Notices by Sarah Jamie Lewis (sarahjamielewis@mastodon.social)

This will likely be the last major version of Cwtch for a little while as @openprivacy has had to make significant reductions in recent years / months and development has slowed as a result (as people have had to seek out other work / moved to restricted-funding projects)

If you'd like to see more active development please consider donating via Patreon (https://www.patreon.com/openprivacy) or see https://openprivacy.ca/donate for other methods.

There is a new version of @cwtch out (https://docs.cwtch.im/)

Cwtch is a privacy-only p2p messenger based on @torproject v3 onion services.

By privacy-only, we mean privacy-only.

Cwtch provides complete control over what features (groups / file sharing / image previews etc.) are enabled, and every feature which alters the default privacy risk model is explicitly opt-in.

We believe that this level of control is what is it takes to actually take your privacy seriously.

"Mozilla is going to be more active in digital advertising."

"we do this fully acknowledging our expanded focus on online advertising won’t be embraced by everyone in our community" - https://blog.mozilla.org/en/mozilla/improving-online-advertising/

I appreciate Mozilla laying their intent out explicitly with no room for interpretation or guesswork.

Personally, I think this is not just a huge misstep, but a deathknell.

To anyone using or who want to use @cwtch on Tails:

At some point in the Tails 6.x release cycle the "/etc/amnesia/version" file was removed - Cwtch was using this to get the OS version to properly connect to the Tor daemon.

We will get a proper fix out for this, but if you'd like to get Cwtch running on the latest Tails then you can following the guide at https://docs.cwtch.im/docs/platforms/tails - but you also need to recreate the file /etc/amnesia/version with contents "6.6 " (that last space is important)

"Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."

The computer, however, will stop you from recording DRM'd content.

Find it fascinating that when faced with drawing safety and security boundaries, the primary beneficiary is not the owner of the device, or the person using it, but random corporations who control the intellectual property rights.

The system doesn't work for you.

Our team has used Cwtch for our daily communication for years now. I've used it for communicated with many others during the same time. And I am aware of others who use it for similar purposes.

Enough to say that it is stable, it is useable. Albeit with some rough edges which we are slowly sanding down despite very limited funding and a complex deployment space.

Even on Android we've made significant improvements as recently as 1.14 in February. https://docs.cwtch.im/blog/cwtch-1-14

Something that does trouble me is that most people who try out @cwtch try out the Android version - it is the way of the world that mobile computers are far more numerous than others.

But this does give a terrible first impression because as much as we have invested into Android over the years it still does not come close to the stability and usefulness of the desktop versions.

Metadata resistant communication is hard. Metadata resistant communication on mobile is harder.

And while I understand all of this, I am also disheartened.

I've poured my soul in Cwtch these last few years because I fundamentally believe that that is how an application should be - locked down by default, open to extension, free and open source, based on sound cryptography, no centralized servers or magic peers or any other surveillance chokepoint.

And it's hard to see Cwtch failing in comparisons because those things are not features, they are limitations.

And that approach also means that communication will likely always have strong limitations like both parties being online at the same time, dealing with the latency of onion services, and the need to run background services - the latter being a particular challenge on mobile devices.

We do listen to all feedback, earnestly. Out mission has always been to make metadata resistant communication usable & accessible to as many people as possible.

On Android, that mission is progressing far slower. And on iOS I'm skeptical it will ever come.

Fundamentally, we've adopted the tenet that we will never weaken Cwtch in the name of performance/usability - many of the features considered table-stakes in other messengers are, and will always be, gated behind security settings in Cwtch.

Clearly I need to do a better job at distinguishing what makes @cwtch good - and I wish we had the budget to really try and solve some more of the harder problems in the space.

Cwtch needs more champions, and more volunteers. People who can tackle those problems, and to bug me to focus on fixing specific issues.

The code is here: https://git.openprivacy.ca/cwtch.im/cwtch-ui

The user/security/dev handbooks are here https://docs.cwtch.im/

I also tend to bite my tongue these days because the space is filled with messengers who make similar promises regarding metadata resistance while also offering real-time video chat and transparent offline messaging - feats which, if true, I would hail as academic breakthroughs.

We have a rough guess of the magnitude of @cwtch users from: last few days of client server bandwidth / rate of bug reports / rate of community contributed translations / and the rate of anonymous people who connect to my public address to say "thanks".

But those are very broad estimates and we deliberately keep them that way.

A survey like the above won't find actual Cwtch clients because it's only looking at web traffic - but the proxy of onions mentioning Cwtch is an interesting insight.

Fascinating table from a new paper looking at some onion service classification (https://arxiv.org/pdf/2401.13320.pdf)

Setting aside that they seem to have failed to reference some significant prior-art..*ahem*

That "cwtch" is a top-5 key word in a significant cluster related to private messaging leads me to believe that there are:

1. A lot of clone sites out there attempting to deliver malware versions of Cwtch.
2. Many more users of Cwtch than we have estimated.

I get that some organizations need to save-face.

They made a big show of saying they will pull out of the UK if this law passes...well this law is going to pass, as is, with no concessions.

The draft text hasn't changed, how the regulations will be written and implemented hasn't changed.

They got a pinky promise that the law will only be used when it can be used.

"A notice can only be issued where technically feasible"

The reality on the ground is that as soon as the UK's Online Safety bill becomes law then the de-facto assumption must be that any service provider with significant exposure to the UK might be under a notice that mandates the compromise of the security and/or privacy of that service.

The statement made today - explicitly designed to defuse any tension that might have held up the bill - only re-enforces that position.

The framing that this is a "win" for online privacy is deeply disingenuous.

Definitely a few issues that need to be resolved, but I now have a rough cut of a functional cwtch@fosstodon.org build for Whonix - will aim to get these changes and instructions out in the next nightly!

(sorry it took so long to get to this)

There is an alternate timeline where the semantic web took off and there was wide investment in ontological tooling to ensure that the information in academic papers, websites, and applications was structured and accessible to future processing.

We instead live in a world where all the useful data is trapped inside proprietary formats, and entangled in meaningless prose - a world primed for large language models to come along and hallucinate the data that might contained therein.

The thing I love most about computers is you can spend *hours* reading increasingly incomprehensible tomes in search of a solution to your problem and then...

...when you think all hope is lost...

...you stumble across it...

...the magical incantation...

"-Xlinker --no-insert-timestamp"