reply to

     • Lutin Discret
     • Fabrice Desré

     @lutindiscret @fabrice we quite agree :) Single rust core is what allows to develop at a tiny fraction of the ~20 million USD yearly personal costs that signal foundation spends. We also don't spend 25 million yearly on Amazon, Google and cloudflare infrastructure which is bound to increase with more users. Everything is roughly a 100 times cheaper with delta dev and ops.

     feld likes this.