Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automattic invests in Matrix

techcrunch.com

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Automattic invests in Matrix

#91

Post by kimi »

rurban wrote: post #90
Arathorn wrote: post #4

Earlier quoted context omitted.

Have you tried since we relaunched encryption and turned it on by default 2 weeks ago? The UX has completely been rewritten and it should now be transparent - see https://blog.riot.im/e2e-encryption-by-default-cross-signing... . edit: To be clear, we no longer nag whenever there's an unverified login present - and unverified logins should increasingly be a thing of the past anyway given we now have cross-signing and…

Now that's good news! The old UI code was horrible

I'm using the latest. It's still horrible.

Re: Automattic invests in Matrix

#92

Post by Arathorn »

Markoff wrote: post #56
ijpsud wrote: post #31

Earlier quoted context omitted.

> This will not work. They seem to be doing fine: ~10.0M global visible accounts ~2.5M messages per day ~4.5M unbridged accounts ~500K unbridged messages per day ~2.1M rooms that Matrix.org participates in ~20,000 federated servers ~3000 msgs/s out, ~30 msgs/s in on Matrix.org ~400 projects building on Matrix ~70 companies building on Matrix https://matrix.org/faq/ They're up to 20k visible servers from about 5.5k se…

10M accounts with 2M rooms sounds odd, any explanation?

10M (nowadays 16.8M) is the total number of matrix IDs we can see from matrix.org based on phone-home stats from Synapse. 2M (nowadays 5.18M) is the total number of matrix rooms from Synapse.

The ratio is about what we'd expect - there's a mix of DMs, private rooms, and massive public rooms; the DMs will dominate, hence this ratio. Every conversation in Matrix happens in a "room" (even DMs), under the hood, which might be the point of confusion here.

Re: Automattic invests in Matrix

#93

Post by Arathorn »

rambojazz wrote: post #37

Excuse me... what am I missing here? Is this just some sort of donation or does Matrix have plans to make money (how?)?

It's not a donation to the Matrix.org Foundation, it's an equity investment in New Vector (https://vector.im), the startup that the folks who created Matrix began in order to make money to support Matrix development. New Vector makes money by selling Matrix hosting (https://modular.im) and providing consulting/support/services to large folks building on Matrix.

Re: Automattic invests in Matrix

#95

Post by Markoff »

Arathorn wrote: post #92
Markoff wrote: post #56

Earlier quoted context omitted.

10M accounts with 2M rooms sounds odd, any explanation?

10M (nowadays 16.8M) is the total number of matrix IDs we can see from matrix.org based on phone-home stats from Synapse. 2M (nowadays 5.18M) is the total number of matrix rooms from Synapse. The ratio is about what we'd expect - there's a mix of DMs, private rooms, and massive public rooms; the DMs will dominate, hence this ratio. Every conversation in Matrix happens in a "room" (even DMs), under the hood, which mig…

OK, didn't know you call private conversation room

Re: Automattic invests in Matrix

#96

Post by cvwright »

Arathorn wrote: post #81
boardwaalk wrote: post #80

Earlier quoted context omitted.

Just want to say this is my experience. I’ve tried a few times to set up a Matrix server and federating with and joining any room that’s larger/has more history is an exercise in frustration. High CPU usage, frequent timeouts. And this is with years between attempts; nothing really seems to have improved. And I’m still getting Matrix-related HTTP requests a month after taking the server down, which is a little annoyi…

Joining big rooms is still slow because you currently have to check the keys of every server in the room before you know whether to trust the events in that room; we're fixing this with MSC1228 (using keys as identifiers so you don't have to separately check the keys). Once you're in, though, performance has improved 2-3x over the last year, and there's easily 10-100x more improvements to be made one way or another.…

This is the MSC you mentioned? https://github.com/matrix-org/matrix-doc/blob/rav/proposal/r...

