Egregoros

@rysiek @delta once e2ee lands on fedi, would that be a reasonable contingency plan?

@dougwade Delta Chat would still be a better option, besides being YEARS ahead of such new solution, in Delta Chat you don't depend on a particular server, for example here in fediverse if your instance goes down suddenly you lose your profile, with delta chat you can have several instances at the same time so if one goes down the other keeps working (this is new and still under development), the fedi solution would also need that level of resilience to be comparable

@rysiek

@arcanechat @rysiek thanks for this thorough answer. Sounds like if I want this someday from the fediverse, it’d be some combination of distributed identity, e2ee, and time, but for today just install delta chat and we’ll worry about all that later.

@feld @phnt @dougwade @rysiek @mkljczk also notice that for chatmail deployment you don't need the chatmail core anymore, that was in the past because there was an "echo bot" being deployed for testing, the "chatmail core" is actually used by client apps and bots and not needed by the server

@feld @phnt @dougwade @rysiek @mkljczk that looks like a bug!

@phnt @arcanechat @feld @rysiek @mkljczk

> we have AP/JSON(-LD) and endless extensions, neither work great

At the risk of revealing how completely out-of-my-depth I've gotten myself, is there a good explainer on the limitations of JSON-LD you're referring to here?

If you're worried about Delta Chat being e-mail based and using OpenPGP, you should probably read this:
https://blog.feld.me/posts/2025/03/deltachat-is-actually-good-though/

@rysiek @delta
Bugger, it's not even sending messages. Yikes.

@davep I'm sure it's going to come back up sooner rather than later. But it's a good reminder how much we rely on it, and to have a backup plan.

@lxo @feld @rysiek Are you implying Signal shares your information with third parties? Or that they even can?

I understand your desire for autonomy, which is cool. That doesn't mean you have to throw shade where it's not needed. The issue here yesterday for Signal was resilience, not access to your data.

@feld That's really interesting, thanks!

@rysiek @lxo

@lxo @feld @rysiek
That second article rails against MS stealing your private keys etc. IIRC, Signal now uses the TPM (this wasn't always the case) on Windows, so in theory MS doesn't have access to it. But if you want to reduce your attack surface, just don't install the Windows client.

your Signal account key is stored in Signal's cloud as you can recover your account with a PIN

@lxo apparently there are secure enclaves behind the pin so your data is protected. It's pretty clever.

https://signal.org/blog/secure-value-recovery/

@feld @rysiek

@feld Oh, indeed. A mutual friend sent me Moxie's original TPM paper in 2016 or 2017 to go over (he had more confidence in my abilities than I do 🤣) and my first thought was "can we trust these things?"

@rysiek @lxo

@feld But having said that, hugely expensive HSMs use shonky old Linux versions and are mainly compliant because they're physically tamper-proof.

@rysiek @lxo

@davep
Doesn't Intel hold private keys for SGX enclaves or something? I remember hearing something like that. Is that a concern?

Then again, I guess we are trusting chip designers anyway. But Intel has recently been partly bought out by the US gov; which is concerning as all the Minneapolis ICE watchers and similar groups are using Signal.
@lxo @feld @rysiek