5 ms·

Riot.im: The Big 1.0

63 points by OberstKrueger 8y ago

fredcy 8y ago
I've been using Riot daily for several years, and this 1.0 version seems to work really well. Like any major UI change it's going to take me a while to get used to the slightly different mechanics. Overall it looks more modern than the prior versions.
qqii 8y ago
For authenticating multiple users, I wonder if you can do something GPG like where you generate a web of trust?
- Arathorn 8y ago
  currently we're aiming for a web of trust between your own devices, and then transitively trusting other's devices once you've verified that user. however, a GPG-style web of trust which lets transitive trust span over users is a bit questionable: all it needs is one party to be sloppy with keysigning and the whole things falls apart. It also leaks metadata in terms of who knows who like a sieve. So we're going to see how far we can get without it :)
  - rwmj 8y ago
    I think I mentioned this before, but I think you should allow for the case where all participants in the virtual room physically meet. Think conference, or a meeting on business premises. They should be able to swap keys with each other efficiently, perhaps using NFC, and without having to have O(n^2) interactions. Yes it may not be super-secure but you can assume the security is already taken care of by the physical security of the meeting.
    - Arathorn 8y ago
      yeah, this is a good example where a temporary(?) web-of-trust could work. in retrospect, i think the cross-signing proposal (https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro...) has some thoughts about how transitive trust between users could work, but i'm failing to find it now. I've raised a bug to track: https://github.com/matrix-org/matrix-doc/issues/1886 https://github.com/matrix-org/matrix-doc/issues/1886 - thanks!
pndy 8y ago
You can't see the content of the room without creating an account now?
- Arathorn 8y ago
  sure you can. https://riot.im/app/#/room/#matrix:matrix.org https://riot.im/app/#/room/#matrix:matrix.org in an incognito tab does what it always did and lets you preview the room without signing up?
stevenicr 8y ago
Looks like lots of nice improvements! Glad to see this! Once there is a way for me to have assigned moderators on my instance able to click / tap to see the ip addy, user agent, associated instance, of users in the room, with the ability to ban them and add a note in an admin/moderator panel.. with the added ability to open list of bans, reasons, and add or remove instances, ip addys, subnets, cidrs, hostnames.. Then I will be bringing a few hundred users to use this instead or wisechat and realchat. Looking forward to using this one day!
- zenexer 8y ago
  Most popular chat platforms don’t allow admins to see IP addresses or user agents. That’s considered sensitive information these days. There are still niche platforms that behave more like IRC, but they’re pretty rare.
  - stevenicr 8y ago
    I am guessing the popular chat platforms you refer to are mainly used in walled gardens or have other censoring / moderating options. In my experience chat systems that are open to new registerations are a ripe target for 4chat like trolls - it's only a matter of time before they come and make all your users wish you could see everyone's ips. even if you can't see them, having an option to ban / block ips, subnets, cidrs, is one of the most important lines of defense if you have an open system. At least in my experiences. Please see some additional info in this regard I just posted below here -> https://news.ycombinator.com/item?id=19171614 https://news.ycombinator.com/item?id=19171614
- Arathorn 8y ago
  from a privacy perspective we really really don't want to leak client IPs and UAs to other users, even if they're moderators. in a disaster the server admin can get at this, however, and there is a /whois API (similar to IRC's) which server admins can use, but none of the clients hook up UI for it.
  - stevenicr 8y ago
secfirstmd 8y ago
Congrats to the Riot.im folks. The UI/UX was one of the only things that we found was holding a number of organisations we work with back from using it. Combined with Matrix, it's a wonderful tool.
- Arathorn 8y ago
  thanks :)

63 points by OberstKrueger 8y ago

I've been using Riot daily for several years, and this 1.0 version seems to work really well. Like any major UI change it's going to take me a while to get used to the slightly different mechanics. Overall it looks more modern than the prior versions.

qqii 8y ago

For authenticating multiple users, I wonder if you can do something GPG like where you generate a web of trust?

Arathorn 8y ago
currently we're aiming for a web of trust between your own devices, and then transitively trusting other's devices once you've verified that user. however, a GPG-style web of trust which lets transitive trust span over users is a bit questionable: all it needs is one party to be sloppy with keysigning and the whole things falls apart. It also leaks metadata in terms of who knows who like a sieve. So we're going to see how far we can get without it :)
- rwmj 8y ago
  I think I mentioned this before, but I think you should allow for the case where all participants in the virtual room physically meet. Think conference, or a meeting on business premises. They should be able to swap keys with each other efficiently, perhaps using NFC, and without having to have O(n^2) interactions. Yes it may not be super-secure but you can assume the security is already taken care of by the physical security of the meeting.
  - Arathorn 8y ago
    yeah, this is a good example where a temporary(?) web-of-trust could work. in retrospect, i think the cross-signing proposal (https://github.com/uhoreg/matrix-doc/blob/cross-signing2/proposals/1756-cross-signing.md https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro...) has some thoughts about how transitive trust between users could work, but i'm failing to find it now. I've raised a bug to track: https://github.com/matrix-org/matrix-doc/issues/1886 https://github.com/matrix-org/matrix-doc/issues/1886 - thanks!

pndy 8y ago

You can't see the content of the room without creating an account now?

Arathorn 8y ago
sure you can. https://riot.im/app/#/room/#matrix:matrix.org https://riot.im/app/#/room/#matrix:matrix.org in an incognito tab does what it always did and lets you preview the room without signing up?

stevenicr 8y ago

Looks like lots of nice improvements! Glad to see this! Once there is a way for me to have assigned moderators on my instance able to click / tap to see the ip addy, user agent, associated instance, of users in the room, with the ability to ban them and add a note in an admin/moderator panel.. with the added ability to open list of bans, reasons, and add or remove instances, ip addys, subnets, cidrs, hostnames.. Then I will be bringing a few hundred users to use this instead or wisechat and realchat. Looking forward to using this one day!

zenexer 8y ago
Most popular chat platforms don’t allow admins to see IP addresses or user agents. That’s considered sensitive information these days. There are still niche platforms that behave more like IRC, but they’re pretty rare.
- stevenicr 8y ago
  I am guessing the popular chat platforms you refer to are mainly used in walled gardens or have other censoring / moderating options. In my experience chat systems that are open to new registerations are a ripe target for 4chat like trolls - it's only a matter of time before they come and make all your users wish you could see everyone's ips. even if you can't see them, having an option to ban / block ips, subnets, cidrs, is one of the most important lines of defense if you have an open system. At least in my experiences. Please see some additional info in this regard I just posted below here -> https://news.ycombinator.com/item?id=19171614 https://news.ycombinator.com/item?id=19171614
Arathorn 8y ago
from a privacy perspective we really really don't want to leak client IPs and UAs to other users, even if they're moderators. in a disaster the server admin can get at this, however, and there is a /whois API (similar to IRC's) which server admins can use, but none of the clients hook up UI for it.
- stevenicr 8y ago

secfirstmd 8y ago

Congrats to the Riot.im folks. The UI/UX was one of the only things that we found was holding a number of organisations we work with back from using it. Combined with Matrix, it's a wonderful tool.

Arathorn 8y ago
thanks :)