I love the idea of using public keys as identifiers, but to be honest the current proposal does NOT give me a warm fuzzy feeling inside.

First, you’re having the server generate keys for the users. This is at best a “code smell” —- even if it works for your particular security goals, it sure feels weird. Zoom recently got absolutely blasted (and rightly so) for doing something similar. Why not have the user generate their own keypair, and then the server can sign the public half, essentially giving you a cert.

Second, there’s a lot of places where you have a layer of indirection between old @user:domain id’s and the new public keys. As an attacker, I would see every one of those places as extra attack surface where I might be able to exploit some confusion.

I hope this doesn’t come off as excessively negative. Matrix is awesome and you’re all doing a great job tackling some huge problems.

Re: Automattic invests in Matrix

#97

Post by cvwright »

Arathorn wrote: post #64
vertex-four wrote: post #51

Every individual Matrix room is a multi-master, non-ACID database which uses its own data as security- and privacy-related configuration. Given how hard this is to get right, I'd really, really like to see Jepsen tests and a security audit done on more than the crypto aspect of Matrix.

There's a massive academic paper dedicated to Matrix's theoretical correctness (and the correctness of the Synapse implementation) going to be published in a few weeks. Wish it was already out, because it's spectacular :) That said, nobody's done any Jepsen tests yet as far as we know, but we'd really welcome them!

That is great news! Please post a link to a preprint when you can.

Re: Automattic invests in Matrix

#98

Post by Arathorn »

cvwright wrote: post #96
Arathorn wrote: post #81

Earlier quoted context omitted.

Joining big rooms is still slow because you currently have to check the keys of every server in the room before you know whether to trust the events in that room; we're fixing this with MSC1228 (using keys as identifiers so you don't have to separately check the keys). Once you're in, though, performance has improved 2-3x over the last year, and there's easily 10-100x more improvements to be made one way or another.…

This is the MSC you mentioned? https://github.com/matrix-org/matrix-doc/blob/rav/proposal/r... I love the idea of using public keys as identifiers, but to be honest the current proposal does NOT give me a warm fuzzy feeling inside. First, you’re having the server generate keys for the users. This is at best a “code smell” —- even if it works for your particular security goals, it sure feels weird. Zoom recently got a…

Yup, that's the right link, but I think you've misunderstood the intention of MSC1228.

The user identity keys are not used for encryption, let alone end-to-end encryption. These are of course only ever created on clients, and never leave the clients.

Instead, this is just a proposal for how to determine what servers are allowed to host a given identity. The proposal also predates E2E - nowadays we might also sign the keys with your E2EE keys to lock the chain of trust to the client.

I get why the whole indirection from @foo:bar.com through to new public keys might also feel weird, but in practice we have that indirection today - as you resolve (say) an email address to a matrix ID. It's basically making the old matrix IDs equivalent to today's 3rd party IDs (email or phone number or whatever).

So yup, understood that it smells funny, but I think the concerns aren't entirely well-founded here. That said, the proposal is ~2 years old, and we'll be dusting it off and sorting it out in the coming months in order to support P2P and speed up room joins, and that might be the point where we tie it into E2EE keys (or not).

Re: Automattic invests in Matrix

#99

Post by tmwed »

i think this is great, VC $ aside. my biggest issue with contributing to Riot or Matrix ecosystem from a Client UI perspective is (from what i remember) the weirdness of the Riot client being half separated into two repos. it makes the barrier to entry seem too high. my hope is that this investment can resolve these concerns

Re: Automattic invests in Matrix

#100

Post by photomatt »

TekMol wrote: post #5

Has this ever worked out? 1: A new technology is being worked on by enthusiasts. Nobody knows if it will get mainstream traction or not. 2: A company puts in a siginificant amount of money to accelerate development and marketing. 3: The new technology gains mainstream traction. Two examples I can think of for point 1 are Linux and PHP. I think both grew without money coming in, right?

WordPress itself.
Post reply on HN