Re: [MLS] MLS in decentralised environments

[Matthew Hodgson <[e-mail]>]

> On 4 Apr 2018, at 17:58, Simon Friedberger <[e-mail]> wrote:
> 
> I think the use-case for allowing splits is pretty weak.

I think you have misunderstood my use of the word “netsplit”. I was not talking about IRC style netsplits where network partitions cause users to vanish from either side of the partition and messages to be lost. Instead, I’m talking about modern decentralised or p2p protocols like Matrix where a network partition allows both sets of connected nodes to keep talking to each other... and the history is synced over to the rest of the network when the partition is healed. No messages are lost, and it’s equally valuable for public chatrooms, private group chats or 1:1 conversations. Instead, it provides an eventually consistent conversation history which is immune to network races and partitions (not dissimilar to SMTP). Short outages end up being completely transparent; long outages can be modelled as threaded conversations. For instance: “Oh, look, the NY office just fixed their internet access: there’s the sidebar discussion they had whilst they were disconnected”.

> 1. Users mostly don't want it because it doesn't fit the model of a
> modern group chat where your presence in the room is independent of the
> connection of your devices. In fact it is essentially a case of "lost
> messages". Which is probably the main complaint about XMPP and Signal
> that I hear.

As per above, no messages get lost. In fact the consideration here is a mechanism to *avoid* message getting lost in the face of a network partition.

> 
> 2. It seems to me it also doesn't force centralization as long as
> multiple servers can host chats. They would just be different chats to
> the user as well.

Having a single logical server responsible for the policy and existence of any given conversation is (to me) very centralised. If that service goes down or can’t scale or has bad connectivity or is somehow compromised or broken or hosted in an environment you don’t trust... then you are screwed unless you migrate to another room, with all the social and UX disruption that entails. Hence trying to ensure that conversations themselves are decentralised.

It’s the same reason that DVCSes like Git are often considered more desirable and flexible than centralised repos like Subversion.

> Having said that, allowing p2p messengers would be great but maybe they
> just have to elect a leader. Supporting distributed setups is a
> necessity but at the level of MLS they can probably be treated as one
> server.

For the reasons given in my answer above; selecting a centralised leader for a decentralised conversation eliminates the whole point of the conversation being decentralised in the first place.

M