The rate that Matrix is able to put out excellent updates has been stunning. Many other businesses in the same space struggle to consistently build quality video software at the same rate. Great job Matrix team!
P2P Matrix
121–130 of 178 posts
Re: P2P Matrix
#122Great work as always Martrix and Riot team. This is a long awaited feature, right now I am considering using Riot to replace most of my messaging, if it supports a SMS bridge. Given the anti-privacy climate in the US, it's great how Matrix is not US based.
There is an sms bridge that already exists, however, I'm not sure how well it works. https://github.com/tijder/SmsMatrix If you're on iOS, there is also an iMessage bridge that exists. https://github.com/matrix-hacks/matrix-puppet-imessage
Thanks,I didn't know about smsmatrix.
Re: P2P Matrix
#123Earlier quoted context omitted.
The most interesting bit of Matrix academically is the merge resolution algorithm used to converge the room DAGs in a BFT manner. (It's not really consensus, given it only cares about being consistent locally). https://matrix.org/docs/guides/implementing-stateres is a good guide, or failing that https://matrix.uhoreg.ca/stateres/reloaded.html if you speak Haskell, https://github.com/matrix-org/matrix-doc/blob/erikj/s…
I hope you reconsider this design decision. What is the value in federation if people can come away with different opinions as to what was said in a conversation? Eg. for example a $$ contract negotiation and an attacker using something like a msg replay attack that gives different sides different views of what the contract value is. Edit: Or does federation mean proxying & replication in this case?
I don't think you've understood the design decision.
Matrix isn't a distributed ledger, and doesn't provide transactional guarantees. For unencrypted conversation, the user trusts their server not to spoof their messages. Other servers cannot spoof history as messages are signed into a room DAG. The worst scenario is that a malicious server could indeed withhold messages from a room DAG, and this would be indistinguishable from a network partition or a slow server.
The way we mitigate your own server attacking your conversations is at the E2EE layer - ensuring the messages are encrypted by the right user and spotting replay attacks based on signed E2EE metadata
There's no mitigation to servers dropping your messages, however, but practically that has little value - you're not going to be able to use it to give different sides of a $$ contract negotiation different views of what the contract value is.
Re: P2P Matrix
#124Earlier quoted context omitted.
I see, thanks. I tried with another friend, I keep trying to verify him but I keep seeing a spinner "waiting for him" and he sees nothing. I'm going to give Matrix a few more years to mature and try again then, I think.
It's really not that bad or I certainly wouldn't be using it. The matrix home server has horrible lag spikes at some times of the day. The e2e implementation was pretty miserable until a few weeks ago but is now pretty smooth sailing. Been using it for 3-4 years and quite happy.
As of last week the matrix.org homeserver should no longer be laggy, as per https://twitter.com/matrixdotorg/status/1265412147737223174 fwiw :)
Re: P2P Matrix
#125Original comment below but I decided instead to go for the following: I am extremely proud of what work is being done online today to secure communications. While we have companies telemetrying our native stacks[1], web browsers[2], and messaging platforms[3], we also have people working on software that doesn't do those things and still tries to empower the user to get what they need done without being a double agen…
The contact social graph in signal is stored inside of SGX using a service called contact discovery. Signal is attempting to design the system such that Signal can never know whose contacts are in your phone as a service provider. They deal with side-channel leakage of lookups from the contact DB into the enclave using a technique called linear scan which is a constant-time bitwise XOR operation on every contact. Thi…
Do you know anyone who was able to successfully compile & run the server as well as re-compile the mobile clients to specify a different server address? Smells a bit like vendor lock-in to me if you aren't going to bother adding such a UI widget on a FOSS app.
Re: P2P Matrix
#126Earlier quoted context omitted.
