Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> - Mumble: Not really private

Could you elaborate? My friends and I self-host mumble. I never really thought about it, but I kind of just assumed that this is as private as it gets. I didn't read through the mumble source code, but I just assumed it wouldn't be sending data anywhere else.

Edit: Their privacy page describes what data is sent where/when and it reads very privacy friendly to me: https://www.mumble.info/privacy/



According to the PR[1] it is because it doesn't use end-to-end encryption.

[1]: https://github.com/privacyguides/privacyguides.org/pull/192


Hmm, I guess that matters if you are using public servers. If you are running your own server, then it is a non-issue. I still think self hosted mumble is a great solution to the problem. Looking through the privacyguides recommendations[0], I don't see a good alternative.

[0] https://www.privacyguides.org/real-time-communication/


As long as everyone involved trusts the server operator, and the risk of the server being compromised is negligible, you would be right. I do think that removing it from the list here was the right call, as most people probably aren't going to self-host.


> - Mumble: Not really private

Unless your self hosting, it's not really private, as it doesn't use E2EE. If you're self hosting and restricting access, then any software could fit into the "private" category. Does that mean every self-hostable piece of software should be classified as "private"?

> As long as everyone involved trusts the server operator

This is the key point that is never mentioned. The software is mentioned but nothing about who is running it.

On a side note something we're looking very forward to is:

[WIP] MSC3401: Native Group VoIP Signalling #3401 https://github.com/matrix-org/matrix-spec-proposals/pull/340...

Which seems to be a focus for 2022:

https://element.io/blog/introducing-native-matrix-voip-with-...


> Does that mean every self-hostable piece of software should be classified as "private"?

In my mind, as long as the self-hostable software isn't sending data back to some central server, yes? I guess we have different definitions, which is fine, this wasn't criticism of your list. I was just curious if you knew something I didn't.

> This is the key point that is never mentioned. The software is mentioned but nothing about who is running it.

It's interesting to have list of tools that can be self-hosted. My friends and I host mumble/irc/pastebin/img upload for our use. We've got it in a wireguard vpn, it works well. Finding out about other services that we can self-host and use is a always interesting. Although I can't really think of something we need at the moment.


The issue with lists like this though is privacy is implied by merely using the software and not from the fact you control the server.

For most people self-hosting isn't an option or something they want to do.

Software should be developed with E2EE from the beginning wherever possible.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: