Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

261–270 of 277 posts

Re: Matrix.org hacked

#261

Post by upofadown »

vertex-four wrote: post #213
seba_dos1 wrote: post #178

Earlier quoted context omitted.

Especially that, after some period of stagnation, XMPP is doing pretty fine these days with stepping into the modern world.

Ehh... not really. I still can't find a good combination of server, desktop client and iOS client that support things like OMEMO, history sharing between clients, and voice/video chat. And the one iOS client (ChatSecure) looks really dodgy and regularly fails while setting up push notifications.

I think there are something like 3 iOS clients that support OMEMO now:

* https://omemo.top/

* https://monal.im/

* https://zom.im/

Re: Matrix.org hacked

#262

Post by shanth »

0FDAA764 wrote: post #198
xyproto wrote: post #169

It's "usless use of cat". He/she should have gone: `grep arathorn users.txt | head -1` Instead of: `cat users.txt | grep arathorn | head -n1` Hackers these days.

It's a "useless use of head". He/she should have gone: `grep -m1 arathorn users` Instead of: `grep arathorn users.txt | head -1` Commenters these days.

It's been a while seeing UUoC awards on a random internet discussion.

Re: Matrix.org hacked

#263

Post by meruru »

acct1771 wrote: post #253
meruru wrote: post #50

Earlier quoted context omitted.

On that note, the matrix.org server currently doesn't delete messages from rooms that have become empty. It probably would be a good idea to do so.

Does synapse allow that for self hosted?

Yes, IIRC it's a script you have to run periodically.

Re: Matrix.org hacked

#264

Post by meruru »

cyphar wrote: post #256
tannhaeuser wrote: post #69

Earlier quoted context omitted.

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…

> Right now there's only the centralized matrix.org server That's just blatantly false. Approximately 50% of Matrix users are on other homeservers. > It's not so much a technical question as it is the attitude of "hey we're implementing our own chat protocol cause XML sucks". This is just a strawman. Every single talk by Arathorn explains, in great detail, why Matrix is not just "XMPP but JSON". Maybe you disagree wi…

Where are you getting that 50% estimate from?

Re: Matrix.org hacked

#265

Post by meruru »

miloignis wrote: post #214
tannhaeuser wrote: post #69

Earlier quoted context omitted.

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…

According to the stats they've last reported, the split's about 50/50 between people on matrix.org and people on alternatives, and they've said several times they want to eventually disable or turn off matrix.org. Also, Matrix is definitely about more than just not-XML - the entire protocol is set up as eventually consistent sync of rooms between servers, which they said would have made a mutant XMPP if they had trie…

>they want to eventually disable or turn off matrix.org.

What happens to everyone on matrix.org?

Re: Matrix.org hacked

#266

Post by cyphar »

notyourday wrote: post #260
cyphar wrote: post #254

Earlier quoted context omitted.

There is currently a bug open in Riot to allow users to save their keys if there was a forced logout by the server (right now, if you try to log out and don't have key backups set up Riot will warn you and ask you to set up key backups). But, your comparison with other messaging apps aren't really a fair comparison (other than "they are messaging apps"). The reason why they don't have these issues is because they don…

Maybe I'm not clear -- destroying any user's data without user's explicit authorization is unacceptable for any non-joke of a system. If users' keys are linked to the session key then the system has to be designed in a way that the centralized session key store is protected like a pot of gold. That's a design constraint and dictates operational constraints. > Matrix doesn't store messages locally long-term and all yo…

If Riot kept around your session keys even if you were logged out I guarantee that a similar complaint would be made about it being insecure since it leaks keys.

I would also like to point out that e2e is still not enabled by default because of issues like this. If you enable it you should know to enable key backups.

Riot has supported automatic key backups for the past few months, and if you'd used that you wouldn't have had a problem (yes it should've existed earlier but there are a lot of things for the underfunded Matrix team to deal with). And the reason it's not default is because making such a system opt-out would also make people start screaming about how Matrix is insecure because "it stores your keys on the server".

I think in many respects, the people working on Matrix are going to get criticised like this no matter what they do. I note you haven't actually suggested a specific proposal for how to fix this -- you're just going on about design cinstraints and how Matrix is therefore a joke system. To me that seems to be more snark than useful advice.

Re: Matrix.org hacked

#267

Post by cyphar »

meruru wrote: post #264
cyphar wrote: post #256

Earlier quoted context omitted.

> Right now there's only the centralized matrix.org server That's just blatantly false. Approximately 50% of Matrix users are on other homeservers. > It's not so much a technical question as it is the attitude of "hey we're implementing our own chat protocol cause XML sucks". This is just a strawman. Every single talk by Arathorn explains, in great detail, why Matrix is not just "XMPP but JSON". Maybe you disagree wi…

Where are you getting that 50% estimate from?

Arathorn mentions this in a bunch of his Matrix talks (and has mentioned it on HN too I think).

Re: Matrix.org hacked

#268

Post by cyphar »

meruru wrote: post #265
miloignis wrote: post #214

Earlier quoted context omitted.

According to the stats they've last reported, the split's about 50/50 between people on matrix.org and people on alternatives, and they've said several times they want to eventually disable or turn off matrix.org. Also, Matrix is definitely about more than just not-XML - the entire protocol is set up as eventually consistent sync of rooms between servers, which they said would have made a mutant XMPP if they had trie…

>they want to eventually disable or turn off matrix.org. What happens to everyone on matrix.org?

Disabling registrations of new accounts, not deleting old user accounts.

However something that they are working on (which is a fairly complicated project) is making accounts migrateable between homeservers. Then, users would be able to seamlessly migrate their accounts off Matrix.org.

Re: Matrix.org hacked

#269

Post by xyproto »

kqr wrote: post #240
xyproto wrote: post #169

It's "usless use of cat". He/she should have gone: `grep arathorn users.txt | head -1` Instead of: `cat users.txt | grep arathorn | head -n1` Hackers these days.

I still dont get that logic. What if it turns out i want to stick a prerprocessing step before grep? With a "useless" use of cat, thats easy. Without it, i need to do some rearranging. Not convinced.

It's the YAGNI principle.

Re: Matrix.org hacked

#270

Post by Arathorn »

cyphar wrote: post #267
meruru wrote: post #264

Earlier quoted context omitted.

Where are you getting that 50% estimate from?

Arathorn mentions this in a bunch of his Matrix talks (and has mentioned it on HN too I think).

For the record: about 2.5M of these 5.6M users on matrix.org are native to Matrix, rather than bridged. the 50% guess comes from the fact we see 8M in the phonehome stats right now (including the 5.6M on Matrix.org) so that gives 2.5M on and 2.4M off. In practice the number off would be much larger given lots of bigger deployments we know about don’t phone home.
Post reply on HN