Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix at FOSDEM 2019

matrix.org

Post reply on HN
Print view View original

71–80 of 97 posts

Re: Matrix at FOSDEM 2019

#71

Post by jstanley »

hutzlibu wrote: post #69
jstanley wrote: post #66

I tried to use Matrix a while back, but I got put off when it asked me to agree to its Terms of Service... what kind of decentralised system has a terms of service? It's meant to serve the user, not the developer. I found Ricochet IM ( https://ricochet.im/ ) to be much more to my taste. Your Ricochet ID is just a Tor hidden service, and when someone wants to chat to you their client connects to your Tor hidden servic…

"Using Tor gets you encryption and onion-routing for free." But not end-to-end encryption ... (unless Tor changed that?)

Tor is and has always been end-to-end encrypted. What do you mean?

It's not encrypted between the Ricochet process and the Tor process (which is a point for potential improvement), but if you don't trust your local machine you've already lost.

Re: Matrix at FOSDEM 2019

#72

Post by Arathorn »

Vinnl wrote: post #67
Arathorn wrote: post #55

Earlier quoted context omitted.

tptacek: the reddit article there is a bit flawed (as uhoreg tries to gently point out in the response). the reality is that we provide decent E2EE stacks on web, iOS and Android which get used in the flagship client (Riot) that most people use. These are pretty solid and getting better, as per the SAS verif and cross-signing work. Other clients like Seaglass which build on the same SDKs obviously get the same experi…

> Now, there’s a long tail of other random clients which don’t do E2EE, which is inevitable given doing a good secure job of an independent E2EE implementation is obviously tough. But is that actually a problem, given the most usable mainstream clients do have it? Well, given that decentralisation is the primary differentiator from Signal (as far as I can see), everybody having to use the same client to get it is a b…

But they don't have to use the same client? The web, iOS/macOS & Android SDKs are completely independent, and have different clients written on them. Riot may be the main one, but Seaglass (on the macOS SDK) has full E2E support, and there are loads of projects building on the matrix-js-sdk which inherit its E2E support. Meanwhile the nheko project has an independent from-scratch implementation of the E2E stack, Fractal is adding it too (thanks to funding from Purism), and even Pidgin has it (albeit read-only currently). (N.B. that the reddit post gets almost all of this wrong :|)

So yes: Moxie has a point that the more implementations you have, the more bugs and security holes you may have, and the slower the project can evolve. But for us, freedom to control your own data and conversations and provide an open network & platform to build on is more important.

Re: Matrix at FOSDEM 2019

#73

Post by Arathorn »

muvek wrote: post #58
Arathorn wrote: post #55

Earlier quoted context omitted.

tptacek: the reddit article there is a bit flawed (as uhoreg tries to gently point out in the response). the reality is that we provide decent E2EE stacks on web, iOS and Android which get used in the flagship client (Riot) that most people use. These are pretty solid and getting better, as per the SAS verif and cross-signing work. Other clients like Seaglass which build on the same SDKs obviously get the same experi…

Those other "random clients" (as you call them) exist because your desktop client is bad. And I am being nice by just calling it "bad", it is the least performant client I have ever come across, even counting other electron-based software.

yup, the electron app sucks :) we are very very glad folks are writing native clients, and can't wait to kill it off. meanwhile we're working on its perf anyway, and if you look at the client redesign in the OP (riot.im/develop) you'll see it's actually getting better.

Re: Matrix at FOSDEM 2019

#74

Post by amelius »

zanny wrote: post #30

There is a bright future where individual users can trivially (like one click deployment trivial) spin up a Mastodon and Matrix container and have their own social network and IM server running in minutes that federates with all the others in a giant decentralized web. Again. I'll keep pressuring everyone I know to migrate to federated replacements for monolithic proprietary alternatives.

Is it possible to connect Mastodon and Matrix somehow? For example, can one start a chat on Matrix with a friend they have on Mastodon in a convenient way?

Re: Matrix at FOSDEM 2019

#75

Post by hutzlibu »

jstanley wrote: post #71
hutzlibu wrote: post #69

Earlier quoted context omitted.

