3 ms·

I pretty much gave up on Matrix after the following exchange: https://news.ycombinator.com/item?id=8697151 https://news.ycombinator.com/item?id=8697151 Perhaps

by derf_ 8y ago

I pretty much gave up on Matrix after the following exchange: https://news.ycombinator.com/item?id=8697151 https://news.ycombinator.com/item?id=8697151 Perhaps I am overreacting, but that sort of attitude on matters core to basic privacy in the post-Snowden era seems both problematic and incurable.

bdefore 8y ago
Matrix E2E encryption is opt-in per room while its support is in beta, with the intent to have on by default when it's out. https://www.uhoreg.ca/blog/20170910-2110 https://www.uhoreg.ca/blog/20170910-2110
ndnxhs 8y ago
It is planned to make riot enable encryption by default when it is fully stable but I totally understand why the protocol would allow it to be disabled. Matrix is about more than instant messaging and there are possible use cases where you may be using it for something that needs no e2e. Maybe you are using it to control the lights in your house and you want to write an SQL script that can read the commands sent to your light over matrix and tell you how long they were turned on for last month. You can't do that if the commands were e2e encrypted and you gain nothing by encrypting them.
mikenew 8y ago
Yes, you are overreacting. Perfect is the enemy of good. Encryption is not so easy when you have a room with potentially hundreds of users, each with many devices, and you have to safely share keys between all of them. I'm using it, and even in a 1 to 1 chat it can be a burden. They are working on it, and it will be default once it's out of beta. But there are reasons why you may not want to use it. And that's a personal choice that people should be allowed to make. Would you also disallow public rooms? Or bridges into non-encrypted services? I care about encryption, you care about encryption, and they care about encryption. "Giving up on them" and saying their attitude is "problematic and incurable" is hurting, not helping.
Arathorn 8y ago
Yup, you’re overreacting, especially given I wrote that >4y ago when we hadn’t even started implementing E2E encryption. Nowadays it’s almost complete and as others have said we will be turning it on by default for private comms in the coming month(s). (There is little point in E2E for a conversation which is public and being indexed by Google etc). Some deployments already have E2E on by default in fact (eg the french government deployment).
PavlovsCat 8y ago
Anything I consider important that I post online is pretty much public. I also wrote private messages on Facebook, but I didn't upload photos or text posts that I didn't want the world to see. For that kind of stuff, encryption is just a giant waste of resources, in my case, so if I ran mastodon on my server, I would be glad that I can turn that off. I still fell victim to apparently being reported as non-human (after 9 years of using FB with over a hundred RL friends and former class mates, many photos of me, real name from day one, and so on), and while I could send a photocopy of my ID to Facebook, as a matter of principle I didn't and won't, not without even having the right to confront my accusers. For all I know, they're bots, at best some people who didn't like a comment I made on some article -- and from the accounts of others, even showing your ID doesn't mean you won't get fucked over in a similar way again. There is just no real recourse, so why even start jumping through hoops, I'm not going to be party to normalizing that nonsense. I also don't believe in technical solutions to social problems. Encryption gains me nothing in a world where my neighbours just shrug when I get carted off for having using encrypted communication -- or get booted off Facebook -- so that needs to be "fixed" anyway, and should it ever be, encryption would be something that protects you against criminals and assholes, not something that protects you against big brother. IMO it's lethal to assume it ever could or should. It's something we can and should use on our way to social solutions to social problems, but not something to rely on. I know that many people in other countries or very different circumstances NEED encryption, so they should have it, and I might use it out of solidarity and to give them cover even -- but that won't fix the problem anymore than Napster fixed the music industry.

by derf_ 8y ago

bdefore 8y ago

Matrix E2E encryption is opt-in per room while its support is in beta, with the intent to have on by default when it's out. https://www.uhoreg.ca/blog/20170910-2110 https://www.uhoreg.ca/blog/20170910-2110

ndnxhs 8y ago

It is planned to make riot enable encryption by default when it is fully stable but I totally understand why the protocol would allow it to be disabled. Matrix is about more than instant messaging and there are possible use cases where you may be using it for something that needs no e2e. Maybe you are using it to control the lights in your house and you want to write an SQL script that can read the commands sent to your light over matrix and tell you how long they were turned on for last month. You can't do that if the commands were e2e encrypted and you gain nothing by encrypting them.

mikenew 8y ago

Yes, you are overreacting. Perfect is the enemy of good. Encryption is not so easy when you have a room with potentially hundreds of users, each with many devices, and you have to safely share keys between all of them. I'm using it, and even in a 1 to 1 chat it can be a burden. They are working on it, and it will be default once it's out of beta. But there are reasons why you may not want to use it. And that's a personal choice that people should be allowed to make. Would you also disallow public rooms? Or bridges into non-encrypted services? I care about encryption, you care about encryption, and they care about encryption. "Giving up on them" and saying their attitude is "problematic and incurable" is hurting, not helping.

Arathorn 8y ago

Yup, you’re overreacting, especially given I wrote that >4y ago when we hadn’t even started implementing E2E encryption. Nowadays it’s almost complete and as others have said we will be turning it on by default for private comms in the coming month(s). (There is little point in E2E for a conversation which is public and being indexed by Google etc). Some deployments already have E2E on by default in fact (eg the french government deployment).

PavlovsCat 8y ago

Anything I consider important that I post online is pretty much public. I also wrote private messages on Facebook, but I didn't upload photos or text posts that I didn't want the world to see. For that kind of stuff, encryption is just a giant waste of resources, in my case, so if I ran mastodon on my server, I would be glad that I can turn that off. I still fell victim to apparently being reported as non-human (after 9 years of using FB with over a hundred RL friends and former class mates, many photos of me, real name from day one, and so on), and while I could send a photocopy of my ID to Facebook, as a matter of principle I didn't and won't, not without even having the right to confront my accusers. For all I know, they're bots, at best some people who didn't like a comment I made on some article -- and from the accounts of others, even showing your ID doesn't mean you won't get fucked over in a similar way again. There is just no real recourse, so why even start jumping through hoops, I'm not going to be party to normalizing that nonsense. I also don't believe in technical solutions to social problems. Encryption gains me nothing in a world where my neighbours just shrug when I get carted off for having using encrypted communication -- or get booted off Facebook -- so that needs to be "fixed" anyway, and should it ever be, encryption would be something that protects you against criminals and assholes, not something that protects you against big brother. IMO it's lethal to assume it ever could or should. It's something we can and should use on our way to social solutions to social problems, but not something to rely on. I know that many people in other countries or very different circumstances NEED encryption, so they should have it, and I might use it out of solidarity and to give them cover even -- but that won't fix the problem anymore than Napster fixed the music industry.