All about open source! Feel free to ask questions, and share news, and interesting stuff!
Community icon from opensource.org, but we are not affiliated with them.
Honestly the only real problem that's holding me back from using Matrix for everything is that it's really inconvenient (for non technical people) to set up an additional device, as you have to verify it.
I've had to walk too many people through this.
Interesting, how does that verification process work? I've never really used matrix so I'm curious.
(Sorry about the length, I'm rather passionate about this. The second half can be ignored)
Essentially, the key to decrypt your old messages is tied to your session. On your (presumably) first session, you can get a recovery key, which is a long hexadecimal string, and a recovery passphrase which you can decide yourself.
If you start a new session (i.e., you log in on another client), for your opd messages to be visible on the new one and your new messages on the ols one, you need to "verify" the new session. There are three ways you can do this.
Alternatively, if you forgot your key and your passphrase and logged out on all the other sessions, you can reset your recovery key, creating a new one and making your old messages unreadable.
(The following are just my thoughts on this) The recovery key is a PITA because most non-technical people I know don't use password managers. Even if they did, though, it's not like any password manager (afaik) offers to save your recovery key. You need to manually put it in there, separate from your account password, and manually enter it when you're connecting a new client.
The recovery passphrase somewhat mitigates this, as they could simply use their favourite "use it everywhere" password, but I don't think I need to point out the problems with that.
The emoji thing is cute and works quite well, but somehow people still get confused and justifiably vaguely irritated that they have to do it at all.
You just can't expect normal people to understand that these are important security measures, they just want to log in and be done.
That said, most people log in once on their phone, very maybe twice to also have it on their laptop and then never have to think about it again. That, however, is a problem in and of itself, because at some point they'll get a new phone, chuck the old one, try to log in and realize they have no idea what their key is.
I've just telling my normie friends who join to disable end to end encryption. If they're on my homeserver it doesn't matter, as we're all communicating internally, and if their account is on m.org... Well... Just mind what you say? No different than chatting on Discord or WhatsApp, IMO.
People get annoyed about the setting up of devices, but that's literally tied to a new type of feature you probably don't need. And e2e shouldn't be by default for most people who can't even remember passwords - I still remember losing all my signal messages because I didn't backup my recovery key and my one phone with it installed decided to, helpfully, clear out my data :)
Tl;DR being unintentionally forced to engage in e2ee is always going to be a bad experience. Our non-technical friends are coming from platforms without it, just forego it for the time being. (yes, I don't care if WhatsApp or whatever claim to have it, if they own your keys it ain't e2ee)
I disagree. In an age of such intensely pervasive spying, I think it's only prudent to use encryption wherever possible. I think in the next decade or two, we're going to start seeing the full implications of all the spying and data harvesting, especially with fascism rising in so many places. Just because your host and the country they operate in are trustworthy today doesn't mean that can't change and make your logs worth monitoring.
The person I was responding to was basically complaining about the complexity of enabling and working with crypto for non technical folk.
It's always going to be hard if you're trying to move people to a new platform and teach them e2ee best practices. .
If you disagree, then that means you've had more success with convincing your non technical friends and family to verify devices, e2ee passwords, and back them up! Great.
But for those who can't seem to do so, seeing as how their friends and family are already offering up their data to the highest bidder by default, bringing them over to a homeserver you own and manage - without the use of e2ee locally - is absolutely a step up compared the alternative of just giving it all to WhatsApp.
Same, I have a discord community and it is been impossible to get people to move to Matrix or anything else. The one person who really tried ended up messing up their encryption keys and gave up.
Exactly!! This really needs to change.
Security is important, of course, but it's not like vodozemac is that good anyway...
Speaking from experience, matrix is still kinda rough around the edges if you have a 100+ person group with non-technical users.
More broadly, pretty much all of the secure messengers currently have an ~O(N^2) problem with state sync in groups. The only one that isn't deeply frustrating is Signal and that's largely because it has very few features and can't be self hosted.
It sucks because it feels SOOOO close. I had my own server setup but setting up a client was so very hard. And it was hard to explain to friends/family how to set it up.
My CPU on my tiny server was being used like crazy for matrix.
I switched from synapse to continuwuity about 9 months ago and it has been a MUCH better experience. Also switched from Element to Sable recently and it is a much more comfortable and reliable client. Not much more complicated to set up than Discord IMHO.