> There are no jurisdictions where all possible information can be shared safely without hiding it. This is not what I am saying. What I am saying is that there are plenty of people in countries doing illegal-on-paper things but are largely ignored by their Governments. No one in Brazil is worried about torrenting, even though it is not legal. No one connecting to a Swedish VPN provider worries much about getting cop…
The point I'm trying to argue, poorly, is that implementing a feature where you can right-click and explicitly choose to download something a bit faster is... probably not worth the sheer amount of arguing for "integrate IPFS into Matrix" that I've seen at every turn, for the past few years. People largely seem to want IPFS because IPFS is their pet project , not for any particular edge that it'll give Matrix, and al…
> people turned up in #matrix-dev
Honestly, for a "normal" homeserver it does not make as much sense as for the p2p version of it. For the "actual server" synapse, I am more interested now in the multi-home-repo that I saw posted also on this thread.
> Sharing multi-gigabyte files with groups of people in a public way is, yes, maybe something some people do
Microsoft executives in the 90s: "Internet search is a silly idea. Once you find a site that you like, you just bookmark it. Who will be constantly search for the sites they already know?"
> if IPFS was uniquely suited (...) wouldn't people be posting IPFS links
The use-case of posting IPFS to share content is mostly covered by "posting magnet links", which is basically "why people just don't bookmark the sites they like?"
There is a lot more than could use cases that can come up once your matrix node can (a) manage data by its content (b) if it could know who also has it. And these use cases can be implemented in a way that do not make other use cases less secure.
You are right though that just having people asking for something without having no real background about the underlying challenges is a pain in the ass. Barely a year of working with blockchain stuff and I already roll my eyes every time I see someone on a forum doing a "Why don't you... X?" just after reading the word in some random blog. Let's see if I find time to brush up on my Go and contribute to the multi-home-repo project.
Re: P2P Matrix
#127Had to download the DMG file directly from riot, I was having no luck finding it on the "official apple app store" https://riot.im/download/desktop/
Re: P2P Matrix
#128This is exciting - I'm looking forward to it. I've been nerding out a bit playing with Matrix/Riot and Urbit - there's a lot of exciting stuff happening in this space. If you like what Matrix is doing consider paying $10/month for your own server via Modular.im ( https://modular.im/ ). It supports the Matrix devs and you get your own high performance federated server to use on the network. Their automation makes it e…
I was interested in a server, but the website does not mention how much storage or any details at all really. Anyone happen to know where to find that info?
Re: P2P Matrix
#129Earlier quoted context omitted.
> The only thing that annoys me is when you release updates to the default configuration file and I have to manually resolve the differences in the middle of an APT upgrade. That's not a big deal though. Deploying with docker will eliminate this kind of issue.
You have to deploy 3-4 services to run your own with Docker, right? Synapse, Riot, Jitsi, etc?
I just run a single Synapse server in docker.
Self hosted Riot is only relevant if you want to customize it, but I've found radical [1] to be a better alternative since I'm the only one using the server.
You can always fall back to using the Matrix-hosted Jitsi and TURN instances if you don't host your own (although I don't end up video calling with riot anyways).
Re: P2P Matrix
#130Earlier quoted context omitted.
I hope you reconsider this design decision. What is the value in federation if people can come away with different opinions as to what was said in a conversation? Eg. for example a $$ contract negotiation and an attacker using something like a msg replay attack that gives different sides different views of what the contract value is. Edit: Or does federation mean proxying & replication in this case?
I don't think you've understood the design decision. Matrix isn't a distributed ledger, and doesn't provide transactional guarantees. For unencrypted conversation, the user trusts their server not to spoof their messages. Other servers cannot spoof history as messages are signed into a room DAG. The worst scenario is that a malicious server could indeed withhold messages from a room DAG, and this would be indistingui…
I don't understand the distinction you are making between a distributed ledger and distributed consistency.
I suspect it will be easy to create a byzantine error avalanche with your current design - or break consistency (eg. different views).
I'd be keen to see what aphyr could do with a jepsen test. Perhaps you could run an open hack matrix contest to see what people can achieve. It might surprise you.