"Using Tor gets you encryption and onion-routing for free." But not end-to-end encryption ... (unless Tor changed that?)

Tor is and has always been end-to-end encrypted. What do you mean? It's not encrypted between the Ricochet process and the Tor process (which is a point for potential improvement), but if you don't trust your local machine you've already lost.

That would be news to me. Since when is the traffic leaving the exit node encrypted? (how could it be?)

https://www.techrepublic.com/article/tor-users-do-not-expect...

Re: Matrix at FOSDEM 2019

#76

Post by Arathorn »

amelius wrote: post #74
zanny wrote: post #30

There is a bright future where individual users can trivially (like one click deployment trivial) spin up a Mastodon and Matrix container and have their own social network and IM server running in minutes that federates with all the others in a giant decentralized web. Again. I'll keep pressuring everyone I know to migrate to federated replacements for monolithic proprietary alternatives.

Is it possible to connect Mastodon and Matrix somehow? For example, can one start a chat on Matrix with a friend they have on Mastodon in a convenient way?

Nobody seems to have written an ActivityPub bridge for Matrix yet, which is a shame as it'd be quite easy and really fun. (For instance, it could be implemented as a backend for https://github.com/matrix-org/matrix-bifrost - our next-gen bridge framework).

https://gitlab.com/ma1uta/mxtoot is a basic ActivityPub Matrix crossposting bot tho.

Re: Matrix at FOSDEM 2019

#77

Post by detaro »

hutzlibu wrote: post #75
jstanley wrote: post #71

Earlier quoted context omitted.

Tor is and has always been end-to-end encrypted. What do you mean? It's not encrypted between the Ricochet process and the Tor process (which is a point for potential improvement), but if you don't trust your local machine you've already lost.

That would be news to me. Since when is the traffic leaving the exit node encrypted? (how could it be?) https://www.techrepublic.com/article/tor-users-do-not-expect...

When talking to a hidden service, there is no exit node, and no traffic leaving the tor network.

Re: Matrix at FOSDEM 2019

#78

Post by hutzlibu »

detaro wrote: post #77
hutzlibu wrote: post #75

Earlier quoted context omitted.

That would be news to me. Since when is the traffic leaving the exit node encrypted? (how could it be?) https://www.techrepublic.com/article/tor-users-do-not-expect...

When talking to a hidden service, there is no exit node, and no traffic leaving the tor network.

Ah yes, that is a different case.

Re: Matrix at FOSDEM 2019

#79

Post by redsky17 »

jancsika wrote: post #48

Matrix people-- please update your section on E2EE: https://matrix.org/docs/guides/faq#which-matrix-clients-supp... * Riot webpage claims their E2EE support is still in beta * nheko links to a github repo that is apparently no longer maintained Not sure about the SDK links. But I'd strongly suggest changing the text to a simple, "None yet." At least until you have stable, default E2EE in at least one client for a few…

There's a fork of nheko that's under active development:

https://github.com/Nheko-Reborn/nheko

I'll reach out to the matrix folks and ask about getting the website updated.

Re: Matrix at FOSDEM 2019

#80

Post by Vinnl »

Arathorn wrote: post #72
Vinnl wrote: post #67

Earlier quoted context omitted.

> Now, there’s a long tail of other random clients which don’t do E2EE, which is inevitable given doing a good secure job of an independent E2EE implementation is obviously tough. But is that actually a problem, given the most usable mainstream clients do have it? Well, given that decentralisation is the primary differentiator from Signal (as far as I can see), everybody having to use the same client to get it is a b…

But they don't have to use the same client? The web, iOS/macOS & Android SDKs are completely independent, and have different clients written on them. Riot may be the main one, but Seaglass (on the macOS SDK) has full E2E support, and there are loads of projects building on the matrix-js-sdk which inherit its E2E support. Meanwhile the nheko project has an independent from-scratch implementation of the E2E stack, Frac…

Sure, not exactly the same client, but at least you should make sure that none of the participants use one of the long tail of non-mainstream clients. Being able to do so would be one of the main selling points of decentralisation for me.
Post reply on HN