Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

matrix.org

Post reply on HN
Print view View original

131–140 of 204 posts

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#131

Post by Arathorn »

jrq wrote: post #100

Why is the world so desperate to pretend that irc doesn't exist? Why can't we just get a new irc spec with e2e in mind? Matrix is an extremely immature project and the French gov is making an irresponsible move here to prop it up as a solution in any capacity. It's beta software! Where are the audits? Where are the formal verifications? Not that irc has those, I don't mean to juxtapose one not-good-enough product wit…

audit e.g.: https://www.nccgroup.trust/us/our-research/matrix-olm-crypto...

formal proofs e.g.: https://matrix.org/_matrix/media/v1/download/jki.re/hSmkLkFG...

Agreed that Matrix is still beta, but hopefully we are heading in the right direction and the end is in sight.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#132

Post by kqr »

syntaxfree wrote: post #127
Qwertie wrote: post #124

Earlier quoted context omitted.

Anything you can make HTTP requests in really. I have messed around with sending messages from Ruby and Bash and it's quite easy. And a lot more easy if there is an SDK for your language which will handle a few things for you.

So what's irssi for Matrix?

weechat-matrix. You should be using weechat over irssi anyway!

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#133

Post by Arathorn »

Arathorn wrote: post #129
bgorman wrote: post #126

Earlier quoted context omitted.

I don't mean to be disrespectful. The first time I heard of Matrix/Riot was at OSCOn 2015. What has happened since then,and why has it taken so long to stabilize?

We spent massive effort working on: * implementing E2E encryption and getting it audited, which turns out to be very hard in a decentralised environment * refining Riot as a flagship client and trying to get it to a Slack/Discord level of UX (still a work in progress) * scaling, as the 1st gen implementation (synapse) failed to keep up with the growth of the network * adding features like Jitsi video conferencing, Wi…

(oh, and we rewrote (almost) the whole thing in Go, too)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#136

Post by Moru »

hokkos wrote: post #106
kuwze wrote: post #70

It's sort of ironic considering France's history with Minitel[0] and encryption[1]. [0]: https://en.wikipedia.org/wiki/Minitel [1]: https://www.forbes.com/forbes/1997/1201/6012058a.html#75b6a6... Specifically from [1] is the line: "Its illegal in France to encrypt any communication in any way unless you have permission from the government. How is electronic commerce going to get off the ground in such a society? Good…

It has nothing to do with Minitel as it is a private government only slack-like tool. And the encryption restriction is long gone like in the US. Why there is alway francophobes in threads like that ?

It's not about francophobes, it's that people remember what they heard earlier, they don't seek out unimportant (to them) facts on random.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#137

Post by dbt00 »

HIPisTheAnswer wrote: post #117
snthd wrote: post #90

Earlier quoted context omitted.

>Signal doesn't work without Google services Not true, it has a websockets alternative to gcm. >and requires a phone number The phone number can be anything you control. >and turned-on phone iirc Yes >(and their profit model seems to be extorting companies like Wire and helping closed source software like Whatsapp advertise with Signal-level encryption). It (now) has its own nonprofit backing it (and a generous benef…

You do not control a phone number. You can control an SSL cert using DNSSEC. So you cannot control your signal end-point. Besides, the signal server is in total control of your identity. Plus anyone might still use the phone number to send plain-text SMS'. TLDR: If you don't control the server, there is no security guarantee. So signal, whatsapp and telegram are out .

DNSSEC is as secure as SMS.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#138

Post by acct1771 »

Arathorn wrote: post #133
Arathorn wrote: post #129

Earlier quoted context omitted.

We spent massive effort working on: * implementing E2E encryption and getting it audited, which turns out to be very hard in a decentralised environment * refining Riot as a flagship client and trying to get it to a Slack/Discord level of UX (still a work in progress) * scaling, as the 1st gen implementation (synapse) failed to keep up with the growth of the network * adding features like Jitsi video conferencing, Wi…

(oh, and we rewrote (almost) the whole thing in Go, too)

I saw someone bitching elsewhere about Python 2.7, but have yet to see any other semi-relevant complaints yet, so congrats to the team on that!

Any comment on that?

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#139

Post by snthd »

HIPisTheAnswer wrote: post #117
snthd wrote: post #90

Earlier quoted context omitted.

>Signal doesn't work without Google services Not true, it has a websockets alternative to gcm. >and requires a phone number The phone number can be anything you control. >and turned-on phone iirc Yes >(and their profit model seems to be extorting companies like Wire and helping closed source software like Whatsapp advertise with Signal-level encryption). It (now) has its own nonprofit backing it (and a generous benef…

You do not control a phone number. You can control an SSL cert using DNSSEC. So you cannot control your signal end-point. Besides, the signal server is in total control of your identity. Plus anyone might still use the phone number to send plain-text SMS'. TLDR: If you don't control the server, there is no security guarantee. So signal, whatsapp and telegram are out .

For signal the phone number serves as a convenience to label a public key - the security comes from verifying the key. The design is to not trust the server.

WhatsApp is the same but has things like key-change messages off by default.

I believe telegram doesn't even encrypt by default, and has flawed crypto anyway.

You're right that the whole thing is flawed to some degree unless both parties are clued up.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#140

Post by xf86alsa »

indescions_2018 wrote: post #125
Arathorn wrote: post #73

Earlier quoted context omitted.

We’re working towards a 1.0 atm, which the French govt and many others are counting on. In terms of state res not being well specified: https://matrix.org/_matrix/media/v1/download/jki.re/hSmkLkFG... is pretty comprehensive and should be merged into the spec relatively soon. I say kudos to the French govt for backing a FOSS project which is still evolving :)

I discovered Matrix through the Godot Game Engine community. It was described to me as the next-gen irc freenode chat platform for open source devs ;) Just wondering about discovery. How do I find interesting channels?

One of the community members has a bot that travels from room to room anytime somebody mentions a room link.

The list (and graph!) of all indexed rooms is here: https://t2bot.io/voyager/

Post reply on HN