Shoutout to continuwuity! UwU Queer people power the internet~
And it was hard to explain to friends/family how to set it up.
That's why I gave up on self hosting it. I can sit here and mess around with recovery keys and verification and whatever else, but if the people that would use it with me can't just sign up and chat, then I've got no one to talk to. They don't care much about privacy, which I'm finding is most people.
Yea Synapse is very resource hungry. Element built a much more performative enterprise server implementation, but though it's open source it comes with a proprietary license, which kind of defeats the point when it comes to digital sovereignty in the public sector. From what I heard they unfortunately concluded that this is the only way to prevent organizations from freeriding, but it still sucks for the ecosystem. I'm working on one of the larger European Matrix public sector projects and we've been trying to mobilize funds for upstream contributions for some time, but it's not easy to convince the policy and finance people to approve sustainable contributions to an open source ecosystem; they want to see procurements where it's 100% clear what you get for your money. Also, public sector communication use cases frequently have high user count, low message volume and a high number of federated instances; so the current Synapse implementation has mostly been workable as you can feasibly scale horizontally. So there is currently not really that much financial incentive and pressure from the public sector to improve the efficiency of Synapse.
Why would ppl use group chat for 100+ ppl, just why? Should not something like Lemmy plus Notification suit the role better? I saw ppl use group chat as gallery sharing but when I saw it is WhatsApp, wechat, line... Well, those big corp deserve it.
Well I'm part of a vegan cooking discord server where people share recipes, photos of what they made, ideas, blogs, links, questions across a few channels and the discord is way more active than the reddit and lemmy sites. There are about 200 members and at any time 30 people are online.
That's what a static forum with comments is for 😂
Using discord/matrix for this means that to get to a recipe, you have to scroll through 100 comments.about recipes not linked to the recipes, and you can't browse the recipes. You just have to be there or never know it happened pretty much.
Also why support "found" using discord like zephyr have almost 0 help on them at all.
Am I the only one think group chat's model is highly inefficient in energy, bandwidth,computational power, storage when group size is larger than 20 ppl? Basically anything not need fast response and attention for everyone should not use it. We have so many better options. And ppl wonder why we run out of ram. Yes AI is main cause, but ppl really abuse mobile so much and some ppl have to get a new phone every year. So many e-waste
I think a messaging server should store messages only until they are delivered. It shouldn't have access to who sent it, only where they are going.
Matrix keeps a massive stack of metadata on the server, because the server takes care of the protocol and it needs all that metadata.
However you can't loose data you never aggregated.
Matrix can be configured to clear logs and history on whatver basis you want it to. XMPP is a bit better by default but its not like you can't log messages on a regular basis from any platform. Its up to server operators to set things up securely.
How would the recipient know who the message was from if that data wasn't in the packet?
Signal dies something called sealed Sender. The idea is, the sender information is encrypted in the package. https://signal.org/blog/sealed-sender/
Oh neat!
Taking that sweet money from police and armed forces
Appreciate the discussion. I really wish they'd prioritize UX.
Video is a year old, but still relevant I think.
ugh matrix sucks and I wish it wasn't the preferred form of communication for everyone on fedi.
once fluxxer gets federation I'm gonna be done with matrix forever.
Once fluxer gets e2ee and federation and better docs and adoption and professional support and a mature org behind it. Then it can be just like Matrix 😂
I don't need something "just like Matrix". E2EE in Matrix sucks and we had to remake several rooms on the FAF Matrix because a bunch of people couldn't read anything. I need something that actually works most of the time and doesn't have constant and myriad problems. the fact that most of fedi uses Matrix is even more regrettable considering the plethora of mature alternatives that work well and are stable.
Its just Matrix and XMPP at the moment for all of those features, right?
XMPP is a pretty wide umbrella, with a lot of very mature alternatives that are stable and consume very little resources.
What XMPP implementations do you recommend that compare to Matrix? One that people can reasonably assume encrypted message traffic without caveats and scales to about the 200 user limit.
I would probably go with one of the ones that supports clustering. if you have that many users, you may very well end up expanding and needing the room to do so. ejabbard has a focus on scalability, and they've been around since 2002.
Oh cool Ejabbard support Matrix too! I'll definitely check it out more!
Honestly covering both kind of covers all the niches I care about (fediverse is another beast on a technical front so I don't expect overlap persay for those).
Personally I'd prefer XMPP. They way it caches data between instances is way less bloated