Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

matrix.org

Post reply on HN
Print view View original

71–80 of 204 posts

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#71

Post by zeratax »

lucb1e wrote: post #28
hoschicz wrote: post #23

Earlier quoted context omitted.

Do you feel like WhatsApp is not polished?

If polish is broadly defined as "something that was hitherto still missing in (claimed-to-be) end to end encrypted chat applications", then open source and a decent profit model are definitely features lacking from WhatsApp. Telegram is open source, but one has to consciously turn on encryption and it doesn't work on the web or desktop clients (and the profit model is non-existent). Signal doesn't work without Google…

you can use signal without any google services though, for more than a year now even.

related commit: https://github.com/signalapp/Signal-Android/commit/166973132...

pretty difficult to find the raw apk though: https://signal.org/android/apk/

about matrix:

you will probably end up having to use the electron riot app for a while, but the community is working hard on native clients, but afaik no client has e2ee in any usable state implemented yet (but a lot of progress is being made).

I think the matrix.org team acts as a non-profit organisation, but most of the core team is also hired by New Vector where, I think the planned profit model is to run matrix instances as a service.

there's some stuff about the funding in the faq: https://matrix.org/docs/guides/faq.html#what-kind-of-company...

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#72

Post by alexkavon »

doomrobo wrote: post #54

What protocol? If you look at spec on their website[0] you'll see 4/5 of the protocols are still marked unstable. Take room state resolution as an example. It has pretty important security implications and it's nontrivial in a distributed setting. The algorithm is not stabilized, and it comes with a warning in the specification: Warning: This section documents the state resolution algorithm as implemented by Synapse…

Yep. Their docs inspire little hope that the protocol will be little more than niche. How to build on top of this protocol without requiring someone with domain specific knowledge is beyond what's offered. Cue XKCD protocols comic.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#73

Post by Arathorn »

doomrobo wrote: post #54

What protocol? If you look at spec on their website[0] you'll see 4/5 of the protocols are still marked unstable. Take room state resolution as an example. It has pretty important security implications and it's nontrivial in a distributed setting. The algorithm is not stabilized, and it comes with a warning in the specification: Warning: This section documents the state resolution algorithm as implemented by Synapse…

We’re working towards a 1.0 atm, which the French govt and many others are counting on. In terms of state res not being well specified: https://matrix.org/_matrix/media/v1/download/jki.re/hSmkLkFG... is pretty comprehensive and should be merged into the spec relatively soon. I say kudos to the French govt for backing a FOSS project which is still evolving :)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#74

Post by Arathorn »

alexkavon wrote: post #72
doomrobo wrote: post #54

What protocol? If you look at spec on their website[0] you'll see 4/5 of the protocols are still marked unstable. Take room state resolution as an example. It has pretty important security implications and it's nontrivial in a distributed setting. The algorithm is not stabilized, and it comes with a warning in the specification: Warning: This section documents the state resolution algorithm as implemented by Synapse…

Yep. Their docs inspire little hope that the protocol will be little more than niche. How to build on top of this protocol without requiring someone with domain specific knowledge is beyond what's offered. Cue XKCD protocols comic.

Right now there are 4.5M registered users on the matrix.org HS alone, so I’m not sure niche is right ;)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#75

Post by Arathorn »

kuwze wrote: post #70

It's sort of ironic considering France's history with Minitel[0] and encryption[1]. [0]: https://en.wikipedia.org/wiki/Minitel [1]: https://www.forbes.com/forbes/1997/1201/6012058a.html#75b6a6... Specifically from [1] is the line: "Its illegal in France to encrypt any communication in any way unless you have permission from the government. How is electronic commerce going to get off the ground in such a society? Good…

I would see this as a positive step - it’s a lot harder to legislate against E2E crypto for the populous when the govt is relying on it :)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#76

Post by giggles_giggles »

j4pe wrote: post #57

I had to roll my own chat system recently because the open source solutions out there were surprisingly insufficient - nothing seems to support websockets. Looking forward to the French contributions to the ecosystem! For instance: at the moment Matrix server implementations expect clients like Riot to long-poll for JSON about each room/chat they're connected to. Alternatives like Prosody's XMPP server implementation…

Rocket Chat supports WebSockets. They don't advertise it very well, but if you look at the nginx config under the manual installation, you'll see that the 'upgrade' header is added when using nginx as a reverse proxy, presumably for ws support. Also, they have an experimental realtime API that uses WS and it looks like it's just the API that is still experimental, while WS are already in use for the regular desktop app and the new (still buggy) mobile app.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#77

Post by riazrizvi »

kuwze wrote: post #70

It's sort of ironic considering France's history with Minitel[0] and encryption[1]. [0]: https://en.wikipedia.org/wiki/Minitel [1]: https://www.forbes.com/forbes/1997/1201/6012058a.html#75b6a6... Specifically from [1] is the line: "Its illegal in France to encrypt any communication in any way unless you have permission from the government. How is electronic commerce going to get off the ground in such a society? Good…

It's pretty common. Almost all EU governments reserve the right to decrypt encrypted communications by law, also India, Russia, China, Australia. Here's a map https://www.gp-digital.org/world-map-of-encryption/, click 'Powers to intercept...'

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#78

Post by Zash »

j4pe wrote: post #57

I had to roll my own chat system recently because the open source solutions out there were surprisingly insufficient - nothing seems to support websockets. Looking forward to the French contributions to the ecosystem! For instance: at the moment Matrix server implementations expect clients like Riot to long-poll for JSON about each room/chat they're connected to. Alternatives like Prosody's XMPP server implementation…

> Prosody's XMPP server implementation dropped websocket

Quite the opposite, but I admit the documentation is in need of improving to make the websocket functionality easier to discover.

It is in the default config file however, right next to BOSH.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#79

Post by Arathorn »

j4pe wrote: post #57

I had to roll my own chat system recently because the open source solutions out there were surprisingly insufficient - nothing seems to support websockets. Looking forward to the French contributions to the ecosystem! For instance: at the moment Matrix server implementations expect clients like Riot to long-poll for JSON about each room/chat they're connected to. Alternatives like Prosody's XMPP server implementation…

FB messenger actually uses MQTT last time I checked. In practice long poll HTTP is fine for most purposes, and meanwhile we have a GSoC project which should help improve on that this year (starting with push; then the protocol itself): https://summerofcode.withgoogle.com/organizations/?sp-search...

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#80

Post by cpa »

jaequery wrote: post #14

well, this is what scares me. because, the conversation may be encrypted (protocol, packets), but still messages can be accessible by the powers that be through variety of means. especially considering they "forked" it, who knows what they will do with it (log keystrokes, take screenshots, in the disguise of diagnostic reasons?). anytime you are reading a message from your app, or sending a message, the app have all…

The app is developed for use within the government. In which case, a keylogger in the app makes as much sense as a keylogger on any civil servant's workstation or professional phone.

At some point, if you work for the government you have to use and trust the tools at your disposal. You are part of the executive power, after all.

Post reply on HN